Linux Analysis Report
nshkmpsl.elf

Overview

General Information

Sample name: nshkmpsl.elf
Analysis ID: 1579302
MD5: 0bdf628b8440886203e1f45d3682130a
SHA1: 40186d96c2a3be219eb0915a0dd7c9802288f1bf
SHA256: 252450f86c557a4eb2dfbebd6820b602b6fca68661caacc2fc4f1f3bfe50a883
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: nshkmpsl.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: nshkmpsl.elf ReversingLabs: Detection: 21%
Source: nshkmpsl.elf Virustotal: Detection: 28% Perma Link

Networking
barindex
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: catvision.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: hikvision.geek. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: shitrocket.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: catlovingfools.geek. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:39440 -> 212.64.215.71:15869
Source: global traffic TCP traffic: 192.168.2.23:52840 -> 80.78.26.121:15869
Source: global traffic TCP traffic: 192.168.2.23:39668 -> 185.72.8.231:10127
Source: global traffic TCP traffic: 192.168.2.23:43512 -> 86.107.100.19:24993
Sample listens on a socket
Source: /tmp/nshkmpsl.elf (PID: 6243) Socket: 127.0.0.1:1172 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: unknown TCP traffic detected without corresponding DNS query: 53.134.228.135
Source: unknown TCP traffic detected without corresponding DNS query: 58.224.15.104
Source: unknown TCP traffic detected without corresponding DNS query: 107.186.26.86
Source: unknown TCP traffic detected without corresponding DNS query: 193.151.33.164
Source: unknown TCP traffic detected without corresponding DNS query: 81.208.195.73
Source: unknown TCP traffic detected without corresponding DNS query: 75.246.6.198
Source: unknown TCP traffic detected without corresponding DNS query: 202.152.100.157
Source: unknown TCP traffic detected without corresponding DNS query: 98.228.129.200
Source: unknown TCP traffic detected without corresponding DNS query: 68.170.47.58
Source: unknown TCP traffic detected without corresponding DNS query: 6.85.153.172
Source: unknown TCP traffic detected without corresponding DNS query: 105.196.147.80
Source: unknown TCP traffic detected without corresponding DNS query: 85.76.251.185
Source: unknown TCP traffic detected without corresponding DNS query: 184.66.235.59
Source: unknown TCP traffic detected without corresponding DNS query: 179.45.48.79
Source: unknown TCP traffic detected without corresponding DNS query: 4.62.198.39
Source: unknown TCP traffic detected without corresponding DNS query: 80.98.38.252
Source: unknown TCP traffic detected without corresponding DNS query: 143.48.208.191
Source: unknown TCP traffic detected without corresponding DNS query: 217.180.105.3
Source: unknown TCP traffic detected without corresponding DNS query: 101.21.64.205
Source: unknown TCP traffic detected without corresponding DNS query: 52.206.219.4
Source: unknown TCP traffic detected without corresponding DNS query: 12.129.186.143
Source: unknown TCP traffic detected without corresponding DNS query: 219.36.55.23
Source: unknown TCP traffic detected without corresponding DNS query: 191.36.141.46
Source: unknown TCP traffic detected without corresponding DNS query: 174.172.59.151
Source: unknown TCP traffic detected without corresponding DNS query: 199.159.28.192
Source: unknown TCP traffic detected without corresponding DNS query: 51.65.143.23
Source: unknown TCP traffic detected without corresponding DNS query: 121.204.172.223
Source: unknown TCP traffic detected without corresponding DNS query: 156.157.123.135
Source: unknown TCP traffic detected without corresponding DNS query: 214.20.119.58
Source: unknown TCP traffic detected without corresponding DNS query: 124.11.247.87
Source: unknown TCP traffic detected without corresponding DNS query: 69.121.65.46
Source: unknown TCP traffic detected without corresponding DNS query: 71.193.212.80
Source: unknown TCP traffic detected without corresponding DNS query: 37.190.250.58
Source: unknown TCP traffic detected without corresponding DNS query: 160.255.84.152
Source: unknown TCP traffic detected without corresponding DNS query: 44.139.152.14
Source: unknown TCP traffic detected without corresponding DNS query: 61.135.197.71
Source: unknown TCP traffic detected without corresponding DNS query: 70.220.213.70
Source: unknown TCP traffic detected without corresponding DNS query: 82.173.20.137
Source: unknown TCP traffic detected without corresponding DNS query: 194.27.66.229
Source: unknown TCP traffic detected without corresponding DNS query: 207.231.229.46
Source: unknown TCP traffic detected without corresponding DNS query: 37.32.127.205
Source: unknown TCP traffic detected without corresponding DNS query: 36.142.71.21
Source: unknown TCP traffic detected without corresponding DNS query: 223.109.57.189
Source: unknown TCP traffic detected without corresponding DNS query: 158.22.151.106
Source: unknown TCP traffic detected without corresponding DNS query: 152.178.200.108
Source: unknown TCP traffic detected without corresponding DNS query: 108.38.165.144
Source: unknown TCP traffic detected without corresponding DNS query: 80.121.160.208
Source: unknown TCP traffic detected without corresponding DNS query: 204.58.234.114
Source: unknown TCP traffic detected without corresponding DNS query: 22.164.170.193
Source: unknown TCP traffic detected without corresponding DNS query: 183.61.122.207
Source: global traffic DNS traffic detected: DNS query: hikvision.geek
Source: global traffic DNS traffic detected: DNS query: catvision.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: shitrocket.dyn
Source: global traffic DNS traffic detected: DNS query: catlovingfools.geek
Source: global traffic DNS traffic detected: DNS query: hikvision.geek. [malformed]
Source: global traffic DNS traffic detected: DNS query: shitrocket.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: catlovingfools.geek. [malformed]
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal68.troj.linELF@0/0@12/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/nshkmpsl.elf (PID: 6243) Queries kernel information via 'uname': Jump to behavior
Source: nshkmpsl.elf, 6243.1.00007ffdc156b000.00007ffdc158c000.rw-.sdmp, nshkmpsl.elf, 6245.1.00007ffdc156b000.00007ffdc158c000.rw-.sdmp Binary or memory string: 7ax86_64/usr/bin/qemu-mipsel/tmp/nshkmpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nshkmpsl.elf
Source: nshkmpsl.elf, 6243.1.000055edba83c000.000055edba8e5000.rw-.sdmp, nshkmpsl.elf, 6245.1.000055edba83c000.000055edba8e5000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mipsel
Source: nshkmpsl.elf, 6243.1.000055edba83c000.000055edba8e5000.rw-.sdmp, nshkmpsl.elf, 6245.1.000055edba83c000.000055edba8e5000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: nshkmpsl.elf, 6243.1.00007ffdc156b000.00007ffdc158c000.rw-.sdmp, nshkmpsl.elf, 6245.1.00007ffdc156b000.00007ffdc158c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsel

