Linux Analysis Report
yvweY4vsVq.elf

Overview

General Information

Sample Name: yvweY4vsVq.elf
Original Sample Name: 7592df37fb3fea64a0994ac342f319f4.elf
Analysis ID: 877738
MD5: 7592df37fb3fea64a0994ac342f319f4
SHA1: bd612669bbc816883907689411667f34b471259f
SHA256: 4e97dfb181ef3db9a59094b5f468255ee7dc5d5e52543730d8394270a434b162
Tags: 32armelfmirai
Infos:

Detection

Mirai
Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample tries to kill multiple processes (SIGKILL)
Sample contains only a LOAD segment without any section mappings
Deletes log files
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "systemctl" command used for controlling the systemd system and service manager
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
ELF contains segments with high entropy indicating compressed/encrypted content

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: yvweY4vsVq.elf ReversingLabs: Detection: 54%
Source: yvweY4vsVq.elf Virustotal: Detection: 50% Perma Link

Networking
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40678
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40682
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40692
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40698
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40706
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40710
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40716
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40720
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40724
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40726
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40730
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40732
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40738
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40740
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40742
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40744
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40746
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40748
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40752
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40754
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40756
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40758
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40760
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40762
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40764
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40768
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40770
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40772
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40774
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40778
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:48592 -> 107.189.3.153:1312
Sample listens on a socket
Source: /tmp/yvweY4vsVq.elf (PID: 6293) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6293) Socket: 0.0.0.0::53413 Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6293) Socket: 0.0.0.0::80 Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6293) Socket: 0.0.0.0::37215 Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) Socket: 0.0.0.0::53413 Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) Socket: 0.0.0.0::80 Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) Socket: 0.0.0.0::37215 Jump to behavior
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 107.189.3.153
Source: unknown TCP traffic detected without corresponding DNS query: 76.0.183.154
Source: unknown TCP traffic detected without corresponding DNS query: 218.45.121.154
Source: unknown TCP traffic detected without corresponding DNS query: 126.137.100.236
Source: unknown TCP traffic detected without corresponding DNS query: 183.86.244.155
Source: unknown TCP traffic detected without corresponding DNS query: 120.95.49.115
Source: unknown TCP traffic detected without corresponding DNS query: 201.206.91.129
Source: unknown TCP traffic detected without corresponding DNS query: 136.240.152.7
Source: unknown TCP traffic detected without corresponding DNS query: 79.160.239.125
Source: unknown TCP traffic detected without corresponding DNS query: 246.183.54.88
Source: unknown TCP traffic detected without corresponding DNS query: 23.36.125.81
Source: unknown TCP traffic detected without corresponding DNS query: 93.6.77.59
Source: unknown TCP traffic detected without corresponding DNS query: 75.192.32.102
Source: unknown TCP traffic detected without corresponding DNS query: 87.220.234.113
Source: unknown TCP traffic detected without corresponding DNS query: 174.229.190.231
Source: unknown TCP traffic detected without corresponding DNS query: 153.190.168.241
Source: unknown TCP traffic detected without corresponding DNS query: 216.202.192.22
Source: unknown TCP traffic detected without corresponding DNS query: 23.233.187.152
Source: unknown TCP traffic detected without corresponding DNS query: 97.77.143.147
Source: unknown TCP traffic detected without corresponding DNS query: 155.226.78.146
Source: unknown TCP traffic detected without corresponding DNS query: 90.225.231.43
Source: unknown TCP traffic detected without corresponding DNS query: 104.13.239.230
Source: unknown TCP traffic detected without corresponding DNS query: 167.152.63.108
Source: unknown TCP traffic detected without corresponding DNS query: 247.136.170.47
Source: unknown TCP traffic detected without corresponding DNS query: 166.11.184.189
Source: unknown TCP traffic detected without corresponding DNS query: 149.168.18.245
Source: unknown TCP traffic detected without corresponding DNS query: 93.214.165.127
Source: unknown TCP traffic detected without corresponding DNS query: 151.171.214.178
Source: unknown TCP traffic detected without corresponding DNS query: 16.229.95.68
Source: unknown TCP traffic detected without corresponding DNS query: 252.75.153.96
Source: unknown TCP traffic detected without corresponding DNS query: 18.99.237.72
Source: unknown TCP traffic detected without corresponding DNS query: 67.42.182.45
Source: unknown TCP traffic detected without corresponding DNS query: 190.36.146.59
Source: unknown TCP traffic detected without corresponding DNS query: 195.175.152.36
Source: unknown TCP traffic detected without corresponding DNS query: 211.116.191.67
Source: unknown TCP traffic detected without corresponding DNS query: 35.27.252.236
Source: unknown TCP traffic detected without corresponding DNS query: 192.228.72.55
Source: unknown TCP traffic detected without corresponding DNS query: 125.152.129.219
Source: unknown TCP traffic detected without corresponding DNS query: 85.64.190.7
Source: unknown TCP traffic detected without corresponding DNS query: 83.240.163.128
Source: unknown TCP traffic detected without corresponding DNS query: 47.77.83.183
Source: unknown TCP traffic detected without corresponding DNS query: 216.105.159.246
Source: unknown TCP traffic detected without corresponding DNS query: 139.7.13.2
Source: unknown TCP traffic detected without corresponding DNS query: 108.125.130.242
Source: unknown TCP traffic detected without corresponding DNS query: 120.26.142.118
Source: unknown TCP traffic detected without corresponding DNS query: 96.106.78.8
Source: unknown TCP traffic detected without corresponding DNS query: 207.53.121.27
Source: unknown TCP traffic detected without corresponding DNS query: 167.147.171.44
Source: unknown TCP traffic detected without corresponding DNS query: 149.95.216.142
Source: yvweY4vsVq.elf String found in binary or memory: http://upx.sf.net

