Linux Analysis Report
arm.elf

Overview

General Information

Sample name: arm.elf
Analysis ID: 1579393
MD5: b40e5bc797d1ec99d0b3402f6901af40
SHA1: fd21c79b5606f3469979f12abac390b1aefa054d
SHA256: d41713a5fec2dcfbfaac5cb6df433a801f1f49af16b9704df7beb731b8e5df8d
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai, Moobot
Score: 88
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Moobot
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
Name Description Attribution Blogpost URLs Link
MooBot No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: arm.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: arm.elf Virustotal: Detection: 59% Perma Link
Source: arm.elf ReversingLabs: Detection: 73%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:51882 -> 209.141.47.117:1999
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 209.141.47.117
Source: unknown TCP traffic detected without corresponding DNS query: 39.122.98.228
Source: unknown TCP traffic detected without corresponding DNS query: 13.61.193.78
Source: unknown TCP traffic detected without corresponding DNS query: 40.194.62.228
Source: unknown TCP traffic detected without corresponding DNS query: 125.196.14.24
Source: unknown TCP traffic detected without corresponding DNS query: 85.209.253.231
Source: unknown TCP traffic detected without corresponding DNS query: 66.99.1.200
Source: unknown TCP traffic detected without corresponding DNS query: 117.108.230.252
Source: unknown TCP traffic detected without corresponding DNS query: 37.171.209.5
Source: unknown TCP traffic detected without corresponding DNS query: 39.92.124.115
Source: unknown TCP traffic detected without corresponding DNS query: 44.226.35.115
Source: unknown TCP traffic detected without corresponding DNS query: 97.101.108.9
Source: unknown TCP traffic detected without corresponding DNS query: 94.179.81.71
Source: unknown TCP traffic detected without corresponding DNS query: 206.254.229.151
Source: unknown TCP traffic detected without corresponding DNS query: 120.246.69.238
Source: unknown TCP traffic detected without corresponding DNS query: 246.90.214.52
Source: unknown TCP traffic detected without corresponding DNS query: 48.72.107.102
Source: unknown TCP traffic detected without corresponding DNS query: 211.81.36.144
Source: unknown TCP traffic detected without corresponding DNS query: 107.197.245.222
Source: unknown TCP traffic detected without corresponding DNS query: 254.38.68.87
Source: unknown TCP traffic detected without corresponding DNS query: 161.238.6.104
Source: unknown TCP traffic detected without corresponding DNS query: 23.45.2.161
Source: unknown TCP traffic detected without corresponding DNS query: 172.62.36.13
Source: unknown TCP traffic detected without corresponding DNS query: 203.54.114.181
Source: unknown TCP traffic detected without corresponding DNS query: 106.200.78.138
Source: unknown TCP traffic detected without corresponding DNS query: 32.16.145.233
Source: unknown TCP traffic detected without corresponding DNS query: 143.21.180.103
Source: unknown TCP traffic detected without corresponding DNS query: 176.61.116.86
Source: unknown TCP traffic detected without corresponding DNS query: 85.166.45.119
Source: unknown TCP traffic detected without corresponding DNS query: 202.112.38.238
Source: unknown TCP traffic detected without corresponding DNS query: 106.212.87.90
Source: unknown TCP traffic detected without corresponding DNS query: 164.69.30.104
Source: unknown TCP traffic detected without corresponding DNS query: 17.224.22.178
Source: unknown TCP traffic detected without corresponding DNS query: 77.239.218.131
Source: unknown TCP traffic detected without corresponding DNS query: 198.33.61.83
Source: unknown TCP traffic detected without corresponding DNS query: 121.19.170.52
Source: unknown TCP traffic detected without corresponding DNS query: 197.53.130.170
Source: unknown TCP traffic detected without corresponding DNS query: 99.139.54.23
Source: unknown TCP traffic detected without corresponding DNS query: 247.208.78.213
Source: unknown TCP traffic detected without corresponding DNS query: 220.11.159.196
Source: unknown TCP traffic detected without corresponding DNS query: 118.141.55.198
Source: unknown TCP traffic detected without corresponding DNS query: 64.236.189.18
Source: unknown TCP traffic detected without corresponding DNS query: 197.163.31.49
Source: unknown TCP traffic detected without corresponding DNS query: 80.78.228.120
Source: unknown TCP traffic detected without corresponding DNS query: 159.185.250.204
Source: unknown TCP traffic detected without corresponding DNS query: 17.28.60.120
Source: unknown TCP traffic detected without corresponding DNS query: 82.18.126.47
Source: unknown TCP traffic detected without corresponding DNS query: 123.164.233.150
Source: unknown TCP traffic detected without corresponding DNS query: 27.170.137.149
Source: unknown TCP traffic detected without corresponding DNS query: 251.91.36.152
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: arm.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: arm.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: arm.elf, type: SAMPLE Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6240.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6240.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6240.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6249.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6249.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6249.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6243.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6243.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6243.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: Process Memory Space: arm.elf PID: 6240, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: arm.elf PID: 6240, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: arm.elf PID: 6243, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: arm.elf PID: 6243, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: arm.elf PID: 6249, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: arm.elf PID: 6249, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Yara signature match
