Linux Analysis Report
z3hir.x86.elf

Overview

General Information

Sample name: z3hir.x86.elf
Analysis ID: 1526846
MD5: 3fea1c5888c35cc0454e18e14859f29d
SHA1: 1e49d2e7745799bb9b45084cad0e33de53583259
SHA256: 64693ceb78daafb78fe3721483b9b1cad2c48bd2cf8b51974337487029704d7f
Tags: user-elfdigest
Infos:

Detection

Mirai
Score: 72
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Machine Learning detection for sample
Sample is packed with UPX
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Sample contains only a LOAD segment without any section mappings
Sample tries to kill a process (SIGKILL)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: z3hir.x86.elf ReversingLabs: Detection: 60%
Machine Learning detection for sample
Source: z3hir.x86.elf Joe Sandbox ML: detected
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:50958 -> 103.238.235.110:9375
Source: unknown TCP traffic detected without corresponding DNS query: 103.238.235.110
Source: unknown TCP traffic detected without corresponding DNS query: 142.14.195.135
Source: unknown TCP traffic detected without corresponding DNS query: 14.60.177.135
Source: unknown TCP traffic detected without corresponding DNS query: 77.49.165.136
Source: unknown TCP traffic detected without corresponding DNS query: 251.168.26.115
Source: unknown TCP traffic detected without corresponding DNS query: 101.140.6.15
Source: unknown TCP traffic detected without corresponding DNS query: 248.92.184.254
Source: unknown TCP traffic detected without corresponding DNS query: 160.29.181.221
Source: unknown TCP traffic detected without corresponding DNS query: 157.84.98.245
Source: unknown TCP traffic detected without corresponding DNS query: 199.3.32.74
Source: unknown TCP traffic detected without corresponding DNS query: 116.20.132.244
Source: unknown TCP traffic detected without corresponding DNS query: 207.222.106.170
Source: unknown TCP traffic detected without corresponding DNS query: 201.152.213.24
Source: unknown TCP traffic detected without corresponding DNS query: 57.17.193.201
Source: unknown TCP traffic detected without corresponding DNS query: 170.143.55.77
Source: unknown TCP traffic detected without corresponding DNS query: 91.89.103.30
Source: unknown TCP traffic detected without corresponding DNS query: 68.64.234.141
Source: unknown TCP traffic detected without corresponding DNS query: 9.232.246.160
Source: unknown TCP traffic detected without corresponding DNS query: 195.80.49.45
Source: unknown TCP traffic detected without corresponding DNS query: 95.137.196.245
Source: unknown TCP traffic detected without corresponding DNS query: 175.106.196.235
Source: unknown TCP traffic detected without corresponding DNS query: 159.61.80.244
Source: unknown TCP traffic detected without corresponding DNS query: 118.59.152.241
Source: unknown TCP traffic detected without corresponding DNS query: 96.20.37.207
Source: unknown TCP traffic detected without corresponding DNS query: 165.144.152.22
Source: unknown TCP traffic detected without corresponding DNS query: 142.197.14.56
Source: unknown TCP traffic detected without corresponding DNS query: 170.57.226.83
Source: unknown TCP traffic detected without corresponding DNS query: 135.112.209.112
Source: unknown TCP traffic detected without corresponding DNS query: 252.199.111.191
Source: unknown TCP traffic detected without corresponding DNS query: 216.51.235.121
Source: unknown TCP traffic detected without corresponding DNS query: 198.60.205.131
Source: unknown TCP traffic detected without corresponding DNS query: 5.76.106.53
Source: unknown TCP traffic detected without corresponding DNS query: 80.229.72.244
Source: unknown TCP traffic detected without corresponding DNS query: 178.57.0.23
Source: unknown TCP traffic detected without corresponding DNS query: 9.247.129.27
Source: unknown TCP traffic detected without corresponding DNS query: 159.197.16.183
Source: unknown TCP traffic detected without corresponding DNS query: 160.106.107.140
Source: unknown TCP traffic detected without corresponding DNS query: 113.79.252.65
Source: unknown TCP traffic detected without corresponding DNS query: 90.63.45.96
Source: unknown TCP traffic detected without corresponding DNS query: 72.191.4.57
Source: unknown TCP traffic detected without corresponding DNS query: 135.127.17.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.56.112.112
Source: unknown TCP traffic detected without corresponding DNS query: 167.108.114.124
Source: unknown TCP traffic detected without corresponding DNS query: 243.98.230.136
Source: unknown TCP traffic detected without corresponding DNS query: 242.253.135.175
Source: unknown TCP traffic detected without corresponding DNS query: 167.83.244.207
Source: unknown TCP traffic detected without corresponding DNS query: 77.27.33.183
Source: unknown TCP traffic detected without corresponding DNS query: 118.105.250.231
Source: unknown TCP traffic detected without corresponding DNS query: 91.194.59.228
Source: unknown TCP traffic detected without corresponding DNS query: 178.95.230.41
Source: z3hir.x86.elf String found in binary or memory: http://upx.sf.net