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: nshkmpsl.elf, type: SAMPLE
Source: Yara match File source: 6245.1.00007fcf3c400000.00007fcf3c417000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6243.1.00007fcf3c400000.00007fcf3c417000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: nshkmpsl.elf, type: SAMPLE
Source: Yara match File source: 6245.1.00007fcf3c400000.00007fcf3c417000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6243.1.00007fcf3c400000.00007fcf3c417000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
129.34.202.21
 unknown United States
1747 IBMWATSON-ASUS false
170.68.216.166
 unknown United States
16761 FEDMOG-ASN-01US false
56.27.211.94
 unknown United States
2686 ATGS-MMD-ASUS false
185.78.7.99
 unknown United Kingdom
16030 ALTECOMES false
99.160.220.16
 unknown United States
7018 ATT-INTERNET4US false
14.142.207.27
 unknown India
4755 TATACOMM-ASTATACommunicationsformerlyVSNLisLeadingISP false
4.204.225.198
 unknown United States
3356 LEVEL3US false
162.88.214.66
 unknown United States
33517 DYNDNSUS false
22.116.194.78
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
207.44.71.176
 unknown United States
3737 AS-PTDUS false
36.160.216.170
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
13.22.154.180
 unknown United States
395959 XEROX-ELLUS false
17.240.3.92
 unknown United States
714 APPLE-ENGINEERINGUS false
58.159.43.208
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
111.191.173.66
 unknown Japan 37903 EMOBILEYmobileCorporationJP false
4.194.29.197
 unknown United States
3356 LEVEL3US false
131.22.3.230
 unknown United States
385 AFCONC-BLOCK1-ASUS false
8.125.159.62
 unknown United States
3356 LEVEL3US false
32.250.10.96
 unknown United States
2686 ATGS-MMD-ASUS false
46.251.195.209
 unknown Kyrgyzstan
50223 ALFAKG false
210.69.30.65
 unknown Taiwan; Republic of China (ROC)
4782 GSNETDataCommunicationBusinessGroupTW false
166.191.149.72
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
177.114.154.44
 unknown Brazil
26599 TELEFONICABRASILSABR false
205.39.50.206
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
194.245.230.82
 unknown Germany
5517 CSLDE false
55.235.121.195
 unknown United States
306 DNIC-ASBLK-00306-00371US false
59.33.173.195
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
120.96.248.235
 unknown Taiwan; Republic of China (ROC)
17716 NTU-TWNationalTaiwanUniversityTW false
68.162.84.166
 unknown United States
701 UUNETUS false
137.91.0.170
 unknown United States
33350 APS---ARIZONA-PUBLIC-SERVICE-CORPORATIONUS false
73.37.126.232
 unknown United States
7922 COMCAST-7922US false
11.62.90.204
 unknown United States
3356 LEVEL3US false
99.239.140.182
 unknown Canada
812 ROGERS-COMMUNICATIONSCA false
125.195.176.75
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
152.211.115.46
 unknown United States
701 UUNETUS false
88.66.228.57
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
122.232.150.105
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
28.240.135.243
 unknown United States
7922 COMCAST-7922US false
128.113.78.36
 unknown United States
91 RPI-ASUS false
98.153.107.41
 unknown United States
20001 TWC-20001-PACWESTUS false
98.15.44.86
 unknown United States
12271 TWC-12271-NYCUS false
142.247.191.15
 unknown Saudi Arabia
25019 SAUDINETSTC-ASSA false
187.10.79.91
 unknown Brazil
27699 TELEFONICABRASILSABR false
103.101.26.21
 unknown India
136632 TELEVAJR-AS-INVajraTelecomPvtLtdIN false
97.170.127.5
 unknown United States
6167 CELLCO-PARTUS false
129.64.168.38
 unknown United States
10561 BRANDEISUS false
159.214.148.127
 unknown United States
10953 PECOUS false
116.115.226.127
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
69.182.108.199
