Linux Analysis Report
efefa7.elf

Overview

General Information

Sample name: efefa7.elf
Analysis ID: 1649551
MD5: 7680ab1d5888a665c5d5a1c4be985cd0
SHA1: 6db351e9f2eabb37f8c6b5efbe8dd913340e01ea
SHA256: a5e3e7a27988bb59e06e7fddd223c803a939a4af9403a0e7f94f1fd35072a3d8
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 76
Range: 0 - 100

Signatures

Multi AV Scanner detection for submitted file
Yara detected Mirai
Manipulation of devices in /dev
Sample deletes itself
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Found strings indicative of a multi-platform dropper
Sample and/or dropped files contains symbols with suspicious names
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: efefa7.elf ReversingLabs: Detection: 30%
Source: unknown HTTPS traffic detected: 54.171.230.55:443 -> 192.168.2.23:33608 version: TLS 1.2
Source: unknown HTTPS traffic detected: 192.168.2.23:33608 -> 54.171.230.55:443 version: TLS 1.2
Found strings indicative of a multi-platform dropper
Source: efefa7.elf String: /lib/systemd//usr/lib/systemd/system/system/bin//gm/bin//home/process//home/helper/home/davinci/z/bin//mnt/mtd//tmp/sqfs//usr/libexec//usr/sbin//z/zbin//usr/bin/bin//tmp/var/mnt/root/boot/home/dev/media/opt/../(deleted)x86armmipsmpslsh4wgetcurllynxftpftpgettftpscpaflaaarsyncpfclamscanreadelfizsnapstracelsofgdbpmapltraceptracewiresharktsharktcpdumpnetstatssnmaphping3tracerouteiptablesnftfirewalldauditctlselinuxapparmoraptdnfyumzypperpacmanemergebrewportnanovimvinvimgeditkateemacspkillkillallkillsystemctlservicenohuppythonpython3perlrubyluanodebashshkshzshfishvolatilitychkrootkitrkhunterradare2binwalkdockerpodmanlxcqemuvirshvboxmanagemountumountdfdulsblkblkidmkfsfdiskpartedobjdumpstringsxxdhexdumpncnetcatsocatjournalctldmesglogcattaillessgrepawksedtmux%s/%s/data/local/tmp/sbin/dev/null/dev/console/var/lib/dockerkworker/u8:0raw.awaken-network.net/proc/self/cmdline/proc/%d/statusName:-

Networking
barindex
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: raw.awaken-network.net. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:50618 -> 141.98.10.142:7733
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: global traffic DNS traffic detected: DNS query: raw.awaken-network.net
Source: global traffic DNS traffic detected: DNS query: raw.awaken-network.net. [malformed]
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 33608
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 33608 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown HTTPS traffic detected: 54.171.230.55:443 -> 192.168.2.23:33608 version: TLS 1.2
Source: unknown HTTPS traffic detected: 192.168.2.23:33608 -> 54.171.230.55:443 version: TLS 1.2
Sample and/or dropped files contains symbols with suspicious names
Source: efefa7.elf ELF static info symbol of initial sample: __gnu_unwind_execute
Sample tries to kill a process (SIGKILL)
Source: /tmp/efefa7.elf (PID: 6216) SIGKILL sent: pid: 777, result: successful Jump to behavior
Source: classification engine Classification label: mal76.troj.evad.linELF@0/4@6/0

