Click to jump to signature section
Source: x86_32.nn.elf | ReversingLabs: Detection: 36% |
Source: x86_32.nn.elf | String: Found And Killed Process: PID=%d, Realpath=%s/snap/snapd/15534/usr/lib/snapd/snapd/usr/libexec/openssh/sftp-serveranko-app/ankosample _8182T_11047815351681972surf2/proc/self/exe/proc/%s/exe/.(deleted)socket/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/opt/app/monitor/z/secom//usr/lib/mnt/sys/boot/media/srv/sbin/etc/dev/telnetbashhttpdtelnetddropbearencodersystem/var/tmp/wlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincissh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimgdbpkillkillallapt487154914:1553<41<515791446<614561;814994;8153;148;14<5which gdb > /dev/null 2>&1which lldb > /dev/null 2>&1which dtrace > /dev/null 2>&1which truss > /dev/null 2>&1which ptrace > /dev/null 2>&1LD_PRELOADLD_LIBRARY_PATHLD_AUDIT/procw/etc/motd%s |
Source: unknown | TCP traffic detected without corresponding DNS query: 54.171.230.55 |
Source: unknown | TCP traffic detected without corresponding DNS query: 91.189.91.42 |
Source: unknown | TCP traffic detected without corresponding DNS query: 91.189.91.43 |
Source: unknown | TCP traffic detected without corresponding DNS query: 109.202.202.202 |
Source: unknown | TCP traffic detected without corresponding DNS query: 91.189.91.42 |
Source: unknown | TCP traffic detected without corresponding DNS query: 91.189.91.43 |
Source: unknown | TCP traffic detected without corresponding DNS query: 109.202.202.202 |
Source: unknown | TCP traffic detected without corresponding DNS query: 91.189.91.42 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 33606 |
Source: unknown | Network traffic detected: HTTP traffic on port 33606 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 43928 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 42836 -> 443 |
Source: x86_32.nn.elf, type: SAMPLE | Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown |
Source: x86_32.nn.elf, type: SAMPLE | Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown |
Source: x86_32.nn.elf, type: SAMPLE | Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown |
Source: x86_32.nn.elf, type: SAMPLE | Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown |
Source: x86_32.nn.elf, type: SAMPLE | Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown |
Source: x86_32.nn.elf, type: SAMPLE | Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown |
Source: x86_32.nn.elf, type: SAMPLE | Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown |
Source: Initial sample | String containing 'busybox' found: /bin/busybox |
Source: Initial sample | String containing 'busybox' found: Found And Killed Process: PID=%d, Realpath=%s/snap/snapd/15534/usr/lib/snapd/snapd/usr/libexec/openssh/sftp-serveranko-app/ankosample _8182T_11047815351681972surf2/proc/self/exe/proc/%s/exe/.(deleted)socket/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/opt/app/monitor/z/secom//usr/lib/mnt/sys/boot/media/srv/sbin/etc/dev/telnetbashhttpdtelnetddropbearencodersystem/var/tmp/wlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincissh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimgdbpkillkillallapt487154914:1553<41<515791446<614561;814994;8153;148;14<5which gdb > /dev/nu |
Source: ELF static info symbol of initial sample | .symtab present: no |
Source: x86_32.nn.elf, type: SAMPLE | Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16 |
Source: x86_32.nn.elf, type: SAMPLE | Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16 |
Source: x86_32.nn.elf, type: SAMPLE | Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16 |
Source: x86_32.nn.elf, type: SAMPLE | Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16 |
Source: x86_32.nn.elf, type: SAMPLE | Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26 |
Source: x86_32.nn.elf, type: SAMPLE | Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26 |
Source: x86_32.nn.elf, type: SAMPLE | Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26 |
Source: classification engine | Classification label: mal64.troj.linELF@0/0@0/0 |
Source: /usr/bin/dash (PID: 6229) | Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.r4U3P9onlX /tmp/tmp.RK6uLKp1lE /tmp/tmp.RFTJY3Zhu7 | Jump to behavior |
Source: /usr/bin/dash (PID: 6230) | Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.r4U3P9onlX /tmp/tmp.RK6uLKp1lE /tmp/tmp.RFTJY3Zhu7 | Jump to behavior |
Source: Yara match | File source: x86_32.nn.elf, type: SAMPLE |
Source: Yara match | File source: x86_32.nn.elf, type: SAMPLE |