Linux Analysis Report
sh4.elf

Overview

General Information

Sample name: sh4.elf
Analysis ID: 1579346
MD5: e8019324c28b20238cf03d822aa0472d
SHA1: 5ec418f875d9d4bf69143aa0c98da8b6efeb84cd
SHA256: 473093f293c8b0a4f3071013654ab743a414d6e0e3ae265a775c77dcc8fc01c8
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai, Moobot
Score: 88
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Moobot
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
Name Description Attribution Blogpost URLs Link
MooBot No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: sh4.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: sh4.elf Virustotal: Detection: 60% Perma Link
Source: sh4.elf ReversingLabs: Detection: 71%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:51884 -> 209.141.47.117:1999
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 209.141.47.117
Source: unknown TCP traffic detected without corresponding DNS query: 242.120.35.111
Source: unknown TCP traffic detected without corresponding DNS query: 121.158.41.194
Source: unknown TCP traffic detected without corresponding DNS query: 216.19.154.89
Source: unknown TCP traffic detected without corresponding DNS query: 161.152.36.50
Source: unknown TCP traffic detected without corresponding DNS query: 245.144.50.69
Source: unknown TCP traffic detected without corresponding DNS query: 115.47.109.69
Source: unknown TCP traffic detected without corresponding DNS query: 166.36.54.117
Source: unknown TCP traffic detected without corresponding DNS query: 219.8.232.109
Source: unknown TCP traffic detected without corresponding DNS query: 118.108.36.187
Source: unknown TCP traffic detected without corresponding DNS query: 66.163.150.198
Source: unknown TCP traffic detected without corresponding DNS query: 125.226.26.14
Source: unknown TCP traffic detected without corresponding DNS query: 188.178.37.59
Source: unknown TCP traffic detected without corresponding DNS query: 112.30.12.10
Source: unknown TCP traffic detected without corresponding DNS query: 190.182.49.128
Source: unknown TCP traffic detected without corresponding DNS query: 248.220.191.222
Source: unknown TCP traffic detected without corresponding DNS query: 148.175.12.216
Source: unknown TCP traffic detected without corresponding DNS query: 9.86.55.73
Source: unknown TCP traffic detected without corresponding DNS query: 164.253.217.23
Source: unknown TCP traffic detected without corresponding DNS query: 196.137.79.86
Source: unknown TCP traffic detected without corresponding DNS query: 222.8.36.204
Source: unknown TCP traffic detected without corresponding DNS query: 151.72.216.3
Source: unknown TCP traffic detected without corresponding DNS query: 208.174.104.201
Source: unknown TCP traffic detected without corresponding DNS query: 145.30.208.236
Source: unknown TCP traffic detected without corresponding DNS query: 35.66.156.17
Source: unknown TCP traffic detected without corresponding DNS query: 141.88.49.21
Source: unknown TCP traffic detected without corresponding DNS query: 219.37.18.136
Source: unknown TCP traffic detected without corresponding DNS query: 124.148.215.84
Source: unknown TCP traffic detected without corresponding DNS query: 124.94.93.245
Source: unknown TCP traffic detected without corresponding DNS query: 158.127.165.248
Source: unknown TCP traffic detected without corresponding DNS query: 254.159.113.147
Source: unknown TCP traffic detected without corresponding DNS query: 125.228.71.129
Source: unknown TCP traffic detected without corresponding DNS query: 84.149.71.13
Source: unknown TCP traffic detected without corresponding DNS query: 80.220.56.245
Source: unknown TCP traffic detected without corresponding DNS query: 59.120.57.109
Source: unknown TCP traffic detected without corresponding DNS query: 75.233.164.0
Source: unknown TCP traffic detected without corresponding DNS query: 123.169.216.71
Source: unknown TCP traffic detected without corresponding DNS query: 146.108.93.161
Source: unknown TCP traffic detected without corresponding DNS query: 114.134.8.176
Source: unknown TCP traffic detected without corresponding DNS query: 97.70.76.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.221.213.100
Source: unknown TCP traffic detected without corresponding DNS query: 76.177.18.20
Source: unknown TCP traffic detected without corresponding DNS query: 168.204.77.182
Source: unknown TCP traffic detected without corresponding DNS query: 211.228.128.153
Source: unknown TCP traffic detected without corresponding DNS query: 116.3.217.125
Source: unknown TCP traffic detected without corresponding DNS query: 83.5.75.215
Source: unknown TCP traffic detected without corresponding DNS query: 91.83.67.118
Source: unknown TCP traffic detected without corresponding DNS query: 9.56.140.27
Source: unknown TCP traffic detected without corresponding DNS query: 159.230.212.204
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: sh4.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: sh4.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: sh4.elf, type: SAMPLE Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6246.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6246.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6246.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6256.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6256.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6256.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6251.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6251.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6251.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: Process Memory Space: sh4.elf PID: 6246, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sh4.elf PID: 6246, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sh4.elf PID: 6251, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sh4.elf PID: 6251, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sh4.elf PID: 6256, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sh4.elf PID: 6256, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Yara signature match
