Linux Analysis Report
na.elf

Overview

General Information

Sample name: na.elf
Analysis ID: 1579299
MD5: b852ccf9f811ed9d1fb4978f44c770b9
SHA1: db50b67add74d12bb291ef3c3c6664d12eae82b8
SHA256: 88194d7e8b4131ded628de436327ecf92580e2b58163e402effeccecf02c60a6
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: na.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: na.elf Virustotal: Detection: 30% Perma Link
Source: na.elf ReversingLabs: Detection: 28%

Networking
barindex
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: catvision.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: shitrocket.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: hikvision.geek. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: catlovingfools.geek. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:51324 -> 185.72.8.231:6315
Source: global traffic TCP traffic: 192.168.2.23:55502 -> 212.64.215.71:6315
Source: global traffic TCP traffic: 192.168.2.23:49970 -> 212.192.13.95:19974
Source: global traffic TCP traffic: 192.168.2.23:60056 -> 37.49.226.109:3512
Source: global traffic TCP traffic: 192.168.2.23:42830 -> 37.49.226.105:8541
Source: global traffic TCP traffic: 192.168.2.23:38638 -> 176.32.32.113:14713
Source: global traffic TCP traffic: 192.168.2.23:58488 -> 86.107.100.19:23130
Source: global traffic TCP traffic: 192.168.2.23:43102 -> 212.60.5.153:3801
Sample listens on a socket
Source: /tmp/na.elf (PID: 6241) Socket: 127.0.0.1:1172 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 196.164.11.98
Source: unknown TCP traffic detected without corresponding DNS query: 76.70.228.164
Source: unknown TCP traffic detected without corresponding DNS query: 140.1.174.15
Source: unknown TCP traffic detected without corresponding DNS query: 112.85.98.99
Source: unknown TCP traffic detected without corresponding DNS query: 58.133.56.50
Source: unknown TCP traffic detected without corresponding DNS query: 129.62.188.80
Source: unknown TCP traffic detected without corresponding DNS query: 191.15.243.219
Source: unknown TCP traffic detected without corresponding DNS query: 57.108.101.36
Source: unknown TCP traffic detected without corresponding DNS query: 153.72.113.10
Source: unknown TCP traffic detected without corresponding DNS query: 81.53.232.109
Source: unknown TCP traffic detected without corresponding DNS query: 55.60.34.15
Source: unknown TCP traffic detected without corresponding DNS query: 156.7.4.117
Source: unknown TCP traffic detected without corresponding DNS query: 105.88.34.222
Source: unknown TCP traffic detected without corresponding DNS query: 201.83.224.24
Source: unknown TCP traffic detected without corresponding DNS query: 49.71.176.75
Source: unknown TCP traffic detected without corresponding DNS query: 172.63.145.75
Source: unknown TCP traffic detected without corresponding DNS query: 60.99.213.162
Source: unknown TCP traffic detected without corresponding DNS query: 54.181.11.181
Source: unknown TCP traffic detected without corresponding DNS query: 166.133.142.65
Source: unknown TCP traffic detected without corresponding DNS query: 65.78.249.227
Source: unknown TCP traffic detected without corresponding DNS query: 78.79.170.119
Source: unknown TCP traffic detected without corresponding DNS query: 90.135.254.112
Source: unknown TCP traffic detected without corresponding DNS query: 4.103.113.133
Source: unknown TCP traffic detected without corresponding DNS query: 35.245.4.89
Source: unknown TCP traffic detected without corresponding DNS query: 179.36.131.20
Source: unknown TCP traffic detected without corresponding DNS query: 96.195.24.81
Source: unknown TCP traffic detected without corresponding DNS query: 223.64.187.69
Source: unknown TCP traffic detected without corresponding DNS query: 26.68.143.50
Source: unknown TCP traffic detected without corresponding DNS query: 9.209.187.124
Source: unknown TCP traffic detected without corresponding DNS query: 44.178.250.241
Source: unknown TCP traffic detected without corresponding DNS query: 190.2.247.149
Source: unknown TCP traffic detected without corresponding DNS query: 154.164.153.67
Source: unknown TCP traffic detected without corresponding DNS query: 168.151.33.63
Source: unknown TCP traffic detected without corresponding DNS query: 38.42.134.116
Source: unknown TCP traffic detected without corresponding DNS query: 214.238.23.108
Source: unknown TCP traffic detected without corresponding DNS query: 105.92.100.98
