Linux Analysis Report
arm.nn.elf

Overview

General Information

Sample name: arm.nn.elf
Analysis ID: 1522871
MD5: f89b296713d8e794e07147262967410d
SHA1: faf84941b55ab9a9a24f81da43b3daca7ddc261e
SHA256: ca663b76e00341b7346a238c8c8815f25b8f0004526dd00a97f3a93a704e6590
Tags: elfGorillaGorillaBotnetMiraiuser-abuse_ch
Infos:

Detection

Okiru
Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Yara detected Okiru
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: arm.nn.elf ReversingLabs: Detection: 36%
Found strings indicative of a multi-platform dropper
Source: arm.nn.elf String: Found And Killed Process: PID=%d, Realpath=%s7815351681972surf2/proc/self/exe/proc/%s/exe/.(deleted)/fd/socket/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencodersystem/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythonbusyboxiptablesnanonvimvimgdbpkillkillallapt487154914:1553<41<515791446<614561;814994;8153;148;14<5which gdb > /dev/null 2>&1Debugger (gdb) detected. Exiting. gorilla botnet didnt like this honeypot....which lldb > /dev/null 2>&1Debugger (lldb) detected. Exiting. gorilla botnet didnt like this honeypot....which dtrace > /dev/null 2>&1Debugger (dtrace) detected. Exiting. gorilla botnet didnt like this honeypot....which truss > /dev/null 2>&1Debugger (truss) detected. Exiting. gorilla botnet didnt like this honeypot....which ptrace > /dev/null 2>&1Debugger (ptrace) detected. Exiting. gorilla botnet didnt like this honeypot....LD_PRELOADSandbox detected (LD_PRELOAD). Exiting. gorilla botnet didnt like this honeypot....LD_LIBRARY_PATHSandbox detected (LD_LIBRARY_PATH). Exiting. gorilla botnet didnt like this honeypot....LD_AUDITSandbox detected (LD_AUDIT). Exiting. gorilla botnet didnt like this honeypot..../proc/proc filesystem not found. Exiting. gorilla botnet didnt like this honeypot..../etc/motdw%s
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: busybox
Source: Initial sample String containing 'busybox' found: Found And Killed Process: PID=%d, Realpath=%s7815351681972surf2/proc/self/exe/proc/%s/exe/.(deleted)/fd/socket/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencodersystem/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythonbusyboxiptablesnanonvimvimgdbpkillkillallapt487154914:1553<41<5157914
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal56.troj.linELF@0/0@0/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/arm.nn.elf (PID: 5483) Queries kernel information via 'uname': Jump to behavior
Source: arm.nn.elf, 5483.1.000055b7fac40000.000055b7fad4c000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: arm.nn.elf, 5483.1.00007ffd9420c000.00007ffd9422d000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm.nn.elf
Source: arm.nn.elf, 5483.1.00007ffd9420c000.00007ffd9422d000.rw-.sdmp Binary or memory string: qemu: %s: %s
Source: arm.nn.elf, 5483.1.00007ffd9420c000.00007ffd9422d000.rw-.sdmp Binary or memory string: leqemu: %s: %s
Source: arm.nn.elf, 5483.1.000055b7fac40000.000055b7fad4c000.rw-.sdmp Binary or memory string: Urg.qemu.gdb.arm.sys.regs">
Source: arm.nn.elf, 5483.1.000055b7fac40000.000055b7fad4c000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: arm.nn.elf, 5483.1.00007ffd9420c000.00007ffd9422d000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: arm.nn.elf, 5483.1.000055b7fac40000.000055b7fad4c000.rw-.sdmp Binary or memory string: rg.qemu.gdb.arm.sys.regs">

Stealing of Sensitive Information
barindex
Yara detected Okiru
Source: Yara match File source: arm.nn.elf, type: SAMPLE

Remote Access Functionality
barindex
Yara detected Okiru
Source: Yara match File source: arm.nn.elf, type: SAMPLE

No Screenshots

⊘No contacted IP infos