Linux Analysis Report
star.ppc.elf

Overview

General Information

Sample name: star.ppc.elf
Analysis ID: 1579327
MD5: a8dac61ba4ca08c8977efab192a3f758
SHA1: 86afe5274e194567c460f8fd5abba67ec355a688
SHA256: 411d55babe206ce7853a5cae6dba6d26ffd39cc2a3d48e5b29912aff4639f584
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai, Moobot
Score: 88
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Moobot
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
Name Description Attribution Blogpost URLs Link
MooBot No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: star.ppc.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: star.ppc.elf Virustotal: Detection: 58% Perma Link
Source: star.ppc.elf ReversingLabs: Detection: 71%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:51880 -> 209.141.47.117:1999
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 209.141.47.117
Source: unknown TCP traffic detected without corresponding DNS query: 24.130.178.164
Source: unknown TCP traffic detected without corresponding DNS query: 78.150.226.164
Source: unknown TCP traffic detected without corresponding DNS query: 24.104.198.96
Source: unknown TCP traffic detected without corresponding DNS query: 36.82.37.7
Source: unknown TCP traffic detected without corresponding DNS query: 136.230.66.160
Source: unknown TCP traffic detected without corresponding DNS query: 252.51.66.101
Source: unknown TCP traffic detected without corresponding DNS query: 188.223.246.233
Source: unknown TCP traffic detected without corresponding DNS query: 16.8.142.133
Source: unknown TCP traffic detected without corresponding DNS query: 248.250.112.132
Source: unknown TCP traffic detected without corresponding DNS query: 63.8.22.52
Source: unknown TCP traffic detected without corresponding DNS query: 37.13.243.160
Source: unknown TCP traffic detected without corresponding DNS query: 185.128.70.16
Source: unknown TCP traffic detected without corresponding DNS query: 193.200.241.62
Source: unknown TCP traffic detected without corresponding DNS query: 13.236.133.19
Source: unknown TCP traffic detected without corresponding DNS query: 57.203.187.15
Source: unknown TCP traffic detected without corresponding DNS query: 125.101.235.41
Source: unknown TCP traffic detected without corresponding DNS query: 154.18.160.222
Source: unknown TCP traffic detected without corresponding DNS query: 142.228.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 16.3.24.124
Source: unknown TCP traffic detected without corresponding DNS query: 62.119.58.82
Source: unknown TCP traffic detected without corresponding DNS query: 174.62.85.105
Source: unknown TCP traffic detected without corresponding DNS query: 155.29.53.49
Source: unknown TCP traffic detected without corresponding DNS query: 142.89.107.160
Source: unknown TCP traffic detected without corresponding DNS query: 240.235.184.246
Source: unknown TCP traffic detected without corresponding DNS query: 145.113.180.241
Source: unknown TCP traffic detected without corresponding DNS query: 154.123.46.209
Source: unknown TCP traffic detected without corresponding DNS query: 179.140.140.84
Source: unknown TCP traffic detected without corresponding DNS query: 180.171.106.80
Source: unknown TCP traffic detected without corresponding DNS query: 38.51.65.115
Source: unknown TCP traffic detected without corresponding DNS query: 221.98.233.140
Source: unknown TCP traffic detected without corresponding DNS query: 196.100.220.24
Source: unknown TCP traffic detected without corresponding DNS query: 76.145.172.163
Source: unknown TCP traffic detected without corresponding DNS query: 61.152.241.211
Source: unknown TCP traffic detected without corresponding DNS query: 71.253.222.37
Source: unknown TCP traffic detected without corresponding DNS query: 203.150.72.46
Source: unknown TCP traffic detected without corresponding DNS query: 244.91.200.75
Source: unknown TCP traffic detected without corresponding DNS query: 174.123.83.80
Source: unknown TCP traffic detected without corresponding DNS query: 93.134.11.204
Source: unknown TCP traffic detected without corresponding DNS query: 169.129.182.194
Source: unknown TCP traffic detected without corresponding DNS query: 204.253.247.230
Source: unknown TCP traffic detected without corresponding DNS query: 85.255.28.69
Source: unknown TCP traffic detected without corresponding DNS query: 83.202.18.154
Source: unknown TCP traffic detected without corresponding DNS query: 53.46.207.70
Source: unknown TCP traffic detected without corresponding DNS query: 63.169.189.181
Source: unknown TCP traffic detected without corresponding DNS query: 156.163.18.50
Source: unknown TCP traffic detected without corresponding DNS query: 202.61.27.94
Source: unknown TCP traffic detected without corresponding DNS query: 192.87.100.104
Source: unknown TCP traffic detected without corresponding DNS query: 68.164.216.85
Source: unknown TCP traffic detected without corresponding DNS query: 107.187.75.171
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: star.ppc.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: star.ppc.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: star.ppc.elf, type: SAMPLE Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6246.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6246.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6246.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6259.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6259.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6259.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6243.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6243.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6243.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: Process Memory Space: star.ppc.elf PID: 6243, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: star.ppc.elf PID: 6243, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: star.ppc.elf PID: 6246, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: star.ppc.elf PID: 6246, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: star.ppc.elf PID: 6259, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: star.ppc.elf PID: 6259, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Yara signature match
