Linux Analysis Report
nshkmips.elf

Overview

General Information

Sample name: nshkmips.elf
Analysis ID: 1579326
MD5: 3e28033a1dd0ba3934530dd900d53456
SHA1: ef4666b2655feade63925a546f2fc9e2a86269d7
SHA256: 4293af8935a04810c1a0edf22120d6780b8fc31cb9ed0e1ba6306fdff15e03c9
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: nshkmips.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: nshkmips.elf ReversingLabs: Detection: 28%

Networking
barindex
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: catvision.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: hikvision.geek. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: shitrocket.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: catlovingfools.geek. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:50198 -> 185.72.8.231:22580
Source: global traffic TCP traffic: 192.168.2.23:60036 -> 37.49.226.109:22580
Source: global traffic TCP traffic: 192.168.2.23:42762 -> 212.192.13.95:14150
Source: global traffic TCP traffic: 192.168.2.23:52828 -> 37.49.226.105:9370
Source: global traffic TCP traffic: 192.168.2.23:45836 -> 212.60.5.153:25142
Source: global traffic TCP traffic: 192.168.2.23:34050 -> 86.107.100.19:23660
Sample listens on a socket
Source: /tmp/nshkmips.elf (PID: 6259) Socket: 127.0.0.1:1172 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 104.25.171.131
Source: unknown TCP traffic detected without corresponding DNS query: 104.17.4.135
Source: unknown TCP traffic detected without corresponding DNS query: 186.215.114.193
Source: unknown TCP traffic detected without corresponding DNS query: 16.73.170.216
Source: unknown TCP traffic detected without corresponding DNS query: 120.95.114.196
Source: unknown TCP traffic detected without corresponding DNS query: 206.28.218.80
Source: unknown TCP traffic detected without corresponding DNS query: 130.54.202.32
Source: unknown TCP traffic detected without corresponding DNS query: 168.22.101.178
Source: unknown TCP traffic detected without corresponding DNS query: 46.5.99.231
Source: unknown TCP traffic detected without corresponding DNS query: 186.81.253.10
Source: unknown TCP traffic detected without corresponding DNS query: 159.140.96.55
Source: unknown TCP traffic detected without corresponding DNS query: 169.68.155.92
Source: unknown TCP traffic detected without corresponding DNS query: 23.82.42.148
Source: unknown TCP traffic detected without corresponding DNS query: 188.167.198.179
Source: unknown TCP traffic detected without corresponding DNS query: 146.247.58.7
Source: unknown TCP traffic detected without corresponding DNS query: 27.114.233.30
Source: unknown TCP traffic detected without corresponding DNS query: 196.8.137.154
Source: unknown TCP traffic detected without corresponding DNS query: 59.139.161.20
Source: unknown TCP traffic detected without corresponding DNS query: 37.150.51.168
Source: unknown TCP traffic detected without corresponding DNS query: 33.199.106.51
Source: unknown TCP traffic detected without corresponding DNS query: 139.81.50.188
Source: unknown TCP traffic detected without corresponding DNS query: 216.87.126.78
Source: unknown TCP traffic detected without corresponding DNS query: 165.235.34.112
Source: unknown TCP traffic detected without corresponding DNS query: 206.83.173.80
Source: unknown TCP traffic detected without corresponding DNS query: 137.173.27.178
Source: unknown TCP traffic detected without corresponding DNS query: 150.204.182.146
Source: unknown TCP traffic detected without corresponding DNS query: 134.232.191.45
Source: unknown TCP traffic detected without corresponding DNS query: 98.113.36.158
Source: unknown TCP traffic detected without corresponding DNS query: 198.203.44.219
Source: unknown TCP traffic detected without corresponding DNS query: 75.175.197.209
Source: unknown TCP traffic detected without corresponding DNS query: 29.232.107.63
Source: unknown TCP traffic detected without corresponding DNS query: 198.107.125.38
Source: unknown TCP traffic detected without corresponding DNS query: 214.94.83.25
Source: unknown TCP traffic detected without corresponding DNS query: 207.52.18.214
Source: unknown TCP traffic detected without corresponding DNS query: 204.238.232.4
Source: unknown TCP traffic detected without corresponding DNS query: 29.63.139.42
Source: unknown TCP traffic detected without corresponding DNS query: 141.99.59.119
Source: unknown TCP traffic detected without corresponding DNS query: 183.252.230.146
Source: unknown TCP traffic detected without corresponding DNS query: 43.119.233.181
Source: unknown TCP traffic detected without corresponding DNS query: 134.142.20.227
Source: unknown TCP traffic detected without corresponding DNS query: 7.237.31.12
Source: unknown TCP traffic detected without corresponding DNS query: 188.195.177.45
Source: unknown TCP traffic detected without corresponding DNS query: 34.176.139.214
