Linux Analysis Report
yakov.mips.elf

Overview

General Information

Sample name: yakov.mips.elf
Analysis ID: 1524328
MD5: 8e0bed7d1e22e8830d5b399c702a36e5
SHA1: 948723dd56d561b94d776136e99d218642ef71c3
SHA256: 0bbded326f0477af5e28f1af007d37662805b1016b7a37f771f2f7b6365ba097
Tags: botnetelfMiraiyakovYakuzauser-NDA0E
Infos:

Detection

Mirai
Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample is packed with UPX
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Sample contains only a LOAD segment without any section mappings
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: yakov.mips.elf ReversingLabs: Detection: 39%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:56080 -> 87.120.114.147:3778
Sample listens on a socket
Source: /tmp/yakov.mips.elf (PID: 5491) Socket: 127.0.0.1:3296 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.114.147
Source: unknown TCP traffic detected without corresponding DNS query: 112.93.131.203
Source: unknown TCP traffic detected without corresponding DNS query: 71.213.209.140
Source: unknown TCP traffic detected without corresponding DNS query: 118.71.51.27
Source: unknown TCP traffic detected without corresponding DNS query: 34.106.255.185
Source: unknown TCP traffic detected without corresponding DNS query: 203.202.227.119
Source: unknown TCP traffic detected without corresponding DNS query: 202.253.90.185
Source: unknown TCP traffic detected without corresponding DNS query: 146.93.60.244
Source: unknown TCP traffic detected without corresponding DNS query: 159.241.28.38
Source: unknown TCP traffic detected without corresponding DNS query: 113.46.94.88
Source: unknown TCP traffic detected without corresponding DNS query: 4.199.79.230
Source: unknown TCP traffic detected without corresponding DNS query: 4.192.11.192
Source: unknown TCP traffic detected without corresponding DNS query: 78.90.173.208
Source: unknown TCP traffic detected without corresponding DNS query: 14.5.169.80
Source: unknown TCP traffic detected without corresponding DNS query: 43.2.151.221
Source: unknown TCP traffic detected without corresponding DNS query: 134.253.136.109
Source: unknown TCP traffic detected without corresponding DNS query: 112.235.233.245
Source: unknown TCP traffic detected without corresponding DNS query: 207.221.178.125
Source: unknown TCP traffic detected without corresponding DNS query: 47.128.130.16
Source: unknown TCP traffic detected without corresponding DNS query: 107.13.6.79
Source: unknown TCP traffic detected without corresponding DNS query: 173.80.14.68
Source: unknown TCP traffic detected without corresponding DNS query: 121.185.152.184
Source: unknown TCP traffic detected without corresponding DNS query: 173.197.222.178
Source: unknown TCP traffic detected without corresponding DNS query: 34.188.68.105
Source: unknown TCP traffic detected without corresponding DNS query: 57.239.248.190
Source: unknown TCP traffic detected without corresponding DNS query: 106.79.101.130
Source: unknown TCP traffic detected without corresponding DNS query: 155.102.255.208
Source: unknown TCP traffic detected without corresponding DNS query: 186.177.194.241
Source: unknown TCP traffic detected without corresponding DNS query: 27.133.162.115
Source: unknown TCP traffic detected without corresponding DNS query: 182.204.28.56
Source: unknown TCP traffic detected without corresponding DNS query: 2.11.72.142
Source: unknown TCP traffic detected without corresponding DNS query: 27.183.34.239
Source: unknown TCP traffic detected without corresponding DNS query: 46.230.52.55
Source: unknown TCP traffic detected without corresponding DNS query: 217.133.128.225
Source: unknown TCP traffic detected without corresponding DNS query: 120.60.27.79
Source: unknown TCP traffic detected without corresponding DNS query: 183.159.132.236
Source: unknown TCP traffic detected without corresponding DNS query: 150.6.206.115
Source: unknown TCP traffic detected without corresponding DNS query: 175.152.177.195
Source: unknown TCP traffic detected without corresponding DNS query: 70.99.125.10
Source: unknown TCP traffic detected without corresponding DNS query: 111.186.117.200
Source: unknown TCP traffic detected without corresponding DNS query: 59.237.37.240
Source: unknown TCP traffic detected without corresponding DNS query: 194.204.4.167
Source: unknown TCP traffic detected without corresponding DNS query: 53.7.148.17
Source: unknown TCP traffic detected without corresponding DNS query: 240.160.59.85
Source: unknown TCP traffic detected without corresponding DNS query: 222.196.196.39
Source: unknown TCP traffic detected without corresponding DNS query: 38.185.38.99
Source: unknown TCP traffic detected without corresponding DNS query: 213.71.101.25
Source: unknown TCP traffic detected without corresponding DNS query: 8.148.235.25
Source: unknown TCP traffic detected without corresponding DNS query: 177.191.241.223
Source: unknown TCP traffic detected without corresponding DNS query: 243.57.197.182
Source: yakov.mips.elf String found in binary or memory: http://upx.sf.net

