Linux Analysis Report
loligang.sh4.elf

Overview

General Information

Sample name: loligang.sh4.elf
Analysis ID: 1579531
MD5: 65ed6f9b20be77087a195ae03829e0c8
SHA1: 56d2e9bd8a34c1b053c3b6f31d662be0465f6e65
SHA256: f25df1ca82116fbf9a0752cffa4fd49b07ec7a395a0174db8334c1846b234d95
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 80
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: loligang.sh4.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: loligang.sh4.elf ReversingLabs: Detection: 71%
Source: loligang.sh4.elf Virustotal: Detection: 63% Perma Link
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:54134 -> 185.255.120.43:1791
Sample listens on a socket
Source: /tmp/loligang.sh4.elf (PID: 6238) Socket: 0.0.0.0:23 Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6238) Socket: 0.0.0.0:0 Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6238) Socket: 0.0.0.0:80 Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6238) Socket: 0.0.0.0:81 Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6238) Socket: 0.0.0.0:8443 Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6238) Socket: 0.0.0.0:9009 Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) Socket: 0.0.0.0:0 Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) Socket: 0.0.0.0:80 Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) Socket: 0.0.0.0:81 Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) Socket: 0.0.0.0:8443 Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) Socket: 0.0.0.0:9009 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 185.255.120.43
Source: unknown TCP traffic detected without corresponding DNS query: 38.227.190.107
Source: unknown TCP traffic detected without corresponding DNS query: 81.133.157.107
Source: unknown TCP traffic detected without corresponding DNS query: 93.190.205.105
Source: unknown TCP traffic detected without corresponding DNS query: 75.152.53.46
Source: unknown TCP traffic detected without corresponding DNS query: 177.43.59.44
Source: unknown TCP traffic detected without corresponding DNS query: 89.130.130.93
Source: unknown TCP traffic detected without corresponding DNS query: 183.206.139.232
Source: unknown TCP traffic detected without corresponding DNS query: 207.67.121.93
Source: unknown TCP traffic detected without corresponding DNS query: 191.193.156.237
Source: unknown TCP traffic detected without corresponding DNS query: 250.65.118.248
Source: unknown TCP traffic detected without corresponding DNS query: 31.183.211.220
Source: unknown TCP traffic detected without corresponding DNS query: 5.137.41.100
Source: unknown TCP traffic detected without corresponding DNS query: 162.79.77.186
Source: unknown TCP traffic detected without corresponding DNS query: 212.249.126.111
Source: unknown TCP traffic detected without corresponding DNS query: 105.152.65.89
Source: unknown TCP traffic detected without corresponding DNS query: 91.111.139.216
Source: unknown TCP traffic detected without corresponding DNS query: 155.133.27.75
Source: unknown TCP traffic detected without corresponding DNS query: 43.59.165.153
Source: unknown TCP traffic detected without corresponding DNS query: 24.57.22.118
Source: unknown TCP traffic detected without corresponding DNS query: 96.142.101.5
Source: unknown TCP traffic detected without corresponding DNS query: 190.250.42.128
Source: unknown TCP traffic detected without corresponding DNS query: 68.89.222.250
Source: unknown TCP traffic detected without corresponding DNS query: 107.135.88.103
Source: unknown TCP traffic detected without corresponding DNS query: 174.187.202.162
Source: unknown TCP traffic detected without corresponding DNS query: 145.181.165.171
Source: unknown TCP traffic detected without corresponding DNS query: 105.82.241.188
Source: unknown TCP traffic detected without corresponding DNS query: 164.202.8.57
Source: unknown TCP traffic detected without corresponding DNS query: 126.41.250.172
Source: unknown TCP traffic detected without corresponding DNS query: 149.127.230.38
Source: unknown TCP traffic detected without corresponding DNS query: 162.0.180.16
Source: unknown TCP traffic detected without corresponding DNS query: 141.99.88.236
Source: unknown TCP traffic detected without corresponding DNS query: 142.16.126.123
Source: unknown TCP traffic detected without corresponding DNS query: 207.27.194.56
Source: unknown TCP traffic detected without corresponding DNS query: 212.59.243.242
Source: unknown TCP traffic detected without corresponding DNS query: 88.112.39.134
Source: unknown TCP traffic detected without corresponding DNS query: 46.224.31.220
Source: unknown TCP traffic detected without corresponding DNS query: 219.148.223.183
Source: unknown TCP traffic detected without corresponding DNS query: 202.149.105.60
Source: unknown TCP traffic detected without corresponding DNS query: 24.112.82.87
Source: unknown TCP traffic detected without corresponding DNS query: 126.154.157.123
Source: unknown TCP traffic detected without corresponding DNS query: 76.49.251.66
Source: unknown TCP traffic detected without corresponding DNS query: 5.62.13.102
Source: unknown TCP traffic detected without corresponding DNS query: 192.0.132.134
Source: unknown TCP traffic detected without corresponding DNS query: 96.1.55.228
Source: unknown TCP traffic detected without corresponding DNS query: 83.57.234.46
Source: unknown TCP traffic detected without corresponding DNS query: 219.116.128.221
Source: unknown TCP traffic detected without corresponding DNS query: 109.140.147.69
Source: unknown TCP traffic detected without corresponding DNS query: 40.177.49.44