Source: unknown TCP traffic detected without corresponding DNS query: 24.50.66.24
Source: unknown TCP traffic detected without corresponding DNS query: 118.64.83.218
Source: unknown TCP traffic detected without corresponding DNS query: 181.255.51.62
Source: unknown TCP traffic detected without corresponding DNS query: 215.121.91.12
Source: unknown TCP traffic detected without corresponding DNS query: 75.65.174.206
Source: unknown TCP traffic detected without corresponding DNS query: 114.108.235.49
Source: unknown TCP traffic detected without corresponding DNS query: 166.20.152.111
Source: global traffic DNS traffic detected: DNS query: catlovingfools.geek
Source: global traffic DNS traffic detected: DNS query: catvision.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: hikvision.geek
Source: global traffic DNS traffic detected: DNS query: shitrocket.dyn
Source: global traffic DNS traffic detected: DNS query: hikvision.geek. [malformed]
Source: global traffic DNS traffic detected: DNS query: shitrocket.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: catlovingfools.geek. [malformed]
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal68.troj.linELF@0/0@19/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/nshkmips.elf (PID: 6259) Queries kernel information via 'uname': Jump to behavior
Source: nshkmips.elf, 6259.1.000055d65cf20000.000055d65cfc9000.rw-.sdmp, nshkmips.elf, 6261.1.000055d65cf20000.000055d65cfc9000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mips
Source: nshkmips.elf, 6259.1.000055d65cf20000.000055d65cfc9000.rw-.sdmp, nshkmips.elf, 6261.1.000055d65cf20000.000055d65cfc9000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: nshkmips.elf, 6259.1.00007ffe96842000.00007ffe96863000.rw-.sdmp, nshkmips.elf, 6261.1.00007ffe96842000.00007ffe96863000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/nshkmips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nshkmips.elf
Source: nshkmips.elf, 6259.1.00007ffe96842000.00007ffe96863000.rw-.sdmp, nshkmips.elf, 6261.1.00007ffe96842000.00007ffe96863000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: nshkmips.elf, type: SAMPLE
Source: Yara match File source: 6259.1.00007fac30400000.00007fac30417000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6261.1.00007fac30400000.00007fac30417000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: nshkmips.elf, type: SAMPLE
Source: Yara match File source: 6259.1.00007fac30400000.00007fac30417000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6261.1.00007fac30400000.00007fac30417000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
184.36.195.27
 unknown United States
5778 CENTURYLINK-LEGACY-EMBARQ-RCMTUS false
154.128.84.152
 unknown Egypt
37069 MOBINILEG false
106.211.140.85
 unknown India
45609 BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService false
3.156.213.77
 unknown United States
16509 AMAZON-02US false
22.232.175.114
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
161.177.27.236
 unknown United States
10695 WAL-MARTUS false
181.136.190.142
 unknown Colombia
13489 EPMTelecomunicacionesSAESPCO false
82.79.101.254
 unknown Romania
8708 RCS-RDS73-75DrStaicoviciRO false
113.22.114.160
 unknown Viet Nam
18403 FPT-AS-APTheCorporationforFinancingPromotingTechnolo false
143.204.223.64
 unknown United States
16509 AMAZON-02US false
223.247.103.186
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
222.214.61.15
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
221.218.224.197
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
99.197.68.17
 unknown United States
7155 VIASAT-SP-BACKBONEUS false
48.89.81.191
 unknown United States
2686 ATGS-MMD-ASUS false
206.98.56.18
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
109.208.19.44
 unknown France
3215 FranceTelecom-OrangeFR false
62.91.213.250
 unknown Germany
20686 BISPINGISPCitycarrierGermanyDE false
79.203.74.171
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
123.252.200.70
 unknown India
17762 HTIL-TTML-IN-APTataTeleservicesMaharashtraLtdIN false
52.154.85.255
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
210.149.17.64
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
140.164.98.201
 unknown Italy
137 ASGARRConsortiumGARREU false
131.95.103.146
 unknown United States
16430 USMUS false
196.182.137.189
 unknown Cote D'ivoire
36974 AFNET-ASCI false
2.132.8.17
 unknown Kazakhstan
9198 KAZTELECOM-ASKZ false
115.249.22.236
 unknown India
18101 RELIANCE-COMMUNICATIONS-INRelianceCommunicationsLtdDAKC false
36.16.77.7
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
97.163.251.218
 unknown United States
6167 CELLCO-PARTUS false
112.111.94.13
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
41.240.121.74
 unknown Sudan
36998 SDN-MOBITELSD false
100.237.194.125
 unknown United States
21928 T-MOBILE-AS21928US false
195.217.26.155
 unknown United Kingdom
