Linux Analysis Report
z3hir.arm.elf

Overview

General Information

Sample name: z3hir.arm.elf
Analysis ID: 1526844
MD5: ba88f30ea805b7af41a46d6421fd258f
SHA1: 88cae64d5a32c20cac6b77db41b6e3212ac21788
SHA256: 1a8e1614e14054ec0df67fdfa5c5c68a950d7217b30ab8cd2bcf4954ea2ff1be
Tags: user-elfdigest
Infos:

Detection

Mirai
Score: 76
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample is packed with UPX
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Sample contains only a LOAD segment without any section mappings
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: z3hir.arm.elf ReversingLabs: Detection: 60%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:55362 -> 103.238.235.110:9375
Sample listens on a socket
Source: /tmp/z3hir.arm.elf (PID: 6239) Socket: 0.0.0.0:23 Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6239) Socket: 0.0.0.0:0 Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6239) Socket: 0.0.0.0:80 Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6239) Socket: 0.0.0.0:81 Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6239) Socket: 0.0.0.0:8443 Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6239) Socket: 0.0.0.0:9009 Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) Socket: 0.0.0.0:0 Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) Socket: 0.0.0.0:80 Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) Socket: 0.0.0.0:81 Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) Socket: 0.0.0.0:8443 Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) Socket: 0.0.0.0:9009 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 103.238.235.110
Source: unknown TCP traffic detected without corresponding DNS query: 103.238.235.110
Source: unknown TCP traffic detected without corresponding DNS query: 206.111.195.134
Source: unknown TCP traffic detected without corresponding DNS query: 46.93.177.134
Source: unknown TCP traffic detected without corresponding DNS query: 88.100.112.239
Source: unknown TCP traffic detected without corresponding DNS query: 64.32.52.29
Source: unknown TCP traffic detected without corresponding DNS query: 16.116.7.149
Source: unknown TCP traffic detected without corresponding DNS query: 51.14.232.133
Source: unknown TCP traffic detected without corresponding DNS query: 87.47.49.202
Source: unknown TCP traffic detected without corresponding DNS query: 109.209.200.71
Source: unknown TCP traffic detected without corresponding DNS query: 191.222.182.163
Source: unknown TCP traffic detected without corresponding DNS query: 201.165.195.66
Source: unknown TCP traffic detected without corresponding DNS query: 94.75.5.78
Source: unknown TCP traffic detected without corresponding DNS query: 37.78.142.232
Source: unknown TCP traffic detected without corresponding DNS query: 44.136.136.49
Source: unknown TCP traffic detected without corresponding DNS query: 202.234.187.73
Source: unknown TCP traffic detected without corresponding DNS query: 84.136.67.254
Source: unknown TCP traffic detected without corresponding DNS query: 76.141.60.199
Source: unknown TCP traffic detected without corresponding DNS query: 192.212.83.83
Source: unknown TCP traffic detected without corresponding DNS query: 223.60.187.98
Source: unknown TCP traffic detected without corresponding DNS query: 221.254.235.66
Source: unknown TCP traffic detected without corresponding DNS query: 157.236.121.165
Source: unknown TCP traffic detected without corresponding DNS query: 182.199.218.78
Source: unknown TCP traffic detected without corresponding DNS query: 222.24.177.193
Source: unknown TCP traffic detected without corresponding DNS query: 58.87.161.70
Source: unknown TCP traffic detected without corresponding DNS query: 148.174.126.148
Source: unknown TCP traffic detected without corresponding DNS query: 73.34.6.251
Source: unknown TCP traffic detected without corresponding DNS query: 187.202.17.67
Source: unknown TCP traffic detected without corresponding DNS query: 165.174.253.122
Source: unknown TCP traffic detected without corresponding DNS query: 126.58.179.146
Source: unknown TCP traffic detected without corresponding DNS query: 222.224.21.171
Source: unknown TCP traffic detected without corresponding DNS query: 44.191.241.44
Source: unknown TCP traffic detected without corresponding DNS query: 242.249.204.67
Source: unknown TCP traffic detected without corresponding DNS query: 223.104.131.21
Source: unknown TCP traffic detected without corresponding DNS query: 83.150.113.169
Source: unknown TCP traffic detected without corresponding DNS query: 69.43.243.169
Source: unknown TCP traffic detected without corresponding DNS query: 60.145.59.124
Source: unknown TCP traffic detected without corresponding DNS query: 159.114.178.173
Source: unknown TCP traffic detected without corresponding DNS query: 34.239.218.46
Source: unknown TCP traffic detected without corresponding DNS query: 13.237.193.229
Source: unknown TCP traffic detected without corresponding DNS query: 212.225.233.24
Source: unknown TCP traffic detected without corresponding DNS query: 180.86.100.30
Source: unknown TCP traffic detected without corresponding DNS query: 74.198.240.231
Source: unknown TCP traffic detected without corresponding DNS query: 252.246.251.20
Source: unknown TCP traffic detected without corresponding DNS query: 118.200.162.65
Source: unknown TCP traffic detected without corresponding DNS query: 31.207.19.43
Source: unknown TCP traffic detected without corresponding DNS query: 48.130.200.57
Source: unknown TCP traffic detected without corresponding DNS query: 43.204.41.218