Source: sh4.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: sh4.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: sh4.elf, type: SAMPLE Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6246.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6246.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6246.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6256.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6256.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6256.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6251.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6251.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6251.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: Process Memory Space: sh4.elf PID: 6246, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sh4.elf PID: 6246, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sh4.elf PID: 6251, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sh4.elf PID: 6251, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sh4.elf PID: 6256, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sh4.elf PID: 6256, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: classification engine Classification label: mal88.troj.linELF@0/0@0/0
Enumerates processes within the "proc" file system
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/6352/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1582/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2033/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2275/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/3088/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1612/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1579/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1699/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1335/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1698/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2028/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1334/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1576/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2302/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/3236/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2025/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2146/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/910/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/4444/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/4445/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/912/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/4446/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/517/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/759/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2307/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/918/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1594/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2285/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2281/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1349/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1623/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/761/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1622/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/884/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1983/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2038/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1344/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1465/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1586/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1860/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1463/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2156/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/800/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/801/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1629/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1627/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1900/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/6258/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/4476/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/3021/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/491/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2294/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2050/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1877/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/772/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1633/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1599/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1632/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/774/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1477/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/654/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/896/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1476/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1872/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2048/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/655/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1475/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2289/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/656/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/777/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/657/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/6249/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/658/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/419/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/936/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1639/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1638/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2208/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2180/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/4480/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/6263/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1809/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1494/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1890/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2063/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2062/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/6261/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1888/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1886/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/420/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1489/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/785/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1642/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/788/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/667/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/789/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/6259/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/1648/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/4531/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2078/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2077/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2074/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2195/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/670/cmdline Jump to behavior
Source: /tmp/sh4.elf (PID: 6255) File opened: /proc/2746/cmdline Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6220) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.KT2oAVtJzr /tmp/tmp.gEQaVDVT2J /tmp/tmp.4EsHAzAnPw Jump to behavior
Source: /usr/bin/dash (PID: 6221) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.KT2oAVtJzr /tmp/tmp.gEQaVDVT2J /tmp/tmp.4EsHAzAnPw Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/sh4.elf (PID: 6246) Queries kernel information via 'uname': Jump to behavior
Source: sh4.elf, 6246.1.00007fff6db9b000.00007fff6dbbc000.rw-.sdmp, sh4.elf, 6251.1.00007fff6db9b000.00007fff6dbbc000.rw-.sdmp, sh4.elf, 6256.1.00007fff6db9b000.00007fff6dbbc000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: sh4.elf, 6246.1.000055795dbcd000.000055795dc30000.rw-.sdmp, sh4.elf, 6251.1.000055795dbcd000.000055795dc30000.rw-.sdmp, sh4.elf, 6256.1.000055795dbcd000.000055795dc30000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4
Source: sh4.elf, 6246.1.000055795dbcd000.000055795dc30000.rw-.sdmp, sh4.elf, 6251.1.000055795dbcd000.000055795dc30000.rw-.sdmp, sh4.elf, 6256.1.000055795dbcd000.000055795dc30000.rw-.sdmp Binary or memory string: ]yU5!/etc/qemu-binfmt/sh4
Source: sh4.elf, 6246.1.00007fff6db9b000.00007fff6dbbc000.rw-.sdmp, sh4.elf, 6251.1.00007fff6db9b000.00007fff6dbbc000.rw-.sdmp, sh4.elf, 6256.1.00007fff6db9b000.00007fff6dbbc000.rw-.sdmp Binary or memory string: @x86_64/usr/bin/qemu-sh4/tmp/sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sh4.elf

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: sh4.elf, type: SAMPLE
Source: Yara match File source: 6246.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6256.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6251.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: sh4.elf PID: 6246, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: sh4.elf PID: 6251, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: sh4.elf PID: 6256, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: sh4.elf, type: SAMPLE
Source: Yara match File source: 6246.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6256.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6251.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: sh4.elf PID: 6246, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: sh4.elf, type: SAMPLE
Source: Yara match File source: 6246.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6256.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6251.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: sh4.elf PID: 6246, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: sh4.elf PID: 6251, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: sh4.elf PID: 6256, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: sh4.elf, type: SAMPLE
Source: Yara match File source: 6246.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6256.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6251.1.00007f2a18400000.00007f2a18414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: sh4.elf PID: 6246, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
2.78.125.65
 unknown Kazakhstan
29355 KCELL-ASKZ false
208.252.56.170
 unknown United States
4208 THE-ISERV-COMPANYUS false
16.213.146.68
 unknown United States
unknown unknown false
244.80.77.102
 unknown Reserved
unknown unknown false
87.218.67.186
 unknown Spain
12479 UNI2-ASES false
60.159.124.238
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
72.166.78.117
 unknown United States
396012 COS-ASN01US false
115.155.240.227
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
40.28.77.97
 unknown United States
4249 LILLY-ASUS false
194.49.11.71
 unknown Spain
200387 ARLUES false
2.80.41.226
 unknown Portugal
3243 MEO-RESIDENCIALPT false
209.143.172.139
 unknown United States
14127 ILANDUS false
170.45.158.28
 unknown United States
