Linux Analysis Report
SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf

Overview

General Information

Sample name: SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf
Analysis ID: 1504848
MD5: 0e9baddd505edcaf077b6935323b608f
SHA1: 8cedefd89863bf40ea986e8a0ed6bdaf5b3cd6e5
SHA256: f5a9ea37f7c2b08313ca8da83d0e0685d5539d3ae23a2276bcd22513a97b5b39
Tags: elf
Infos:

Detection

Mirai
Score: 76
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample is packed with UPX
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Sample contains only a LOAD segment without any section mappings
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf ReversingLabs: Detection: 39%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:33046 -> 154.216.17.218:9506
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.17.218
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.17.218
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.17.218
Source: unknown TCP traffic detected without corresponding DNS query: 206.187.94.80
Source: unknown TCP traffic detected without corresponding DNS query: 9.0.49.169
Source: unknown TCP traffic detected without corresponding DNS query: 58.20.36.176
Source: unknown TCP traffic detected without corresponding DNS query: 245.31.125.108
Source: unknown TCP traffic detected without corresponding DNS query: 221.158.243.207
Source: unknown TCP traffic detected without corresponding DNS query: 192.114.222.129
Source: unknown TCP traffic detected without corresponding DNS query: 154.15.185.87
Source: unknown TCP traffic detected without corresponding DNS query: 19.172.102.2
Source: unknown TCP traffic detected without corresponding DNS query: 8.175.73.226
Source: unknown TCP traffic detected without corresponding DNS query: 170.59.108.176
Source: unknown TCP traffic detected without corresponding DNS query: 92.56.54.255
Source: unknown TCP traffic detected without corresponding DNS query: 150.44.149.87
Source: unknown TCP traffic detected without corresponding DNS query: 212.248.148.31
Source: unknown TCP traffic detected without corresponding DNS query: 196.255.115.200
Source: unknown TCP traffic detected without corresponding DNS query: 163.235.66.150
Source: unknown TCP traffic detected without corresponding DNS query: 158.211.65.19
Source: unknown TCP traffic detected without corresponding DNS query: 46.82.79.150
Source: unknown TCP traffic detected without corresponding DNS query: 167.142.178.126
Source: unknown TCP traffic detected without corresponding DNS query: 83.234.99.18
Source: unknown TCP traffic detected without corresponding DNS query: 196.167.242.232
Source: unknown TCP traffic detected without corresponding DNS query: 76.102.241.106
Source: unknown TCP traffic detected without corresponding DNS query: 24.43.222.133
Source: unknown TCP traffic detected without corresponding DNS query: 242.186.207.204
Source: unknown TCP traffic detected without corresponding DNS query: 139.251.121.207
Source: unknown TCP traffic detected without corresponding DNS query: 168.37.197.254
Source: unknown TCP traffic detected without corresponding DNS query: 133.136.247.80
Source: unknown TCP traffic detected without corresponding DNS query: 84.48.227.120
Source: unknown TCP traffic detected without corresponding DNS query: 169.195.30.83
Source: unknown TCP traffic detected without corresponding DNS query: 182.60.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 98.85.160.164
Source: unknown TCP traffic detected without corresponding DNS query: 46.63.255.194
Source: unknown TCP traffic detected without corresponding DNS query: 34.12.177.53
Source: unknown TCP traffic detected without corresponding DNS query: 1.173.123.245
Source: unknown TCP traffic detected without corresponding DNS query: 159.47.145.232
Source: unknown TCP traffic detected without corresponding DNS query: 245.33.215.59
Source: unknown TCP traffic detected without corresponding DNS query: 195.249.211.112
Source: unknown TCP traffic detected without corresponding DNS query: 101.146.34.112
Source: unknown TCP traffic detected without corresponding DNS query: 159.129.81.32
Source: unknown TCP traffic detected without corresponding DNS query: 84.19.132.114
Source: unknown TCP traffic detected without corresponding DNS query: 93.128.32.10
Source: unknown TCP traffic detected without corresponding DNS query: 42.175.113.198
Source: unknown TCP traffic detected without corresponding DNS query: 100.127.88.184
Source: unknown TCP traffic detected without corresponding DNS query: 76.158.178.197
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.17.218
Source: unknown TCP traffic detected without corresponding DNS query: 173.103.40.46
Source: unknown TCP traffic detected without corresponding DNS query: 218.231.200.102
Source: unknown TCP traffic detected without corresponding DNS query: 97.46.225.230
Source: SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf String found in binary or memory: http://upx.sf.net
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 6218.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6218.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6207.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6207.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6204.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6204.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x8000
Sample tries to kill a process (SIGKILL)
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6206) SIGKILL sent: pid: 759, result: successful Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6206) SIGKILL sent: pid: 6034, result: successful Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) SIGKILL sent: pid: 759, result: successful Jump to behavior
Yara signature match
Source: 6218.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6218.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6207.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6207.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6204.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6204.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: classification engine Classification label: mal76.troj.evad.linELF@0/0@0/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
Enumerates processes within the "proc" file system