Source: unknown TCP traffic detected without corresponding DNS query: 27.20.62.3
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: loligang.sh4.elf, type: SAMPLE Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: loligang.sh4.elf, type: SAMPLE Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6239.1.00007fb60c400000.00007fb60c410000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6239.1.00007fb60c400000.00007fb60c410000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6246.1.00007fb60c400000.00007fb60c410000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6246.1.00007fb60c400000.00007fb60c410000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6236.1.00007fb60c400000.00007fb60c410000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6236.1.00007fb60c400000.00007fb60c410000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/loligang.sh4.elf (PID: 6238) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) SIGKILL sent: pid: 6238, result: successful Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) SIGKILL sent: pid: 759, result: successful Jump to behavior
Yara signature match
Source: loligang.sh4.elf, type: SAMPLE Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: loligang.sh4.elf, type: SAMPLE Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6239.1.00007fb60c400000.00007fb60c410000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6239.1.00007fb60c400000.00007fb60c410000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6246.1.00007fb60c400000.00007fb60c410000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6246.1.00007fb60c400000.00007fb60c410000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6236.1.00007fb60c400000.00007fb60c410000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6236.1.00007fb60c400000.00007fb60c410000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: classification engine Classification label: mal80.troj.linELF@0/0@0/0
Enumerates processes within the "proc" file system
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/2033/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/2033/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1582/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1582/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/2275/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1612/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1612/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1579/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1579/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1699/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1699/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1335/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1335/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1698/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1698/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/2028/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/2028/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1334/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1334/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1576/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1576/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/2302/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/3236/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/2025/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/2025/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/2146/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/910/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/912/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/912/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/912/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/759/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/759/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/759/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/517/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/2307/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/918/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/918/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/918/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1594/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1594/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/2285/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/2281/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1349/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1349/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1623/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1623/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/761/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/761/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/761/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1622/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1622/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/884/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/884/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/884/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1983/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1983/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/2038/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/2038/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1586/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1586/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1465/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