Source: arm.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: arm.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: arm.elf, type: SAMPLE Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6240.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6240.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6240.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6249.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6249.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6249.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6243.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6243.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6243.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: Process Memory Space: arm.elf PID: 6240, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: arm.elf PID: 6240, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: arm.elf PID: 6243, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: arm.elf PID: 6243, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: arm.elf PID: 6249, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: arm.elf PID: 6249, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: classification engine Classification label: mal88.troj.linELF@0/0@0/0
Enumerates processes within the "proc" file system
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1582/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2033/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2275/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/3088/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/6193/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/6195/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1612/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1579/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1699/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1335/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1698/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2028/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1334/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1576/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2302/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/3236/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2025/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2146/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/910/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/4444/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/4445/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/912/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/4446/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/517/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/759/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2307/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/918/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/6245/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1594/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2285/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2281/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1349/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1623/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/761/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1622/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/884/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1983/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2038/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1344/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1465/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1586/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1463/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2156/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/800/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/801/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1629/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1627/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1900/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/6251/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/6254/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/3021/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/491/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2294/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2050/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1877/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/772/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1633/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1599/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1632/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/774/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1477/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/654/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/896/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1476/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1872/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2048/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/655/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1475/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2289/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/656/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/777/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/657/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/6249/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/658/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/6248/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/4501/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/419/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/936/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1639/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1638/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2208/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2180/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1809/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1494/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1890/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2063/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2062/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1888/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1886/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/420/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1489/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/785/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1642/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/788/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/667/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/789/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/4512/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/1648/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/4530/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2078/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2077/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2074/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2195/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/670/cmdline Jump to behavior
Source: /tmp/arm.elf (PID: 6242) File opened: /proc/2746/cmdline Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/arm.elf (PID: 6240) Queries kernel information via 'uname': Jump to behavior
Source: arm.elf, 6240.1.00007ffd58d63000.00007ffd58d84000.rw-.sdmp, arm.elf, 6243.1.00007ffd58d63000.00007ffd58d84000.rw-.sdmp, arm.elf, 6249.1.00007ffd58d63000.00007ffd58d84000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm.elf
Source: arm.elf, 6240.1.0000556fabb8e000.0000556fabcbc000.rw-.sdmp, arm.elf, 6243.1.0000556fabb8e000.0000556fabcbc000.rw-.sdmp, arm.elf, 6249.1.0000556fabb8e000.0000556fabcbc000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: arm.elf, 6240.1.00007ffd58d63000.00007ffd58d84000.rw-.sdmp, arm.elf, 6243.1.00007ffd58d63000.00007ffd58d84000.rw-.sdmp, arm.elf, 6249.1.00007ffd58d63000.00007ffd58d84000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: arm.elf, 6240.1.0000556fabb8e000.0000556fabcbc000.rw-.sdmp, arm.elf, 6243.1.0000556fabb8e000.0000556fabcbc000.rw-.sdmp, arm.elf, 6249.1.0000556fabb8e000.0000556fabcbc000.rw-.sdmp Binary or memory string: oU!/etc/qemu-binfmt/arm

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: arm.elf, type: SAMPLE
Source: Yara match File source: 6240.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6249.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6243.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: arm.elf PID: 6240, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: arm.elf PID: 6243, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: arm.elf PID: 6249, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: arm.elf, type: SAMPLE
Source: Yara match File source: 6240.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6249.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6243.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: arm.elf PID: 6240, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: arm.elf PID: 6243, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: arm.elf PID: 6249, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: arm.elf, type: SAMPLE
Source: Yara match File source: 6240.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6249.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6243.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: arm.elf PID: 6240, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: arm.elf PID: 6243, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: arm.elf PID: 6249, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: arm.elf, type: SAMPLE
Source: Yara match File source: 6240.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6249.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6243.1.00007f9708017000.00007f970802e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: arm.elf PID: 6240, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: arm.elf PID: 6243, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: arm.elf PID: 6249, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
59.154.204.194
 unknown Australia
7474 OPTUSCOM-AS01-AUSingTelOptusPtyLtdAU false
101.52.224.120
 unknown China
45079 GDSNETGDSCHANGANSERVICESLtdCN false
245.87.95.121
 unknown Reserved
unknown unknown false
180.203.3.29
 unknown China
9814 FIBRLINKBeijingFibrLINKNetworksCoLtdCN false
194.6.179.192
 unknown Switzerland
35276 RDMCH false
201.43.221.181
 unknown Brazil
27699 TELEFONICABRASILSABR false
87.189.248.238
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
8.171.34.4
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
71.9.203.237
 unknown United States
20115 CHARTER-20115US false
24.183.211.223
 unknown United States
20115 CHARTER-20115US false
208.84.131.62
 unknown United States
33491 COMCAST-33491US false
89.133.176.66
 unknown Hungary
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
186.83.146.243
 unknown Colombia
10620 TelmexColombiaSACO false