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1582/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2033/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2275/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/3088/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1612/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1579/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1699/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1335/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1698/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2028/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1334/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1576/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2302/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/3236/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2025/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2146/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/910/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/4444/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/4445/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/912/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/4446/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/517/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/759/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/4447/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2307/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/918/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1594/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2285/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2281/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1349/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1623/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/761/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1622/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/884/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1983/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2038/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1344/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1465/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1586/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1860/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1463/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2156/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/800/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/801/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1629/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1627/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1900/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/4470/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/4474/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/4476/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/3021/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/491/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2294/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2050/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1877/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/772/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1633/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1599/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1632/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/774/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1477/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/654/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/896/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1476/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1872/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2048/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/655/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1475/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2289/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/656/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/777/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/657/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/658/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/4468/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/419/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/936/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1639/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1638/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2208/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2180/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/6145/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1809/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1494/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1890/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2063/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2062/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1888/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1886/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/420/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1489/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/785/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1642/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/788/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/667/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/789/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/1648/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/6034/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/6154/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2078/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2077/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2074/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2195/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/670/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/2746/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212) File opened: /proc/793/exe Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6194) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.9yohMkvOXt /tmp/tmp.Ax2zdBdAp6 /tmp/tmp.afWcU9SYKv Jump to behavior
Source: /usr/bin/dash (PID: 6195) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.9yohMkvOXt /tmp/tmp.Ax2zdBdAp6 /tmp/tmp.afWcU9SYKv Jump to behavior
ELF contains segments with high entropy indicating compressed/encrypted content
Source: SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf Submission file: segment LOAD with 7.9526 entropy (max. 8.0)
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6204) Queries kernel information via 'uname': Jump to behavior
Source: SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6204.1.0000557ecf015000.0000557ecf1a3000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6207.1.0000557ecf015000.0000557ecf1a3000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6218.1.0000557ecf015000.0000557ecf1a3000.rw-.sdmp Binary or memory string: ~U!/etc/qemu-binfmt/arm
Source: SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6204.1.0000557ecf015000.0000557ecf1a3000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6207.1.0000557ecf015000.0000557ecf1a3000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6218.1.0000557ecf015000.0000557ecf1a3000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6204.1.00007fffcc09e000.00007fffcc0bf000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6207.1.00007fffcc09e000.00007fffcc0bf000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6218.1.00007fffcc09e000.00007fffcc0bf000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6204.1.00007fffcc09e000.00007fffcc0bf000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6207.1.00007fffcc09e000.00007fffcc0bf000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6218.1.00007fffcc09e000.00007fffcc0bf000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: 6218.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6207.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6204.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: 6218.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6207.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6204.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORY
