Linux Analysis Report
hmips.elf

Overview

General Information

Sample name: hmips.elf
Analysis ID: 1579318
MD5: 23a0598f20eedd3be23be91892dea3a7
SHA1: 337b56ae51839bfbf6c2c5ed7556b5f6569bdd77
SHA256: 874a3ac4fd35321b47b7c4f6a3de963f239ef599fca5e4ee0fbda832b2ade89c
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: hmips.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: hmips.elf Virustotal: Detection: 28% Perma Link
Source: hmips.elf ReversingLabs: Detection: 26%

Networking
barindex
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: hikvision.geek. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: catvision.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: catlovingfools.geek. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: shitrocket.dyn. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:34602 -> 212.64.215.71:10982
Source: global traffic TCP traffic: 192.168.2.13:36624 -> 86.107.100.19:10982
Source: global traffic TCP traffic: 192.168.2.13:40628 -> 176.32.32.113:21073
Source: global traffic TCP traffic: 192.168.2.13:51614 -> 80.78.26.121:8855
Source: global traffic TCP traffic: 192.168.2.13:38650 -> 37.49.226.109:24159
Sample listens on a socket
Source: /tmp/hmips.elf (PID: 5450) Socket: 127.0.0.1:1172 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443
Source: unknown TCP traffic detected without corresponding DNS query: 199.36.208.196
Source: unknown TCP traffic detected without corresponding DNS query: 53.215.134.45
Source: unknown TCP traffic detected without corresponding DNS query: 141.174.219.134
Source: unknown TCP traffic detected without corresponding DNS query: 158.160.208.80
Source: unknown TCP traffic detected without corresponding DNS query: 140.67.74.83
Source: unknown TCP traffic detected without corresponding DNS query: 99.9.167.127
Source: unknown TCP traffic detected without corresponding DNS query: 213.240.133.81
Source: unknown TCP traffic detected without corresponding DNS query: 174.83.174.67
Source: unknown TCP traffic detected without corresponding DNS query: 115.90.11.198
Source: unknown TCP traffic detected without corresponding DNS query: 22.150.183.214
Source: unknown TCP traffic detected without corresponding DNS query: 45.8.208.63
Source: unknown TCP traffic detected without corresponding DNS query: 31.171.235.229
Source: unknown TCP traffic detected without corresponding DNS query: 45.171.194.43
Source: unknown TCP traffic detected without corresponding DNS query: 78.230.249.96
Source: unknown TCP traffic detected without corresponding DNS query: 162.76.103.227
Source: unknown TCP traffic detected without corresponding DNS query: 104.66.22.217
Source: unknown TCP traffic detected without corresponding DNS query: 77.75.209.20
Source: unknown TCP traffic detected without corresponding DNS query: 95.37.228.222
Source: unknown TCP traffic detected without corresponding DNS query: 67.119.41.66
Source: unknown TCP traffic detected without corresponding DNS query: 198.139.100.42
Source: unknown TCP traffic detected without corresponding DNS query: 107.250.203.85
Source: unknown TCP traffic detected without corresponding DNS query: 22.122.93.126
Source: unknown TCP traffic detected without corresponding DNS query: 130.205.45.134
Source: unknown TCP traffic detected without corresponding DNS query: 44.19.69.54
Source: unknown TCP traffic detected without corresponding DNS query: 22.134.233.203
Source: unknown TCP traffic detected without corresponding DNS query: 78.149.222.56
Source: unknown TCP traffic detected without corresponding DNS query: 112.18.186.239
Source: unknown TCP traffic detected without corresponding DNS query: 172.154.98.40
Source: unknown TCP traffic detected without corresponding DNS query: 149.171.40.43
Source: unknown TCP traffic detected without corresponding DNS query: 28.245.255.24