Source: unknown TCP traffic detected without corresponding DNS query: 218.68.200.178
Source: unknown TCP traffic detected without corresponding DNS query: 196.67.39.2
Source: unknown TCP traffic detected without corresponding DNS query: 149.151.54.176
Source: unknown TCP traffic detected without corresponding DNS query: 83.202.223.30
Source: unknown TCP traffic detected without corresponding DNS query: 47.63.137.80
Source: unknown TCP traffic detected without corresponding DNS query: 188.154.134.245
Source: unknown TCP traffic detected without corresponding DNS query: 145.161.244.79
Source: unknown TCP traffic detected without corresponding DNS query: 63.233.150.127
Source: unknown TCP traffic detected without corresponding DNS query: 170.163.168.29
Source: unknown TCP traffic detected without corresponding DNS query: 164.226.239.52
Source: unknown TCP traffic detected without corresponding DNS query: 40.92.155.254
Source: unknown TCP traffic detected without corresponding DNS query: 207.156.16.90
Source: unknown TCP traffic detected without corresponding DNS query: 53.83.42.213
Source: global traffic DNS traffic detected: DNS query: catvision.dyn
Source: global traffic DNS traffic detected: DNS query: shitrocket.dyn
Source: global traffic DNS traffic detected: DNS query: hikvision.geek
Source: global traffic DNS traffic detected: DNS query: catvision.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: catlovingfools.geek
Source: global traffic DNS traffic detected: DNS query: shitrocket.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: hikvision.geek. [malformed]
Source: global traffic DNS traffic detected: DNS query: catlovingfools.geek. [malformed]
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal68.troj.linELF@0/0@27/0
Enumerates processes within the "proc" file system
Source: /tmp/na.elf (PID: 6309) File opened: /proc/6069/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 6309) File opened: /proc/6410/status Jump to behavior
Source: /tmp/na.elf (PID: 6309) File opened: /proc/6421/status Jump to behavior
Source: /tmp/na.elf (PID: 6309) File opened: /proc/6420/status Jump to behavior
Source: /tmp/na.elf (PID: 6309) File opened: /proc/6412/status Jump to behavior
Source: /tmp/na.elf (PID: 6309) File opened: /proc/6423/status Jump to behavior
Source: /tmp/na.elf (PID: 6309) File opened: /proc/6411/status Jump to behavior
Source: /tmp/na.elf (PID: 6309) File opened: /proc/6422/status Jump to behavior
Source: /tmp/na.elf (PID: 6309) File opened: /proc/6414/status Jump to behavior
Source: /tmp/na.elf (PID: 6309) File opened: /proc/6413/status Jump to behavior
Source: /tmp/na.elf (PID: 6309) File opened: /proc/6416/status Jump to behavior
Source: /tmp/na.elf (PID: 6309) File opened: /proc/6415/status Jump to behavior
Source: /tmp/na.elf (PID: 6309) File opened: /proc/6407/status Jump to behavior
Source: /tmp/na.elf (PID: 6309) File opened: /proc/6418/status Jump to behavior
Source: /tmp/na.elf (PID: 6309) File opened: /proc/6417/status Jump to behavior
Source: /tmp/na.elf (PID: 6309) File opened: /proc/6409/status Jump to behavior
Source: /tmp/na.elf (PID: 6309) File opened: /proc/6408/status Jump to behavior
Source: /tmp/na.elf (PID: 6309) File opened: /proc/6419/status Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/na.elf (PID: 6241) Queries kernel information via 'uname': Jump to behavior
Source: na.elf, 6241.1.00007ffe90e4a000.00007ffe90e6b000.rw-.sdmp, na.elf, 6243.1.00007ffe90e4a000.00007ffe90e6b000.rw-.sdmp, na.elf, 6244.1.00007ffe90e4a000.00007ffe90e6b000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 6241.1.000055a335ffe000.000055a3360cb000.rw-.sdmp, na.elf, 6243.1.000055a335ffe000.000055a3360cb000.rw-.sdmp, na.elf, 6244.1.000055a335ffe000.000055a3360cb000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mips
Source: na.elf, 6241.1.000055a335ffe000.000055a3360cb000.rw-.sdmp, na.elf, 6243.1.000055a335ffe000.000055a3360cb000.rw-.sdmp, na.elf, 6244.1.000055a335ffe000.000055a3360cb000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: na.elf, 6244.1.000055a335ffe000.000055a3360cb000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: na.elf, 6241.1.00007ffe90e4a000.00007ffe90e6b000.rw-.sdmp, na.elf, 6243.1.00007ffe90e4a000.00007ffe90e6b000.rw-.sdmp, na.elf, 6244.1.00007ffe90e4a000.00007ffe90e6b000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips
Source: na.elf, 6244.1.000055a335ffe000.000055a3360cb000.rw-.sdmp Binary or memory string: U!/usr/bin/vmtoolsd