System Summary
barindex
Sample tries to kill multiple processes (SIGKILL)
Source: /tmp/yvweY4vsVq.elf (PID: 6293) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 6293, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 720, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 759, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 788, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 800, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 847, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 1334, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 1335, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 1860, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 1872, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 2096, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 2097, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 2102, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 2180, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 2208, result: successful Jump to behavior
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x8000
Sample tries to kill a process (SIGKILL)
Source: /tmp/yvweY4vsVq.elf (PID: 6293) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 6293, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 720, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 759, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 788, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 800, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 847, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 1334, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 1335, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 1860, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 1872, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 2096, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 2097, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 2102, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 2180, result: successful Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) SIGKILL sent: pid: 2208, result: successful Jump to behavior
Source: classification engine Classification label: mal68.spre.troj.evad.linELF@0/49@0/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
Enumerates processes within the "proc" file system
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/2033/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/2033/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1582/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1582/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/2275/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/6191/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/6192/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1612/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1612/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1579/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1579/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1699/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1699/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1335/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1335/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1698/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1698/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/2028/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/2028/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1334/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1334/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1576/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1576/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/2302/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/3236/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/2025/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/2025/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/2146/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/2146/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/910/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/912/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/912/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/912/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/759/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/759/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/759/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/517/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/2307/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/918/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/918/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/918/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1594/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1594/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/2285/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/2281/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1349/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1349/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1623/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1623/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/761/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/761/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/761/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1622/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1622/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/884/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/884/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/884/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1983/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1983/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/2038/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/2038/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1586/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1586/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1465/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1465/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1344/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1344/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1860/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1860/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