Linux Analysis Report
mips.elf

Overview

General Information

Sample name: mips.elf
Analysis ID: 1579347
MD5: 4a16d254a4a373cb01f5a33c05623549
SHA1: a8371b524192de016f5afca6d673969358579097
SHA256: 115dde91db57628554eadfb3b552de116b5433cce8b0dd16313cc91fa28f0722
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai, Moobot
Score: 88
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Moobot
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
Name Description Attribution Blogpost URLs Link
MooBot No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: mips.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: mips.elf ReversingLabs: Detection: 71%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:51882 -> 209.141.47.117:1999
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 209.141.47.117
Source: unknown TCP traffic detected without corresponding DNS query: 179.179.69.91
Source: unknown TCP traffic detected without corresponding DNS query: 88.117.60.213
Source: unknown TCP traffic detected without corresponding DNS query: 168.95.47.108
Source: unknown TCP traffic detected without corresponding DNS query: 204.180.6.253
Source: unknown TCP traffic detected without corresponding DNS query: 89.165.91.181
Source: unknown TCP traffic detected without corresponding DNS query: 190.202.162.112
Source: unknown TCP traffic detected without corresponding DNS query: 253.151.126.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.219.42.78
Source: unknown TCP traffic detected without corresponding DNS query: 51.0.214.28
Source: unknown TCP traffic detected without corresponding DNS query: 201.7.142.173
Source: unknown TCP traffic detected without corresponding DNS query: 217.116.251.62
Source: unknown TCP traffic detected without corresponding DNS query: 76.106.32.72
Source: unknown TCP traffic detected without corresponding DNS query: 23.215.199.7
Source: unknown TCP traffic detected without corresponding DNS query: 160.176.69.164
Source: unknown TCP traffic detected without corresponding DNS query: 118.63.26.45
Source: unknown TCP traffic detected without corresponding DNS query: 19.43.195.15
Source: unknown TCP traffic detected without corresponding DNS query: 202.223.157.127
Source: unknown TCP traffic detected without corresponding DNS query: 105.67.209.104
Source: unknown TCP traffic detected without corresponding DNS query: 27.202.15.23
Source: unknown TCP traffic detected without corresponding DNS query: 196.218.39.240
Source: unknown TCP traffic detected without corresponding DNS query: 150.237.55.246
Source: unknown TCP traffic detected without corresponding DNS query: 94.59.180.84
Source: unknown TCP traffic detected without corresponding DNS query: 53.136.211.163
Source: unknown TCP traffic detected without corresponding DNS query: 122.134.8.72
Source: unknown TCP traffic detected without corresponding DNS query: 125.220.244.95
Source: unknown TCP traffic detected without corresponding DNS query: 86.128.7.26
Source: unknown TCP traffic detected without corresponding DNS query: 91.239.35.131
Source: unknown TCP traffic detected without corresponding DNS query: 249.118.33.29
Source: unknown TCP traffic detected without corresponding DNS query: 92.82.223.11
Source: unknown TCP traffic detected without corresponding DNS query: 219.26.100.43
Source: unknown TCP traffic detected without corresponding DNS query: 34.133.40.135
Source: unknown TCP traffic detected without corresponding DNS query: 156.50.131.46
Source: unknown TCP traffic detected without corresponding DNS query: 44.39.238.11
Source: unknown TCP traffic detected without corresponding DNS query: 183.91.183.170
Source: unknown TCP traffic detected without corresponding DNS query: 174.241.59.33
Source: unknown TCP traffic detected without corresponding DNS query: 117.163.166.222
Source: unknown TCP traffic detected without corresponding DNS query: 123.127.193.101
Source: unknown TCP traffic detected without corresponding DNS query: 146.240.41.110
Source: unknown TCP traffic detected without corresponding DNS query: 221.116.242.32
Source: unknown TCP traffic detected without corresponding DNS query: 202.51.187.140
Source: unknown TCP traffic detected without corresponding DNS query: 243.79.63.203
Source: unknown TCP traffic detected without corresponding DNS query: 173.131.79.241
Source: unknown TCP traffic detected without corresponding DNS query: 117.202.173.24
Source: unknown TCP traffic detected without corresponding DNS query: 162.17.19.76
Source: unknown TCP traffic detected without corresponding DNS query: 243.217.37.155
Source: unknown TCP traffic detected without corresponding DNS query: 201.44.69.169
Source: unknown TCP traffic detected without corresponding DNS query: 165.83.35.122
Source: unknown TCP traffic detected without corresponding DNS query: 157.89.50.50
Source: unknown TCP traffic detected without corresponding DNS query: 62.62.77.139
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: mips.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: mips.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: mips.elf, type: SAMPLE Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6250.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6250.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6250.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6241.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6241.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6241.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6237.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6237.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6237.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: Process Memory Space: mips.elf PID: 6237, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: mips.elf PID: 6237, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: mips.elf PID: 6241, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: mips.elf PID: 6241, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: mips.elf PID: 6250, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: mips.elf PID: 6250, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Yara signature match
