Linux Analysis Report
nshkarm7.elf

Overview

General Information

Sample name: nshkarm7.elf
Analysis ID: 1579349
MD5: 3787a29f90ccc08e39a8e957be61d9aa
SHA1: 6c0c1e80795b8ea76ccf09452120eb801cd1ab55
SHA256: 60e8fe252180f6eed332b8722e756557d765ab99f9d89079138ff6953d2f23cb
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 64
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Detected TCP or UDP traffic on non-standard ports
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: nshkarm7.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: nshkarm7.elf ReversingLabs: Detection: 34%
Source: nshkarm7.elf Virustotal: Detection: 31% Perma Link
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:50888 -> 185.72.8.231:13146
Sample listens on a socket
Source: /tmp/nshkarm7.elf (PID: 6248) Socket: 127.0.0.1:1172 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 39.47.218.108
Source: unknown TCP traffic detected without corresponding DNS query: 182.149.68.48
Source: unknown TCP traffic detected without corresponding DNS query: 170.7.254.211
Source: unknown TCP traffic detected without corresponding DNS query: 170.91.157.174
Source: unknown TCP traffic detected without corresponding DNS query: 137.73.190.46
Source: unknown TCP traffic detected without corresponding DNS query: 28.103.84.116
Source: unknown TCP traffic detected without corresponding DNS query: 19.254.15.90
Source: unknown TCP traffic detected without corresponding DNS query: 18.130.34.51
Source: unknown TCP traffic detected without corresponding DNS query: 107.97.118.248
Source: unknown TCP traffic detected without corresponding DNS query: 20.179.224.55
Source: unknown TCP traffic detected without corresponding DNS query: 158.67.137.127
Source: unknown TCP traffic detected without corresponding DNS query: 193.214.122.126
Source: unknown TCP traffic detected without corresponding DNS query: 39.44.27.152
Source: unknown TCP traffic detected without corresponding DNS query: 120.17.209.29
Source: unknown TCP traffic detected without corresponding DNS query: 1.127.149.100
Source: unknown TCP traffic detected without corresponding DNS query: 121.27.196.97
Source: unknown TCP traffic detected without corresponding DNS query: 105.206.74.26
Source: unknown TCP traffic detected without corresponding DNS query: 7.245.194.57
Source: unknown TCP traffic detected without corresponding DNS query: 132.116.0.67
Source: unknown TCP traffic detected without corresponding DNS query: 51.43.133.80
Source: unknown TCP traffic detected without corresponding DNS query: 54.45.150.115
Source: unknown TCP traffic detected without corresponding DNS query: 159.115.233.16
Source: unknown TCP traffic detected without corresponding DNS query: 57.251.5.212
Source: unknown TCP traffic detected without corresponding DNS query: 72.245.221.128
Source: unknown TCP traffic detected without corresponding DNS query: 189.19.215.140
Source: unknown TCP traffic detected without corresponding DNS query: 66.162.153.144
Source: unknown TCP traffic detected without corresponding DNS query: 85.142.181.174
Source: unknown TCP traffic detected without corresponding DNS query: 90.155.90.118
Source: unknown TCP traffic detected without corresponding DNS query: 124.67.13.223
Source: unknown TCP traffic detected without corresponding DNS query: 184.213.49.239
Source: unknown TCP traffic detected without corresponding DNS query: 108.53.45.131
Source: unknown TCP traffic detected without corresponding DNS query: 54.194.50.205
Source: unknown TCP traffic detected without corresponding DNS query: 112.188.56.124
Source: unknown TCP traffic detected without corresponding DNS query: 220.155.95.139
Source: unknown TCP traffic detected without corresponding DNS query: 32.65.93.240
Source: unknown TCP traffic detected without corresponding DNS query: 121.229.94.201
Source: unknown TCP traffic detected without corresponding DNS query: 83.208.131.98
Source: unknown TCP traffic detected without corresponding DNS query: 186.124.36.68
Source: unknown TCP traffic detected without corresponding DNS query: 37.159.215.255
Source: unknown TCP traffic detected without corresponding DNS query: 99.57.120.64
Source: unknown TCP traffic detected without corresponding DNS query: 193.173.8.39
Source: unknown TCP traffic detected without corresponding DNS query: 141.34.114.179
Source: unknown TCP traffic detected without corresponding DNS query: 205.0.16.164
Source: unknown TCP traffic detected without corresponding DNS query: 78.204.81.45
Source: unknown TCP traffic detected without corresponding DNS query: 90.183.154.29
Source: unknown TCP traffic detected without corresponding DNS query: 186.182.59.209