Source: star.ppc.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: star.ppc.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: star.ppc.elf, type: SAMPLE Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6246.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6246.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6246.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6259.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6259.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6259.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6243.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6243.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6243.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: Process Memory Space: star.ppc.elf PID: 6243, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: star.ppc.elf PID: 6243, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: star.ppc.elf PID: 6246, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: star.ppc.elf PID: 6246, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: star.ppc.elf PID: 6259, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: star.ppc.elf PID: 6259, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: classification engine Classification label: mal88.troj.linELF@0/0@0/0
Enumerates processes within the "proc" file system
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/6230/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/6196/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1582/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/2033/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/2275/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/3088/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1612/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1579/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1699/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1335/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1698/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/2028/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1334/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1576/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/2302/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/3236/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/2025/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/2146/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/910/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/4444/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/4445/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/912/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/4446/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/517/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/759/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/4447/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/6228/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/6349/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/2307/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/918/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/6245/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1594/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/2285/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/2281/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1349/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1623/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/761/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1622/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/884/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1983/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/2038/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1344/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1465/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1586/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1860/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1463/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/2156/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/800/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/801/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1629/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1627/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1900/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/6257/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/3021/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/491/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/2294/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/2050/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1877/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/4507/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/772/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1633/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/4509/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1599/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1632/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/774/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1477/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/654/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/896/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