 unknown United States
32813 APS-ASNUS false
6.19.145.191
 unknown United States
3356 LEVEL3US false
174.103.179.4
 unknown United States
10796 TWC-10796-MIDWESTUS false
81.208.26.144
 unknown Italy
12874 FASTWEBIT false
48.157.193.150
 unknown United States
2686 ATGS-MMD-ASUS false
110.151.56.102
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
8.125.159.84
 unknown United States
3356 LEVEL3US false
201.177.4.207
 unknown Argentina
22927 TelefonicadeArgentinaAR false
69.40.33.203
 unknown United States
7029 WINDSTREAMUS false
122.73.163.93
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
142.89.143.171
 unknown Canada
822 STJOSEPHS-ASCA false
40.54.113.9
 unknown United States
4249 LILLY-ASUS false
73.69.159.87
 unknown United States
7922 COMCAST-7922US false
196.168.72.152
 unknown Togo
24691 TOGOTEL-ASTogoTelecomTogoTG false
60.163.132.107
 unknown China
136190 CHINATELECOM-ZHEJIANG-JINHUA-IDCJINHUAZHEJIANGProvince false
66.98.91.69
 unknown Dominican Republic
6400 CompaniaDominicanadeTelefonosSADO false
143.165.67.18
 unknown United States
2923 AS-TIAA-NETUS false
85.205.176.48
 unknown Germany
12663 VODAFONE-GROUPIT false
27.200.159.23
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
185.24.218.245
 unknown Poland
59491 LIVENET-PL false
208.95.81.171
 unknown United States
23314 ORLANDOTELCOUS false
147.238.82.35
 unknown United States
1494 DNIC-ASBLK-01494-01495US false
64.68.30.193
 unknown United States
16567 NETRIX-16567US false
130.41.156.168
 unknown United States
243 HARRIS-ATD-ASUS false
30.242.77.105
 unknown United States
7922 COMCAST-7922US false
186.136.147.38
 unknown Argentina
10318 TelecomArgentinaSAAR false
134.209.166.126
 unknown United States
14061 DIGITALOCEAN-ASNUS false
8.24.140.220
 unknown United States
14112 NET-SECURENET-MTLCA false
189.255.154.199
 unknown Mexico
8151 UninetSAdeCVMX false
174.112.118.103
 unknown Canada
812 ROGERS-COMMUNICATIONSCA false
109.78.247.224
 unknown Ireland
15502 VODAFONE-IRELAND-ASNIE false
20.106.167.55
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
195.58.81.241
 unknown United Kingdom
3253 SOVINTEL-EF-ASRU false
134.143.169.206
 unknown Netherlands
32432 COFANUS false
32.128.69.183
 unknown United States
2686 ATGS-MMD-ASUS false
29.115.114.102
 unknown United States
7922 COMCAST-7922US false
30.210.198.204
 unknown United States
7922 COMCAST-7922US false
200.102.118.64
 unknown Brazil
8167 BrasilTelecomSA-FilialDistritoFederalBR false
201.230.99.18
 unknown Peru
6147 TelefonicadelPeruSAAPE false
47.204.35.202
 unknown United States
5650 FRONTIER-FRTRUS false
186.253.253.22
 unknown Brazil
26615 TIMSABR false
137.34.36.146
 unknown Switzerland
721 DNIC-ASBLK-00721-00726US false
220.36.213.204
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
186.100.192.21
 unknown Argentina
11315 TelefonicaMovilesArgentinaSAMovistarArgentinaAR false
125.48.191.57
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
48.149.104.4
 unknown United States
2686 ATGS-MMD-ASUS false
32.31.76.73
 unknown United States
2686 ATGS-MMD-ASUS false
39.77.43.35
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
78.86.61.61
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
201.91.173.14
 unknown Brazil
10429 TELEFONICABRASILSABR false
91.74.182.130
 unknown United Arab Emirates
15802 DU-AS1AE false
52.107.25.214
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false

Contacted Domains

Name IP Active
shitrocket.dyn 176.32.32.113 true
catlovingfools.geek 80.78.26.121 true
hikvision.geek 185.72.8.231 true
catlovingfools.geek. [malformed] unknown unknown
hikvision.geek. [malformed] unknown unknown
shitrocket.dyn. [malformed] unknown unknown
catvision.dyn. [malformed] unknown unknown