Linux Analysis Report
firmware.sh4.elf

Overview

General Information

Sample name:	firmware.sh4.elf
Analysis ID:	1502457
MD5:	866ab94cdba8c1e145fcfc5e8a587251
SHA1:	3eda27ca9939320a3fdd89e794d3c1207cca7902
SHA256:	b8aba5f4f1a0f074f60982b0f030fd84af36556d747e0642a8fb575f9899de6c
Tags:	elffirmware
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Drops files in suspicious directories

Executes the "crontab" command typically for achieving persistence

Sample tries to persist itself using cron

Executes commands using a shell command-line interpreter

Executes the "hostname" command used to retrieve the computers name

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Writes ELF files to disk

Yara signature match

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: firmware.sh4.elf

Avira: detected

Antivirus detection for dropped file

Source: /usr/bin/isovqu

Avira: detection malicious, Label: LINUX/Mirai.bonb

Multi AV Scanner detection for submitted file

Source: firmware.sh4.elf	ReversingLabs: Detection: 50%
Source: firmware.sh4.elf	Virustotal: Detection: 56%			Perma Link

System Summary

Malicious sample detected (through community Yara rule)

Source: firmware.sh4.elf, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6255.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6483.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6414.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6276.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6460.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6487.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6274.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6458.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6485.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6489.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6412.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: /usr/bin/isovqu, type: DROPPED	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: dropped/isovqu, type: DROPPED	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Sample tries to kill a process (SIGKILL)

Source: /tmp/firmware.sh4.elf (PID: 6414)	SIGKILL sent: pid: 6412, result: successful	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6460)	SIGKILL sent: pid: 6458, result: successful	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6485)	SIGKILL sent: pid: 6483, result: successful	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6489)	SIGKILL sent: pid: 6487, result: successful	Jump to behavior

Yara signature match

Source: firmware.sh4.elf, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6255.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6483.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6414.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6276.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6460.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6487.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6274.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6458.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6485.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6489.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6412.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: /usr/bin/isovqu, type: DROPPED	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: dropped/isovqu, type: DROPPED	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b

Source: classification engine

Classification label: mal84.troj.evad.linELF@0/24@0/0

Persistence and Installation Behavior

Executes the "crontab" command typically for achieving persistence

Source: /bin/sh (PID: 6313)	Crontab executable: /usr/bin/crontab -> crontab /var/spool/cron/crontabs/root			Jump to behavior
Source: /bin/sh (PID: 6314)	Crontab executable: /usr/bin/crontab -> crontab /var/spool/cron/crontabs/root			Jump to behavior

Sample tries to persist itself using cron

Source: /tmp/firmware.sh4.elf (PID: 6258)	File: /var/spool/cron/crontabs/root	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6260)	File: /var/spool/cron/crontabs/root	Jump to behavior
Source: /usr/bin/crontab (PID: 6313)	File: /var/spool/cron/crontabs/tmp.dUBIUw	Jump to behavior
Source: /usr/bin/crontab (PID: 6313)	File: /var/spool/cron/crontabs/root	Jump to behavior
Source: /usr/bin/crontab (PID: 6314)	File: /var/spool/cron/crontabs/tmp.LcjwCF	Jump to behavior
Source: /usr/bin/crontab (PID: 6314)	File: /var/spool/cron/crontabs/root	Jump to behavior

Executes commands using a shell command-line interpreter

Source: /tmp/firmware.sh4.elf (PID: 6277)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6345)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6378)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6389)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6403)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6426)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6437)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6447)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6473)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6491)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6512)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6288)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6309)	Shell command executed: sh -c "crontab /var/spool/cron/crontabs/root"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6272)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6338)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6375)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6386)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6400)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6420)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6434)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6444)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6466)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6506)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6287)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6311)	Shell command executed: sh -c "crontab /var/spool/cron/crontabs/root"	Jump to behavior

