Linux Analysis Report
SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf

Overview

General Information

Sample name: SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf
Analysis ID: 1504849
MD5: dd979274e98e98c09cec002bbb9463b0
SHA1: 4be98164f9324eb25fc688964c19c5c004e60e6c
SHA256: 6fd2b5684b508d9cb2c316daad9964381fdb3e3e73ebfe26f0c977385980452b
Tags: elf
Infos:

Detection

Mirai
Score: 76
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample is packed with UPX
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Sample contains only a LOAD segment without any section mappings
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf ReversingLabs: Detection: 44%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:49644 -> 154.216.17.218:9506
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.17.218
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.17.218
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.17.218
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.17.218
Source: unknown TCP traffic detected without corresponding DNS query: 207.161.33.53
Source: unknown TCP traffic detected without corresponding DNS query: 123.108.138.53
Source: unknown TCP traffic detected without corresponding DNS query: 71.119.154.80
Source: unknown TCP traffic detected without corresponding DNS query: 169.71.254.127
Source: unknown TCP traffic detected without corresponding DNS query: 107.100.225.151
Source: unknown TCP traffic detected without corresponding DNS query: 16.154.179.173
Source: unknown TCP traffic detected without corresponding DNS query: 140.225.65.237
Source: unknown TCP traffic detected without corresponding DNS query: 182.106.175.2
Source: unknown TCP traffic detected without corresponding DNS query: 171.230.40.137
Source: unknown TCP traffic detected without corresponding DNS query: 112.147.96.117
Source: unknown TCP traffic detected without corresponding DNS query: 39.0.112.21
Source: unknown TCP traffic detected without corresponding DNS query: 254.181.188.27
Source: unknown TCP traffic detected without corresponding DNS query: 115.187.220.217
Source: unknown TCP traffic detected without corresponding DNS query: 73.139.17.77
Source: unknown TCP traffic detected without corresponding DNS query: 218.237.139.51
Source: unknown TCP traffic detected without corresponding DNS query: 202.6.138.12
Source: unknown TCP traffic detected without corresponding DNS query: 94.61.138.222
Source: unknown TCP traffic detected without corresponding DNS query: 180.187.139.123
Source: unknown TCP traffic detected without corresponding DNS query: 58.134.241.252
Source: unknown TCP traffic detected without corresponding DNS query: 9.216.156.167
Source: unknown TCP traffic detected without corresponding DNS query: 194.171.255.3
Source: unknown TCP traffic detected without corresponding DNS query: 119.86.166.241
Source: unknown TCP traffic detected without corresponding DNS query: 153.151.34.5
Source: unknown TCP traffic detected without corresponding DNS query: 119.57.53.172
Source: unknown TCP traffic detected without corresponding DNS query: 43.249.68.170
Source: unknown TCP traffic detected without corresponding DNS query: 141.237.138.178
Source: unknown TCP traffic detected without corresponding DNS query: 135.230.123.244
Source: unknown TCP traffic detected without corresponding DNS query: 66.143.207.222
Source: unknown TCP traffic detected without corresponding DNS query: 136.157.192.206
Source: unknown TCP traffic detected without corresponding DNS query: 223.137.39.51
Source: unknown TCP traffic detected without corresponding DNS query: 41.80.218.230
Source: unknown TCP traffic detected without corresponding DNS query: 174.98.62.83
Source: unknown TCP traffic detected without corresponding DNS query: 106.160.223.29
Source: unknown TCP traffic detected without corresponding DNS query: 157.119.31.34
Source: unknown TCP traffic detected without corresponding DNS query: 48.123.230.235
Source: unknown TCP traffic detected without corresponding DNS query: 86.163.60.253
Source: unknown TCP traffic detected without corresponding DNS query: 96.224.159.34
Source: unknown TCP traffic detected without corresponding DNS query: 156.131.11.17
Source: unknown TCP traffic detected without corresponding DNS query: 146.251.234.13
Source: unknown TCP traffic detected without corresponding DNS query: 88.94.158.228
Source: unknown TCP traffic detected without corresponding DNS query: 154.244.61.50
Source: unknown TCP traffic detected without corresponding DNS query: 18.232.247.172
Source: unknown TCP traffic detected without corresponding DNS query: 191.1.23.70
Source: unknown TCP traffic detected without corresponding DNS query: 169.53.104.126
Source: unknown TCP traffic detected without corresponding DNS query: 207.55.20.242
Source: unknown TCP traffic detected without corresponding DNS query: 254.133.91.9
Source: SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf String found in binary or memory: http://upx.sf.net
Source: unknown Network traffic detected: HTTP traffic on port 46540 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 5498.1.00007fa158017000.00007fa15802e000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5498.1.00007fa158017000.00007fa15802e000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5488.1.00007fa158017000.00007fa15802e000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5488.1.00007fa158017000.00007fa15802e000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5484.1.00007fa158017000.00007fa15802e000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5484.1.00007fa158017000.00007fa15802e000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x8000