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: na.elf, type: SAMPLE
Source: Yara match File source: 6241.1.00007fb32c400000.00007fb32c417000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6244.1.00007fb32c400000.00007fb32c417000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6243.1.00007fb32c400000.00007fb32c417000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: na.elf, type: SAMPLE
Source: Yara match File source: 6241.1.00007fb32c400000.00007fb32c417000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6244.1.00007fb32c400000.00007fb32c417000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6243.1.00007fb32c400000.00007fb32c417000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
194.208.11.109
 unknown Austria
5385 RUSSMEDIA-ITAT false
122.40.141.206
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
18.195.78.68
 unknown United States
16509 AMAZON-02US false
218.52.46.228
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
184.29.182.57
 unknown United States
16625 AKAMAI-ASUS false
128.234.234.229
 unknown Saudi Arabia
25019 SAUDINETSTC-ASSA false
219.99.225.50
 unknown Japan 59108 KATCH-NETKATCHNETWORKINCJP false
53.81.196.248
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
215.91.43.12
 unknown United States
721 DNIC-ASBLK-00721-00726US false
139.251.141.62
 unknown United States
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
133.155.43.121
 unknown Japan 7524 HANSHINITECHANKYUHANSHINCOLTDJP false
189.152.3.179
 unknown Mexico
8151 UninetSAdeCVMX false
151.172.231.98
 unknown unknown
45025 EDN-ASUA false
15.236.15.75
 unknown United States
16509 AMAZON-02US false
163.245.19.47
 unknown United States
17 PURDUEUS false
147.175.228.89
 unknown Slovakia (SLOVAK Republic)
2607 SANETSlovakAcademicNetworkSK false
176.110.4.10
 unknown Ukraine
41911 LANET-SDUA false
206.62.82.43
 unknown United States
174 COGENT-174US false
158.121.83.246
 unknown United States
1968 UMASSP-DOMUS false
112.205.13.4
 unknown Philippines
9299 IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH false
20.201.109.42
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
153.118.89.203
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
167.129.232.194
 unknown Canada
394366 CITYOFSASKATOONCA false
148.188.66.139
 unknown United States
42652 DELUNETDE false
152.121.32.132
 unknown United States
27030 USCG-ASUS false
57.50.158.65
 unknown Belgium
2686 ATGS-MMD-ASUS false
184.134.59.195
 unknown United States
5778 CENTURYLINK-LEGACY-EMBARQ-RCMTUS false
114.134.127.123
 unknown Japan 4721 JCNJupiterTelecommunicationsCoLtdJP false
175.209.232.90
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
56.55.47.44
 unknown United States
2686 ATGS-MMD-ASUS false
142.166.65.22
 unknown Canada
855 CANET-ASN-4CA false
52.63.235.185
 unknown United States
16509 AMAZON-02US false
28.91.39.130
 unknown United States
7922 COMCAST-7922US false
73.98.141.255
 unknown United States
7922 COMCAST-7922US false
198.210.56.59
 unknown United States
395111 KVCNET-2009US false
82.115.89.248
 unknown Poland
16340 IS-ASNIS-NETAutonomousSystemPL false
105.210.251.68
 unknown South Africa
16637 MTNNS-ASZA false
9.170.73.43
 unknown United States
3356 LEVEL3US false
192.117.120.136
 unknown Israel
8551 BEZEQ-INTERNATIONAL-ASBezeqintInternetBackboneIL false
8.188.166.169
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
42.2.200.145
 unknown Hong Kong
4760 HKTIMS-APHKTLimitedHK false
15.59.170.252
 unknown United States
13979 ATT-IPFRUS false
178.81.128.40
 unknown Saudi Arabia
35819 MOBILY-ASEtihadEtisalatCompanyMobilySA false
1.82.8.34
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
194.37.136.202
 unknown Austria
8387 T-SYSTEMS-ATRennweg97-99AT false
5.5.54.220
 unknown Germany
6805 TDDE-ASN1DE false
23.82.106.113
 unknown United States
15003 NOBIS-TECHUS false
167.135.191.204