Source: mips.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: mips.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: mips.elf, type: SAMPLE Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6250.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6250.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6250.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6241.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6241.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6241.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6237.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6237.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6237.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: Process Memory Space: mips.elf PID: 6237, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: mips.elf PID: 6237, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: mips.elf PID: 6241, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: mips.elf PID: 6241, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: mips.elf PID: 6250, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: mips.elf PID: 6250, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: classification engine Classification label: mal88.troj.linELF@0/0@0/0
Enumerates processes within the "proc" file system
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1582/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/2033/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/2275/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/3088/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/6192/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1612/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1579/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1699/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1335/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1698/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/2028/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1334/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1576/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/2302/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/3236/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/2025/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/2146/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/910/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/4444/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/4445/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/912/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/4446/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/517/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/759/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/2307/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/918/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1594/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/2285/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/2281/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1349/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1623/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/761/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1622/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/884/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1983/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/2038/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1344/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1465/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1586/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1860/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1463/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/2156/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/800/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/801/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1629/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/6239/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1627/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1900/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/6252/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/6254/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/6253/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/6256/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/6258/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/3021/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/491/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/2294/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/2050/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/6250/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1877/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/4507/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/772/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1633/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1599/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1632/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/774/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1477/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/654/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/896/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1476/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1872/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/2048/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/655/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1475/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/2289/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/656/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/777/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/657/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/658/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/419/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/936/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1639/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1638/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/2208/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/2180/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/4480/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1809/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1494/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1890/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/2063/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/2062/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1888/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1886/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/420/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1489/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/785/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1642/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/788/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/667/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/789/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/4477/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/1648/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/2078/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/2077/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/2074/cmdline Jump to behavior
Source: /tmp/mips.elf (PID: 6245) File opened: /proc/2195/cmdline Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/mips.elf (PID: 6237) Queries kernel information via 'uname': Jump to behavior
Source: mips.elf, 6237.1.0000559d744d8000.0000559d7455f000.rw-.sdmp, mips.elf, 6241.1.0000559d744d8000.0000559d7455f000.rw-.sdmp, mips.elf, 6250.1.0000559d744d8000.0000559d7455f000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mips
Source: mips.elf, 6237.1.0000559d744d8000.0000559d7455f000.rw-.sdmp, mips.elf, 6241.1.0000559d744d8000.0000559d7455f000.rw-.sdmp, mips.elf, 6250.1.0000559d744d8000.0000559d7455f000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: mips.elf, 6237.1.00007ffc1e0d7000.00007ffc1e0f8000.rw-.sdmp, mips.elf, 6241.1.00007ffc1e0d7000.00007ffc1e0f8000.rw-.sdmp, mips.elf, 6250.1.00007ffc1e0d7000.00007ffc1e0f8000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mips.elf
Source: mips.elf, 6237.1.00007ffc1e0d7000.00007ffc1e0f8000.rw-.sdmp, mips.elf, 6241.1.00007ffc1e0d7000.00007ffc1e0f8000.rw-.sdmp, mips.elf, 6250.1.00007ffc1e0d7000.00007ffc1e0f8000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: mips.elf, type: SAMPLE
Source: Yara match File source: 6250.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6241.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6237.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: mips.elf PID: 6237, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: mips.elf PID: 6241, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: mips.elf PID: 6250, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: mips.elf, type: SAMPLE
Source: Yara match File source: 6250.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6241.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6237.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: mips.elf PID: 6237, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: mips.elf PID: 6241, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: mips.elf, type: SAMPLE
Source: Yara match File source: 6250.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6241.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6237.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: mips.elf PID: 6237, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: mips.elf PID: 6241, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: mips.elf PID: 6250, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: mips.elf, type: SAMPLE
Source: Yara match File source: 6250.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6241.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6237.1.00007fd524400000.00007fd52441b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: mips.elf PID: 6237, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: mips.elf PID: 6241, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
58.237.168.206
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
198.167.119.207
 unknown Canada
855 CANET-ASN-4CA false
98.200.35.18
 unknown United States
7922 COMCAST-7922US false
148.156.230.187
 unknown United States
7359 CENTURYLINK-SPA-ZUNIUS false
119.50.208.133
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
95.47.60.133
 unknown Czech Republic
50685 UNITED-NETWORKS-ASBY false
12.105.164.2
 unknown United States
7018 ATT-INTERNET4US false
183.27.237.78
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
82.70.221.167
 unknown United Kingdom
13037 ZEN-ASZenInternet-UKGB false
180.73.37.118
 unknown Malaysia
38322 WEBE-MY-AS-APWEBEDIGITALSDNBHDMY false
116.234.235.244
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
9.61.239.119
 unknown United States
3356 LEVEL3US false
