Linux Analysis Report
nshmips.elf

Overview

General Information

Sample name: nshmips.elf
Analysis ID: 1579304
MD5: 5f9077245a8bd881f4a484ede89d6e4d
SHA1: ad002c54c920ba8a336e41dd6638b9ed6bc13f62
SHA256: 875ec9e70673f8049e02d6d061e6bec597dbe68ccb31cfdaad54d2c05b6d1c7b
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: nshmips.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: nshmips.elf Virustotal: Detection: 28% Perma Link
Source: nshmips.elf ReversingLabs: Detection: 26%

Networking
barindex
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: catvision.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: hikvision.geek. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: catlovingfools.geek. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: shitrocket.dyn. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:58508 -> 212.64.215.71:18660
Source: global traffic TCP traffic: 192.168.2.23:38034 -> 37.49.226.109:21416
Source: global traffic TCP traffic: 192.168.2.23:43946 -> 80.78.26.121:4047
Source: global traffic TCP traffic: 192.168.2.23:60972 -> 212.60.5.153:8631
Sample listens on a socket
Source: /tmp/nshmips.elf (PID: 6209) Socket: 127.0.0.1:1172 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 83.5.146.73
Source: unknown TCP traffic detected without corresponding DNS query: 27.118.48.178
Source: unknown TCP traffic detected without corresponding DNS query: 23.178.105.7
Source: unknown TCP traffic detected without corresponding DNS query: 124.232.253.85
Source: unknown TCP traffic detected without corresponding DNS query: 196.54.102.208
Source: unknown TCP traffic detected without corresponding DNS query: 148.172.181.158
Source: unknown TCP traffic detected without corresponding DNS query: 155.118.160.9
Source: unknown TCP traffic detected without corresponding DNS query: 211.89.160.226
Source: unknown TCP traffic detected without corresponding DNS query: 117.166.4.104
Source: unknown TCP traffic detected without corresponding DNS query: 169.44.181.133
Source: unknown TCP traffic detected without corresponding DNS query: 140.127.73.88
Source: unknown TCP traffic detected without corresponding DNS query: 140.164.170.144
Source: unknown TCP traffic detected without corresponding DNS query: 131.21.29.240
Source: unknown TCP traffic detected without corresponding DNS query: 85.13.163.98
Source: unknown TCP traffic detected without corresponding DNS query: 113.102.228.138
Source: unknown TCP traffic detected without corresponding DNS query: 103.90.4.251
Source: unknown TCP traffic detected without corresponding DNS query: 100.242.250.209
Source: unknown TCP traffic detected without corresponding DNS query: 88.106.37.208
Source: unknown TCP traffic detected without corresponding DNS query: 107.135.75.238
Source: unknown TCP traffic detected without corresponding DNS query: 149.32.185.39
Source: unknown TCP traffic detected without corresponding DNS query: 116.165.41.125
Source: unknown TCP traffic detected without corresponding DNS query: 131.159.16.43
Source: unknown TCP traffic detected without corresponding DNS query: 34.82.9.14
Source: unknown TCP traffic detected without corresponding DNS query: 151.101.123.103
Source: unknown TCP traffic detected without corresponding DNS query: 117.84.88.175
Source: unknown TCP traffic detected without corresponding DNS query: 47.221.43.32
Source: unknown TCP traffic detected without corresponding DNS query: 116.214.253.114
Source: unknown TCP traffic detected without corresponding DNS query: 67.30.146.116
Source: unknown TCP traffic detected without corresponding DNS query: 172.241.212.92
Source: unknown TCP traffic detected without corresponding DNS query: 93.26.254.51
Source: unknown TCP traffic detected without corresponding DNS query: 209.17.151.202
Source: unknown TCP traffic detected without corresponding DNS query: 189.209.117.47
Source: unknown TCP traffic detected without corresponding DNS query: 42.120.218.202
Source: unknown TCP traffic detected without corresponding DNS query: 120.218.153.141
Source: unknown TCP traffic detected without corresponding DNS query: 13.111.200.155
Source: unknown TCP traffic detected without corresponding DNS query: 69.85.203.132
Source: unknown TCP traffic detected without corresponding DNS query: 179.170.247.206
Source: unknown TCP traffic detected without corresponding DNS query: 209.181.85.178
Source: unknown TCP traffic detected without corresponding DNS query: 4.40.226.70
Source: unknown TCP traffic detected without corresponding DNS query: 200.225.144.202
Source: unknown TCP traffic detected without corresponding DNS query: 141.216.23.195
Source: unknown TCP traffic detected without corresponding DNS query: 155.3.214.52
Source: unknown TCP traffic detected without corresponding DNS query: 8.122.44.186
Source: unknown TCP traffic detected without corresponding DNS query: 6.253.181.148
Source: unknown TCP traffic detected without corresponding DNS query: 40.37.9.30
Source: unknown TCP traffic detected without corresponding DNS query: 75.174.154.249
Source: unknown TCP traffic detected without corresponding DNS query: 58.190.172.176
Source: unknown TCP traffic detected without corresponding DNS query: 88.215.26.252
Source: unknown TCP traffic detected without corresponding DNS query: 41.250.45.130
Source: global traffic DNS traffic detected: DNS query: hikvision.geek
Source: global traffic DNS traffic detected: DNS query: catlovingfools.geek
Source: global traffic DNS traffic detected: DNS query: catvision.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: shitrocket.dyn
Source: global traffic DNS traffic detected: DNS query: hikvision.geek. [malformed]
Source: global traffic DNS traffic detected: DNS query: catlovingfools.geek. [malformed]
Source: global traffic DNS traffic detected: DNS query: shitrocket.dyn. [malformed]
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal68.troj.linELF@0/0@18/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/nshmips.elf (PID: 6209) Queries kernel information via 'uname': Jump to behavior
Source: nshmips.elf, 6209.1.00007ffeb27aa000.00007ffeb27cb000.rw-.sdmp, nshmips.elf, 6211.1.00007ffeb27aa000.00007ffeb27cb000.rw-.sdmp Binary or memory string: ]zx86_64/usr/bin/qemu-mips/tmp/nshmips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nshmips.elf
Source: nshmips.elf, 6209.1.000055dfe778a000.000055dfe7857000.rw-.sdmp, nshmips.elf, 6211.1.000055dfe778a000.000055dfe7857000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mips
Source: nshmips.elf, 6209.1.000055dfe778a000.000055dfe7857000.rw-.sdmp, nshmips.elf, 6211.1.000055dfe778a000.000055dfe7857000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: nshmips.elf, 6211.1.000055dfe778a000.000055dfe7857000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: nshmips.elf, 6209.1.00007ffeb27aa000.00007ffeb27cb000.rw-.sdmp, nshmips.elf, 6211.1.00007ffeb27aa000.00007ffeb27cb000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips
Source: nshmips.elf, 6211.1.000055dfe778a000.000055dfe7857000.rw-.sdmp Binary or memory string: U!/usr/bin/vmtoolsd