1465/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1344/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1344/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1860/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1860/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1463/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1463/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/2156/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/800/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/800/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/800/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/6238/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/801/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/801/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/801/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1629/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1629/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1627/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1627/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1900/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1900/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/491/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/491/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/491/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/2294/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/2050/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/2050/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1877/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1877/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/772/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/772/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/772/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1633/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1633/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1599/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1599/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1632/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1632/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1477/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/1477/exe Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/774/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/774/fd Jump to behavior
Source: /tmp/loligang.sh4.elf (PID: 6244) File opened: /proc/774/exe Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/loligang.sh4.elf (PID: 6236) Queries kernel information via 'uname': Jump to behavior
Source: loligang.sh4.elf, 6236.1.00007ffdc28f1000.00007ffdc2912000.rw-.sdmp, loligang.sh4.elf, 6239.1.00007ffdc28f1000.00007ffdc2912000.rw-.sdmp, loligang.sh4.elf, 6246.1.00007ffdc28f1000.00007ffdc2912000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: loligang.sh4.elf, 6236.1.000055f9ac9de000.000055f9aca41000.rw-.sdmp, loligang.sh4.elf, 6239.1.000055f9ac9de000.000055f9aca41000.rw-.sdmp, loligang.sh4.elf, 6246.1.000055f9ac9de000.000055f9aca41000.rw-.sdmp Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: loligang.sh4.elf, 6236.1.000055f9ac9de000.000055f9aca41000.rw-.sdmp, loligang.sh4.elf, 6239.1.000055f9ac9de000.000055f9aca41000.rw-.sdmp, loligang.sh4.elf, 6246.1.000055f9ac9de000.000055f9aca41000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4
Source: loligang.sh4.elf, 6236.1.00007ffdc28f1000.00007ffdc2912000.rw-.sdmp, loligang.sh4.elf, 6239.1.00007ffdc28f1000.00007ffdc2912000.rw-.sdmp, loligang.sh4.elf, 6246.1.00007ffdc28f1000.00007ffdc2912000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/loligang.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/loligang.sh4.elf

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: loligang.sh4.elf, type: SAMPLE
Source: Yara match File source: 6239.1.00007fb60c400000.00007fb60c410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6246.1.00007fb60c400000.00007fb60c410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6236.1.00007fb60c400000.00007fb60c410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: loligang.sh4.elf PID: 6239, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: loligang.sh4.elf, type: SAMPLE
Source: Yara match File source: 6239.1.00007fb60c400000.00007fb60c410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6246.1.00007fb60c400000.00007fb60c410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6236.1.00007fb60c400000.00007fb60c410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: loligang.sh4.elf PID: 6239, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
145.159.244.22
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
209.77.183.106
 unknown United States
7132 SBIS-ASUS false
36.51.99.108
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
209.197.23.2
 unknown United States
33438 HIGHWINDS2US false
139.226.219.238
 unknown China
17621 CNCGROUP-SHChinaUnicomShanghainetworkCN false
180.44.23.101
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
172.242.224.92
 unknown United States
7155 VIASAT-SP-BACKBONEUS false
194.62.116.165
 unknown United Kingdom
202053 UPCLOUDFI false
87.44.85.54
 unknown Ireland
1213 HEANETIE false
190.132.106.90
 unknown Uruguay
6057 AdministracionNacionaldeTelecomunicacionesUY false
77.25.21.10
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
241.202.238.92
 unknown Reserved
unknown unknown false
249.41.17.70
 unknown Reserved
unknown unknown false
152.96.147.80
 unknown Switzerland
559 SWITCHPeeringrequestspeeringswitchchEU false
24.157.11.101
 unknown United States