Data Obfuscation
barindex
Manipulation of devices in /dev
Source: /tmp/efefa7.elf (PID: 6220) Deleted: /dev/null Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/66/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/66/cmdline Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/66/stat Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/44/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/22/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/22/stat Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/22/cmdline Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/22/stat Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/22/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/22/stat Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/22/cmdline Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/22/stat Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/22/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/44444/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/111114/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/111/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/111/cmdline Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/111/stat Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/111/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/111/cmdline Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/111/stat Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/111/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/333/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/333/cmdline Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/333/stat Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/333/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/333/cmdline Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/333/stat Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/333/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/33333/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/777/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/777/cmdline Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/777/stat Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/777/fd Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/777/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/777/cmdline Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/777/stat Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/1111/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/2222/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/3333/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/5555/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/4444/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/999/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/999/cmdline Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/999/stat Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/6666/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/7777/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/8888/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/9999/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/33/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/33/stat Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/33/cmdline Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/11/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/11/stat Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/11/cmdline Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/11/stat Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/11/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/11/stat Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/11/cmdline Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/11/stat Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/11/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/99/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/99/cmdline Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/99/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/99/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/66666/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/22222/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/222226/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/222/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/222/cmdline Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/222/stat Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/222/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/222/cmdline Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/222/stat Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/222/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/888/maps Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/888/cmdline Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/888/stat Jump to behavior
Source: /tmp/efefa7.elf (PID: 6216) File opened: /proc/11111/maps Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6222) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.FO5ZfineMZ /tmp/tmp.v0FO74aAEU /tmp/tmp.XjvKqPdygn Jump to behavior
Source: /usr/bin/dash (PID: 6231) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.FO5ZfineMZ /tmp/tmp.v0FO74aAEU /tmp/tmp.XjvKqPdygn Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Sample deletes itself
Source: /tmp/efefa7.elf (PID: 6214) File: /tmp/efefa7.elf Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/efefa7.elf (PID: 6212) Queries kernel information via 'uname': Jump to behavior
Source: efefa7.elf Binary or memory string: /lib/systemd//usr/lib/systemd/system/system/bin//gm/bin//home/process//home/helper/home/davinci/z/bin//mnt/mtd//tmp/sqfs//usr/libexec//usr/sbin//z/zbin//usr/bin/bin//tmp/var/mnt/root/boot/home/dev/media/opt/../(deleted)x86armmipsmpslsh4wgetcurllynxftpftpgettftpscpaflaaarsyncpfclamscanreadelfizsnapstracelsofgdbpmapltraceptracewiresharktsharktcpdumpnetstatssnmaphping3tracerouteiptablesnftfirewalldauditctlselinuxapparmoraptdnfyumzypperpacmanemergebrewportnanovimvinvimgeditkateemacspkillkillallkillsystemctlservicenohuppythonpython3perlrubyluanodebashshkshzshfishvolatilitychkrootkitrkhunterradare2binwalkdockerpodmanlxcqemuvirshvboxmanagemountumountdfdulsblkblkidmkfsfdiskpartedobjdumpstringsxxdhexdumpncnetcatsocatjournalctldmesglogcattaillessgrepawksedtmux%s/%s/data/local/tmp/sbin/dev/null/dev/console/var/lib/dockerkworker/u8:0raw.awaken-network.net/proc/self/cmdline/proc/%d/statusName:-
Source: efefa7.elf, 6212.1.00007fff06e6b000.00007fff06e8c000.rw-.sdmp Binary or memory string: /tmp/qemu-open.KGNrcW
Source: efefa7.elf, 6212.1.000056330cfea000.000056330d13c000.rw-.sdmp, efefa7.elf, 6214.1.000056330cfea000.000056330d118000.rw-.sdmp, efefa7.elf, 6216.1.000056330cfea000.000056330d118000.rw-.sdmp Binary or memory string: 3V!/etc/qemu-binfmt/arm
Source: efefa7.elf, 6212.1.000056330cfea000.000056330d13c000.rw-.sdmp, efefa7.elf, 6214.1.000056330cfea000.000056330d118000.rw-.sdmp, efefa7.elf, 6216.1.000056330cfea000.000056330d118000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: efefa7.elf, 6212.1.00007fff06e6b000.00007fff06e8c000.rw-.sdmp, efefa7.elf, 6214.1.00007fff06e6b000.00007fff06e8c000.rw-.sdmp, efefa7.elf, 6216.1.00007fff06e6b000.00007fff06e8c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: efefa7.elf, 6212.1.00007fff06e6b000.00007fff06e8c000.rw-.sdmp Binary or memory string: 3V/tmp/qemu-open.KGNrcW:
Source: efefa7.elf, 6214.1.00007fff06e6b000.00007fff06e8c000.rw-.sdmp Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Source: efefa7.elf, 6212.1.00007fff06e6b000.00007fff06e8c000.rw-.sdmp, efefa7.elf, 6214.1.00007fff06e6b000.00007fff06e8c000.rw-.sdmp, efefa7.elf, 6216.1.00007fff06e6b000.00007fff06e8c000.rw-.sdmp Binary or memory string: Qx86_64/usr/bin/qemu-arm/tmp/efefa7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/efefa7.elf

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: efefa7.elf, type: SAMPLE

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: efefa7.elf, type: SAMPLE

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
54.171.230.55
 unknown United States
16509 AMAZON-02US false
141.98.10.142
 raw.awaken-network.net Lithuania
209605 HOSTBALTICLT false
109.202.202.202
 unknown Switzerland
13030 INIT7CH false
91.189.91.43
 unknown United Kingdom
41231 CANONICAL-ASGB false
91.189.91.42
 unknown United Kingdom
41231 CANONICAL-ASGB false

Contacted Domains

Name IP Active
raw.awaken-network.net 141.98.10.142 true
raw.awaken-network.net. [malformed] unknown unknown