Executes the "hostname" command used to retrieve the computers name

Source: /bin/sh (PID: 6292)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6350)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6380)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6395)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6409)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6428)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6439)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6453)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6478)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6495)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6518)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6294)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6291)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6344)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6377)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6388)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6402)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6425)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6436)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6446)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6472)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6508)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6293)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior

Sample tries to set the executable flag

Source: /tmp/firmware.sh4.elf (PID: 6258)	File: /bin/isovqu (bits: - usr: rx grp: rx all: rwx)			Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6260)	File: /bin/isovqu (bits: - usr: rx grp: rx all: rwx)			Jump to behavior

Writes ELF files to disk

Source: /tmp/firmware.sh4.elf (PID: 6258)	File written: /usr/bin/isovqu
Source: /tmp/firmware.sh4.elf (PID: 6260)	File written: /usr/bin/isovqu			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Drops files in suspicious directories

Source: /tmp/firmware.sh4.elf (PID: 6258)	File: /usr/bin/isovqu
Source: /tmp/firmware.sh4.elf (PID: 6260)	File: /usr/bin/isovqu			Jump to dropped file

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/firmware.sh4.elf (PID: 6255)

Queries kernel information via 'uname':

Jump to behavior

Source: firmware.sh4.elf, 6255.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6276.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6412.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6414.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6458.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6460.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6483.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6485.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6274.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6487.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6489.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: firmware.sh4.elf, 6255.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6276.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6412.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6414.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6458.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6460.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6483.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6485.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6274.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6487.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6489.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/firmware.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/firmware.sh4.elf
Source: firmware.sh4.elf, 6255.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6276.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6412.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6414.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6458.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6460.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6483.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6485.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6274.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6487.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6489.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: firmware.sh4.elf, 6255.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6276.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6412.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6414.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6458.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6460.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6483.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6485.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6274.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6487.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6489.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: firmware.sh4.elf, 6276.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6274.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Screenshots

No Screenshots

Network Map

⊘No contacted IP infos

Name	Type	MD5	SHA1	SHA256
/etc/allah_is_prick.html	HTML document, ASCII text, with very long lines (360), with no line terminators	3A2D9EE3D20A76ED6AF3F066BE482B64	8EE4338DF17D6DBBD7CFEC1AA0ABBD6A7B8081F6	9D542210472A30C5142DF1F1AC2A25D72A453C5DFAD27B09F805691A2E936082
/etc/d	ASCII text	A608947B77730C54084CBDB7F0DC39E0	2725761B16E5D70685E8A898450757F9B5CE433B	2ABF442BF3CA4F75B128B24FB05D5E54C5614BCFC626ACC889CE5334646C58B7
/home/allah_is_prick.html	HTML document, ASCII text, with very long lines (360), with no line terminators	3A2D9EE3D20A76ED6AF3F066BE482B64	8EE4338DF17D6DBBD7CFEC1AA0ABBD6A7B8081F6	9D542210472A30C5142DF1F1AC2A25D72A453C5DFAD27B09F805691A2E936082
/mnt/allah_is_prick.html	HTML document, ASCII text, with very long lines (360), with no line terminators	3A2D9EE3D20A76ED6AF3F066BE482B64	8EE4338DF17D6DBBD7CFEC1AA0ABBD6A7B8081F6	9D542210472A30C5142DF1F1AC2A25D72A453C5DFAD27B09F805691A2E936082
/root/allah_is_prick.html	HTML document, ASCII text, with very long lines (360), with no line terminators	3A2D9EE3D20A76ED6AF3F066BE482B64	8EE4338DF17D6DBBD7CFEC1AA0ABBD6A7B8081F6	9D542210472A30C5142DF1F1AC2A25D72A453C5DFAD27B09F805691A2E936082
/tmp/allah_is_prick.html	HTML document, ASCII text, with very long lines (11160), with no line terminators	5A685CBE9A538B8AC034F7330825FCAF	1C7BB6895AEF2D35CE44A9B8913E2372A8292656	04049BED3C3F91BA576248067B0282B1D793ED7E09B0F30591D4984CFE1F6375
/usr/bin/isovqu	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped	866AB94CDBA8C1E145FCFC5E8A587251	3EDA27CA9939320A3FDD89E794D3C1207CCA7902	B8ABA5F4F1A0F074F60982B0F030FD84AF36556D747E0642A8FB575F9899DE6C
/var/allah_is_prick.html	HTML document, ASCII text, with very long lines (360), with no line terminators	3A2D9EE3D20A76ED6AF3F066BE482B64	8EE4338DF17D6DBBD7CFEC1AA0ABBD6A7B8081F6	9D542210472A30C5142DF1F1AC2A25D72A453C5DFAD27B09F805691A2E936082
/var/spool/cron/crontabs/root	ASCII text	1A01B50D693C1189008B251AE1A2DF7B	6CA8997525685A22B8ACE5FE46321D6C6A72EE55	AB2A091E581E6CBD1F6B50D401D6F47F8A62B3C6343F9029B5481E4BBD85B8EF
/var/spool/cron/crontabs/tmp.LcjwCF	ASCII text	1C4BD90B60F8EAABF6AC7B1BD58B5B02	2C1AAEE92CBCA33B034AE9F950A32C3BE45CBC7A	5DF4AEE3DC343F08A82634E24E14B80771DBD7E0082481E7CC5B6A7CFE7A346F
/var/spool/cron/crontabs/tmp.dUBIUw	ASCII text	87B992514A260ACF32008AF2797AC4F3	EF72845BF1C1CFFD82B60904CBE8EF3440ACFD6F	1C2F05089A5B1EDD1515BD7EA4059CD3B2B9CF7B6DC47282E21E4170967A7F89