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: nshmips.elf, type: SAMPLE
Source: Yara match File source: 6209.1.00007f07c4400000.00007f07c4417000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6211.1.00007f07c4400000.00007f07c4417000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: nshmips.elf, type: SAMPLE
Source: Yara match File source: 6209.1.00007f07c4400000.00007f07c4417000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6211.1.00007f07c4400000.00007f07c4417000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
145.250.19.180
 unknown Switzerland
1101 IP-EEND-ASIP-EENDBVNL false
98.66.104.181
 unknown United States
11351 TWC-11351-NORTHEASTUS false
163.38.31.150
 unknown United States
1659 ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationC false
117.141.51.115
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
153.104.226.193
 unknown United States
10448 VILLANOVA-UNIVUS false
203.93.161.118
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
9.165.14.245
 unknown United States
3356 LEVEL3US false
133.187.254.213
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
156.179.81.182
 unknown Egypt
36992 ETISALAT-MISREG false
189.194.242.36
 unknown Mexico
13999 MegaCableSAdeCVMX false
166.42.58.80
 unknown United States
3372 MCI-ASNUS false
31.210.249.114
 unknown Sweden
35706 NAOSE false
58.112.88.160
 unknown Japan 9595 XEPHIONNTT-MECorporationJP false
173.254.77.37
 unknown United States
46606 UNIFIEDLAYER-AS-1US false
187.25.72.250
 unknown Brazil
22085 ClaroSABR false
84.95.12.215
 unknown Israel
9116 GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste false
7.100.21.6
 unknown United States
3356 LEVEL3US false
178.195.108.162
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
39.155.85.99
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
58.2.26.221
 unknown India
2510 INFOWEBFUJITSULIMITEDJP false
101.220.36.143
 unknown India
58519 CHINATELECOM-CTCLOUDCloudComputingCorporationCN false
74.25.109.155
 unknown United States
7922 COMCAST-7922US false
170.103.242.253
 unknown United States
23305 WORTHINGTONINDUSTRIESUS false
154.241.243.144
 unknown Algeria
36947 ALGTEL-ASDZ false
13.19.50.42
 unknown United States
26662 XEROX-WVUS false
181.197.167.73
 unknown Panama
18809 CableOndaPA false
197.163.1.32
 unknown Egypt
24863 LINKdotNET-ASEG false
101.54.2.75
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
140.119.219.29
 unknown Taiwan; Republic of China (ROC)
17716 NTU-TWNationalTaiwanUniversityTW false
135.251.35.200
 unknown United States
10455 LUCENT-CIOUS false
179.134.252.251
 unknown Brazil
26599 TELEFONICABRASILSABR false
168.73.238.62
 unknown United States
265240 ULTRANETSERVICOSEMINTERNETLTDABR false
140.205.153.135
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
182.249.115.31
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
108.243.173.5
 unknown United States
7018 ATT-INTERNET4US false
27.241.214.179
 unknown Taiwan; Republic of China (ROC)
9674 FET-TWFarEastToneTelecommunicationCoLtdTW false
102.90.150.254
 unknown Nigeria
29465 VCG-ASNG false
12.155.33.182
 unknown United States
7018 ATT-INTERNET4US false
59.181.165.146
 unknown India
17813 MTNL-APMahanagarTelephoneNigamLimitedIN false
169.1.9.96
 unknown South Africa
37611 AfrihostZA false
93.245.109.18
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
80.111.159.238
 unknown Netherlands
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
79.45.133.21
 unknown Italy
3269 ASN-IBSNAZIT false
105.74.194.119
 unknown Morocco
36884 MAROCCONNECTMA false
148.94.232.105
 unknown United States
786 JANETJiscServicesLimitedGB false
144.5.230.62
 unknown United States
7862 CHEVRONUS false
194.59.198.63
 unknown Czech Republic
48146 TRIPLEAES false
136.131.18.124
 unknown United States
60311 ONEFMCH false