1463/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1463/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/2156/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/2156/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/800/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/800/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/800/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/801/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/801/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/801/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1629/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1629/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1627/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1627/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1900/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1900/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/491/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/491/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/491/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/2294/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/2050/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/2050/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1877/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1877/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/772/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/772/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/772/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1633/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1633/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1599/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1599/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1632/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1632/exe Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1477/fd Jump to behavior
Source: /tmp/yvweY4vsVq.elf (PID: 6299) File opened: /proc/1477/exe Jump to behavior
Executes commands using a shell command-line interpreter
Source: /usr/sbin/logrotate (PID: 6241) Shell command executed: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log " Jump to behavior
Source: /usr/sbin/logrotate (PID: 6252) Shell command executed: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /usr/sbin/invoke-rc.d (PID: 6245) Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-enabled cups.service Jump to behavior
Source: /usr/sbin/invoke-rc.d (PID: 6250) Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active cups.service Jump to behavior
Source: /usr/lib/rsyslog/rsyslog-rotate (PID: 6254) Systemctl executable: /usr/bin/systemctl -> systemctl kill -s HUP rsyslog.service Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40678
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40682
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40692
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40698
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40706
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40710
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40716
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40720
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40724
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40726
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40730
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40732
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40738
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40740
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40742
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40744
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40746
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40748
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40752
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40754
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40756
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40758
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40760
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40762
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40764
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40768
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40770
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40772
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40774
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40778
ELF contains segments with high entropy indicating compressed/encrypted content
Source: yvweY4vsVq.elf Submission file: segment LOAD with 7.9335 entropy (max. 8.0)
Deletes log files
Source: /usr/sbin/logrotate (PID: 6198) Truncated file: /var/log/cups/access_log.1 Jump to behavior
Source: /usr/sbin/logrotate (PID: 6198) Truncated file: /var/log/syslog.1 Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/yvweY4vsVq.elf (PID: 6291) Queries kernel information via 'uname': Jump to behavior
Source: yvweY4vsVq.elf, 6291.1.00007fffb98e5000.00007fffb9906000.rw-.sdmp, yvweY4vsVq.elf, 6293.1.00007fffb98e5000.00007fffb9906000.rw-.sdmp, yvweY4vsVq.elf, 6295.1.00007fffb98e5000.00007fffb9906000.rw-.sdmp, yvweY4vsVq.elf, 6301.1.00007fffb98e5000.00007fffb9906000.rw-.sdmp Binary or memory string: Dx86_64/usr/bin/qemu-arm/tmp/yvweY4vsVq.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/yvweY4vsVq.elf
Source: yvweY4vsVq.elf, 6291.1.000055d7e0edc000.000055d7e10ea000.rw-.sdmp, yvweY4vsVq.elf, 6293.1.000055d7e0edc000.000055d7e10ea000.rw-.sdmp, yvweY4vsVq.elf, 6295.1.000055d7e0edc000.000055d7e10ea000.rw-.sdmp, yvweY4vsVq.elf, 6301.1.000055d7e0edc000.000055d7e10ea000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: yvweY4vsVq.elf, 6291.1.000055d7e0edc000.000055d7e10ea000.rw-.sdmp, yvweY4vsVq.elf, 6293.1.000055d7e0edc000.000055d7e10ea000.rw-.sdmp, yvweY4vsVq.elf, 6295.1.000055d7e0edc000.000055d7e10ea000.rw-.sdmp, yvweY4vsVq.elf, 6301.1.000055d7e0edc000.000055d7e10ea000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: yvweY4vsVq.elf, 6291.1.00007fffb98e5000.00007fffb9906000.rw-.sdmp, yvweY4vsVq.elf, 6293.1.00007fffb98e5000.00007fffb9906000.rw-.sdmp, yvweY4vsVq.elf, 6295.1.00007fffb98e5000.00007fffb9906000.rw-.sdmp, yvweY4vsVq.elf, 6301.1.00007fffb98e5000.00007fffb9906000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
91.72.178.153