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
75.173.109.201
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
211.112.21.86
 unknown Korea Republic of
4663 ELIMNET-AS-KRELIMNETINCKR false
138.229.162.217
 unknown United States
20115 CHARTER-20115US false
162.164.130.134
 unknown United States
21928 T-MOBILE-AS21928US false
207.56.90.23
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
241.93.78.82
 unknown Reserved
unknown unknown false
200.249.61.252
 unknown Brazil
4230 CLAROSABR false
248.146.211.206
 unknown Reserved
unknown unknown false
115.126.183.244
 unknown New Caledonia
45345 NAUTILE-NC-AS-APNautileNC false
62.138.132.146
 unknown Germany
8972 GD-EMEA-DC-SXB1DE false
196.224.35.74
 unknown Tunisia
37492 ORANGE-TN false
203.149.68.237
 unknown Australia
17766 GCOMM-AS-APGCOMMPtyLtdAU false
85.89.208.217
 unknown Norway
43200 PCSUPPORTNO false
12.160.166.248
 unknown United States
14858 HISNETUS false
181.70.241.1
 unknown Colombia
27831 ColombiaMovilCO false
135.33.139.70
 unknown United States
54614 CIKTELECOM-CABLECA false
126.61.224.93
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
62.215.196.18
 unknown Kuwait
21050 FAST-TELCOKW false
58.110.83.119
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
53.64.177.210
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
108.25.155.172
 unknown United States
701 UUNETUS false
83.167.53.0
 unknown France
8218 NEO-ASNlegacyNeotelecomsFR false
93.112.223.246
 unknown Saudi Arabia
25019 SAUDINETSTC-ASSA false
216.3.38.8
 unknown United States
2828 XO-AS15US false
156.79.43.36
 unknown United States
11363 FUJITSU-USAUS false
167.15.113.74
 unknown United States
20426 PWC-ASUS false
62.200.58.36
 unknown European Union
2686 ATGS-MMD-ASUS false
175.186.67.243
 unknown China
139774 CERNET-IVION-ASCERNETCenterCN false
185.248.57.99
 unknown Turkey
43260 AS43260TR false
121.170.59.48
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
192.195.37.66
 unknown United States
63242 AS-CMN-LSUS false
36.183.122.228
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
176.98.226.182
 unknown Kazakhstan
51997 ASKET-ASKZ false
121.77.231.109
 unknown China
9812 CNNIC-CN-COLNETOrientalCableNetworkCoLtdCN false
80.199.115.193
 unknown Denmark
3292 TDCTDCASDK false
222.251.24.29
 unknown Taiwan; Republic of China (ROC)
17709 APTAsiaPacificTelecomTW false
172.93.183.162
 unknown United States
8100 ASN-QUADRANET-GLOBALUS false
242.143.101.173
 unknown Reserved
unknown unknown false
83.80.167.233
 unknown Netherlands
33915 TNF-ASNL false
67.12.71.48
 unknown United States
33363 BHN-33363US false
45.97.239.140
 unknown Egypt
37069 MOBINILEG false
212.91.81.96
 unknown Italy
12850 ASN-ENTERIT false
171.17.136.62
 unknown Germany
12888 Berghamerstr5DE false
100.46.108.58
 unknown United States
14654 WAYPORTUS false
151.108.222.92
 unknown United States
1218 NCUBE-BELMONT-ASUS false
181.207.212.175
 unknown Colombia
27831 ColombiaMovilCO false
164.126.177.47
 unknown Poland
39603 P4NETP4UMTSoperatorinPolandPL false
111.161.38.51
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
143.23.200.74
 unknown United States
11003 PANDGUS false
71.179.24.255
 unknown United States
701 UUNETUS false
79.137.211.27
 unknown Russian Federation
12695 DINET-ASRU false
197.247.118.96
 unknown Morocco
36925 ASMediMA false
180.172.113.146
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
120.230.148.188
 unknown China
56040 CMNET-GUANGDONG-APChinaMobilecommunicationscorporation false
157.8.236.215
 unknown Japan 4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
171.87.232.25
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
60.141.239.209
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
90.250.209.19
 unknown United Kingdom
5378 VodafoneGB false
217.195.149.234
 unknown Germany
9558 PRIMECROWN-AS-INPrimeCrownTechnologiesPrivateLimitedIN false
41.206.119.137
 unknown Mauritius
37100 SEACOM-ASMU false
243.16.201.31
 unknown Reserved
unknown unknown false
159.210.165.219
 unknown Italy
131090 CAT-IDC-4BYTENET-AS-APCATTELECOMPublicCompanyLtdCATT false
5.140.107.248
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
27.42.203.5
 unknown China
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
58.118.45.244
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
254.48.197.213
 unknown Reserved
unknown unknown false
20.169.249.56
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
88.90.161.134
 unknown Norway
2119 TELENOR-NEXTELTelenorNorgeASNO false
19.84.214.194
 unknown United States
3 MIT-GATEWAYSUS false
105.141.249.111
 unknown Morocco
6713 IAM-ASMA false
166.135.74.20
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
106.143.116.211
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
67.204.100.139
 unknown United States
27564 CAPGEMINI-CIS-AS1US false
96.72.177.233
 unknown United States
7922 COMCAST-7922US false
105.71.48.37
 unknown Morocco
36884 MAROCCONNECTMA false
144.25.107.61
 unknown United States
31898 ORACLE-BMC-31898US false
74.162.238.101
 unknown United States
10796 TWC-10796-MIDWESTUS false
240.201.39.168
 unknown Reserved
unknown unknown false
141.111.86.172
 unknown United States
68 LANL-INET-ASUS false
181.118.233.173
 unknown Argentina
19889 CooperativaTelefonicaDelVisoAR false
24.144.136.155
 unknown United States
27364 ACS-INTERNETUS false
47.241.69.228
 unknown United States
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC false
107.128.55.29
 unknown United States
7018 ATT-INTERNET4US false
37.91.2.166
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
202.205.157.166
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
142.1.103.246
 unknown Canada
239 UTORONTO-ASCA false
27.21.180.96
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
63.177.17.21
 unknown United States
1239 SPRINTLINKUS false
18.115.13.9
 unknown United States
3 MIT-GATEWAYSUS false
170.141.60.162
 unknown United States
19956 TENNESSEE-NETUS false
173.1.41.6
 unknown United States
26228 SERVEPATHUS false
24.158.137.86
 unknown United States
20115 CHARTER-20115US false
85.248.145.78
 unknown Slovakia (SLOVAK Republic)
5578 AS-BENESTRABratislavaSlovakRepublicSK false
156.235.217.93
 unknown Seychelles
134548 DXTL-HKDXTLTseungKwanOServiceHK false
169.94.69.188
 unknown United States
37611 AfrihostZA false
178.216.108.20
 unknown Poland
197049 ISBANDUROWSKIPL false
146.125.25.70
 unknown United States
3260 INTRACOMGR false
68.9.27.9
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
250.183.176.197
 unknown Reserved
unknown unknown false
157.69.176.226
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false