Linux Analysis Report
nshkppc.elf

Overview

General Information

Sample name: nshkppc.elf
Analysis ID: 1579402
MD5: 1249843b026b698b5a63e3b1c54df080
SHA1: b38b50d61d79725b3e471a591b52721ae0ee172f
SHA256: aa9e7481708b6922088ac3b2169e18bb31afe9714e341465d450982630f47e92
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: nshkppc.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: nshkppc.elf ReversingLabs: Detection: 31%

Networking
barindex
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: shitrocket.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: hikvision.geek. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: catlovingfools.geek. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: catvision.dyn. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:57256 -> 37.49.226.109:24395
Source: global traffic TCP traffic: 192.168.2.23:37218 -> 37.49.226.105:2243
Source: global traffic TCP traffic: 192.168.2.23:50166 -> 80.78.26.121:2243
Source: global traffic TCP traffic: 192.168.2.23:50134 -> 212.64.215.71:20516
Source: global traffic TCP traffic: 192.168.2.23:43890 -> 212.60.5.153:24633
Sample listens on a socket
Source: /tmp/nshkppc.elf (PID: 6234) Socket: 127.0.0.1:1172 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 88.60.70.45
Source: unknown TCP traffic detected without corresponding DNS query: 168.191.159.167
Source: unknown TCP traffic detected without corresponding DNS query: 64.122.254.79
Source: unknown TCP traffic detected without corresponding DNS query: 53.58.94.69
Source: unknown TCP traffic detected without corresponding DNS query: 105.242.51.35
Source: unknown TCP traffic detected without corresponding DNS query: 126.108.90.228
Source: unknown TCP traffic detected without corresponding DNS query: 61.241.127.15
Source: unknown TCP traffic detected without corresponding DNS query: 71.140.26.134
Source: unknown TCP traffic detected without corresponding DNS query: 31.157.90.208
Source: unknown TCP traffic detected without corresponding DNS query: 23.206.226.73
Source: unknown TCP traffic detected without corresponding DNS query: 113.72.59.31
Source: unknown TCP traffic detected without corresponding DNS query: 76.179.63.38
Source: unknown TCP traffic detected without corresponding DNS query: 108.143.141.44
Source: unknown TCP traffic detected without corresponding DNS query: 9.135.218.104
Source: unknown TCP traffic detected without corresponding DNS query: 47.29.152.9
Source: unknown TCP traffic detected without corresponding DNS query: 24.224.231.83
Source: unknown TCP traffic detected without corresponding DNS query: 78.164.138.74
Source: unknown TCP traffic detected without corresponding DNS query: 40.180.235.46
Source: unknown TCP traffic detected without corresponding DNS query: 206.253.14.201
Source: unknown TCP traffic detected without corresponding DNS query: 31.38.128.245
Source: unknown TCP traffic detected without corresponding DNS query: 126.90.161.78
Source: unknown TCP traffic detected without corresponding DNS query: 66.156.200.216
Source: unknown TCP traffic detected without corresponding DNS query: 14.65.69.63
Source: unknown TCP traffic detected without corresponding DNS query: 75.194.148.48
Source: unknown TCP traffic detected without corresponding DNS query: 219.144.88.32
Source: unknown TCP traffic detected without corresponding DNS query: 162.176.149.4
Source: unknown TCP traffic detected without corresponding DNS query: 50.113.183.108
Source: unknown TCP traffic detected without corresponding DNS query: 206.60.81.244
Source: unknown TCP traffic detected without corresponding DNS query: 206.225.219.29
Source: unknown TCP traffic detected without corresponding DNS query: 97.38.163.246
Source: unknown TCP traffic detected without corresponding DNS query: 207.199.24.154
Source: unknown TCP traffic detected without corresponding DNS query: 197.30.186.255
Source: unknown TCP traffic detected without corresponding DNS query: 34.45.142.13
Source: unknown TCP traffic detected without corresponding DNS query: 223.95.1.92
Source: unknown TCP traffic detected without corresponding DNS query: 179.82.249.17
Source: unknown TCP traffic detected without corresponding DNS query: 20.81.8.68
Source: unknown TCP traffic detected without corresponding DNS query: 136.195.36.235
Source: unknown TCP traffic detected without corresponding DNS query: 32.217.145.222
Source: unknown TCP traffic detected without corresponding DNS query: 123.250.223.26
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.239.65
Source: unknown TCP traffic detected without corresponding DNS query: 209.34.250.10
Source: unknown TCP traffic detected without corresponding DNS query: 135.130.202.9
Source: unknown TCP traffic detected without corresponding DNS query: 216.106.109.74
