Linux Analysis Report
yakov.m68k.elf

Overview

General Information

Sample name: yakov.m68k.elf
Analysis ID: 1524329
MD5: 177c3d3956c1489d66e0b33bfe340649
SHA1: 087cb328c8cd2344465871554af30c8f25342831
SHA256: d1a6aa4a4b2b610be67696fb4069055dd6321c557ab4120347e012a997d95061
Tags: botnetelfMiraiyakovYakuzauser-NDA0E
Infos:

Detection

Mirai
Score: 72
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: yakov.m68k.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: yakov.m68k.elf ReversingLabs: Detection: 65%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.15:52498 -> 87.120.114.147:3778
Sample listens on a socket
Source: /tmp/yakov.m68k.elf (PID: 5537) Socket: 127.0.0.1:17424 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.114.147
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.114.147
Source: unknown TCP traffic detected without corresponding DNS query: 211.227.128.214
Source: unknown TCP traffic detected without corresponding DNS query: 242.92.11.54
Source: unknown TCP traffic detected without corresponding DNS query: 145.12.244.211
Source: unknown TCP traffic detected without corresponding DNS query: 101.79.27.80
Source: unknown TCP traffic detected without corresponding DNS query: 99.219.124.131
Source: unknown TCP traffic detected without corresponding DNS query: 117.231.119.232
Source: unknown TCP traffic detected without corresponding DNS query: 61.235.217.226
Source: unknown TCP traffic detected without corresponding DNS query: 62.84.21.148
Source: unknown TCP traffic detected without corresponding DNS query: 193.80.24.5
Source: unknown TCP traffic detected without corresponding DNS query: 53.70.59.111
Source: unknown TCP traffic detected without corresponding DNS query: 65.201.179.56
Source: unknown TCP traffic detected without corresponding DNS query: 123.33.219.68
Source: unknown TCP traffic detected without corresponding DNS query: 91.207.56.155
Source: unknown TCP traffic detected without corresponding DNS query: 59.102.244.146
Source: unknown TCP traffic detected without corresponding DNS query: 192.145.22.59
Source: unknown TCP traffic detected without corresponding DNS query: 92.216.40.156
Source: unknown TCP traffic detected without corresponding DNS query: 113.78.46.134
Source: unknown TCP traffic detected without corresponding DNS query: 43.167.140.55
Source: unknown TCP traffic detected without corresponding DNS query: 220.68.21.191
Source: unknown TCP traffic detected without corresponding DNS query: 16.125.215.148
Source: unknown TCP traffic detected without corresponding DNS query: 250.213.253.167
Source: unknown TCP traffic detected without corresponding DNS query: 95.73.153.197
Source: unknown TCP traffic detected without corresponding DNS query: 99.125.77.192
Source: unknown TCP traffic detected without corresponding DNS query: 158.183.9.40
Source: unknown TCP traffic detected without corresponding DNS query: 9.3.136.128
Source: unknown TCP traffic detected without corresponding DNS query: 89.191.157.169
Source: unknown TCP traffic detected without corresponding DNS query: 115.84.91.222
Source: unknown TCP traffic detected without corresponding DNS query: 112.154.195.209
Source: unknown TCP traffic detected without corresponding DNS query: 86.185.254.152
Source: unknown TCP traffic detected without corresponding DNS query: 73.65.225.141
Source: unknown TCP traffic detected without corresponding DNS query: 190.36.113.233
Source: unknown TCP traffic detected without corresponding DNS query: 243.16.127.204
Source: unknown TCP traffic detected without corresponding DNS query: 169.38.136.104
Source: unknown TCP traffic detected without corresponding DNS query: 194.52.225.134
Source: unknown TCP traffic detected without corresponding DNS query: 246.142.196.209
Source: unknown TCP traffic detected without corresponding DNS query: 107.172.122.152
Source: unknown TCP traffic detected without corresponding DNS query: 77.247.120.222
Source: unknown TCP traffic detected without corresponding DNS query: 83.249.88.56
Source: unknown TCP traffic detected without corresponding DNS query: 217.171.223.52
Source: unknown TCP traffic detected without corresponding DNS query: 78.51.226.79
Source: unknown TCP traffic detected without corresponding DNS query: 252.205.77.223
Source: unknown TCP traffic detected without corresponding DNS query: 166.66.237.28
Source: unknown TCP traffic detected without corresponding DNS query: 80.137.117.139
Source: unknown TCP traffic detected without corresponding DNS query: 240.212.4.243
Source: unknown TCP traffic detected without corresponding DNS query: 31.177.146.104
Source: unknown TCP traffic detected without corresponding DNS query: 192.46.23.7
Source: unknown TCP traffic detected without corresponding DNS query: 77.161.181.119
Source: unknown TCP traffic detected without corresponding DNS query: 206.16.189.100