 unknown United Arab Emirates
15802 DU-AS1AE false
19.194.56.75
 unknown United States
3 MIT-GATEWAYSUS false
176.81.232.119
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
75.131.165.178
 unknown United States
20115 CHARTER-20115US false
66.44.1.18
 unknown United States
6079 RCN-ASUS false
216.151.48.52
 unknown United States
31869 LL-BEANUS false
119.70.232.53
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
186.223.112.108
 unknown Brazil
28573 CLAROSABR false
1.119.108.59
 unknown China
23724 CHINANET-IDC-BJ-APIDCChinaTelecommunicationsCorporation false
245.31.144.9
 unknown Reserved
unknown unknown false
144.24.166.220
 unknown Greece
58541 CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN false
118.17.139.140
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
71.82.115.201
 unknown United States
20115 CHARTER-20115US false
152.38.145.32
 unknown United States
81 NCRENUS false
161.212.230.79
 unknown Venezuela
6306 TELEFONICAVENEZOLANACAVE false
146.74.158.132
 unknown United States
30051 SCCGOVUS false
94.40.89.117
 unknown Poland
20960 TKTELEKOM-ASPL false
95.23.180.230
 unknown Spain
12479 UNI2-ASES false
195.249.12.67
 unknown Denmark
3292 TDCTDCASDK false
198.207.62.225
 unknown United States
17007 OATK-AS1US false
196.167.93.110
 unknown South Africa
328065 Vast-Networks-ASZA false
120.64.203.192
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
241.71.207.167
 unknown Reserved
unknown unknown false
136.25.206.10
 unknown United States
19165 WEBPASSUS false
204.214.223.26
 unknown United States
1239 SPRINTLINKUS false
161.165.43.90
 unknown United States
10695 WAL-MARTUS false
74.199.29.180
 unknown United States
12083 WOW-INTERNETUS false
195.205.241.144
 unknown Poland
5617 TPNETPL false
38.229.203.53
 unknown United States
23028 TEAM-CYMRUUS false
23.121.55.94
 unknown United States
7018 ATT-INTERNET4US false
27.231.45.76
 unknown Japan 9605 DOCOMONTTDOCOMOINCJP false
205.198.24.195
 unknown United States
133847 ICT-AS-APAnppleTechEnterpriseMY false
171.190.191.247
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
117.79.59.230
 unknown China
55990 HWCSNETHuaweiCloudServicedatacenterCN false
48.162.218.62
 unknown United States
2686 ATGS-MMD-ASUS false
191.45.88.178
 unknown Brazil
7738 TelemarNorteLesteSABR false
116.62.52.238
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
181.55.62.16
 unknown Colombia
10620 TelmexColombiaSACO false
60.204.107.202
 unknown China
9595 XEPHIONNTT-MECorporationJP false
105.217.216.229
 unknown South Africa
16637 MTNNS-ASZA false
78.216.161.1
 unknown France
12322 PROXADFR false
94.104.57.239
 unknown Belgium
47377 ORANGE_BELGIUM_SAKPNBelgiumBusinessNVhasbeenacquired false
251.32.191.44
 unknown Reserved
unknown unknown false
155.14.152.106
 unknown United States
40155 APLLIUS false
113.230.156.33
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
169.203.96.4
 unknown United States
22920 BIAEDNET-INTERNETUS false
103.224.219.136
 unknown India
135226 JEECOM-ASJeecommunicationsIN false
110.162.48.72
 unknown Japan 9605 DOCOMONTTDOCOMOINCJP false
190.139.248.21
 unknown Argentina
7303 TelecomArgentinaSAAR false
23.234.164.53
 unknown United States
54905 DIGITAL-LANDSCAPEUS false
243.11.93.252
 unknown Reserved
unknown unknown false
156.190.95.246
 unknown Egypt
36992 ETISALAT-MISREG false
86.143.83.13
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
148.72.226.86
 unknown United States
26496 AS-26496-GO-DADDY-COM-LLCUS false
105.37.93.217
 unknown Egypt
37069 MOBINILEG false
13.40.198.228
 unknown United States
7018 ATT-INTERNET4US false
37.250.156.26
 unknown Sweden
44034 HI3GSE false
19.175.149.177
 unknown United States
3 MIT-GATEWAYSUS false
144.95.227.31
 unknown Netherlands
32023 ANADARKOUS false
121.243.246.201
 unknown India
17908 TCISLTataCommunicationsIN false
57.98.26.31
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
245.51.97.122
 unknown Reserved
unknown unknown false
145.221.28.61
 unknown Netherlands
15625 ING-ASAmsterdamNL false
190.150.134.219
 unknown El Salvador
27773 MILLICOMCABLEELSALVADORSADECVSV false
84.155.227.30
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
194.142.114.69
 unknown Finland
1759 TSF-IP-CORETeliaFinlandOyjEU false
104.157.219.169
 unknown Canada
36493 295CA-TOR-ASNCA false
53.18.189.84
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
82.147.226.38
 unknown Denmark
15516 DK-DANSKKABELTVDK false
207.123.162.138
 unknown United States
3356 LEVEL3US false
194.47.5.189
 unknown Sweden
1653 SUNETSUNETSwedishUniversityNetworkEU false
255.65.102.126
 unknown Reserved
unknown unknown false
195.76.65.49
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
207.136.225.200
 unknown United States
5738 SOVER-ASNUS false
93.85.251.206
 unknown Belarus
6697 BELPAK-ASBELPAKBY false
164.150.30.65
 unknown South Africa
37130 SITA-ASZA false
152.36.229.246
 unknown United States
31715 ABTME-ASUS false
63.195.7.190
 unknown United States
7018 ATT-INTERNET4US false
170.115.152.134
 unknown United States
11205 CITY-OF-PHILADELPHIAUS false
2.73.95.133
 unknown Kazakhstan
29355 KCELL-ASKZ false
248.133.109.69
 unknown Reserved
unknown unknown false
197.53.207.221
 unknown Egypt
8452 TE-ASTE-ASEG false
216.95.76.109
 unknown United States
701 UUNETUS false
91.41.111.144
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
139.174.47.177
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
110.156.82.185
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
95.120.112.167
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
57.124.200.251
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
217.85.150.41
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
246.109.142.99
 unknown Reserved
unknown unknown false
163.130.240.50
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
125.108.202.31
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
111.69.66.133
 unknown New Zealand
23655 SNAP-NZ-ASSnapInternetLimitedNZ false
78.216.67.239
 unknown France
12322 PROXADFR false
246.211.208.229
 unknown Reserved
unknown unknown false
12.253.252.114
 unknown United States
8030 WORLDNET5-10US false
188.81.116.228
 unknown Portugal
3243 MEO-RESIDENCIALPT false
116.189.252.212
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
71.246.41.123
 unknown United States
5650 FRONTIER-FRTRUS false
74.80.40.146
 unknown United States
25921 LUS-FIBER-LCGUS false