Sample tries to kill a process (SIGKILL)
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5486) SIGKILL sent: pid: 767, result: successful Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5486) SIGKILL sent: pid: 5327, result: successful Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) SIGKILL sent: pid: 767, result: successful Jump to behavior
Yara signature match
Source: 5498.1.00007fa158017000.00007fa15802e000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5498.1.00007fa158017000.00007fa15802e000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5488.1.00007fa158017000.00007fa15802e000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5488.1.00007fa158017000.00007fa15802e000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5484.1.00007fa158017000.00007fa15802e000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5484.1.00007fa158017000.00007fa15802e000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: classification engine Classification label: mal76.troj.evad.linELF@0/0@0/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
Enumerates processes within the "proc" file system
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/2672/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1583/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3244/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3120/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3361/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3239/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1577/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1610/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/512/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1299/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3235/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/514/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3751/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3631/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3752/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3753/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/519/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/2946/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/917/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/5432/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3134/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1593/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3011/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3094/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/2955/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3406/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1589/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3129/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1588/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3402/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3125/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3246/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3245/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/767/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/800/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/888/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/801/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/769/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/803/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/806/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/807/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/928/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/2956/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3420/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/490/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3142/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1635/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1633/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1599/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3139/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1873/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1630/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3412/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/657/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/658/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/659/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/418/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/419/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1639/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1638/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3398/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1371/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3392/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/780/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/660/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/661/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/782/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1369/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3304/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3425/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/785/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1642/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/940/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/941/