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 5493.1.00007f0c54400000.00007f0c54410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5493.1.00007f0c54400000.00007f0c54410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5489.1.00007f0c54400000.00007f0c54410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5489.1.00007f0c54400000.00007f0c54410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: yakov.mips.elf PID: 5489, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: yakov.mips.elf PID: 5489, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: yakov.mips.elf PID: 5493, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: yakov.mips.elf PID: 5493, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x100000
Yara signature match
Source: 5493.1.00007f0c54400000.00007f0c54410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5493.1.00007f0c54400000.00007f0c54410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5489.1.00007f0c54400000.00007f0c54410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5489.1.00007f0c54400000.00007f0c54410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: yakov.mips.elf PID: 5489, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: yakov.mips.elf PID: 5489, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: yakov.mips.elf PID: 5493, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: yakov.mips.elf PID: 5493, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: classification engine Classification label: mal68.troj.evad.linELF@0/0@0/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
ELF contains segments with high entropy indicating compressed/encrypted content
Source: yakov.mips.elf Submission file: segment LOAD with 7.8719 entropy (max. 8.0)
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/yakov.mips.elf (PID: 5489) Queries kernel information via 'uname': Jump to behavior
Source: yakov.mips.elf, 5489.1.0000564e0371e000.0000564e037a5000.rw-.sdmp, yakov.mips.elf, 5493.1.0000564e0371e000.0000564e037a5000.rw-.sdmp Binary or memory string: NV!/etc/qemu-binfmt/mips
Source: yakov.mips.elf, 5489.1.00007ffd3852f000.00007ffd38550000.rw-.sdmp, yakov.mips.elf, 5493.1.00007ffd3852f000.00007ffd38550000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/yakov.mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/yakov.mips.elf
Source: yakov.mips.elf, 5489.1.0000564e0371e000.0000564e037a5000.rw-.sdmp, yakov.mips.elf, 5493.1.0000564e0371e000.0000564e037a5000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: yakov.mips.elf, 5489.1.00007ffd3852f000.00007ffd38550000.rw-.sdmp, yakov.mips.elf, 5493.1.00007ffd3852f000.00007ffd38550000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: 5493.1.00007f0c54400000.00007f0c54410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5489.1.00007f0c54400000.00007f0c54410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: yakov.mips.elf PID: 5489, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: yakov.mips.elf PID: 5493, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: 5493.1.00007f0c54400000.00007f0c54410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5489.1.00007f0c54400000.00007f0c54410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: yakov.mips.elf PID: 5489, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: yakov.mips.elf PID: 5493, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
158.162.5.25
 unknown Portugal
1930 RCCNFundacaoparaaCienciaeaTecnologiaIPPT false
186.192.112.53
 unknown Brazil
262728 ELETRODATALTDABR false
81.198.95.235
 unknown Latvia
12578 APOLLO-ASLatviaLV false
244.114.32.187
 unknown Reserved
unknown unknown false
208.45.238.162
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
102.118.171.197
 unknown Mauritius
23889 MauritiusTelecomMU false
91.69.184.42
 unknown France
15557 LDCOMNETFR false
66.170.250.19
 unknown United States
13996 ECHOSTARUS false
242.164.162.51
 unknown Reserved
unknown unknown false
42.111.123.242
 unknown India
38266 VODAFONE-INVodafoneIndiaLtdIN false
13.64.31.4
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
142.107.87.29
 unknown Canada
808 GONET-ASN-1CA false
213.108.70.150
 unknown France
16347 RMI-FITECHFR false
124.93.126.146
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
125.39.115.5
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
151.28.45.115
 unknown Italy
1267 ASN-WINDTREIUNETEU false
223.44.14.116
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
103.86.18.166
 unknown India
45916 GTPL-AS-APGujaratTelelinkPvtLtdIN false
91.151.92.145
 unknown Turkey
397563 ADEOXTECHUS false
91.190.223.30
 unknown Luxembourg
28704 BELGACOM-ASBE false
208.240.218.191
 unknown United States
4208 THE-ISERV-COMPANYUS false
85.15.166.251
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
190.207.91.246
 unknown Venezuela
8048 CANTVServiciosVenezuelaVE false
121.64.38.57