Source: unknown TCP traffic detected without corresponding DNS query: 136.48.48.71
Source: z3hir.arm.elf String found in binary or memory: http://upx.sf.net
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 6241.1.00007efb08017000.00007efb08028000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6241.1.00007efb08017000.00007efb08028000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6237.1.00007efb08017000.00007efb08028000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6237.1.00007efb08017000.00007efb08028000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6252.1.00007efb08017000.00007efb08028000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6252.1.00007efb08017000.00007efb08028000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x8000
Sample tries to kill a process (SIGKILL)
Source: /tmp/z3hir.arm.elf (PID: 6239) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) SIGKILL sent: pid: 6239, result: successful Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) SIGKILL sent: pid: 759, result: successful Jump to behavior
Yara signature match
Source: 6241.1.00007efb08017000.00007efb08028000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6241.1.00007efb08017000.00007efb08028000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6237.1.00007efb08017000.00007efb08028000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6237.1.00007efb08017000.00007efb08028000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6252.1.00007efb08017000.00007efb08028000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6252.1.00007efb08017000.00007efb08028000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: classification engine Classification label: mal76.troj.evad.linELF@0/0@0/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
Enumerates processes within the "proc" file system
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/2033/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/2033/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1582/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1582/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/2275/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1612/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1612/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1579/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1579/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1699/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1699/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1335/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1335/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1698/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1698/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/2028/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/2028/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1334/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1334/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1576/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1576/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/2302/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/3236/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/2025/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/2025/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/2146/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/910/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/912/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/912/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/912/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/759/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/759/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/759/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/517/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/2307/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/918/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/918/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/918/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1594/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1594/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/2285/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/2281/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1349/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1349/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1623/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1623/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/761/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/761/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/761/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1622/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1622/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/884/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/884/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/884/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1983/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1983/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/2038/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/2038/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1586/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1586/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1465/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1465/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1344/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