Linux Analysis Report
nshppc.elf

Overview

General Information

Sample name: nshppc.elf
Analysis ID: 1579337
MD5: b87032c64e9c4472e2937c7f170786b5
SHA1: 451f03dc2bad06f3f6adf41fbc704ee43f85e6b8
SHA256: 32f9b3b1df6036110462c39c7882be3d532cd738c8d2769e4cd86c89001d4666
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: nshppc.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: nshppc.elf ReversingLabs: Detection: 31%

Networking
barindex
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: catvision.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: hikvision.geek. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: shitrocket.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: catlovingfools.geek. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:58444 -> 176.32.32.113:13759
Source: global traffic TCP traffic: 192.168.2.23:40648 -> 80.78.26.121:13759
Source: global traffic TCP traffic: 192.168.2.23:55450 -> 212.192.13.95:1525
Source: global traffic TCP traffic: 192.168.2.23:58958 -> 212.60.5.153:1525
Source: global traffic TCP traffic: 192.168.2.23:45050 -> 212.64.215.71:11426
Source: global traffic TCP traffic: 192.168.2.23:54414 -> 86.107.100.19:21252
Sample listens on a socket
Source: /tmp/nshppc.elf (PID: 6238) Socket: 127.0.0.1:1172 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 147.37.132.142
Source: unknown TCP traffic detected without corresponding DNS query: 173.11.37.105
Source: unknown TCP traffic detected without corresponding DNS query: 59.2.50.173
Source: unknown TCP traffic detected without corresponding DNS query: 113.149.52.32
Source: unknown TCP traffic detected without corresponding DNS query: 80.228.45.87
Source: unknown TCP traffic detected without corresponding DNS query: 75.44.188.238
Source: unknown TCP traffic detected without corresponding DNS query: 4.101.21.230
Source: unknown TCP traffic detected without corresponding DNS query: 186.68.160.114
Source: unknown TCP traffic detected without corresponding DNS query: 14.97.232.237
Source: unknown TCP traffic detected without corresponding DNS query: 179.7.80.140
Source: unknown TCP traffic detected without corresponding DNS query: 186.3.27.196
Source: unknown TCP traffic detected without corresponding DNS query: 131.172.73.252
Source: unknown TCP traffic detected without corresponding DNS query: 132.131.18.58
Source: unknown TCP traffic detected without corresponding DNS query: 54.153.227.204
Source: unknown TCP traffic detected without corresponding DNS query: 41.179.34.69
Source: unknown TCP traffic detected without corresponding DNS query: 212.188.72.68
Source: unknown TCP traffic detected without corresponding DNS query: 153.108.255.186
Source: unknown TCP traffic detected without corresponding DNS query: 111.130.141.154
Source: unknown TCP traffic detected without corresponding DNS query: 196.195.86.151
Source: unknown TCP traffic detected without corresponding DNS query: 41.194.245.13
Source: unknown TCP traffic detected without corresponding DNS query: 151.235.163.32
Source: unknown TCP traffic detected without corresponding DNS query: 98.163.40.149
Source: unknown TCP traffic detected without corresponding DNS query: 23.197.213.172
Source: unknown TCP traffic detected without corresponding DNS query: 20.138.7.191
Source: unknown TCP traffic detected without corresponding DNS query: 31.172.209.189
Source: unknown TCP traffic detected without corresponding DNS query: 212.134.233.216
Source: unknown TCP traffic detected without corresponding DNS query: 77.63.182.121
Source: unknown TCP traffic detected without corresponding DNS query: 124.103.162.69
Source: unknown TCP traffic detected without corresponding DNS query: 31.178.24.25
Source: unknown TCP traffic detected without corresponding DNS query: 40.227.124.86
Source: unknown TCP traffic detected without corresponding DNS query: 8.124.72.123
Source: unknown TCP traffic detected without corresponding DNS query: 90.95.239.76
Source: unknown TCP traffic detected without corresponding DNS query: 15.228.89.76
Source: unknown TCP traffic detected without corresponding DNS query: 212.97.157.11
Source: unknown TCP traffic detected without corresponding DNS query: 121.57.137.203
Source: unknown TCP traffic detected without corresponding DNS query: 99.255.232.92
Source: unknown TCP traffic detected without corresponding DNS query: 162.69.106.239
Source: unknown TCP traffic detected without corresponding DNS query: 219.171.234.1
Source: unknown TCP traffic detected without corresponding DNS query: 17.127.228.87
Source: unknown TCP traffic detected without corresponding DNS query: 22.167.41.133
Source: unknown TCP traffic detected without corresponding DNS query: 136.37.46.128
Source: unknown TCP traffic detected without corresponding DNS query: 162.74.203.84
Source: unknown TCP traffic detected without corresponding DNS query: 92.48.49.175
Source: unknown TCP traffic detected without corresponding DNS query: 63.245.73.185
Source: unknown TCP traffic detected without corresponding DNS query: 41.228.50.159
Source: unknown TCP traffic detected without corresponding DNS query: 190.17.204.115
Source: unknown TCP traffic detected without corresponding DNS query: 126.211.1.65
Source: unknown TCP traffic detected without corresponding DNS query: 191.154.28.255
Source: unknown TCP traffic detected without corresponding DNS query: 71.47.101.138
Source: unknown TCP traffic detected without corresponding DNS query: 145.139.57.7
Source: global traffic DNS traffic detected: DNS query: catlovingfools.geek
Source: global traffic DNS traffic detected: DNS query: catvision.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: hikvision.geek
Source: global traffic DNS traffic detected: DNS query: shitrocket.dyn
Source: global traffic DNS traffic detected: DNS query: hikvision.geek. [malformed]
Source: global traffic DNS traffic detected: DNS query: shitrocket.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: catlovingfools.geek. [malformed]
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal68.troj.linELF@0/0@26/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/nshppc.elf (PID: 6238) Queries kernel information via 'uname': Jump to behavior
Source: nshppc.elf, 6238.1.00007ffecbd14000.00007ffecbd35000.rw-.sdmp, nshppc.elf, 6240.1.00007ffecbd14000.00007ffecbd35000.rw-.sdmp Binary or memory string: -5x86_64/usr/bin/qemu-ppc/tmp/nshppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nshppc.elf
Source: nshppc.elf, 6240.1.000055ad70539000.000055ad7060f000.rw-.sdmp Binary or memory string: !/proc/2018/exe0!/usr/bin/vmtoolsd1/proc/2146/exe/ppc/sr10!/proc/2014/exe0!/proc/759/exe1/usr/bin/xfce4-power-manager0q
Source: nshppc.elf, 6240.1.000055ad70539000.000055ad7060f000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: nshppc.elf, 6238.1.000055ad70539000.000055ad7060f000.rw-.sdmp, nshppc.elf, 6240.1.000055ad70539000.000055ad7060f000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: nshppc.elf, 6238.1.00007ffecbd14000.00007ffecbd35000.rw-.sdmp, nshppc.elf, 6240.1.00007ffecbd14000.00007ffecbd35000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc
Source: nshppc.elf, 6238.1.000055ad70539000.000055ad7060f000.rw-.sdmp, nshppc.elf, 6240.1.000055ad70539000.000055ad7060f000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc1/usr/lib/udisks2/udisksd1/proc/103/exe