1476/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1872/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/2048/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/655/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1475/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/2289/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/656/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/777/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/657/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/658/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/4501/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/419/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/936/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1639/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1638/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/2208/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/2180/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/6263/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1809/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1494/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1890/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/2063/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/2062/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/6261/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1888/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1886/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/420/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1489/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/785/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1642/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/788/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/667/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/789/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/6259/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/1648/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/2078/cmdline Jump to behavior
Source: /tmp/star.ppc.elf (PID: 6251) File opened: /proc/2077/cmdline Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/star.ppc.elf (PID: 6243) Queries kernel information via 'uname': Jump to behavior
Source: star.ppc.elf, 6243.1.0000558c22c1a000.0000558c22cca000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: star.ppc.elf, 6246.1.0000558c22c1a000.0000558c22cca000.rw-.sdmp, star.ppc.elf, 6259.1.0000558c22c1a000.0000558c22cca000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: star.ppc.elf, 6243.1.0000558c22c1a000.0000558c22cca000.rw-.sdmp, star.ppc.elf, 6246.1.0000558c22c1a000.0000558c22cca000.rw-.sdmp, star.ppc.elf, 6259.1.0000558c22c1a000.0000558c22cca000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: star.ppc.elf, 6243.1.00007ffe0af6a000.00007ffe0af8b000.rw-.sdmp, star.ppc.elf, 6246.1.00007ffe0af6a000.00007ffe0af8b000.rw-.sdmp, star.ppc.elf, 6259.1.00007ffe0af6a000.00007ffe0af8b000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc
Source: star.ppc.elf, 6243.1.00007ffe0af6a000.00007ffe0af8b000.rw-.sdmp, star.ppc.elf, 6246.1.00007ffe0af6a000.00007ffe0af8b000.rw-.sdmp, star.ppc.elf, 6259.1.00007ffe0af6a000.00007ffe0af8b000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/star.ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/star.ppc.elf

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: star.ppc.elf, type: SAMPLE
Source: Yara match File source: 6246.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6259.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6243.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: star.ppc.elf PID: 6243, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: star.ppc.elf PID: 6246, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: star.ppc.elf PID: 6259, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: star.ppc.elf, type: SAMPLE
Source: Yara match File source: 6246.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6259.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6243.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: star.ppc.elf PID: 6246, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: star.ppc.elf, type: SAMPLE
Source: Yara match File source: 6246.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6259.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6243.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: star.ppc.elf PID: 6243, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: star.ppc.elf PID: 6246, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: star.ppc.elf PID: 6259, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: star.ppc.elf, type: SAMPLE
Source: Yara match File source: 6246.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6259.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6243.1.00007f4d2c001000.00007f4d2c016000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: star.ppc.elf PID: 6246, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
147.17.10.242
 unknown United States
10796 TWC-10796-MIDWESTUS false
2.176.227.165
 unknown Iran (ISLAMIC Republic Of)
12880 DCI-ASIR false
135.129.34.140
 unknown United States
14962 NCR-252US false
17.184.93.75
 unknown United States
714 APPLE-ENGINEERINGUS false
112.96.223.206
 unknown China
17622 CNCGROUP-GZChinaUnicomGuangzhounetworkCN false
95.109.203.229
 unknown Ukraine
34610 RIKSNETSE false
95.141.150.159
 unknown United Kingdom
35104 KTC-ASKZ false
211.195.220.55
 unknown Korea Republic of
10056 HDMF-ASHyundaiMarinFireInsuranceKR false
203.230.188.83
 unknown Korea Republic of
45377 JJE-AS-KRJejuSpecialSelfGoverningProvincialofficeofE false
17.54.111.128
 unknown United States
714 APPLE-ENGINEERINGUS false
149.251.118.36
 unknown France
15854 HP_WEBSERVICESDE false