1344/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1860/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1860/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1463/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1463/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/2156/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/800/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/800/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/800/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/801/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/801/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/801/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1629/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1629/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/6239/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1627/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1627/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1900/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1900/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/491/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/491/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/491/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/2294/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/2050/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/2050/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1877/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1877/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/772/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/772/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/772/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1633/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1633/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1599/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1599/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1632/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1632/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1477/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/1477/exe Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/774/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/774/fd Jump to behavior
Source: /tmp/z3hir.arm.elf (PID: 6249) File opened: /proc/774/exe Jump to behavior
ELF contains segments with high entropy indicating compressed/encrypted content
Source: z3hir.arm.elf Submission file: segment LOAD with 7.9515 entropy (max. 8.0)
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/z3hir.arm.elf (PID: 6237) Queries kernel information via 'uname': Jump to behavior
Source: z3hir.arm.elf, 6237.1.000055d53dfd1000.000055d53e17f000.rw-.sdmp, z3hir.arm.elf, 6241.1.000055d53dfd1000.000055d53e17f000.rw-.sdmp, z3hir.arm.elf, 6252.1.000055d53dfd1000.000055d53e17f000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: z3hir.arm.elf, 6237.1.00007ffdaddca000.00007ffdaddeb000.rw-.sdmp, z3hir.arm.elf, 6241.1.00007ffdaddca000.00007ffdaddeb000.rw-.sdmp, z3hir.arm.elf, 6252.1.00007ffdaddca000.00007ffdaddeb000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/z3hir.arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/z3hir.arm.elf
Source: z3hir.arm.elf, 6237.1.000055d53dfd1000.000055d53e17f000.rw-.sdmp, z3hir.arm.elf, 6241.1.000055d53dfd1000.000055d53e17f000.rw-.sdmp, z3hir.arm.elf, 6252.1.000055d53dfd1000.000055d53e17f000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: z3hir.arm.elf, 6237.1.00007ffdaddca000.00007ffdaddeb000.rw-.sdmp, z3hir.arm.elf, 6241.1.00007ffdaddca000.00007ffdaddeb000.rw-.sdmp, z3hir.arm.elf, 6252.1.00007ffdaddca000.00007ffdaddeb000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: 6241.1.00007efb08017000.00007efb08028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6237.1.00007efb08017000.00007efb08028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6252.1.00007efb08017000.00007efb08028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: z3hir.arm.elf PID: 6241, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: z3hir.arm.elf PID: 6252, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: 6241.1.00007efb08017000.00007efb08028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6237.1.00007efb08017000.00007efb08028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6252.1.00007efb08017000.00007efb08028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: z3hir.arm.elf PID: 6241, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: z3hir.arm.elf PID: 6252, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
176.238.242.82
 unknown Turkey
16135 TURKCELL-ASTurkcellASTR false
71.155.75.213
 unknown United States
7018 ATT-INTERNET4US false
69.74.25.35
 unknown United States
39981 STONE-POINT-CAPITAL-PUBLICUS false
181.153.11.199
 unknown Colombia
26611 COMCELSACO false
67.173.142.226
 unknown United States
7922 COMCAST-7922US false
223.163.175.171
 unknown China
7641 CHINABTNChinaBroadcastingTVNetCN false
126.136.217.209
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
80.34.93.67
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
39.43.39.165
 unknown Pakistan
45595 PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK false
67.90.86.132
 unknown United States
2828 XO-AS15US false
190.62.198.59
 unknown El Salvador
14754 TelguaGT false
91.193.128.241
 unknown Ukraine
44894 UCMA-ASUA false
174.50.92.68
 unknown United States
7922 COMCAST-7922US false
35.210.7.51
 unknown United States
19527 GOOGLE-2US false
220.99.118.80