19108 SUDDENLINK-COMMUNICATIONSUS false
159.239.168.53
 unknown United Kingdom
14977 STATE-OF-WYOMING-ASNUS false
142.119.117.228
 unknown Canada
577 BACOMCA false
65.217.170.6
 unknown United States
13518 CDAC-AS-1US false
104.72.108.202
 unknown United States
16625 AKAMAI-ASUS false
93.180.197.77
 unknown Ukraine
31343 INTERTELECOMUA false
68.5.229.36
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
5.235.138.167
 unknown Iran (ISLAMIC Republic Of)
58224 TCIIR false
112.35.121.181
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
196.178.124.11
 unknown Tunisia
37693 TUNISIANATN false
149.156.152.51
 unknown Poland
8267 CYFRONET-ASMetropolitanAreaNetworkAutonomousSystemPL false
173.230.62.68
 unknown United States
23473 PAVLOVMEDIAUS false
162.30.8.128
 unknown United States
46483 RGHSUS false
118.144.216.65
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
212.160.6.20
 unknown Poland
5617 TPNETPL false
181.231.197.214
 unknown Argentina
10481 TelecomArgentinaSAAR false
105.15.223.41
 unknown South Africa
37168 CELL-CZA false
218.51.113.144
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
155.110.130.25
 unknown United States
1906 NORTHROP-GRUMMANUS false
167.125.41.133
 unknown Canada
2055 LSU-1US false
12.103.188.228
 unknown United States
7018 ATT-INTERNET4US false
17.56.12.74
 unknown United States
714 APPLE-ENGINEERINGUS false
57.149.133.181
 unknown Belgium
2686 ATGS-MMD-ASUS false
164.54.141.141
 unknown United States
683 ARGONNE-ASUS false
77.6.119.202
 unknown Germany
6805 TDDE-ASN1DE false
244.97.162.132
 unknown Reserved
unknown unknown false
174.204.84.79
 unknown United States
22394 CELLCOUS false
54.137.103.116
 unknown United States
14618 AMAZON-AESUS false
173.82.220.212
 unknown United States
35916 MULTA-ASN1US false
184.35.240.133
 unknown United States
5778 CENTURYLINK-LEGACY-EMBARQ-RCMTUS false
169.43.150.228
 unknown Switzerland
37611 AfrihostZA false
19.80.173.170
 unknown United States
3 MIT-GATEWAYSUS false
252.195.185.2
 unknown Reserved
unknown unknown false
2.53.123.195
 unknown Israel
12400 PARTNER-ASIL false
76.158.7.13
 unknown United States
7922 COMCAST-7922US false
144.19.145.131
 unknown United States
58541 CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN false
192.48.153.123
 unknown United States
unknown unknown false
245.117.6.254
 unknown Reserved
unknown unknown false
19.96.160.154
 unknown United States
3 MIT-GATEWAYSUS false
110.41.246.175
 unknown China
59011 YLWLBeijingYunlinNetworkTechnologyCoLtdCN false
45.68.234.28
 unknown unknown
55660 MWN-AS-IDPTMasterWebNetworkID false
2.141.205.71
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
124.0.64.134
 unknown Korea Republic of
18302 SKG_NW-AS-KRSKTelecomKR false
200.51.231.124
 unknown Argentina
10834 TelefonicadeArgentinaAR false
121.36.176.226
 unknown China
55990 HWCSNETHuaweiCloudServicedatacenterCN false
117.53.241.13
 unknown Korea Republic of
9770 SPEEDONSTV-AS-KRLGHelloVisionCorpKR false
109.245.66.114
 unknown Serbia
15958 TELENOR_DOO_ASTelenordoo-NETRS false
69.142.36.81
 unknown United States
7922 COMCAST-7922US false
73.5.100.109
 unknown United States
7922 COMCAST-7922US false
81.53.6.175
 unknown France
3215 FranceTelecom-OrangeFR false
216.236.214.226
 unknown United States
12684 SES-LUX-ASLU false
117.76.116.108
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
31.219.176.50
 unknown United Arab Emirates
5384 EMIRATES-INTERNETEmiratesInternetAE false
98.195.172.139
 unknown United States
7922 COMCAST-7922US false
169.40.32.60
 unknown United States
37611 AfrihostZA false
117.174.40.99
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
156.222.129.34
 unknown Egypt
8452 TE-ASTE-ASEG false
188.232.219.220
 unknown Russian Federation
41843 ERTH-OMSK-ASRU false
64.252.106.176
 unknown United States
16509 AMAZON-02US false
243.80.203.178
 unknown Reserved
unknown unknown false
178.37.151.227
 unknown Poland
12741 AS-NETIAWarszawa02-822PL false
115.69.13.69
 unknown Australia
18390 SPIN-INTERNET-APSpinInternetServiceAU false
190.12.131.97
 unknown Colombia
22724 PUNTONETSAEC false
162.158.254.178
 unknown United States
13335 CLOUDFLARENETUS false
125.212.134.177
 unknown Viet Nam
7552 VIETEL-AS-APViettelGroupVN false
74.197.200.244
 unknown United States
19108 SUDDENLINK-COMMUNICATIONSUS false
151.138.242.113
 unknown United States
6482 SUPER-AS1US false
242.209.214.29
 unknown Reserved
unknown unknown false
197.248.162.96
 unknown Kenya
37061 SafaricomKE false
205.150.31.254
 unknown United States
701 UUNETUS false
241.70.159.117
 unknown Reserved
unknown unknown false
182.81.96.196
 unknown China
23771 SXBCTV-APSXBCTVInternetServiceProviderCN false
160.101.255.200
 unknown United States
25940 TIBCOUS false
170.142.153.234
 unknown United States
4454 TNET-ASUS false
86.230.56.101
 unknown France
3215 FranceTelecom-OrangeFR false
99.233.65.136
 unknown Canada
812 ROGERS-COMMUNICATIONSCA false
111.200.104.170
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
176.218.165.64
 unknown Turkey
8386 KOCNETTR false
123.163.227.84
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
105.70.157.127
 unknown Morocco
36884 MAROCCONNECTMA false
73.150.3.34
 unknown United States
7922 COMCAST-7922US false
58.184.195.212
 unknown Korea Republic of
9950 PUBNETPLUS2-AS-KRDACOM-PUBNETPLUSKR false
203.86.105.40
 unknown China
4755 TATACOMM-ASTATACommunicationsformerlyVSNLisLeadingISP false
82.154.64.187
 unknown Portugal
3243 MEO-RESIDENCIALPT false
170.232.43.114
 unknown United States
11685 HNBCOL-ASUS false
240.7.198.245
 unknown Reserved
unknown unknown false