23.28.227.143
 unknown United States
12083 WOW-INTERNETUS false
205.82.23.1
 unknown United States
647 DNIC-ASBLK-00616-00665US false
84.35.150.39
 unknown Netherlands
21221 INFOPACT-ASTheNetherlandsNL false
66.96.2.212
 unknown United States
13337 EVWI-NET-01US false
161.48.83.144
 unknown France
1767 ILIGHT-NETUS false
104.246.182.240
 unknown Canada
5645 TEKSAVVYCA false
77.55.80.197
 unknown Poland
15967 NAZWAPL false
175.158.32.252
 unknown Indonesia
4787 ASN-CBNPTCyberindoAditamaID false
169.62.101.145
 unknown United States
36351 SOFTLAYERUS false
143.165.67.11
 unknown United States
2923 AS-TIAA-NETUS false
49.198.158.125
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
1.62.56.197
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
166.130.72.144
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
187.100.242.49
 unknown Brazil
27699 TELEFONICABRASILSABR false
107.164.204.39
 unknown United States
18779 EGIHOSTINGUS false
25.254.239.103
 unknown United Kingdom
199055 UKCLOUD-ASGB false
129.91.29.67
 unknown United States
63295 ORCL-CHICAGO1US false
18.202.125.149
 unknown United States
16509 AMAZON-02US false
139.170.217.163
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
23.155.145.136
 unknown Reserved
398299 FRAXIONCA false
34.66.142.1
 unknown United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
185.126.207.145
 unknown Italy
208920 ROCKETWAY-ASIT false
145.224.73.101
 unknown United Kingdom
1101 IP-EEND-ASIP-EENDBVNL false
174.186.232.211
 unknown United States
7922 COMCAST-7922US false
157.200.138.18
 unknown Finland
1759 TSF-IP-CORETeliaFinlandOyjEU false
125.73.206.62
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
31.59.81.149
 unknown Iran (ISLAMIC Republic Of)
31549 RASANAIR false
65.99.176.12
 unknown Sweden
12552 IPO-EUSE false
98.137.87.72
 unknown United States
36646 YAHOO-NE1US false
11.219.251.248
 unknown United States
3356 LEVEL3US false
217.244.31.31
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
165.239.86.119
 unknown United States
11663 SUG-1US false
5.244.19.210
 unknown Saudi Arabia
34400 ASN-ETTIHADETISALATSA false
130.54.84.23
 unknown Japan 2504 NCA5KyotoUniversityJP false
170.118.73.33
 unknown United States
22347 DORSEY-WHITNEYUS false
176.19.203.160
 unknown Saudi Arabia
35819 MOBILY-ASEtihadEtisalatCompanyMobilySA false
161.39.253.196
 unknown United States
33039 EDMC-INTERNETUS false
115.138.191.90
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
116.210.56.138
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
37.27.50.214
 unknown Iran (ISLAMIC Republic Of)
39232 UNINETAZ false
9.83.27.251
 unknown United States
3356 LEVEL3US false
41.127.73.162
 unknown South Africa
16637 MTNNS-ASZA false
101.151.196.4
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
86.220.144.179
 unknown France
3215 FranceTelecom-OrangeFR false
163.61.118.43
 unknown unknown
2516 KDDIKDDICORPORATIONJP false
85.248.194.98
 unknown Slovakia (SLOVAK Republic)
5578 AS-BENESTRABratislavaSlovakRepublicSK false
51.124.254.246
 unknown United Kingdom
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
97.175.248.222
 unknown United States
6167 CELLCO-PARTUS false
120.104.151.57
 unknown Taiwan; Republic of China (ROC)
17716 NTU-TWNationalTaiwanUniversityTW false
31.147.210.3
 unknown Croatia (LOCAL Name: Hrvatska)
2108 CARNET-ASJMarohnica510000ZagrebHR false
77.129.234.33
 unknown France
15557 LDCOMNETFR false
21.150.238.109
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false

Contacted Domains

Name IP Active
catlovingfools.geek 37.49.226.105 true
shitrocket.dyn 86.107.100.19 true
hikvision.geek 80.78.26.121 true
catlovingfools.geek. [malformed] unknown unknown
hikvision.geek. [malformed] unknown unknown
shitrocket.dyn. [malformed] unknown unknown
catvision.dyn. [malformed] unknown unknown