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
203.169.164.97
 unknown Hong Kong
9293 HKNET-VIPNETNTTComAsiaLimitedHK false
107.31.44.189
 unknown United States
14654 WAYPORTUS false
217.65.109.123
 unknown Hungary
5483 MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHU false
14.120.104.108
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
105.202.185.213
 unknown Egypt
36992 ETISALAT-MISREG false
141.184.141.100
 unknown United States
197921 HBTFJO false
13.72.178.39
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
143.240.147.18
 unknown United States
174 COGENT-174US false
126.139.16.82
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
145.232.254.240
 unknown Switzerland
15675 ETAT-DE-VAUDCH false
147.127.108.251
 unknown France
1715 FR-REMIP2000REMIP2000AutonomousSystemEU false
61.92.27.92
 unknown Hong Kong
9269 HKBN-AS-APHongKongBroadbandNetworkLtdHK false
84.79.73.255
 unknown Spain
12479 UNI2-ASES false
191.88.37.68
 unknown Colombia
27831 ColombiaMovilCO false
163.53.194.109
 unknown Indonesia
58381 WOWRACK-AS-IDWowInternetIndonesiaID false
251.118.153.168
 unknown Reserved
unknown unknown false
247.105.104.177
 unknown Reserved
unknown unknown false
163.173.151.173
 unknown France
2200 FR-RENATERReseauNationaldetelecommunicationspourlaTec false
53.210.84.105
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
63.124.100.201
 unknown United States
701 UUNETUS false
222.215.189.181
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
138.227.66.176
 unknown Switzerland
12980 EMEAHostingAutonomousSystemEU false
78.89.177.126
 unknown Kuwait
29357 WATANIYATELECOM-ASKW false
63.237.156.66
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
148.254.125.133
 unknown United States
174 COGENT-174US false
181.181.252.26
 unknown Venezuela
262210 VIETTELPERUSACPE false
177.22.237.31
 unknown Brazil
262669 KONNETINFORMATICAEIRELI-EPPBR false
161.87.208.217
 unknown Netherlands
14298 EPA-NETUS false
209.0.149.208
 unknown United States
3356 LEVEL3US false
188.152.99.205
 unknown Italy
30722 VODAFONE-IT-ASNIT false
216.203.168.31
 unknown United States
2828 XO-AS15US false
42.171.230.114
 unknown China
4249 LILLY-ASUS false
1.158.114.168
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
243.95.230.160
 unknown Reserved
unknown unknown false
205.243.233.155
 unknown United States
4358 XNETUS false
186.10.181.55
 unknown Chile
6471 ENTELCHILESACL false
79.159.39.119
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
251.86.251.179
 unknown Reserved
unknown unknown false
62.162.210.187
 unknown Macedonia
6821 MT-AS-OWNbulOrceNikolovbbMK false
23.89.242.110
 unknown United States
18978 ENZUINC-US false
89.185.227.231
 unknown Czech Republic
24971 MASTER-ASCzechRepublicwwwmasterczCZ false
62.27.45.83
 unknown Germany
12312 ECOTELDE false
174.8.232.167
 unknown United States
6327 SHAWCA false
142.178.36.47
 unknown Canada
18814 ATC-DC-NET01CA false
151.211.221.75
 unknown United Kingdom
11003 PANDGUS false
246.194.48.63
 unknown Reserved
unknown unknown false
90.39.180.23
 unknown France
3215 FranceTelecom-OrangeFR false
69.96.76.23
 unknown United States
4261 BLUEGRASSNETUS false
201.230.8.34
 unknown Peru
6147 TelefonicadelPeruSAAPE false
186.148.170.217
 unknown Colombia
262186 TVAZTECASUCURSALCOLOMBIACO false
94.168.72.63
 unknown Netherlands
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
164.196.47.15
 unknown United States
2621 DNIC-AS-02621US false
157.13.147.151
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
125.97.71.234
 unknown China
9814 FIBRLINKBeijingFibrLINKNetworksCoLtdCN false
32.111.4.127
 unknown United States
2688 ATGS-MMD-ASUS false
206.111.195.134
 unknown United States
2828 XO-AS15US false
116.61.162.78
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
88.139.140.67
 unknown France
8228 CEGETEL-ASFR false
1.161.6.135
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
151.91.217.115
 unknown Italy
12874 FASTWEBIT false
89.235.102.108
 unknown Iran (ISLAMIC Republic Of)
58224 TCIIR false
1.178.191.64
 unknown Australia
9723 ISEEK-AS-APiseekCommunicationsPtyLtdAU false
84.20.129.162
 unknown Finland
29422 NBLNETWORKS-ASNebulaOyFI false
41.234.252.142
 unknown Egypt
8452 TE-ASTE-ASEG false
85.68.85.182
 unknown France
21502 ASN-NUMERICABLEFR false
14.133.3.177
 unknown Japan 18126 CTCXChubuTelecommunicationsCompanyIncJP false
150.19.17.67
 unknown Japan 2506 SUPERCSINTTWESTCHUGOKUCORPORATIONJP false
43.50.177.229
 unknown Japan 4249 LILLY-ASUS false
167.10.171.177
 unknown United States
46520 CA-DOJUS false
73.21.20.83
 unknown United States
7922 COMCAST-7922US false
61.178.245.197
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
184.131.122.5
 unknown United States
5778 CENTURYLINK-LEGACY-EMBARQ-RCMTUS false
148.66.62.253
 unknown Hong Kong
45753 NETSEC-HKNETSECHK false
173.201.204.199
 unknown United States
26496 AS-26496-GO-DADDY-COM-LLCUS false
160.94.252.98
 unknown United States
217 UMN-SYSTEMUS false
181.208.81.17
 unknown Venezuela
21826 CorporacionTelemicCAVE false
31.52.79.4
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
82.48.62.248
 unknown Italy
3269 ASN-IBSNAZIT false
176.62.227.121
 unknown Czech Republic
49985 IP4ISPCZ false
39.19.33.111
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
138.216.185.42
 unknown Finland
1759 TSF-IP-CORETeliaFinlandOyjEU false
71.253.118.142
 unknown United States
701 UUNETUS false
19.101.130.131
 unknown United States
3 MIT-GATEWAYSUS false
164.152.31.12
 unknown United States
27343 MONSANTO-INETUS false
161.80.73.30
 unknown United States
14298 EPA-NETUS false