Source: unknown TCP traffic detected without corresponding DNS query: 126.234.191.217
Source: unknown TCP traffic detected without corresponding DNS query: 133.103.191.145
Source: unknown TCP traffic detected without corresponding DNS query: 107.246.30.213
Source: unknown TCP traffic detected without corresponding DNS query: 18.13.62.152
Source: unknown TCP traffic detected without corresponding DNS query: 55.220.45.178
Source: unknown TCP traffic detected without corresponding DNS query: 140.84.73.172
Source: global traffic DNS traffic detected: DNS query: catvision.dyn
Source: global traffic DNS traffic detected: DNS query: shitrocket.dyn
Source: global traffic DNS traffic detected: DNS query: catlovingfools.geek
Source: global traffic DNS traffic detected: DNS query: shitrocket.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: hikvision.geek. [malformed]
Source: global traffic DNS traffic detected: DNS query: catlovingfools.geek. [malformed]
Source: global traffic DNS traffic detected: DNS query: catvision.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: hikvision.geek
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal68.troj.linELF@0/0@25/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/nshkppc.elf (PID: 6234) Queries kernel information via 'uname': Jump to behavior
Source: nshkppc.elf, 6234.1.000055e467143000.000055e4671f3000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: nshkppc.elf, 6234.1.00007ffd4d818000.00007ffd4d839000.rw-.sdmp, nshkppc.elf, 6236.1.00007ffd4d818000.00007ffd4d839000.rw-.sdmp Binary or memory string: #8x86_64/usr/bin/qemu-ppc/tmp/nshkppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nshkppc.elf
Source: nshkppc.elf, 6236.1.000055e467143000.000055e4671f3000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: nshkppc.elf, 6234.1.000055e467143000.000055e4671f3000.rw-.sdmp, nshkppc.elf, 6236.1.000055e467143000.000055e4671f3000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: nshkppc.elf, 6234.1.00007ffd4d818000.00007ffd4d839000.rw-.sdmp, nshkppc.elf, 6236.1.00007ffd4d818000.00007ffd4d839000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: nshkppc.elf, type: SAMPLE
Source: Yara match File source: 6234.1.00007f4794001000.00007f4794013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6236.1.00007f4794001000.00007f4794013000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: nshkppc.elf, type: SAMPLE
Source: Yara match File source: 6234.1.00007f4794001000.00007f4794013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6236.1.00007f4794001000.00007f4794013000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
89.25.106.83
 unknown Bulgaria
9070 COOOLBOXBG false
82.146.113.109
 unknown Belgium
8201 EVONETNL false
20.95.227.108
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
106.231.205.188
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
19.65.140.112
 unknown United States
3 MIT-GATEWAYSUS false
161.158.243.33
 unknown Netherlands
36351 SOFTLAYERUS false
131.151.152.108
 unknown United States
11348 MSTUS false
145.245.20.11
 unknown Switzerland
2047 ASN-ROCHE-BASLEGlobalcorporateIPnetworkCH false
18.114.62.61
 unknown United States
3 MIT-GATEWAYSUS false
108.174.181.80
 unknown United States
13692 DFN-ASN-1US false
215.43.87.119
 unknown United States
721 DNIC-ASBLK-00721-00726US false
107.2.203.240
 unknown United States
16567 NETRIX-16567US false
167.234.240.208
 unknown United States
3525 ALBERTSONSUS false
142.93.67.183
 unknown United States
14061 DIGITALOCEAN-ASNUS false
5.5.54.254
 unknown Germany
6805 TDDE-ASN1DE false
183.23.36.205
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
181.183.120.174
 unknown Venezuela
262210 VIETTELPERUSACPE false
140.251.34.74
 unknown United States
20252 JSIWMCUS false
170.118.73.69
 unknown United States
22347 DORSEY-WHITNEYUS false
157.203.98.36
 unknown United Kingdom
1759 TSF-IP-CORETeliaFinlandOyjEU false
143.180.1.86
 unknown Switzerland
8803 MIGROSCH false
123.252.200.70
 unknown India
17762 HTIL-TTML-IN-APTataTeleservicesMaharashtraLtdIN false
118.91.228.97
 unknown Indonesia
38525 NETSOFT-AS-IDNetsoftPTID false
90.97.135.170
 unknown France
28708 ORANGEFR-PORTAL-ASDSImutualizedinternetaccessFR false
59.97.9.147
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
17.153.135.81
 unknown United States
714 APPLE-ENGINEERINGUS false
174.220.167.138
 unknown United States
22394 CELLCOUS false
113.183.33.163
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
210.212.47.146
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
123.143.169.237
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
88.43.235.120
 unknown Italy
3269 ASN-IBSNAZIT false
76.198.253.121
 unknown United States