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: nshppc.elf, type: SAMPLE
Source: Yara match File source: 6240.1.00007fd7c8001000.00007fd7c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6238.1.00007fd7c8001000.00007fd7c8013000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: nshppc.elf, type: SAMPLE
Source: Yara match File source: 6240.1.00007fd7c8001000.00007fd7c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6238.1.00007fd7c8001000.00007fd7c8013000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
76.97.81.67
 unknown United States
7922 COMCAST-7922US false
138.26.26.41
 unknown United States
3452 UAB-ASUS false
29.54.86.64
 unknown United States
7922 COMCAST-7922US false
55.251.137.55
 unknown United States
306 DNIC-ASBLK-00306-00371US false
20.231.62.25
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
190.74.137.100
 unknown Venezuela
8048 CANTVServiciosVenezuelaVE false
130.86.176.87
 unknown United States
396465 SACSTATEUS false
136.213.123.76
 unknown United States
721 DNIC-ASBLK-00721-00726US false
128.53.179.246
 unknown Japan 2514 INFOSPHERENTTPCCommunicationsIncJP false
41.149.186.119
 unknown South Africa
5713 SAIX-NETZA false
61.38.179.222
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
93.5.46.101
 unknown France
15557 LDCOMNETFR false
69.65.0.56
 unknown United States
32181 ASN-GIGENETUS false
130.29.222.129
 unknown United States
367 DNIC-ASBLK-00306-00371US false
181.174.226.60
 unknown Costa Rica
30361 SWIFTWILL2US false
59.187.104.165
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
44.154.12.42
 unknown United States
62383 LDS-ASBE false
110.113.31.226
 unknown China
24138 CTTNETChinaTieTongTelecommunicationsCorporationCN false
213.41.84.39
 unknown United Kingdom
8220 COLTCOLTTechnologyServicesGroupLimitedGB false
18.19.210.91
 unknown United States
3 MIT-GATEWAYSUS false
109.183.48.78
 unknown Czech Republic
12767 PRAGONET-ASCZ false
88.16.54.79
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
100.174.242.86
 unknown United States
21928 T-MOBILE-AS21928US false
169.186.27.192
 unknown United States
37611 AfrihostZA false
212.196.181.181
 unknown United Kingdom
49392 ASBAXETNRU false
88.245.81.163
 unknown Turkey
9121 TTNETTR false
5.40.190.81
 unknown Spain
43160 ES-MDC-DATACENTERMalagaDataCenterES false
17.181.203.199
 unknown United States
714 APPLE-ENGINEERINGUS false
132.89.30.251
 unknown United States
306 DNIC-ASBLK-00306-00371US false
27.104.43.44
 unknown Singapore
4773 MOBILEONELTD-AS-APMobileOneLtdMobileInternetServicePr false
160.15.117.58
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
161.177.27.255
 unknown United States
10695 WAL-MARTUS false
179.111.72.103
 unknown Brazil
27699 TELEFONICABRASILSABR false
113.104.210.212
 unknown China
58466 CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN false
87.97.156.241
 unknown Bulgaria
13124 IBGCBG false
162.123.127.42
 unknown United States
11857 AEGONUSAUS false
53.189.202.221
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
125.154.175.201
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
59.108.216.179
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
80.74.154.39
 unknown Switzerland
21069 ASN-METANETRoutingpeeringissuesnocmetanetchCH false
91.11.116.197
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
49.165.157.64
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
85.170.165.158
 unknown France
21502 ASN-NUMERICABLEFR false
185.70.34.109
 unknown United Kingdom
201353 NSUKGB false
71.15.10.130
 unknown United States
20115 CHARTER-20115US false
216.140.219.2
 unknown United States
3356 LEVEL3US false
37.69.111.83
 unknown France
15557 LDCOMNETFR false
46.21.151.164
 unknown Netherlands
29802 HVC-ASUS false
42.158.0.124
 unknown China