AV Detection

Antivirus / Scanner detection for submitted sample

Source: firmware.sh4.elf

Avira: detected

Antivirus detection for dropped file

Source: /usr/bin/isovqu

Avira: detection malicious, Label: LINUX/Mirai.bonb

Multi AV Scanner detection for submitted file

Source: firmware.sh4.elf	ReversingLabs: Detection: 50%
Source: firmware.sh4.elf	Virustotal: Detection: 56%			Perma Link

System Summary

Malicious sample detected (through community Yara rule)

Source: firmware.sh4.elf, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6255.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6483.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6414.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6276.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6460.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6487.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6274.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6458.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6485.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6489.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6412.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: /usr/bin/isovqu, type: DROPPED	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: dropped/isovqu, type: DROPPED	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Sample tries to kill a process (SIGKILL)

Source: /tmp/firmware.sh4.elf (PID: 6414)	SIGKILL sent: pid: 6412, result: successful	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6460)	SIGKILL sent: pid: 6458, result: successful	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6485)	SIGKILL sent: pid: 6483, result: successful	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6489)	SIGKILL sent: pid: 6487, result: successful	Jump to behavior

Yara signature match

Source: firmware.sh4.elf, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6255.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6483.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6414.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6276.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6460.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6487.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6274.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6458.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6485.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6489.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6412.1.00007f9f40400000.00007f9f40417000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: /usr/bin/isovqu, type: DROPPED	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: dropped/isovqu, type: DROPPED	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b

Source: classification engine

Classification label: mal84.troj.evad.linELF@0/24@0/0

Persistence and Installation Behavior

Executes the "crontab" command typically for achieving persistence

Source: /bin/sh (PID: 6313)	Crontab executable: /usr/bin/crontab -> crontab /var/spool/cron/crontabs/root			Jump to behavior
Source: /bin/sh (PID: 6314)	Crontab executable: /usr/bin/crontab -> crontab /var/spool/cron/crontabs/root			Jump to behavior