252.96.91.248
 unknown Reserved
unknown unknown false
104.1.228.69
 unknown United States
7018 ATT-INTERNET4US false
114.30.219.94
 unknown Korea Republic of
38121 UPASSTV-AS-KRLGHelloVisionCorpKR false
125.4.75.172
 unknown Japan 9617 ZAQJupiterTelecommunicationsCoLtdJP false
27.110.107.25
 unknown Japan 23783 CNACableNetworksAkitaColtdJP false
4.74.225.7
 unknown United States
3356 LEVEL3US false
155.111.136.60
 unknown United States
61153 PROCTERGAMBLENCSCDE false
39.252.1.175
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
253.30.98.150
 unknown Reserved
unknown unknown false
162.131.92.246
 unknown United States
6319 MARRIOT-ASNUS false
46.240.239.166
 unknown Serbia
31042 SERBIA-BROADBAND-ASSerbiaBroadBand-SrpskeKablovskemreze false
107.11.69.61
 unknown United States
10796 TWC-10796-MIDWESTUS false
1.20.112.60
 unknown Thailand
23969 TOT-NETTOTPublicCompanyLimitedTH false
92.197.36.36
 unknown Germany
20676 PLUSNETDE false
100.204.1.81
 unknown United States
21928 T-MOBILE-AS21928US false
176.244.184.224
 unknown Italy
30722 VODAFONE-IT-ASNIT false
182.191.221.213
 unknown Pakistan
45595 PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK false
41.69.27.237
 unknown Egypt
24835 RAYA-ASEG false
12.229.3.184
 unknown United States
7018 ATT-INTERNET4US false
248.143.70.49
 unknown Reserved
unknown unknown false
248.61.193.226
 unknown Reserved
unknown unknown false
209.115.220.94
 unknown Canada
3359 U-ALBERTACA false
42.109.112.67
 unknown India
38266 VODAFONE-INVodafoneIndiaLtdIN false
186.150.137.81
 unknown Dominican Republic
28118 ALTICEDOMINICANASADO false
86.36.37.139
 unknown Qatar
29384 QATAR-FOUNDATIONQA false
147.112.32.96
 unknown Norway
766 REDIRISRedIRISAutonomousSystemES false
19.244.163.80
 unknown United States
3 MIT-GATEWAYSUS false
201.224.84.195
 unknown Panama
11556 CableWirelessPanamaPA false
61.21.237.104
 unknown Japan 9824 JTCL-JP-ASJupiterTelecommunicationCoLtdJP false
107.206.41.240
 unknown United States
7018 ATT-INTERNET4US false
241.244.47.192
 unknown Reserved
unknown unknown false
117.103.187.102
 unknown Japan 2914 NTT-COMMUNICATIONS-2914US false
216.97.119.65
 unknown United States
54489 CORESPACE-DALUS false
206.111.6.229
 unknown United States
2828 XO-AS15US false
76.223.52.162
 unknown United States
16509 AMAZON-02US false
192.56.173.25
 unknown United States
20804 ASN-TELENERGOulPERKUNA47WARSZAWAPL false
115.56.236.189
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
175.210.224.148
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
97.207.132.254
 unknown United States
6167 CELLCO-PARTUS false
243.71.228.155
 unknown Reserved
unknown unknown false
108.121.222.219
 unknown United States
10507 SPCSUS false
188.0.135.48
 unknown Kazakhstan
35104 KTC-ASKZ false
66.71.119.151
 unknown United States
3999 PENN-STATEUS false
153.173.218.91
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
112.50.14.17
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
149.201.100.57
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
183.65.247.236
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
179.232.223.43
 unknown Brazil
28573 CLAROSABR false
62.45.21.194
 unknown Netherlands
15435 KABELFOONDELTAFiberNederlandNL false
145.201.252.230
 unknown Netherlands
1101 IP-EEND-ASIP-EENDBVNL false
59.113.149.248
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
186.105.18.237
 unknown Chile
7418 TELEFONICACHILESACL false
76.239.239.45
 unknown United States
7018 ATT-INTERNET4US false
20.183.46.189
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
160.27.18.221
 unknown Japan 9371 SAKURA-CSAKURAInternetIncJP false
148.59.3.194
 unknown United States
2015 MSEN-SYSTEMUS false
254.93.44.213
 unknown Reserved
unknown unknown false
86.110.156.6
 unknown Italy
21309 CASAWEB-ASViaMolinoRosso8IMOLABOITALYIT false
155.170.56.9
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
221.239.50.101
 unknown China
17638 CHINATELECOM-TJ-AS-APASNforTIANJINProvincialNetofCT false
197.22.223.242
 unknown Tunisia
37693 TUNISIANATN false
13.137.183.133
 unknown United States
7018 ATT-INTERNET4US false
181.255.203.28
 unknown Colombia
26611 COMCELSACO false
27.185.35.39
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
12.18.96.173
 unknown United States
17064 TISD-VICUS false
124.92.224.234
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
155.170.172.233
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
90.135.166.78
 unknown Sweden
1257 TELE2EU false
20.246.190.14
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
92.100.125.77
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
112.141.166.114
 unknown Australia
9443 VOCUS-RETAIL-AUVocusRetailAU false
150.179.29.132
 unknown United States
3479 PEACHNET-AS1US false
48.122.154.194
 unknown United States
2686 ATGS-MMD-ASUS false
254.41.236.37
 unknown Reserved
unknown unknown false
135.214.238.148
 unknown United States
797 AMERITECH-ASUS false
249.239.36.235
 unknown Reserved
unknown unknown false
244.237.209.217
 unknown Reserved
unknown unknown false
220.22.134.86
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
99.173.65.11
 unknown United States
7018 ATT-INTERNET4US false
64.50.77.216
 unknown United States
2828 XO-AS15US false
19.133.220.71
 unknown United States
3 MIT-GATEWAYSUS false
67.110.124.153
 unknown United States
2828 XO-AS15US false
36.177.111.225
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
170.226.234.212
 unknown United States
11685 HNBCOL-ASUS false
45.54.134.116
 unknown United States
10405 UPRR-ASN-01US false
100.13.73.28
 unknown United States
5650 FRONTIER-FRTRUS false
116.161.49.247
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
101.217.64.72
 unknown India
58519 CHINATELECOM-CTCLOUDCloudComputingCorporationCN false
152.10.107.176
 unknown United States
81 NCRENUS false