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
202.39.72.149
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
104.96.65.94
 unknown United States
20940 AKAMAI-ASN1EU false
84.232.192.12
 unknown Romania
8708 RCS-RDS73-75DrStaicoviciRO false
13.98.208.5
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
165.1.20.131
 unknown United States
7297 AP-ASUS false
248.72.216.81
 unknown Reserved
unknown unknown false
114.238.138.48
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
66.40.89.95
 unknown Canada
13768 COGECO-PEER1CA false
109.60.122.157
 unknown Croatia (LOCAL Name: Hrvatska)
31012 DCM-ASVipnetdooHR false
241.211.174.160
 unknown Reserved
unknown unknown false
157.81.221.184
 unknown unknown
2907 SINET-ASResearchOrganizationofInformationandSystemsN false
88.39.126.95
 unknown Italy
3269 ASN-IBSNAZIT false
69.245.129.199
 unknown United States
7922 COMCAST-7922US false
251.26.56.215
 unknown Reserved
unknown unknown false
70.236.82.252
 unknown United States
7018 ATT-INTERNET4US false
172.195.115.127
 unknown Australia
18747 IFX18747US false
220.158.26.84
 unknown Japan 2519 VECTANTARTERIANetworksCorporationJP false
182.37.13.94
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
105.78.55.159
 unknown Morocco
36884 MAROCCONNECTMA false
106.115.93.96
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
133.160.31.211
 unknown Japan 385 AFCONC-BLOCK1-ASUS false
18.117.117.234
 unknown United States
3 MIT-GATEWAYSUS false
174.22.195.225
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
27.171.35.234
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
35.46.201.93
 unknown United States
36375 UMICH-AS-5US false
95.209.16.214
 unknown Sweden
44034 HI3GSE false
66.182.7.122
 unknown United States
7385 ALLSTREAMUS false
102.75.216.133
 unknown Morocco
6713 IAM-ASMA false
89.108.102.237
 unknown Russian Federation
43146 AGAVA3RU false
150.204.194.44
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
91.176.20.175
 unknown Belgium
5432 PROXIMUS-ISP-ASBE false
136.80.65.112
 unknown United States
60311 ONEFMCH false
41.17.101.8
 unknown South Africa
29975 VODACOM-ZA false
197.248.19.172
 unknown Kenya
37061 SafaricomKE false
95.64.209.79
 unknown Russian Federation
49170 MKSBALASHIHI-ASRU false
40.150.48.189
 unknown United States
4249 LILLY-ASUS false
92.216.112.46
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
156.183.158.125
 unknown Egypt
36992 ETISALAT-MISREG false
41.113.110.200
 unknown South Africa
16637 MTNNS-ASZA false
191.139.5.146
 unknown Brazil
26615 TIMSABR false
91.217.133.129
 unknown Denmark
16095 JAYNETSentiaDanmarkASDK false
247.74.39.72
 unknown Reserved
unknown unknown false
2.70.124.143
 unknown Sweden
44034 HI3GSE false
248.224.34.229
 unknown Reserved
unknown unknown false
168.126.197.148
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
121.177.149.174
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
166.208.142.44
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
48.249.96.183
 unknown United States
2686 ATGS-MMD-ASUS false
148.11.185.224
 unknown United States
394673 9408US false
2.147.123.173
 unknown Iran (ISLAMIC Republic Of)
44244 IRANCELL-ASIR false
58.233.45.1
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
69.65.56.120
 unknown United States
32181 ASN-GIGENETUS false
39.43.133.98
 unknown Pakistan
45595 PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK false
35.58.190.132
 unknown United States
36375 UMICH-AS-5US false
42.44.38.77
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
143.17.205.83
 unknown United States
11003 PANDGUS false
174.194.65.123
 unknown United States
22394 CELLCOUS false
243.43.74.151
 unknown Reserved
unknown unknown false
84.0.70.53
 unknown Hungary
5483 MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHU false
136.91.241.70
 unknown United States
60311 ONEFMCH false
73.176.234.88
 unknown United States
7922 COMCAST-7922US false
38.121.127.181
 unknown United States
174 COGENT-174US false
17.142.222.227
 unknown United States
714 APPLE-ENGINEERINGUS false
177.115.148.62
 unknown Brazil
26599 TELEFONICABRASILSABR false
120.80.74.20
 unknown China
134543 UNICOM-DONGGUAN-IDCChinaUnicomGuangdongIPnetworkCN false
195.25.173.201
 unknown France
3215 FranceTelecom-OrangeFR false
179.76.101.114
 unknown Brazil
26615 TIMSABR false
86.221.187.202
 unknown France
3215 FranceTelecom-OrangeFR false
121.104.191.237
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
202.110.118.5
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
148.87.159.48
 unknown United States
1215 ORACLE-NA-ASUS false
165.205.219.150
 unknown New Zealand
22809 AMFAM-INSUS false
4.24.145.241
 unknown United States
3356 LEVEL3US false
219.90.116.227
 unknown Hong Kong
9584 GENESIS-APDiyixiancomLimitedHK false
191.138.228.194
 unknown Brazil
26615 TIMSABR false
213.183.244.248
 unknown Russian Federation
197460 ZENCOM-ASRU false