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1640/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3147/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3268/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1364/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/548/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/5327/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1647/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3680/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/2991/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1383/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1382/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1381/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/791/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/671/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/794/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1655/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/795/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/674/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1653/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/797/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/2983/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3159/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/678/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1650/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3157/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/679/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/1659/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3319/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/5470/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/5471/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5496) File opened: /proc/3178/exe Jump to behavior
ELF contains segments with high entropy indicating compressed/encrypted content
Source: SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf Submission file: segment LOAD with 7.9684 entropy (max. 8.0)
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf (PID: 5484) Queries kernel information via 'uname': Jump to behavior
Source: SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf, 5484.1.00007ffd11a86000.00007ffd11aa7000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf, 5488.1.00007ffd11a86000.00007ffd11aa7000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf, 5498.1.00007ffd11a86000.00007ffd11aa7000.rw-.sdmp Binary or memory string: ix86_64/usr/bin/qemu-arm/tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf
Source: SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf, 5484.1.000055e7ab76d000.000055e7ab8fb000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf, 5488.1.000055e7ab76d000.000055e7ab8fb000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf, 5498.1.000055e7ab76d000.000055e7ab8fb000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf, 5484.1.000055e7ab76d000.000055e7ab8fb000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf, 5488.1.000055e7ab76d000.000055e7ab8fb000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf, 5498.1.000055e7ab76d000.000055e7ab8fb000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf, 5484.1.00007ffd11a86000.00007ffd11aa7000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf, 5488.1.00007ffd11a86000.00007ffd11aa7000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf, 5498.1.00007ffd11a86000.00007ffd11aa7000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: 5498.1.00007fa158017000.00007fa15802e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5488.1.00007fa158017000.00007fa15802e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5484.1.00007fa158017000.00007fa15802e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf PID: 5484, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf PID: 5488, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf PID: 5498, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: 5498.1.00007fa158017000.00007fa15802e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5488.1.00007fa158017000.00007fa15802e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5484.1.00007fa158017000.00007fa15802e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf PID: 5484, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf PID: 5488, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf PID: 5498, type: MEMORYSTR
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
246.121.252.108
 unknown Reserved
unknown unknown false
151.90.140.164
 unknown Italy
3269 ASN-IBSNAZIT false
250.101.112.218
 unknown Reserved
unknown unknown false
206.147.234.218
 unknown United States
5715 ONVOYUS false
193.169.25.139
 unknown Russian Federation
49315 CENTRSVYAZ-ASRU false
35.34.193.97
 unknown United States
36375 UMICH-AS-5US false
57.111.93.18
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
1.178.178.98
 unknown Australia
9723 ISEEK-AS-APiseekCommunicationsPtyLtdAU false
208.228.144.250
 unknown United States
4208 THE-ISERV-COMPANYUS false
255.114.129.209
 unknown Reserved
unknown unknown false
59.155.142.105
 unknown China
7474 OPTUSCOM-AS01-AUSingTelOptusPtyLtdAU false
154.197.69.28
 unknown Seychelles
18013 ASLINE-AS-APASLINELIMITEDHK false
64.2.188.88
 unknown United States
2828 XO-AS15US false
31.65.184.232
 unknown United Kingdom
12576 EELtdGB false
162.39.94.31
 unknown United States
7029 WINDSTREAMUS false
104.8.105.61
 unknown United States
7018 ATT-INTERNET4US false
182.38.65.149
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