Source: unknown TCP traffic detected without corresponding DNS query: 154.230.84.167
Source: unknown TCP traffic detected without corresponding DNS query: 18.175.34.243
Source: unknown TCP traffic detected without corresponding DNS query: 102.251.226.126
Source: global traffic DNS traffic detected: DNS query: hikvision.geek
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal64.troj.linELF@0/0@1/0
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6220) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.f4gbqBXrd3 /tmp/tmp.fHTFfS47rG /tmp/tmp.k9UPe8arSy Jump to behavior
Source: /usr/bin/dash (PID: 6221) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.f4gbqBXrd3 /tmp/tmp.fHTFfS47rG /tmp/tmp.k9UPe8arSy Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/nshkarm7.elf (PID: 6248) Queries kernel information via 'uname': Jump to behavior
Source: nshkarm7.elf, 6248.1.00005570cf84a000.00005570cf99f000.rw-.sdmp, nshkarm7.elf, 6250.1.00005570cf84a000.00005570cf99f000.rw-.sdmp, nshkarm7.elf, 6296.1.00005570cf84a000.00005570cf99f000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: nshkarm7.elf, 6248.1.00007ffd83701000.00007ffd83722000.rw-.sdmp, nshkarm7.elf, 6250.1.00007ffd83701000.00007ffd83722000.rw-.sdmp, nshkarm7.elf, 6296.1.00007ffd83701000.00007ffd83722000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: nshkarm7.elf, 6248.1.00005570cf84a000.00005570cf99f000.rw-.sdmp, nshkarm7.elf, 6250.1.00005570cf84a000.00005570cf99f000.rw-.sdmp, nshkarm7.elf, 6296.1.00005570cf84a000.00005570cf99f000.rw-.sdmp Binary or memory string: pU!/etc/qemu-binfmt/arm
Source: nshkarm7.elf, 6248.1.00007ffd83701000.00007ffd83722000.rw-.sdmp, nshkarm7.elf, 6250.1.00007ffd83701000.00007ffd83722000.rw-.sdmp, nshkarm7.elf, 6296.1.00007ffd83701000.00007ffd83722000.rw-.sdmp Binary or memory string: hx86_64/usr/bin/qemu-arm/tmp/nshkarm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nshkarm7.elf
Source: nshkarm7.elf, 6296.1.00007ffd83701000.00007ffd83722000.rw-.sdmp Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: nshkarm7.elf, type: SAMPLE
Source: Yara match File source: 6296.1.00007f5598017000.00007f559802e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6250.1.00007f5598017000.00007f559802e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6248.1.00007f5598017000.00007f559802e000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: nshkarm7.elf, type: SAMPLE
Source: Yara match File source: 6296.1.00007f5598017000.00007f559802e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6250.1.00007f5598017000.00007f559802e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6248.1.00007f5598017000.00007f559802e000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
131.120.255.28
 unknown United States
668 DNIC-AS-00668US false
54.28.188.139
 unknown United States
14618 AMAZON-AESUS false
221.13.21.134
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
12.128.2.3
 unknown United States
7018 ATT-INTERNET4US false
40.3.252.132
 unknown United States
4249 LILLY-ASUS false
190.61.249.170
 unknown Colombia
18747 IFX18747US false
209.196.172.110
 unknown United States
32448 METROCAST-1US false
88.247.14.61
 unknown Turkey
9121 TTNETTR false
140.105.254.119
 unknown Italy
137 ASGARRConsortiumGARREU false
41.3.151.123
 unknown South Africa
29975 VODACOM-ZA false
37.111.12.141
 unknown Myanmar
133385 TELENORMYANMAR-ASTelenorMyanmarMM false
169.202.104.228
 unknown South Africa
37611 AfrihostZA false
206.33.161.78
 unknown United States
3356 LEVEL3US false
135.112.9.66
 unknown United States
10455 LUCENT-CIOUS false
167.58.131.66
 unknown Uruguay
6057 AdministracionNacionaldeTelecomunicacionesUY false
176.224.147.76
 unknown Saudi Arabia
35819 MOBILY-ASEtihadEtisalatCompanyMobilySA false
34.54.98.252
 unknown United States
2686 ATGS-MMD-ASUS false
22.110.57.90
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
191.183.255.90
 unknown Brazil
28573 CLAROSABR false
11.70.172.35
 unknown United States
3356 LEVEL3US false
12.182.77.36
 unknown United States
7018 ATT-INTERNET4US false
49.250.54.106
 unknown Japan 9617 ZAQJupiterTelecommunicationsCoLtdJP false
203.59.6.240
 unknown Australia
4739 INTERNODE-ASInternodePtyLtdAU false
170.169.85.109
 unknown Mexico
2134 GSVNET-ASGSVirtualNetworkProdubanES false
46.134.190.127
 unknown Poland
5617 TPNETPL false
61.93.172.164
 unknown Hong Kong
9269 HKBN-AS-APHongKongBroadbandNetworkLtdHK false
87.209.182.244
 unknown Netherlands
13127 VERSATELASfortheTrans-EuropeanTele2IPTransportbackbo false
18.40.47.184
 unknown United States
3 MIT-GATEWAYSUS false
39.173.184.181
 unknown China
56041 CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC false
154.205.78.194