Source: unknown TCP traffic detected without corresponding DNS query: 38.75.140.123
Source: unknown TCP traffic detected without corresponding DNS query: 149.236.108.228
Source: unknown TCP traffic detected without corresponding DNS query: 89.196.182.162
Source: unknown TCP traffic detected without corresponding DNS query: 162.242.191.22
Source: unknown TCP traffic detected without corresponding DNS query: 206.176.202.236
Source: unknown TCP traffic detected without corresponding DNS query: 180.178.84.144
Source: unknown TCP traffic detected without corresponding DNS query: 64.161.226.250
Source: unknown TCP traffic detected without corresponding DNS query: 27.171.214.123
Source: unknown TCP traffic detected without corresponding DNS query: 170.205.130.252
Source: unknown TCP traffic detected without corresponding DNS query: 180.152.242.221
Source: unknown TCP traffic detected without corresponding DNS query: 4.86.4.87
Source: unknown TCP traffic detected without corresponding DNS query: 136.47.138.254
Source: unknown TCP traffic detected without corresponding DNS query: 143.244.36.131
Source: unknown TCP traffic detected without corresponding DNS query: 172.2.70.178
Source: unknown TCP traffic detected without corresponding DNS query: 100.153.77.22
Source: unknown TCP traffic detected without corresponding DNS query: 53.21.177.188
Source: unknown TCP traffic detected without corresponding DNS query: 202.155.208.72
Source: unknown TCP traffic detected without corresponding DNS query: 220.4.71.27
Source: unknown TCP traffic detected without corresponding DNS query: 86.108.78.35
Source: unknown TCP traffic detected without corresponding DNS query: 99.18.70.233
Source: global traffic DNS traffic detected: DNS query: hikvision.geek
Source: global traffic DNS traffic detected: DNS query: catlovingfools.geek
Source: global traffic DNS traffic detected: DNS query: hikvision.geek. [malformed]
Source: global traffic DNS traffic detected: DNS query: catvision.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: catlovingfools.geek. [malformed]
Source: global traffic DNS traffic detected: DNS query: shitrocket.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: shitrocket.dyn
Source: unknown Network traffic detected: HTTP traffic on port 48202 -> 443
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal68.troj.linELF@0/0@31/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/hmips.elf (PID: 5450) Queries kernel information via 'uname': Jump to behavior
Source: hmips.elf, 5450.1.00007ffe4d0e3000.00007ffe4d104000.rw-.sdmp, hmips.elf, 5452.1.00007ffe4d0e3000.00007ffe4d104000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/hmips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/hmips.elf
Source: hmips.elf, 5450.1.00005610a5572000.00005610a563f000.rw-.sdmp, hmips.elf, 5452.1.00005610a5572000.00005610a563f000.rw-.sdmp Binary or memory string: /etc/qemu-binfmtP /usr/libexec/goa-daemonQ0
Source: hmips.elf, 5450.1.00005610a5572000.00005610a563f000.rw-.sdmp, hmips.elf, 5452.1.00005610a5572000.00005610a563f000.rw-.sdmp Binary or memory string: V!/etc/qemu-binfmt/mips
Source: hmips.elf, 5450.1.00005610a5572000.00005610a563f000.rw-.sdmp, hmips.elf, 5452.1.00005610a5572000.00005610a563f000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: hmips.elf, 5452.1.00005610a5572000.00005610a563f000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: hmips.elf, 5450.1.00005610a5572000.00005610a563f000.rw-.sdmp, hmips.elf, 5452.1.00005610a5572000.00005610a563f000.rw-.sdmp Binary or memory string: /etc/qemu-binfmtP
Source: hmips.elf, 5450.1.00007ffe4d0e3000.00007ffe4d104000.rw-.sdmp, hmips.elf, 5452.1.00007ffe4d0e3000.00007ffe4d104000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips
Source: hmips.elf, 5452.1.00005610a5572000.00005610a563f000.rw-.sdmp Binary or memory string: V0!/usr/bin/vmtoolsd