218.87.189.1
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
94.222.49.246
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
116.81.214.64
 unknown Japan 18144 AS-ENECOMEnergiaCommunicationsIncJP false
110.161.221.153
 unknown Japan 9605 DOCOMONTTDOCOMOINCJP false
145.25.21.162
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
170.108.103.48
 unknown United States
6289 AHM-CORPUS false
111.78.169.201
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
100.29.92.173
 unknown United States
14618 AMAZON-AESUS false
17.140.15.91
 unknown United States
714 APPLE-ENGINEERINGUS false
78.191.238.226
 unknown Turkey
9121 TTNETTR false
164.80.99.110
 unknown Australia
9880 NEXTGENNET-AS1-AU-APNextGenNetPtyLtdNorthSydneyAU false
216.218.253.207
 unknown United States
36103 CENTRALUTAHUS false
151.67.245.164
 unknown Italy
1267 ASN-WINDTREIUNETEU false
80.107.48.218
 unknown Greece
6799 OTENET-GRAthens-GreeceGR false
88.116.71.79
 unknown Austria
8447 TELEKOM-ATA1TelekomAustriaAGAT false
94.72.167.50
 unknown Bulgaria
42735 MAXTELECOM-ASBG false
223.56.251.226
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
168.87.153.24
 unknown United States
25867 INTRIA-HP-CORPUS false
60.73.178.63
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
12.182.53.77
 unknown United States
7018 ATT-INTERNET4US false
23.10.77.236
 unknown United States
16625 AKAMAI-ASUS false
5.245.226.209
 unknown Saudi Arabia
34400 ASN-ETTIHADETISALATSA false
14.59.217.129
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
88.10.38.149
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
145.71.54.215
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
88.111.94.255
 unknown United Kingdom
9105 TISCALI-UKTalkTalkCommunicationsLimitedGB false
147.26.21.105
 unknown United States
18777 TEXAS-STATE-UNIVERSITYUS false
43.91.144.164
 unknown Japan 4249 LILLY-ASUS false
135.239.42.142
 unknown United States
10455 LUCENT-CIOUS false
194.171.219.177
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
32.35.17.43
 unknown United States
2686 ATGS-MMD-ASUS false
87.128.146.164
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
247.168.95.15
 unknown Reserved
unknown unknown false
126.252.193.228
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
84.58.245.6
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
99.75.200.55
 unknown United States
7018 ATT-INTERNET4US false
182.191.133.252
 unknown Pakistan
45595 PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK false
124.74.187.40
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
104.202.16.130
 unknown United States
18978 ENZUINC-US false
116.187.45.43
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
240.182.26.100
 unknown Reserved
unknown unknown false
160.240.28.146
 unknown Japan 11259 ANGOLATELECOMAO false
19.138.118.185
 unknown United States
3 MIT-GATEWAYSUS false
210.115.221.28
 unknown Korea Republic of
7558 KBS-ASKoreanBroadcastingSystemKBSKR false
100.138.237.141
 unknown United States
21928 T-MOBILE-AS21928US false
124.74.19.26
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
5.186.154.253
 unknown Denmark
44869 FIBIA-P-SDK false
103.101.86.128
 unknown Bangladesh
30938 ABSTATIONwwwabstationnetGB false
142.86.102.203
 unknown Canada
11489 BACICA false
108.212.152.82
 unknown United States
7018 ATT-INTERNET4US false
200.13.170.179
 unknown El Salvador
27773 MILLICOMCABLEELSALVADORSADECVSV false
218.197.116.161
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
102.200.137.68
 unknown unknown
36926 CKL1-ASNKE false
180.47.173.174
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
105.202.21.179
 unknown Egypt
36992 ETISALAT-MISREG false
35.111.38.179
 unknown United States
237 MERIT-AS-14US false
78.95.49.167
 unknown Saudi Arabia
39891 ALJAWWALSTC-ASSA false
105.237.188.170
 unknown South Africa
16637 MTNNS-ASZA false
244.91.245.185
 unknown Reserved
unknown unknown false
249.169.215.200
 unknown Reserved
unknown unknown false
74.230.139.30
 unknown United States
7018 ATT-INTERNET4US false
255.184.42.24
 unknown Reserved
unknown unknown false
58.15.159.251
 unknown China
17506 UCOMARTERIANetworksCorporationJP false
14.58.187.161
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
155.244.182.51
 unknown United States
668 DNIC-AS-00668US false
54.110.202.79
 unknown United States
16509 AMAZON-02US false
219.180.39.78
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
167.4.144.80
 unknown United States
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
66.91.13.150
 unknown United States
20001 TWC-20001-PACWESTUS false
61.19.157.123
 unknown Thailand
9931 CAT-APTheCommunicationAuthoityofThailandCATTH false
99.61.247.103
 unknown United States
7018 ATT-INTERNET4US false
184.182.6.190
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
252.136.84.231
 unknown Reserved
unknown unknown false
89.177.125.131
 unknown Czech Republic
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
148.112.182.213
 unknown United States
10615 PAINEWEBBER-ASNUS false
85.25.34.206
 unknown Germany
8972 GD-EMEA-DC-SXB1DE false
153.142.79.12
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
57.238.159.168
 unknown Belgium
2686 ATGS-MMD-ASUS false
198.119.164.179
 unknown United States
297 AS297US false
117.141.248.102
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
121.227.15.87
 unknown China
23650 CHINANET-JS-AS-APASNumberforCHINANETjiangsuprovinceba false
17.111.97.232
 unknown United States
714 APPLE-ENGINEERINGUS false
94.27.69.139
 unknown Ukraine
12530 GOLDENTELECOM-UKRAINEKyivstarPJSCUA false