Linux Analysis Report
aisuru.i586.elf

Overview

General Information

Sample name: aisuru.i586.elf
Analysis ID: 1502206
MD5: 71d43172c1fda38a716425df67592187
SHA1: 3620c8e08707effd0e05be1ba3ad898f7caa1f33
SHA256: 1fc1035b6d2c0516837354056416dccf319b3bf5d658f5f0de63c7198ec1d614
Tags: aisuruelf
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Yara signature match

Classification

Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:41882 -> 92.38.160.13:2348
Source: global traffic DNS traffic detected: DNS query: b.francoanddosbot.fun

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: aisuru.i586.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 5505.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Yara signature match
Source: aisuru.i586.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 5505.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: classification engine Classification label: mal48.linELF@0/0@1/0
Enumerates processes within the "proc" file system
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/230/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/230/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/110/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/110/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/231/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/231/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/111/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/111/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/232/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/232/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/112/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/112/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/233/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/233/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/113/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/113/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/234/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/234/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/114/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/114/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/235/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/235/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/115/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/115/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/236/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/236/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/116/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/116/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/237/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/237/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/117/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/117/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/238/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/238/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/118/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/118/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/239/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/239/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/119/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/119/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/914/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/914/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/10/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/10/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/917/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/917/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/11/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/11/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/12/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/12/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/13/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/13/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/14/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/14/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/15/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/15/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/16/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/16/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/17/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/17/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/18/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/18/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/19/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/19/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/240/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/240/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/3095/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/3095/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/120/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/120/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/241/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/241/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/121/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/121/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/242/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/242/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/1/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/1/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/122/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/122/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/243/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/243/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/2/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/2/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/123/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/123/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/244/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/244/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/3/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/3/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/124/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/124/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/245/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/245/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/1588/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/1588/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/125/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/125/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/4/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/4/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/246/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/246/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/126/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/126/cmdline Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/5/maps Jump to behavior
Source: /tmp/aisuru.i586.elf (PID: 5522) File opened: /proc/5/cmdline Jump to behavior
Source: submitted sample Stderr: Segmentation fault: exit code = 0

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
92.38.160.13
 unknown Austria
199524 GCOREAT false

Contacted Domains

Name IP Active
b.francoanddosbot.fun 92.223.30.117 true