23724 CHINANET-IDC-BJ-APIDCChinaTelecommunicationsCorporation false
181.31.213.38
 unknown Argentina
10318 TelecomArgentinaSAAR false
45.167.243.28
 unknown Brazil
268058 REDEMETROPOLITANADETELECOMUNICACOESLTDA-MEBR false
205.219.243.103
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
71.52.220.59
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
15.102.153.40
 unknown United States
13979 ATT-IPFRUS false
166.126.15.148
 unknown United States
30488 SPRINGSUS false
57.74.95.124
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
27.118.193.108
 unknown Korea Republic of
17877 NEXG-AS-KRNexGCoLTDKR false
116.90.155.113
 unknown Japan 9354 TDNCCommunityNetworkCenterIncJP false
118.201.110.228
 unknown Singapore
3758 SINGNETSingNetSG false
158.66.163.91
 unknown Poland
21111 CISGCentrumInformacjiSpoleczno-GospodarczejPL false
204.68.220.145
 unknown United States
393826 AS-IMAGINESOFTWAREUS false
96.182.203.184
 unknown United States
7922 COMCAST-7922US false
194.183.165.168
 unknown Ukraine
12963 VOLZScientific-IndustrialFirmVolzLtdUA false
40.103.90.195
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
213.110.25.88
 unknown Russian Federation
49483 SKATISPRU false
125.3.3.225
 unknown Japan 2510 INFOWEBFUJITSULIMITEDJP false
96.148.61.141
 unknown United States
7922 COMCAST-7922US false
119.237.195.82
 unknown Hong Kong
4760 HKTIMS-APHKTLimitedHK false
28.147.37.88
 unknown United States
7922 COMCAST-7922US false
6.209.132.167
 unknown United States
3356 LEVEL3US false
72.13.226.171
 unknown United States
3257 GTT-BACKBONEGTTDE false
141.105.165.166
 unknown United Arab Emirates
198394 GR1AE false
46.162.29.105
 unknown Ukraine
24881 INTERPHONE-ASUA false
52.107.25.221
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
151.105.118.236
 unknown Finland
1759 TSF-IP-CORETeliaFinlandOyjEU false
187.75.183.47
 unknown Brazil
27699 TELEFONICABRASILSABR false
170.93.162.190
 unknown United States
15196 MDDOTUS false
209.143.100.93
 unknown United States
17054 AS17054US false
158.93.27.84
 unknown United States
3479 PEACHNET-AS1US false
59.205.168.44
 unknown China
2516 KDDIKDDICORPORATIONJP false
60.87.12.86
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
30.146.145.206
 unknown United States
7922 COMCAST-7922US false
75.142.213.208
 unknown United States
20115 CHARTER-20115US false
138.188.222.2
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
139.165.232.137
 unknown Belgium
2611 BELNETBE false
158.8.88.112
 unknown United States
5180 DNIC-ASBLK-05120-05376US false
121.199.253.195
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
160.81.164.62
 unknown United States
1239 SPRINTLINKUS false
221.218.224.170
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
51.238.254.104
 unknown United Kingdom
2686 ATGS-MMD-ASUS false
81.225.194.110
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
175.87.150.233
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
164.110.213.82
 unknown United States
14827 WSDOT-ASNUS false
17.254.82.57
 unknown United States
714 APPLE-ENGINEERINGUS false
178.66.52.69
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
2.251.105.65
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
143.104.76.75
 unknown United States
395139 NYP-INTERNETUS false
222.148.191.41
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
55.126.241.18
 unknown United States
326 DNIC-ASBLK-00306-00371US false
65.95.25.203
 unknown Canada
577 BACOMCA false

Contacted Domains

Name IP Active
catlovingfools.geek 80.78.26.121 true
shitrocket.dyn 37.49.226.109 true
hikvision.geek 212.192.13.95 true
catlovingfools.geek. [malformed] unknown unknown
hikvision.geek. [malformed] unknown unknown
shitrocket.dyn. [malformed] unknown unknown
catvision.dyn. [malformed] unknown unknown