7018 ATT-INTERNET4US false
221.160.166.169
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
190.248.105.13
 unknown Colombia
13489 EPMTelecomunicacionesSAESPCO false
31.247.60.223
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
161.57.69.63
 unknown United States
11206 FSU-AS-1US false
4.72.212.61
 unknown United States
3356 LEVEL3US false
116.81.238.40
 unknown Japan 18144 AS-ENECOMEnergiaCommunicationsIncJP false
179.173.98.63
 unknown Brazil
26599 TELEFONICABRASILSABR false
81.208.26.156
 unknown Italy
12874 FASTWEBIT false
85.191.178.4
 unknown Denmark
43557 ASEMNETDK false
160.212.192.37
 unknown United States
13333 CCI-PA-AS-1US false
61.161.203.214
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
149.140.200.24
 unknown Turkey
8386 KOCNETTR false
151.186.193.182
 unknown United States
45025 EDN-ASUA false
179.111.72.103
 unknown Brazil
27699 TELEFONICABRASILSABR false
133.86.207.48
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
121.7.105.77
 unknown Singapore
9506 SINGTEL-FIBRESingtelFibreBroadbandSG false
43.4.150.190
 unknown Japan 4249 LILLY-ASUS false
89.156.171.181
 unknown France
21502 ASN-NUMERICABLEFR false
87.46.25.34
 unknown Ireland
1213 HEANETIE false
74.32.182.144
 unknown United States
7011 FRONTIER-AND-CITIZENSUS false
121.138.87.170
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
6.58.57.5
 unknown United States
1464 DNIC-ASBLK-01464-01465US false
98.132.241.45
 unknown United States
8473 BAHNHOFhttpwwwbahnhofnetSE false
90.135.166.99
 unknown Sweden
1257 TELE2EU false
160.132.169.241
 unknown United States
721 DNIC-ASBLK-00721-00726US false
82.147.174.245
 unknown Estonia
8728 InfonetEE false
80.68.167.180
 unknown Germany
20918 PI-ASHertzstr61DE false
205.255.98.148
 unknown United States
10801 REGIONS-ASN-1US false
70.207.124.80
 unknown United States
22394 CELLCOUS false
132.164.150.76
 unknown Reserved
6360 UNIVHAWAIIUS false
195.158.190.53
 unknown Germany
20676 PLUSNETDE false
142.130.91.33
 unknown Canada
13576 SDNW-13576US false
13.206.185.231
 unknown United States
7018 ATT-INTERNET4US false
3.136.136.67
 unknown United States
16509 AMAZON-02US false
59.201.103.180
 unknown China
2516 KDDIKDDICORPORATIONJP false
128.239.43.82
 unknown United States
11975 WMUS false
124.138.65.206
 unknown Korea Republic of
18302 SKG_NW-AS-KRSKTelecomKR false
213.37.142.194
 unknown Spain
6739 ONO-ASCableuropa-ONOES false
66.135.222.178
 unknown United States
11643 EBAYUS false
158.16.120.78
 unknown United States
1504 DNIC-AS-01504US false
110.0.162.183
 unknown Japan 10013 FBDCFreeBitCoLtdJP false
38.84.218.17
 unknown United States
174 COGENT-174US false
71.99.245.192
 unknown United States
5650 FRONTIER-FRTRUS false
199.207.163.36
 unknown United States
7227 KPMGL-ASUS false
159.128.249.32
 unknown Canada
25019 SAUDINETSTC-ASSA false
174.230.112.95
 unknown United States
22394 CELLCOUS false
3.193.46.42
 unknown United States
16509 AMAZON-02US false
203.133.111.85
 unknown Taiwan; Republic of China (ROC)
9416 MULTIMEDIA-AS-APHoshinMultimediaCenterIncTW false
67.48.33.46
 unknown United States
11427 TWC-11427-TEXASUS false
148.237.84.24
 unknown Mexico
7325 UniversidadAutonomaDeTamaulipasMX false
202.114.163.249
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
28.229.201.98
 unknown United States
7922 COMCAST-7922US false
175.108.83.128
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
41.14.214.94
 unknown South Africa
29975 VODACOM-ZA false
29.239.190.74
 unknown United States
7922 COMCAST-7922US false
32.250.10.45
 unknown United States
2686 ATGS-MMD-ASUS false
8.24.140.206
 unknown United States
14112 NET-SECURENET-MTLCA false
161.153.47.61
 unknown United States
9328 DATACOM-AUDATACOMSYSTEMSAUPTYLTDAU false
160.200.90.0
 unknown Japan 7670 CTNETEnergiaCommunicationsIncJP false
46.227.239.102
 unknown Netherlands
12871 NL-CONCEPTSNL false
40.65.53.80
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
104.24.135.181
 unknown United States
13335 CLOUDFLARENETUS false
98.198.78.86
 unknown United States
7922 COMCAST-7922US false
102.38.52.64
 unknown South Africa
328529 Zoom-NetworksZA false
76.214.179.106
 unknown United States
7018 ATT-INTERNET4US false
220.218.98.103
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
199.77.28.186
 unknown United States
3549 LVLT-3549US false
169.247.53.214
 unknown United States
557 UMAINE-SYS-ASUS false

Contacted Domains

Name IP Active
catvision.dyn 37.49.226.105 true
catlovingfools.geek 212.60.5.153 true
shitrocket.dyn 185.72.8.231 true
hikvision.geek 212.64.215.71 true
catlovingfools.geek. [malformed] unknown unknown
shitrocket.dyn. [malformed] unknown unknown
hikvision.geek. [malformed] unknown unknown
catvision.dyn. [malformed] unknown unknown