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0xc01000
Sample tries to kill a process (SIGKILL)
Source: /tmp/z3hir.x86.elf (PID: 5487) SIGKILL sent: pid: 940, result: successful Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) SIGKILL sent: pid: 940, result: successful Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) SIGKILL sent: pid: 5487, result: successful Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) SIGKILL sent: pid: 767, result: successful Jump to behavior
Yara signature match
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: classification engine Classification label: mal72.troj.evad.linELF@0/0@0/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
Enumerates processes within the "proc" file system
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/490/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/791/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/794/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/795/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/797/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/853/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/917/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/780/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/1/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/661/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/782/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/785/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/940/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/767/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/800/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/888/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/801/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/725/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/769/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/726/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/803/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/806/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/807/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5487) File opened: /proc/928/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/3244/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/1583/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/2672/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/3120/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/3120/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/3361/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/3239/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/1577/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/1577/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/1610/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/1610/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/1299/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/1299/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/3235/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/512/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/514/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/519/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/2946/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/2946/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/917/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/917/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/917/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/3134/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/3134/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/1593/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/1593/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/3011/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/3011/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/3094/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/3094/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/2955/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/2955/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/3406/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/1/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/1/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/1589/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/1589/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/3129/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/3129/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/1588/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/1588/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/3402/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/3125/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/3125/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/3246/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/3245/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/767/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/767/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/767/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/800/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/800/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/800/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/888/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/888/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/888/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/801/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/801/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/801/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/769/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/769/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/769/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/803/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/803/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/803/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/806/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/806/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/806/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/807/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/807/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/807/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/928/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/928/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/928/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/2956/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/2956/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/3420/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/490/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/490/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/490/exe Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/3142/fd Jump to behavior
Source: /tmp/z3hir.x86.elf (PID: 5490) File opened: /proc/3142/exe Jump to behavior
ELF contains segments with high entropy indicating compressed/encrypted content
Source: z3hir.x86.elf Submission file: segment LOAD with 7.8786 entropy (max. 8.0)