48.191.183.238
 unknown United States
2686 ATGS-MMD-ASUS false
86.105.229.243
 unknown United Kingdom
398217 GUIDANCE-HOSTING-US false
90.184.173.185
 unknown Denmark
39554 FULLRATEDK false
220.111.138.209
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
75.74.47.232
 unknown United States
7922 COMCAST-7922US false
43.42.50.140
 unknown Japan 4249 LILLY-ASUS false
35.45.206.46
 unknown United States
36375 UMICH-AS-5US false
149.138.220.223
 unknown United States
3356 LEVEL3US false
250.183.176.147
 unknown Reserved
unknown unknown false
74.148.212.79
 unknown United States
7922 COMCAST-7922US false
188.41.63.37
 unknown Turkey
20978 TT_MOBILIstanbulTR false
12.172.204.203
 unknown United States
2386 INS-ASUS false
35.52.44.158
 unknown United States
36375 UMICH-AS-5US false
72.118.27.12
 unknown United States
22394 CELLCOUS false
59.233.132.6
 unknown China
2516 KDDIKDDICORPORATIONJP false
121.0.87.32
 unknown Korea Republic of
18328 DOTNAME-AS-KRDotnameKoreaCorpKR false
203.160.237.29
 unknown Taiwan; Republic of China (ROC)
9505 TWGATE-APTaiwanInternetGatewayTW false
80.142.180.175
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
13.69.143.152
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
85.121.11.137
 unknown Romania
25103 ADISANRO false
178.128.106.17
 unknown Netherlands
14061 DIGITALOCEAN-ASNUS false
83.186.224.121
 unknown Sweden
1257 TELE2EU false
209.111.33.254
 unknown United States
7029 WINDSTREAMUS false
115.168.28.218
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
13.161.16.226
 unknown United States
7018 ATT-INTERNET4US false
103.83.130.152
 unknown India
136724 PRACNETW-ASPractionNetworksPvtLtdIN false
216.83.81.254
 unknown United States
30346 TBDUS false
73.71.89.237
 unknown United States
7922 COMCAST-7922US false
113.32.51.49
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
223.1.83.223
 unknown China
63555 CNBIDCCBeijingBeilongYunhaiNetworkDataTechnologyCorpo false
213.2.136.192
 unknown United Kingdom
8426 CLARANET-ASClaraNETLTDGB false
75.34.206.143
 unknown United States
7018 ATT-INTERNET4US false
139.182.67.183
 unknown United States
2152 CSUNET-NWUS false
9.222.238.96
 unknown United States
3356 LEVEL3US false
162.64.50.70
 unknown United States
35893 ACPCA false
104.223.82.214
 unknown United States
8100 ASN-QUADRANET-GLOBALUS false
253.23.224.196
 unknown Reserved
unknown unknown false
248.133.158.55
 unknown Reserved
unknown unknown false
110.3.191.209
 unknown Japan 10013 FBDCFreeBitCoLtdJP false
83.20.10.81
 unknown Poland
5617 TPNETPL false
183.27.238.183
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
223.216.129.87
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
1.109.97.121
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
207.206.177.118
 unknown United States
5656 ACCESSUS-DOMUS false
176.28.64.65
 unknown Russian Federation
47684 FCOMM-ASRU false
71.25.178.62
 unknown United States
7922 COMCAST-7922US false
86.115.48.168
 unknown Finland
1759 TSF-IP-CORETeliaFinlandOyjEU false
75.208.122.124
 unknown United States
22394 CELLCOUS false
35.193.205.137
 unknown United States
15169 GOOGLEUS false
139.193.211.207
 unknown Indonesia
23700 FASTNET-AS-IDLinknet-FastnetASNID false
163.74.166.199
 unknown France
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
41.172.207.50
 unknown South Africa
36937 Neotel-ASZA false
158.234.40.123
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
86.219.190.30
 unknown France
3215 FranceTelecom-OrangeFR false
80.24.159.71
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
207.75.88.5
 unknown United States
237 MERIT-AS-14US false
70.2.128.100
 unknown United States
10507 SPCSUS false
203.151.84.166
 unknown Thailand
4618 INET-TH-ASInternetThailandCompanyLimitedTH false
209.216.157.186
 unknown Canada
15127 CHATHAM-INTERNET-ACCESSCA false
171.4.79.142
 unknown Thailand
45758 TRIPLETNET-AS-APTripleTInternetTripleTBroadbandTH false
71.248.203.40
 unknown United States
701 UUNETUS false
254.36.93.6
 unknown Reserved
unknown unknown false
44.32.149.163
 unknown United States
7377 UCSDUS false
202.177.233.250
 unknown India
24554 FIVE-NET-AS-INFivenetworkSolutionIndiaPvtLtdInternet false
249.90.13.37
 unknown Reserved
unknown unknown false
121.224.195.11
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
121.35.187.17
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
69.128.206.39
 unknown United States
4181 TDS-ASUS false
182.211.254.183
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
146.89.185.120
 unknown United States
17153 NMT-ASUS false
98.241.109.39
 unknown United States
7922 COMCAST-7922US false
123.49.88.139
 unknown Singapore
17494 BTTB-AS-APTelecomOperatorInternetServiceProviderasw false
81.141.92.19
 unknown United Kingdom
6871 PLUSNETUKInternetServiceProviderGB false
166.166.70.157
 unknown United States
22394 CELLCOUS false
206.107.144.68
 unknown United States
1239 SPRINTLINKUS false
155.228.154.41
 unknown Switzerland
25021 CIEF-ASEtatdeFribourgSITelCH false
121.28.250.100
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
162.236.241.9
 unknown United States
7018 ATT-INTERNET4US false
13.122.1.22
 unknown United States
16509 AMAZON-02US false
103.169.35.199
 unknown unknown
7575 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe false
73.250.141.110
 unknown United States
7922 COMCAST-7922US false
190.45.54.143
 unknown Chile
22047 VTRBANDAANCHASACL false
139.235.37.146
 unknown United States
1462 DNIC-ASBLK-01462-01463US false
61.56.228.241
 unknown Taiwan; Republic of China (ROC)
9919 NCIC-TWNewCenturyInfoCommTechCoLtdTW false
175.53.148.178
 unknown China
134810 CMNET-JILIN-AS-APChinaMobileGroupJiLincommunicationsco false
182.219.78.62
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
73.254.247.181
 unknown United States
7922 COMCAST-7922US false