1699 ANS-1699-ASUS false
204.207.158.247
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
17.112.192.80
 unknown United States
714 APPLE-ENGINEERINGUS false
4.52.123.97
 unknown United States
3356 LEVEL3US false
213.228.151.235
 unknown Portugal
13156 AS13156PalmelaPT false
213.61.114.138
 unknown Germany
8220 COLTCOLTTechnologyServicesGroupLimitedGB false
176.170.212.93
 unknown France
5410 BOUYGTEL-ISPFR false
94.104.120.139
 unknown Belgium
47377 ORANGE_BELGIUM_SAKPNBelgiumBusinessNVhasbeenacquired false
65.43.159.249
 unknown United States
7018 ATT-INTERNET4US false
133.155.43.114
 unknown Japan 7524 HANSHINITECHANKYUHANSHINCOLTDJP false
61.144.54.199
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
184.98.240.205
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
191.255.128.146
 unknown Brazil
27699 TELEFONICABRASILSABR false
156.3.253.166
 unknown United States
2920 LACOEUS false
75.45.81.125
 unknown United States
7018 ATT-INTERNET4US false
122.36.44.43
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
98.33.187.15
 unknown United States
7922 COMCAST-7922US false
25.224.233.225
 unknown United Kingdom
7922 COMCAST-7922US false
54.153.44.160
 unknown United States
16509 AMAZON-02US false
179.134.252.223
 unknown Brazil
26599 TELEFONICABRASILSABR false
193.5.220.26
 unknown Switzerland
33845 SWISSGOVCH false
190.99.146.178
 unknown Colombia
10299 EMPRESASMUNICIPALESDECALIEICEESPCO false
70.189.167.240
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
93.171.146.226
 unknown Czech Republic
57016 ISTV-ASUZ false
151.203.213.55
 unknown United States
701 UUNETUS false
214.195.70.186
 unknown United States
721 DNIC-ASBLK-00721-00726US false
207.56.160.235
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
57.5.38.96
 unknown Belgium
2686 ATGS-MMD-ASUS false
140.77.41.65
 unknown France
1945 FR-LYRESLyonRechercheetEnseignementSuperieurLyRESE false
192.117.120.143
 unknown Israel
8551 BEZEQ-INTERNATIONAL-ASBezeqintInternetBackboneIL false
221.40.30.116
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
90.74.177.123
 unknown France
12479 UNI2-ASES false
191.92.238.158
 unknown Colombia
27831 ColombiaMovilCO false
13.22.154.195
 unknown United States
395959 XEROX-ELLUS false
167.42.203.24
 unknown Canada
2665 CDAGOVNCA false
125.247.125.240
 unknown Korea Republic of
38402 GOESW-AS-KRGyeonggiProvincialSuwonOfficeofEducationK false
8.245.171.238
 unknown United States
3356 LEVEL3US false
115.65.105.168
 unknown Japan 9595 XEPHIONNTT-MECorporationJP false
11.249.79.140
 unknown United States
3356 LEVEL3US false
124.132.61.143
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
66.245.26.107
 unknown United States
7029 WINDSTREAMUS false
85.176.81.195
 unknown Germany
6805 TDDE-ASN1DE false
161.225.9.106
 unknown United States
17052 TARGETUS false
21.98.81.37
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
41.45.223.177
 unknown Egypt
8452 TE-ASTE-ASEG false
103.94.15.33
 unknown China
131578 BFSUNETBeijingForeignStudiesUniversityCN false
141.163.202.19
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
90.202.191.170
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
146.101.58.56
 unknown United Kingdom
1290 TELSTRAEUROPELTD-BACKBONETelstraEuropeLtdEU false
58.210.192.105
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
44.160.206.59
 unknown United States
7377 UCSDUS false
197.86.54.152
 unknown South Africa
10474 OPTINETZA false
5.130.59.99
 unknown Russian Federation
31200 NTKIPv6customersRU false
37.94.1.229
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
134.157.171.175
 unknown France
1307 FR-U-JUSSIEU-PARISEU false
118.169.114.189
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
138.89.159.215
 unknown United States
701 UUNETUS false
83.203.128.186
 unknown France
3215 FranceTelecom-OrangeFR false
125.195.176.48
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
140.77.41.41
 unknown France
1945 FR-LYRESLyonRechercheetEnseignementSuperieurLyRESE false
126.249.149.72
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
203.221.37.117
 unknown Australia
9942 COMINDICO-APSOULConvergedCommunicationsAustraliaAU false
150.8.121.97
 unknown Japan 6400 CompaniaDominicanadeTelefonosSADO false
162.198.231.155
 unknown United States
7018 ATT-INTERNET4US false
83.184.232.27
 unknown Sweden
1257 TELE2EU false
135.248.251.27
 unknown United States
10455 LUCENT-CIOUS false
220.170.81.178
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
148.26.55.143
 unknown United States
6400 CompaniaDominicanadeTelefonosSADO false

Contacted Domains

Name IP Active
catlovingfools.geek 185.72.8.231 true
shitrocket.dyn 37.49.226.105 true
catlovingfools.geek. [malformed] unknown unknown
hikvision.geek. [malformed] unknown unknown
shitrocket.dyn. [malformed] unknown unknown
catvision.dyn. [malformed] unknown unknown
hikvision.geek unknown unknown