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5488.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
170.60.138.128
 unknown Switzerland
15854 HP_WEBSERVICESDE false
162.234.58.31
 unknown United States
7018 ATT-INTERNET4US false
211.138.224.49
 unknown China
56047 CMNET-HUNAN-APChinaMobilecommunicationscorporationCN false
83.128.255.83
 unknown Netherlands
15435 KABELFOONDELTAFiberNederlandNL false
45.52.254.169
 unknown United States
5650 FRONTIER-FRTRUS false
212.45.199.115
 unknown Switzerland
15623 CYBERLINKCyberlinkAGCH false
62.135.4.22
 unknown Egypt
24863 LINKdotNET-ASEG false
184.125.201.144
 unknown United States
7922 COMCAST-7922US false
109.176.44.233
 unknown United Kingdom
12513 ECLIPSEGB false
254.24.41.120
 unknown Reserved
unknown unknown false
139.167.58.99
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
31.251.222.217
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
180.101.40.199
 unknown China
4809 CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr false
185.170.187.134
 unknown Moldova Republic of
62337 TELE-LUCI-ASMD false
162.62.116.230
 unknown Singapore
132203 TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN false
89.210.54.37
 unknown Greece
3329 HOL-GRAthensGreeceGR false
116.24.218.40
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
216.121.100.91
 unknown United States
26228 SERVEPATHUS false
217.142.13.109
 unknown Sweden
16253 BORDERLIGHT-ASVretgrand18SE false
219.215.7.178
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
171.88.238.0
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
38.188.164.222
 unknown United States
174 COGENT-174US false
16.100.173.142
 unknown United States
unknown unknown false
171.211.236.100
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
243.159.42.203
 unknown Reserved
unknown unknown false
67.231.218.144
 unknown Canada
812 ROGERS-COMMUNICATIONSCA false
155.42.184.38
 unknown United States
54257 VSC-AS-VERMONT-STATE-COLLEGESUS false
69.226.230.83
 unknown United States
7018 ATT-INTERNET4US false
200.254.246.18
 unknown Brazil
4230 CLAROSABR false
221.220.146.225
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
4.155.55.137
 unknown United States
3356 LEVEL3US false
17.186.70.25
 unknown United States
714 APPLE-ENGINEERINGUS false
246.12.137.156
 unknown Reserved
unknown unknown false
77.197.50.101
 unknown France
15557 LDCOMNETFR false
107.145.254.225
 unknown United States
33363 BHN-33363US false
82.82.11.154
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
109.249.104.224
 unknown United Kingdom
12576 EELtdGB false
83.133.136.163
 unknown European Union
13237 LAMBDANET-ASEuropeanBackboneofAS13237DE false
209.138.97.243
 unknown United States
701 UUNETUS false
85.134.74.16
 unknown Finland
24751 MULTIFI-ASFI false
222.154.100.55
 unknown New Zealand
4771 SPARKNZSparkNewZealandTradingLtdNZ false
221.146.25.133
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
213.253.113.107
 unknown Slovenia
9119 SOFTNET-ASInternetServiceProviderinSloveniaandSouthE false
100.183.96.97
 unknown United States
21928 T-MOBILE-AS21928US false
240.34.20.106
 unknown Reserved
unknown unknown false
245.20.147.103
 unknown Reserved
unknown unknown false
125.13.82.121
 unknown Japan 9824 JTCL-JP-ASJupiterTelecommunicationCoLtdJP false
125.222.69.255
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
35.225.224.176
 unknown United States
15169 GOOGLEUS false
122.131.173.254
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
65.125.42.118
 unknown United States
27235 CVC-INET-33US false
252.243.88.78
 unknown Reserved
unknown unknown false
153.0.146.185
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
59.219.211.114
 unknown China
2516 KDDIKDDICORPORATIONJP false
123.58.253.58
 unknown China
133119 UNICOM-CNChinaUnicomIPnetworkCN false
97.167.234.101
 unknown United States
6167 CELLCO-PARTUS false
44.172.145.8
 unknown United States
20473 AS-CHOOPAUS false
106.136.29.181
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
219.14.134.165
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
112.157.123.241
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
5.74.168.46
 unknown Iran (ISLAMIC Republic Of)
12880 DCI-ASIR false
36.70.64.16
 unknown Indonesia
7713 TELKOMNET-AS-APPTTelekomunikasiIndonesiaID false
200.38.113.203
 unknown Mexico
28517 TVAztecaSABdeCVMX false
178.157.241.143
 unknown Denmark
43557 ASEMNETDK false
244.172.65.87
 unknown Reserved
unknown unknown false
81.78.98.137
 unknown United Kingdom
3269 ASN-IBSNAZIT false
90.217.222.103
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
218.71.178.40
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
68.11.0.104
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
91.92.231.144
 unknown Iran (ISLAMIC Republic Of)
58224 TCIIR false
145.79.46.249
 unknown Netherlands
33915 TNF-ASNL false
166.94.19.6
 unknown United States
3926 FFX-CNTYUS false
58.58.153.14
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
178.57.0.23
 unknown Russian Federation
201952 ATEL-RYBINSKRU false
248.238.201.227
 unknown Reserved
unknown unknown false
160.130.184.42
 unknown United States
8103 STATE-OF-FLAUS false
168.38.212.109
 unknown United States
1761 TDIR-CAPNETUS false
162.101.183.252
 unknown United States
33274 ASN-FAIRVIEWHEALTHSERVICESUS false
176.91.64.129
 unknown Turkey
16135 TURKCELL-ASTurkcellASTR false
61.21.29.90
 unknown Japan 9824 JTCL-JP-ASJupiterTelecommunicationCoLtdJP false
250.65.26.37
 unknown Reserved
unknown unknown false
101.85.152.84
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
115.194.192.14
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
81.112.8.76
 unknown Italy
20959 TELECOM-ITALIA-DATA-COMIT false
27.55.110.71
 unknown Thailand
132061 REALMOVE-AS-APRealmoveCompanyLimitedTH false
184.224.70.229
 unknown United States
10507 SPCSUS false
213.181.28.237
 unknown Russian Federation
8241 RELLINE-ASRU false
97.225.123.149
 unknown United States
6167 CELLCO-PARTUS false
16.116.57.60
 unknown United States
unknown unknown false
59.126.125.204
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
222.160.76.159
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
175.137.126.156
 unknown Malaysia
4788 TMNET-AS-APTMNetInternetServiceProviderMY false
79.116.103.93
 unknown Romania
8708 RCS-RDS73-75DrStaicoviciRO false
222.191.78.44
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
8.116.114.179
 unknown United States
3356 LEVEL3US false
48.3.58.78
 unknown United States
2686 ATGS-MMD-ASUS false
88.224.86.0
 unknown Turkey
9121 TTNETTR false
1.126.170.132
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
202.69.75.92
 unknown Hong Kong
9381 HKBNES-AS-APHKBNEnterpriseSolutionsHKLimitedHK false
150.81.196.155
 unknown Japan 6400 CompaniaDominicanadeTelefonosSADO false