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: yakov.m68k.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: yakov.m68k.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5534.1.00007faea0001000.00007faea000e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5534.1.00007faea0001000.00007faea000e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5539.1.00007faea0001000.00007faea000e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5539.1.00007faea0001000.00007faea000e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: yakov.m68k.elf PID: 5539, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: yakov.m68k.elf PID: 5539, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Yara signature match
Source: yakov.m68k.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: yakov.m68k.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5534.1.00007faea0001000.00007faea000e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5534.1.00007faea0001000.00007faea000e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5539.1.00007faea0001000.00007faea000e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5539.1.00007faea0001000.00007faea000e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: yakov.m68k.elf PID: 5539, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: yakov.m68k.elf PID: 5539, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: yakov.m68k.elf, 5534.1.0000562e742bd000.0000562e74342000.rw-.sdmp, yakov.m68k.elf, 5539.1.0000562e742bd000.0000562e74342000.rw-.sdmp Binary or memory string: g.t.Vbp
Source: classification engine Classification label: mal72.troj.linELF@0/0@0/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/yakov.m68k.elf (PID: 5534) Queries kernel information via 'uname': Jump to behavior
Source: yakov.m68k.elf, 5534.1.0000562e742bd000.0000562e74342000.rw-.sdmp, yakov.m68k.elf, 5539.1.0000562e742bd000.0000562e74342000.rw-.sdmp Binary or memory string: ,t.VP,t.V!/etc/qemu-binfmt/m68k
Source: yakov.m68k.elf, 5534.1.00007ffeb3755000.00007ffeb3776000.rw-.sdmp, yakov.m68k.elf, 5539.1.00007ffeb3755000.00007ffeb3776000.rw-.sdmp Binary or memory string: /usr/bin/qemu-m68k
Source: yakov.m68k.elf, 5534.1.0000562e742bd000.0000562e74342000.rw-.sdmp, yakov.m68k.elf, 5539.1.0000562e742bd000.0000562e74342000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/m68k
Source: yakov.m68k.elf, 5534.1.00007ffeb3755000.00007ffeb3776000.rw-.sdmp, yakov.m68k.elf, 5539.1.00007ffeb3755000.00007ffeb3776000.rw-.sdmp Binary or memory string: `usx86_64/usr/bin/qemu-m68k/tmp/yakov.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/yakov.m68k.elf