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: hmips.elf, type: SAMPLE
Source: Yara match File source: 5452.1.00007fde8c400000.00007fde8c414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5450.1.00007fde8c400000.00007fde8c414000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: hmips.elf, type: SAMPLE
Source: Yara match File source: 5452.1.00007fde8c400000.00007fde8c414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5450.1.00007fde8c400000.00007fde8c414000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
4.225.37.60
 unknown United States
3356 LEVEL3US false
186.120.219.21
 unknown Dominican Republic
28118 ALTICEDOMINICANASADO false
87.227.191.162
 unknown Bulgaria
29580 HOMELAN-ASBG false
137.163.10.207
 unknown Finland
719 ELISA-ASHelsinkiFinlandEU false
160.21.176.231
 unknown Japan 45194 SIPL-ASSysconInfowayPvtLtdIN false
171.130.11.96
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
78.78.18.221
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
158.2.72.190
 unknown United States
1541 DNIC-ASBLK-01534-01546US false
143.39.72.214
 unknown United States
11003 PANDGUS false
92.49.241.175
 unknown Kazakhstan
21299 KAR-TEL-ASAlmatyRepublicofKazakhstanKZ false
15.182.20.203
 unknown United States
71 HP-INTERNET-ASUS false
221.170.13.60
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
151.50.46.132
 unknown Italy
1267 ASN-WINDTREIUNETEU false
75.90.52.188
 unknown United States
7029 WINDSTREAMUS false
204.119.210.149
 unknown United States
11404 AS-WAVE-1US false
206.64.5.121
 unknown United States
701 UUNETUS false
117.251.253.224
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
62.168.37.195
 unknown Czech Republic
5588 GTSCEGTSCentralEuropeAntelGermanyCZ false
185.15.150.37
 unknown Spain
199930 WIFIBALEARES-ASCSabaters13ES false
13.19.50.41
 unknown United States
26662 XEROX-WVUS false
139.247.91.89
 unknown United States
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
196.67.151.72
 unknown Morocco
6713 IAM-ASMA false
158.23.145.83
 unknown United States
1504 DNIC-AS-01504US false
30.239.82.66
 unknown United States
7922 COMCAST-7922US false
60.61.209.132
 unknown Japan 9824 JTCL-JP-ASJupiterTelecommunicationCoLtdJP false
36.2.53.18
 unknown Japan 2519 VECTANTARTERIANetworksCorporationJP false
210.62.225.38
 unknown Taiwan; Republic of China (ROC)
1659 ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationC false
132.38.18.198
 unknown United States
385 AFCONC-BLOCK1-ASUS false
159.50.239.225
 unknown France
25215 BNP-PARIBASFranceFR false
65.180.56.241
 unknown United States
1239 SPRINTLINKUS false
71.32.64.38
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
140.13.56.183
 unknown United States
23700 FASTNET-AS-IDLinknet-FastnetASNID false
64.105.229.216
 unknown United States
18566 MEGAPATH5-US false
166.180.21.250
 unknown United States
22394 CELLCOUS false
23.243.134.216
 unknown United States
20001 TWC-20001-PACWESTUS false
52.166.110.242
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
121.21.224.82
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
163.61.118.86
 unknown unknown
2516 KDDIKDDICORPORATIONJP false
68.61.146.250
 unknown United States
7922 COMCAST-7922US false
2.175.19.208
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
160.13.29.240
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
73.152.2.133
 unknown United States
7922 COMCAST-7922US false
34.155.7.5
 unknown United States
2686 ATGS-MMD-ASUS false
98.112.164.72
 unknown United States
7018 ATT-INTERNET4US false
171.188.4.155
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
160.79.21.175
 unknown United States
24867 ADAPT-ASGB false
31.193.7.88
 unknown United Kingdom
61323 UKFASTGB false
57.46.60.122
 unknown Belgium
2686 ATGS-MMD-ASUS false