191.78.18.13
 unknown Colombia
26611 COMCELSACO false
78.7.202.114
 unknown Italy
8968 BT-ITALIAIT false
64.47.237.55
 unknown United States
19855 MASERGYUS false
23.239.14.23
 unknown United States
63949 LINODE-APLinodeLLCUS false
47.1.114.82
 unknown United States
34533 ESAMARA-ASRU false
69.146.14.7
 unknown United States
33588 BRESNAN-33588US false
240.0.225.91
 unknown Reserved
unknown unknown false
109.145.127.72
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
31.226.254.192
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
159.163.143.17
 unknown United States
2116 ASN-CATCHCOMNO false
87.227.143.252
 unknown Bulgaria
59484 SIS-NETBG false
209.172.240.66
 unknown United States
393289 MERCERU-GA-ASNUS false
17.210.41.32
 unknown United States
714 APPLE-ENGINEERINGUS false
105.49.88.156
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
87.42.38.252
 unknown Ireland
1213 HEANETIE false
203.91.16.82
 unknown Taiwan; Republic of China (ROC)
38266 VODAFONE-INVodafoneIndiaLtdIN false
65.248.145.144
 unknown United States
701 UUNETUS false
73.225.6.219
 unknown United States
7922 COMCAST-7922US false
253.61.193.132
 unknown Reserved
unknown unknown false
168.67.37.52
 unknown United States
265240 ULTRANETSERVICOSEMINTERNETLTDABR false
164.189.48.180
 unknown United States
37717 EL-KhawarizmiTN false
112.167.94.80
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
182.207.58.86
 unknown China
17799 CHINATELECOM-LN-AS-APasnforLiaoningProvincialNetofCT false
194.209.113.38
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
158.251.133.186
 unknown Chile
16742 UniversidadCatolicadeValparaisoCL false
38.9.48.113
 unknown United States
174 COGENT-174US false
100.24.66.176
 unknown United States
14618 AMAZON-AESUS false
117.96.222.27
 unknown India
24560 AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServices false
204.228.113.136
 unknown United States
30136 AD12US false
240.237.150.31
 unknown Reserved
unknown unknown false
59.214.146.0
 unknown China
2516 KDDIKDDICORPORATIONJP false
193.215.70.99
 unknown Norway
2119 TELENOR-NEXTELTelenorNorgeASNO false
67.157.112.93
 unknown United States
1226 CTA-42-AS1226US false
194.188.202.227
 unknown Finland
719 ELISA-ASHelsinkiFinlandEU false
40.208.64.0
 unknown United States
4249 LILLY-ASUS false
93.121.227.252
 unknown France
21351 CANALPLUSTELECOMFR false
164.101.233.194
 unknown United States
4758 NICNET-VSNL-BOARDER-APNationalInformaticsCentreIN false
2.44.101.116
 unknown Italy
30722 VODAFONE-IT-ASNIT false
93.24.51.129
 unknown France
15557 LDCOMNETFR false
150.223.203.154
 unknown China
58519 CHINATELECOM-CTCLOUDCloudComputingCorporationCN false
169.113.31.161
 unknown United States
37611 AfrihostZA false
193.124.243.159
 unknown United Kingdom
209519 PFGB false
59.184.98.8
 unknown India
17813 MTNL-APMahanagarTelephoneNigamLimitedIN false
201.123.50.90
 unknown Mexico
8151 UninetSAdeCVMX false
86.68.24.217
 unknown France
15557 LDCOMNETFR false
89.158.77.176
 unknown France
21502 ASN-NUMERICABLEFR false
117.208.93.146
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
102.79.253.160
 unknown Morocco
6713 IAM-ASMA false
45.104.124.41
 unknown Egypt
37069 MOBINILEG false
78.209.26.254
 unknown France
12322 PROXADFR false
9.247.102.130
 unknown United States
3356 LEVEL3US false
210.235.178.77
 unknown Japan 7679 QTNETQTnetIncJP false
218.25.243.141
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
86.84.176.198
 unknown Netherlands
1136 KPNKPNNationalEU false
162.109.137.208
 unknown United States
13325 STOMIUS false
18.195.151.252
 unknown United States
16509 AMAZON-02US false
252.78.93.188
 unknown Reserved
unknown unknown false
86.6.207.216
 unknown United Kingdom
5089 NTLGB false
141.202.69.192
 unknown United States
41587 ATLAS-ELEKTRONIKSebaldsbrueckerHeerstrasse235DE false
59.125.100.162
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
67.81.106.222
 unknown United States
6128 CABLE-NET-1US false
255.129.33.144
 unknown Reserved
unknown unknown false
198.186.142.234
 unknown United States
40524 FUNSOFT-ASUS false
41.9.137.157
 unknown South Africa
29975 VODACOM-ZA false
59.101.152.208
 unknown Australia
2764 AAPTAAPTLimitedAU false
93.15.40.224
 unknown France
15557 LDCOMNETFR false
174.20.119.50
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
116.230.228.111
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
186.121.193.243
 unknown Bolivia
26210 AXSBoliviaSABO false
84.142.139.21
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
144.54.247.69
 unknown Netherlands
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
59.12.171.239
 unknown Korea Republic of
23554 SHBShinhanBankKR false
9.229.188.20
 unknown United States
3356 LEVEL3US false
98.1.212.38
 unknown United States
11351 TWC-11351-NORTHEASTUS false
66.229.8.106
 unknown United States
7922 COMCAST-7922US false
156.34.23.151
 unknown Canada
855 CANET-ASN-4CA false
84.171.123.8
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
87.107.232.234
 unknown Iran (ISLAMIC Republic Of)
41881 FANAVA-ASFanavaGroupCommunicationCoIR false
82.127.150.42
 unknown France
3215 FranceTelecom-OrangeFR false
163.139.178.52
 unknown Japan 2519 VECTANTARTERIANetworksCorporationJP false
183.10.244.128
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
159.155.32.42
 unknown United States
11757 WHIRLPOOL-ASNUS false
63.206.207.17
 unknown United States
40795 COUNTY-OF-LAKEUS false
182.244.34.63
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
104.181.69.14
 unknown United States
7018 ATT-INTERNET4US false
64.54.251.12
 unknown United States
5653 UCSFUS false
34.137.136.252
 unknown United States
2686 ATGS-MMD-ASUS false
35.197.158.68
 unknown United States
15169 GOOGLEUS false