264957 CoopercitrusCooperativadeProdutoresRuraisBR false
130.194.45.248
 unknown Australia
56132 MONASHUNI-AU-AS-APMonashUniversityAU false
73.150.76.43
 unknown United States
7922 COMCAST-7922US false
141.169.57.103
 unknown Germany
135887 TELSTRA-BELONG-APTelstraCorporationAU false
130.247.180.163
 unknown United States
786 JANETJiscServicesLimitedGB false
222.162.156.45
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
102.45.70.145
 unknown Egypt
8452 TE-ASTE-ASEG false
247.214.201.166
 unknown Reserved
unknown unknown false
95.203.30.175
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
149.211.230.240
 unknown Germany
15854 HP_WEBSERVICESDE false
89.78.10.214
 unknown Poland
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
251.120.49.24
 unknown Reserved
unknown unknown false
255.143.32.122
 unknown Reserved
unknown unknown false
187.242.133.205
 unknown Mexico
13999 MegaCableSAdeCVMX false
94.227.247.130
 unknown Belgium
6848 TELENET-ASBE false
124.177.69.154
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
118.19.231.127
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
197.27.46.203
 unknown Tunisia
37492 ORANGE-TN false
191.242.141.221
 unknown Brazil
262730 BytewebComunicacaoMultimidiaLtdaBR false
19.223.84.235
 unknown United States
3 MIT-GATEWAYSUS false
219.141.210.106
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
2.202.172.176
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
210.195.169.21
 unknown Malaysia
4788 TMNET-AS-APTMNetInternetServiceProviderMY false
166.113.228.118
 unknown United States
19870 CCSDUS false
117.43.182.243
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
13.50.244.72
 unknown United States
16509 AMAZON-02US false
195.167.76.30
 unknown Greece
6799 OTENET-GRAthens-GreeceGR false
146.42.160.72
 unknown United States
197938 TRAVIANGAMESDE false
136.94.23.92
 unknown United States
60311 ONEFMCH false
8.195.50.62
 unknown United States
3356 LEVEL3US false
123.245.212.178
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
91.170.122.90
 unknown France
12322 PROXADFR false
1.158.91.64
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
247.91.147.121
 unknown Reserved
unknown unknown false
37.202.175.71
 unknown Iran (ISLAMIC Republic Of)
31549 RASANAIR false
118.115.37.104
 unknown China
38283 CHINANET-SCIDC-AS-APCHINANETSiChuanTelecomInternetData false
36.26.247.56
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
67.66.185.56
 unknown United States
7018 ATT-INTERNET4US false
27.48.39.175
 unknown India
7545 TPG-INTERNET-APTPGTelecomLimitedAU false
63.48.75.243
 unknown United States
701 UUNETUS false
109.114.64.34
 unknown Italy
30722 VODAFONE-IT-ASNIT false
149.134.27.130
 unknown Belgium
137 ASGARRConsortiumGARREU false
82.33.237.106
 unknown United Kingdom
5089 NTLGB false
79.117.134.91
 unknown Romania
8708 RCS-RDS73-75DrStaicoviciRO false
39.170.131.56
 unknown China
56041 CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC false
37.128.68.203
 unknown Poland
12741 AS-NETIAWarszawa02-822PL false
48.41.52.177
 unknown United States
2686 ATGS-MMD-ASUS false
43.91.56.7
 unknown Japan 4249 LILLY-ASUS false
135.88.18.6
 unknown United States
10455 LUCENT-CIOUS false
182.33.39.121
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
158.192.206.9
 unknown France
9159 CreditAgricoleFR false
87.168.181.93
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
35.68.3.56
 unknown United States
237 MERIT-AS-14US false
121.29.40.54
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
67.33.35.4
 unknown United States
7018 ATT-INTERNET4US false
133.106.187.119
 unknown Japan 138384 RMNI-AS-APRakutenMobileNetworkIncJP false
19.244.163.57
 unknown United States
3 MIT-GATEWAYSUS false
204.244.230.236
 unknown Canada
5071 WESTEL-1CA false
179.23.101.172
 unknown Venezuela
26615 TIMSABR false
118.148.86.33
 unknown New Zealand
23655 SNAP-NZ-ASSnapInternetLimitedNZ false
46.41.114.87
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
100.197.44.93
 unknown United States
21928 T-MOBILE-AS21928US false
209.245.67.188
 unknown United States
3356 LEVEL3US false
197.117.202.174
 unknown Algeria
36947 ALGTEL-ASDZ false
74.88.97.164
 unknown United States
6128 CABLE-NET-1US false
35.65.54.111
 unknown United States
237 MERIT-AS-14US false
2.199.144.88
 unknown Italy
16232 ASN-TIMServiceProviderIT false
57.87.239.4
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
90.171.43.238
 unknown Spain
12479 UNI2-ASES false
111.233.139.106
 unknown Japan 10013 FBDCFreeBitCoLtdJP false
163.69.181.161
 unknown France
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
156.247.76.147
 unknown Seychelles
54600 PEGTECHINCUS false
161.177.38.20
 unknown United States
10695 WAL-MARTUS false
108.183.186.137
 unknown United States
11351 TWC-11351-NORTHEASTUS false
72.175.41.14
 unknown United States
33588 BRESNAN-33588US false
207.181.235.190
 unknown United States
6079 RCN-ASUS false
16.124.156.221
 unknown United States
unknown unknown false
114.14.75.61
 unknown Indonesia
56046 CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN false
118.140.122.241
 unknown Hong Kong
9304 HUTCHISON-AS-APHGCGlobalCommunicationsLimitedHK false
87.220.191.59
 unknown Spain
12479 UNI2-ASES false
70.61.192.254
 unknown United States
11426 TWC-11426-CAROLINASUS false
154.205.78.167
 unknown Seychelles
8100 ASN-QUADRANET-GLOBALUS false
114.87.176.29
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
135.249.229.221
 unknown United States
10455 LUCENT-CIOUS false
182.38.190.127
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
13.148.207.34
 unknown United States
7018 ATT-INTERNET4US false
246.182.89.56
 unknown Reserved
unknown unknown false
39.179.211.115
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false