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: yakov.m68k.elf, type: SAMPLE
Source: Yara match File source: 5534.1.00007faea0001000.00007faea000e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5539.1.00007faea0001000.00007faea000e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: yakov.m68k.elf PID: 5539, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: yakov.m68k.elf, type: SAMPLE
Source: Yara match File source: 5534.1.00007faea0001000.00007faea000e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5539.1.00007faea0001000.00007faea000e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: yakov.m68k.elf PID: 5539, type: MEMORYSTR
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
38.49.39.152
 unknown United States
174 COGENT-174US false
79.48.202.100
 unknown Italy
3269 ASN-IBSNAZIT false
1.190.106.49
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
63.229.124.65
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
113.202.87.57
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
205.236.174.124
 unknown Canada
22652 FIBRENOIRE-INTERNETCA false
82.43.150.119
 unknown United Kingdom
5089 NTLGB false
244.154.106.254
 unknown Reserved
unknown unknown false
59.143.213.75
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
5.117.99.37
 unknown Iran (ISLAMIC Republic Of)
44244 IRANCELL-ASIR false
121.57.253.87
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
166.172.210.151
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
198.84.82.69
 unknown United States
54290 HOSTWINDSUS false
31.230.109.6
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
170.238.30.107
 unknown Brazil
53066 VETORIALNETINFESERVICOSDEINTERNETLTDABR false
79.69.90.100
 unknown United Kingdom
9105 TISCALI-UKTalkTalkCommunicationsLimitedGB false
125.184.240.139
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
20.112.218.247
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
251.135.154.23
 unknown Reserved
unknown unknown false
41.147.11.12
 unknown South Africa
5713 SAIX-NETZA false
17.4.184.141
 unknown United States
714 APPLE-ENGINEERINGUS false
109.227.147.42
 unknown Spain
15704 AS15704ES false
23.65.105.145
 unknown United States
9829 BSNL-NIBNationalInternetBackboneIN false
24.97.243.204
 unknown United States
11351 TWC-11351-NORTHEASTUS false
251.58.246.1
 unknown Reserved
unknown unknown false
220.158.38.94
 unknown Japan 2519 VECTANTARTERIANetworksCorporationJP false
223.86.67.51
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
101.113.53.90
 unknown Australia
133612 VODAFONE-AS-APVodafoneAustraliaPtyLtdAU false
222.248.71.15
 unknown China
17962 TOPWAY-NETShenZhenTopwayVideoCommunicationCoLtdCN false
38.233.253.207
 unknown United States
174 COGENT-174US false
196.219.72.204
 unknown Egypt
8452 TE-ASTE-ASEG false
180.158.141.238
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
115.125.169.124
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
47.6.195.201
 unknown United States
20115 CHARTER-20115US false
58.15.38.152
 unknown China
17506 UCOMARTERIANetworksCorporationJP false
146.215.187.34
 unknown United States
9619 SSDSonyGlobalSolutionsIncJP false
98.178.93.182
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
2.239.41.48
 unknown Italy
12874 FASTWEBIT false
24.174.196.113
 unknown United States
11426 TWC-11426-CAROLINASUS false
46.154.43.6
 unknown Turkey
15897 VODAFONETURKEYTR false
249.190.106.203
 unknown Reserved
unknown unknown false
187.168.1.156
 unknown Mexico
8151 UninetSAdeCVMX false
8.173.5.16
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
172.87.55.12
 unknown United States
15294 SENTINELTECHUS false
90.129.181.151
 unknown Sweden
1257 TELE2EU false
195.117.240.203
 unknown Poland
5617 TPNETPL false
206.111.147.203
 unknown United States
2828 XO-AS15US false
66.2.145.211
 unknown United States
2828 XO-AS15US false
165.38.70.121
 unknown United States
37053 RSAWEB-ASZA false
141.182.47.231
 unknown United States
197921 HBTFJO false
158.97.242.186
 unknown Mexico
3640 CICESEMX false
159.38.188.6
 unknown Sweden
19399 SLLNETEU false
71.168.245.89
 unknown United States
701 UUNETUS false
37.200.161.157
 unknown Oman
50010 NAWRAS-ASSultanateofOmanOM false
185.124.38.203
 unknown Spain
12479 UNI2-ASES false
117.146.180.77
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
70.35.91.45
 unknown United States
23089 HOTWIRE-COMMUNICATIONSUS false
193.71.62.208
 unknown Norway
2116 ASN-CATCHCOMNO false
252.100.220.144
 unknown Reserved
unknown unknown false
152.143.2.52
 unknown Germany
50629 LWLCOMDE false
113.79.47.195
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
246.217.191.126
 unknown Reserved
unknown unknown false
180.90.255.245
 unknown China
7497 CSTNET-AS-APComputerNetworkInformationCenterCN false
152.230.61.128
 unknown Chile
14259 GtdInternetSACL false
45.65.160.145
 unknown Chile
28098 ABGONCOMUNICACIONESCL false
59.245.105.22
 unknown China
2516 KDDIKDDICORPORATIONJP false
136.96.110.119
 unknown United States
60311 ONEFMCH false
251.78.236.114
 unknown Reserved
unknown unknown false
70.217.40.119
 unknown United States
22394 CELLCOUS false
251.152.58.70
 unknown Reserved
unknown unknown false
66.98.244.30
 unknown United States
36351 SOFTLAYERUS false
5.87.220.77
 unknown Italy
24608 WINDTRE-ASIT false
143.31.44.191
 unknown United States
11003 PANDGUS false
221.183.116.88
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
67.216.227.36
 unknown United States
15960 GLOBALACCESSDE false
253.26.128.39
 unknown Reserved
unknown unknown false
220.168.82.36
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
126.26.48.64
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
92.217.155.15
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
183.44.66.210
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
85.4.20.73
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
2.129.202.255
 unknown Denmark
9158 TELENOR_DANMARK_ASDK false
111.97.244.191
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
108.191.17.225
 unknown United States
33363 BHN-33363US false
150.223.203.192
 unknown China
58519 CHINATELECOM-CTCLOUDCloudComputingCorporationCN false
118.113.238.169
 unknown China
38283 CHINANET-SCIDC-AS-APCHINANETSiChuanTelecomInternetData false
24.79.194.223
 unknown Canada
6327 SHAWCA false
146.28.194.62
 unknown United States
197938 TRAVIANGAMESDE false
199.73.105.200
 unknown United States
23314 ORLANDOTELCOUS false
217.205.66.56
 unknown United Kingdom
4589 EASYNETEasynetGlobalServicesEU false
2.70.212.141
 unknown Sweden
44034 HI3GSE false
81.136.49.224
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
151.238.141.123
 unknown Iran (ISLAMIC Republic Of)
31549 RASANAIR false
62.40.54.75
 unknown Ireland
13280 H3GIE false
251.233.107.224
 unknown Reserved
unknown unknown false
104.42.202.37
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
147.24.2.87
 unknown United States
10796 TWC-10796-MIDWESTUS false
48.31.2.229
 unknown United States
2686 ATGS-MMD-ASUS false
79.216.6.37
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
185.232.223.140
 unknown Germany
202283 FVNRWDE false