 unknown Seychelles
8100 ASN-QUADRANET-GLOBALUS false
73.138.219.211
 unknown United States
7922 COMCAST-7922US false
66.241.220.166
 unknown United States
20021 LNH-INCUS false
3.47.75.28
 unknown United States
8987 AMAZONEXPANSIONGB false
215.67.90.206
 unknown United States
495 AFCONC-BLOCK1-ASUS false
171.104.177.74
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
1.33.224.21
 unknown Japan 2514 INFOSPHERENTTPCCommunicationsIncJP false
75.106.34.166
 unknown United States
7155 VIASAT-SP-BACKBONEUS false
125.111.169.130
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
50.174.197.44
 unknown United States
7922 COMCAST-7922US false
96.177.177.102
 unknown United States
7922 COMCAST-7922US false
75.155.101.200
 unknown Canada
852 ASN852CA false
90.255.143.209
 unknown United Kingdom
5378 VodafoneGB false
139.146.59.130
 unknown United States
8968 BT-ITALIAIT false
137.124.179.226
 unknown United States
11351 TWC-11351-NORTHEASTUS false
118.16.102.217
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
134.88.115.66
 unknown United States
394003 UMASSDUS false
160.246.122.46
 unknown Japan 7687 D-CRUISENETTOYOTADIGITALCRUISEINCORPORATEDJP false
104.115.80.125
 unknown United States
1680 NV-ASNCELLCOMltdIL false
175.219.70.189
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
9.143.132.222
 unknown United States
3356 LEVEL3US false
4.176.67.127
 unknown United States
3356 LEVEL3US false
53.105.142.108
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
167.15.101.70
 unknown United States
20426 PWC-ASUS false
174.181.88.8
 unknown United States
7922 COMCAST-7922US false
187.250.247.180
 unknown Mexico
8151 UninetSAdeCVMX false
139.4.86.166
 unknown Germany
702 UUNETUS false
122.224.221.97
 unknown China
58461 CT-HANGZHOU-IDCNo288Fu-chunRoadCN false
184.134.59.177
 unknown United States
5778 CENTURYLINK-LEGACY-EMBARQ-RCMTUS false
135.113.97.83
 unknown United States
10455 LUCENT-CIOUS false
179.93.120.142
 unknown Brazil
26599 TELEFONICABRASILSABR false
213.58.107.23
 unknown Portugal
9186 ONILisbonPortugalPT false
90.33.42.210
 unknown France
3215 FranceTelecom-OrangeFR false
149.3.156.222
 unknown Lebanon
42852 BCDBBN-ASSolidereBeyrouthDowntownMetroEthernetLB false
174.50.238.144
 unknown United States
7922 COMCAST-7922US false
147.196.132.58
 unknown France
2527 SO-NETSo-netEntertainmentCorporationJP false
52.25.84.238
 unknown United States
16509 AMAZON-02US false
123.167.26.31
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
43.5.41.72
 unknown Japan 4249 LILLY-ASUS false
129.57.155.68
 unknown United States
6406 CEBAFUS false
14.232.223.38
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
108.60.223.101
 unknown United States
13354 ZC38-AS1US false
37.189.99.4
 unknown Portugal
3243 MEO-RESIDENCIALPT false
78.126.75.106
 unknown France
8228 CEGETEL-ASFR false
203.102.176.132
 unknown Australia
703 UUNETUS false
28.45.110.211
 unknown United States
7922 COMCAST-7922US false
11.11.78.140
 unknown United States
3356 LEVEL3US false
49.30.132.32
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
99.46.52.25
 unknown United States
7018 ATT-INTERNET4US false
130.230.236.53
 unknown Finland
1739 TUTNETTUTAutonomousSystemEU false
37.12.240.59
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
176.255.192.225
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
38.223.205.247
 unknown United States
174 COGENT-174US false
47.22.179.55
 unknown United States
6128 CABLE-NET-1US false
202.51.249.99
 unknown India
7610 NUS-GP-AS-APNUSGigapopSG false
124.224.22.18
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
37.155.189.32
 unknown Turkey
20978 TT_MOBILIstanbulTR false
17.88.42.173
 unknown United States
714 APPLE-ENGINEERINGUS false
88.116.245.5
 unknown Austria
8447 TELEKOM-ATA1TelekomAustriaAGAT false
38.89.76.198
 unknown United States
174 COGENT-174US false
202.230.67.209
 unknown Japan 4694 IDCFIDCFrontierIncJP false
13.84.235.30
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
188.186.92.249
 unknown Russian Federation
41682 ERTH-TMN-ASRU false
57.164.147.51
 unknown Belgium
2686 ATGS-MMD-ASUS false
60.51.26.151
 unknown Malaysia
4788 TMNET-AS-APTMNetInternetServiceProviderMY false
170.187.70.44
 unknown United States
7018 ATT-INTERNET4US false
223.12.255.223
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
88.61.96.60
 unknown Italy
3269 ASN-IBSNAZIT false
58.251.246.154
 unknown China
17623 CNCGROUP-SZChinaUnicomShenzennetworkCN false
192.48.59.187
 unknown United States
46573 LAYER-HOSTUS false
112.40.230.234
 unknown China
56044 CMNET-AS-LIAONINGChinaMobilecommunicationscorporationC false

Contacted Domains

Name IP Active
hikvision.geek 176.32.32.113 true