 unknown United States
11404 AS-WAVE-1US false
12.202.107.55
 unknown United States
22983 FISERV-INCUS false
215.33.97.207
 unknown United States
721 DNIC-ASBLK-00721-00726US false
172.50.129.164
 unknown United States
21928 T-MOBILE-AS21928US false
37.186.250.137
 unknown Italy
12874 FASTWEBIT false
59.79.11.118
 unknown China
24364 CNGI-SH-IX-AS-APCERNET2IXatShanghaiJiaotongUniversity false
180.232.89.109
 unknown Philippines
9658 ETPI-IDS-AS-APEasternTelecomsPhilsIncPH false
166.26.105.203
 unknown United States
206 CSC-IGN-AMERUS false
220.79.61.205
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
86.208.210.157
 unknown France
3215 FranceTelecom-OrangeFR false
111.168.156.47
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
171.133.159.157
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
194.209.37.110
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
193.84.18.113
 unknown France
39605 IGUANESOLUTIONSFR false
92.72.223.227
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
98.126.6.69
 unknown United States
35908 VPLSNETUS false
15.150.109.39
 unknown United States
71 HP-INTERNET-ASUS false
186.101.109.127
 unknown Ecuador
27947 TelconetSAEC false
4.238.127.42
 unknown United States
3356 LEVEL3US false
186.98.225.135
 unknown Colombia
701 UUNETUS false
12.197.10.151
 unknown United States
7018 ATT-INTERNET4US false
195.25.119.136
 unknown France
3215 FranceTelecom-OrangeFR false
120.189.11.193
 unknown Indonesia
4761 INDOSAT-INP-APINDOSATInternetNetworkProviderID false
45.5.248.128
 unknown unknown
266124 MarcioEijiYasue-MEBR false
173.202.160.108
 unknown United States
22561 CENTURYLINK-LEGACY-LIGHTCOREUS false
206.64.5.153
 unknown United States
701 UUNETUS false
166.178.53.245
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
80.241.105.151
 unknown Switzerland
30727 SYSLINKBaselSwitzerlandCH false
208.160.70.24
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
130.230.236.19
 unknown Finland
1739 TUTNETTUTAutonomousSystemEU false
107.199.244.143
 unknown United States
7018 ATT-INTERNET4US false
13.112.203.36
 unknown United States
16509 AMAZON-02US false
2.37.157.74
 unknown Italy
30722 VODAFONE-IT-ASNIT false
16.238.26.220
 unknown United States
unknown unknown false
52.238.75.110
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
71.203.217.150
 unknown United States
7922 COMCAST-7922US false
35.210.89.38
 unknown United States
19527 GOOGLE-2US false
48.130.121.236
 unknown United States
2686 ATGS-MMD-ASUS false
132.181.181.223
 unknown New Zealand
9432 CANTERBURY-ASUniversityofCanterburyNZ false
132.250.112.174
 unknown United States
48 DNIC-AS-00048US false
163.109.89.172
 unknown France
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
174.103.238.36
 unknown United States
10796 TWC-10796-MIDWESTUS false
205.23.44.13
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
221.98.182.176
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
189.4.141.113
 unknown Brazil
28573 CLAROSABR false
94.67.1.225
 unknown Greece
6799 OTENET-GRAthens-GreeceGR false
116.5.97.68
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
60.38.90.44
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
125.218.94.77
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
34.5.25.79
 unknown United States
2686 ATGS-MMD-ASUS false
79.196.146.241
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
181.61.167.19
 unknown Colombia
10620 TelmexColombiaSACO false
94.15.123.89
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false

Contacted Domains

Name IP Active
catvision.dyn 212.60.5.153 true
shitrocket.dyn 176.32.32.113 true
catlovingfools.geek 212.192.13.95 true
hikvision.geek 80.78.26.121 true
catlovingfools.geek. [malformed] unknown unknown
shitrocket.dyn. [malformed] unknown unknown
hikvision.geek. [malformed] unknown unknown
catvision.dyn. [malformed] unknown unknown