Sample tries to persist itself using cron

Source: /tmp/firmware.sh4.elf (PID: 6258)	File: /var/spool/cron/crontabs/root	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6260)	File: /var/spool/cron/crontabs/root	Jump to behavior
Source: /usr/bin/crontab (PID: 6313)	File: /var/spool/cron/crontabs/tmp.dUBIUw	Jump to behavior
Source: /usr/bin/crontab (PID: 6313)	File: /var/spool/cron/crontabs/root	Jump to behavior
Source: /usr/bin/crontab (PID: 6314)	File: /var/spool/cron/crontabs/tmp.LcjwCF	Jump to behavior
Source: /usr/bin/crontab (PID: 6314)	File: /var/spool/cron/crontabs/root	Jump to behavior

Executes commands using a shell command-line interpreter

Source: /tmp/firmware.sh4.elf (PID: 6277)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6345)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6378)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6389)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6403)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6426)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6437)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6447)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6473)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6491)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6512)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6288)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6309)	Shell command executed: sh -c "crontab /var/spool/cron/crontabs/root"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6272)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6338)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6375)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6386)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6400)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6420)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6434)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6444)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6466)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6506)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6287)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6311)	Shell command executed: sh -c "crontab /var/spool/cron/crontabs/root"	Jump to behavior

Executes the "hostname" command used to retrieve the computers name

Source: /bin/sh (PID: 6292)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6350)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6380)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6395)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6409)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6428)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6439)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6453)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6478)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6495)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6518)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6294)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6291)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6344)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6377)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6388)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6402)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6425)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6436)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6446)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6472)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6508)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 6293)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior

Sample tries to set the executable flag

Source: /tmp/firmware.sh4.elf (PID: 6258)	File: /bin/isovqu (bits: - usr: rx grp: rx all: rwx)			Jump to behavior
Source: /tmp/firmware.sh4.elf (PID: 6260)	File: /bin/isovqu (bits: - usr: rx grp: rx all: rwx)			Jump to behavior

Writes ELF files to disk

Source: /tmp/firmware.sh4.elf (PID: 6258)	File written: /usr/bin/isovqu
Source: /tmp/firmware.sh4.elf (PID: 6260)	File written: /usr/bin/isovqu			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Drops files in suspicious directories

Source: /tmp/firmware.sh4.elf (PID: 6258)	File: /usr/bin/isovqu
Source: /tmp/firmware.sh4.elf (PID: 6260)	File: /usr/bin/isovqu			Jump to dropped file

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/firmware.sh4.elf (PID: 6255)

Queries kernel information via 'uname':

Jump to behavior

Source: firmware.sh4.elf, 6255.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6276.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6412.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6414.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6458.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6460.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6483.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6485.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6274.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6487.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6489.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: firmware.sh4.elf, 6255.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6276.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6412.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6414.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6458.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6460.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6483.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6485.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6274.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6487.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6489.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/firmware.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/firmware.sh4.elf
Source: firmware.sh4.elf, 6255.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6276.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6412.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6414.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6458.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6460.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6483.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6485.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6274.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6487.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6489.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: firmware.sh4.elf, 6255.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6276.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6412.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6414.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6458.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6460.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6483.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6485.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6274.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6487.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp, firmware.sh4.elf, 6489.1.000055c2d7179000.000055c2d71fc000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: firmware.sh4.elf, 6276.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp, firmware.sh4.elf, 6274.1.00007ffe8b6d8000.00007ffe8b6f9000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

ID:	1502457
Product:	CloudBasic
Start time:	17:33:40
Start date:	01.09.2024
Sample:	firmware.sh4.elf
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	866ab94cdba8c1e145fcfc5e8a587251
SHA1:	3eda27ca9939320a3fdd89e794d3c1207cca7902
SHA256:	b8aba5f4f1a0f074f60982b0f030fd84af36556d747e0642a8fb575f9899de6c
Filetype:	ELF Executable and Linkable format (generic) (4004/1) 100.00%

Linux Analysis Report firmware.sh4.elf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Linux Analysis Report
firmware.sh4.elf