24.166.104.231
 unknown United States
10796 TWC-10796-MIDWESTUS false
108.47.6.223
 unknown United States
5650 FRONTIER-FRTRUS false
142.155.73.183
 unknown Canada
26677 ORION-ASNCA false
78.30.37.130
 unknown Spain
15704 AS15704ES false
223.178.172.254
 unknown India
45609 BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService false
208.52.153.6
 unknown United States
22626 VCI-22626US false
2.55.79.6
 unknown Israel
12400 PARTNER-ASIL false
152.172.143.220
 unknown Chile
7418 TELEFONICACHILESACL false
197.193.232.153
 unknown Egypt
36992 ETISALAT-MISREG false
100.10.116.10
 unknown United States
701 UUNETUS false
98.227.119.45
 unknown United States
7922 COMCAST-7922US false
212.84.77.129
 unknown United Kingdom
198382 FIRSTEASY-ASGB false
78.142.169.228
 unknown Austria
8437 UTA-ASAT false
217.181.57.6
 unknown United Kingdom
5503 RMIFLGB false
192.122.105.185
 unknown United Kingdom
393825 BOZZ-275-CTUS false
80.10.85.222
 unknown France
8376 JordanDataCommunicationsJO false
102.91.140.172
 unknown Nigeria
29465 VCG-ASNG false
24.174.189.95
 unknown United States
11426 TWC-11426-CAROLINASUS false
55.162.59.189
 unknown United States
1541 DNIC-ASBLK-01534-01546US false
64.105.204.80
 unknown United States
18566 MEGAPATH5-US false
110.90.175.223
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
43.51.167.141
 unknown Japan 4249 LILLY-ASUS false
78.156.45.12
 unknown Czech Republic
43507 RETE-ASCZ false
213.192.201.234
 unknown Spain
12541 BTESPANABTESDatacenterandhostingASNES false
87.143.41.143
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
62.52.13.65
 unknown Germany
6805 TDDE-ASN1DE false
3.157.62.206
 unknown United States
16509 AMAZON-02US false
17.179.11.128
 unknown United States
714 APPLE-ENGINEERINGUS false
159.226.170.237
 unknown China
7497 CSTNET-AS-APComputerNetworkInformationCenterCN false
106.236.42.47
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
134.212.196.32
 unknown France
1715 FR-REMIP2000REMIP2000AutonomousSystemEU false
53.171.229.233
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
28.170.143.239
 unknown United States
7922 COMCAST-7922US false
66.191.128.26
 unknown United States
20115 CHARTER-20115US false
91.243.156.131
 unknown Spain
12479 UNI2-ASES false
4.45.110.66
 unknown United States
3356 LEVEL3US false
150.169.40.191
 unknown United States
21982 PRDCA-ASNUS false
196.53.248.77
 unknown South Africa
56309 SIAMDATA-TH408Fl4CATTOWERTH false
119.35.15.199
 unknown China
17622 CNCGROUP-GZChinaUnicomGuangzhounetworkCN false
184.14.180.146
 unknown United States
7011 FRONTIER-AND-CITIZENSUS false
110.97.187.236
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
73.255.61.194
 unknown United States
7922 COMCAST-7922US false
178.76.5.157
 unknown Azerbaijan
1299 TELIANETTeliaCarrierEU false
84.73.147.179
 unknown Switzerland
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
54.108.73.117
 unknown United States
16509 AMAZON-02US false
134.235.6.107
 unknown United States
1586 DNIC-ASBLK-01550-01601US false
207.173.87.57
 unknown United States
7385 ALLSTREAMUS false
55.232.85.29
 unknown United States
306 DNIC-ASBLK-00306-00371US false
55.103.124.200
 unknown United States
361 DNIC-ASBLK-00306-00371US false
142.93.67.128
 unknown United States
14061 DIGITALOCEAN-ASNUS false
137.225.74.189
 unknown United States
1103 SURFNET-NLSURFnetTheNetherlandsNL false
141.228.126.2
 unknown United Kingdom
12701 BARCAPLondonGB false

Contacted Domains

Name IP Active
catlovingfools.geek 86.107.100.19 true
shitrocket.dyn 86.107.100.19 true
hikvision.geek 212.64.215.71 true
catlovingfools.geek. [malformed] unknown unknown
hikvision.geek. [malformed] unknown unknown
shitrocket.dyn. [malformed] unknown unknown
catvision.dyn. [malformed] unknown unknown