Linux Analysis Report
x86.elf

Overview

General Information

Sample name: x86.elf
Analysis ID: 1527385
MD5: 264119b15751815c12fa9501869ea3de
SHA1: 115641623e23bdb43edf02d9aafabe5aebe2a82d
SHA256: 7919a77efbc4cc78bbb520782011f617aeb0e4fe0879f02bd1e5bd6fc62c6f89
Tags: user-elfdigest
Infos:

Detection

Mirai
Score: 80
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Contains symbols with names commonly found in malware
Machine Learning detection for sample
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample and/or dropped files contains symbols with suspicious names
Sample listens on a socket
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: x86.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: x86.elf ReversingLabs: Detection: 31%
Machine Learning detection for sample
Source: x86.elf Joe Sandbox ML: detected
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:40280 -> 45.144.172.147:5972
Source: global traffic TCP traffic: 192.168.2.14:54686 -> 185.82.200.181:21207
Source: global traffic TCP traffic: 192.168.2.14:44676 -> 91.219.236.13:13182
Source: global traffic TCP traffic: 192.168.2.14:32938 -> 87.120.166.4:18843
Source: global traffic TCP traffic: 192.168.2.14:40610 -> 27.102.115.180:25447
Source: global traffic TCP traffic: 192.168.2.14:45766 -> 158.51.124.230:21215
Source: global traffic TCP traffic: 192.168.2.14:53368 -> 46.29.161.108:9695
Source: global traffic TCP traffic: 192.168.2.14:42682 -> 212.192.13.171:17195
Sample listens on a socket
Source: /tmp/x86.elf (PID: 5607) Socket: 127.0.0.1:1172 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 66.94.138.46
Source: unknown TCP traffic detected without corresponding DNS query: 53.46.178.81
Source: unknown TCP traffic detected without corresponding DNS query: 144.183.59.85
Source: unknown TCP traffic detected without corresponding DNS query: 132.82.242.139
Source: unknown TCP traffic detected without corresponding DNS query: 209.215.46.219
Source: unknown TCP traffic detected without corresponding DNS query: 99.168.217.14
Source: unknown TCP traffic detected without corresponding DNS query: 103.236.112.12
Source: unknown TCP traffic detected without corresponding DNS query: 60.218.111.247
Source: unknown TCP traffic detected without corresponding DNS query: 116.51.163.120
Source: unknown TCP traffic detected without corresponding DNS query: 93.136.35.80
Source: unknown TCP traffic detected without corresponding DNS query: 159.104.37.156
Source: unknown TCP traffic detected without corresponding DNS query: 52.142.243.77
Source: unknown TCP traffic detected without corresponding DNS query: 79.58.134.18
Source: unknown TCP traffic detected without corresponding DNS query: 51.130.202.221
Source: unknown TCP traffic detected without corresponding DNS query: 20.207.220.134
Source: unknown TCP traffic detected without corresponding DNS query: 196.126.204.187
Source: unknown TCP traffic detected without corresponding DNS query: 176.243.184.171
Source: unknown TCP traffic detected without corresponding DNS query: 82.195.51.61
Source: unknown TCP traffic detected without corresponding DNS query: 57.14.202.175
Source: unknown TCP traffic detected without corresponding DNS query: 213.11.40.171
Source: unknown TCP traffic detected without corresponding DNS query: 177.250.72.148
Source: unknown TCP traffic detected without corresponding DNS query: 199.118.190.16
Source: unknown TCP traffic detected without corresponding DNS query: 28.50.142.141
Source: unknown TCP traffic detected without corresponding DNS query: 21.38.95.142
Source: unknown TCP traffic detected without corresponding DNS query: 161.118.73.154
Source: unknown TCP traffic detected without corresponding DNS query: 191.146.39.199
Source: unknown TCP traffic detected without corresponding DNS query: 52.157.211.251
Source: unknown TCP traffic detected without corresponding DNS query: 174.45.186.233
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.2.15
Source: unknown TCP traffic detected without corresponding DNS query: 100.153.148.201
Source: unknown TCP traffic detected without corresponding DNS query: 45.141.159.78
Source: unknown TCP traffic detected without corresponding DNS query: 129.91.195.59
Source: unknown TCP traffic detected without corresponding DNS query: 6.160.212.112
Source: unknown TCP traffic detected without corresponding DNS query: 139.215.151.165
Source: unknown TCP traffic detected without corresponding DNS query: 189.247.50.85
Source: unknown TCP traffic detected without corresponding DNS query: 160.142.108.202
Source: unknown TCP traffic detected without corresponding DNS query: 24.74.117.169
Source: unknown TCP traffic detected without corresponding DNS query: 201.16.116.255
Source: unknown TCP traffic detected without corresponding DNS query: 79.16.119.143
Source: unknown TCP traffic detected without corresponding DNS query: 118.173.87.213
Source: unknown TCP traffic detected without corresponding DNS query: 82.240.32.226
Source: unknown TCP traffic detected without corresponding DNS query: 137.111.83.127
Source: unknown TCP traffic detected without corresponding DNS query: 209.173.247.177
Source: unknown TCP traffic detected without corresponding DNS query: 38.169.207.148
Source: unknown TCP traffic detected without corresponding DNS query: 183.34.60.137
Source: unknown TCP traffic detected without corresponding DNS query: 17.65.8.40
Source: unknown TCP traffic detected without corresponding DNS query: 67.31.148.9
Source: unknown TCP traffic detected without corresponding DNS query: 134.95.190.60
Source: unknown TCP traffic detected without corresponding DNS query: 80.64.154.1
Source: unknown TCP traffic detected without corresponding DNS query: 146.64.177.24
Source: global traffic DNS traffic detected: DNS query: kingstonwikkerink.dyn
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_3fe3c668 Author: unknown
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_637f2c04 Author: unknown
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Tsunami_0e52c842 Author: unknown
Source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_3fe3c668 Author: unknown
Source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_637f2c04 Author: unknown
Source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Tsunami_0e52c842 Author: unknown
Contains symbols with names commonly found in malware
Source: ELF static info symbol of initial sample Name: add_attack
Source: ELF static info symbol of initial sample Name: attack.c
Source: ELF static info symbol of initial sample Name: attack_get_opt_int
Source: ELF static info symbol of initial sample Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample Name: attack_get_opt_str
Source: ELF static info symbol of initial sample Name: attack_gre_ip
Source: ELF static info symbol of initial sample Name: attack_init
Source: ELF static info symbol of initial sample Name: attack_kill_all
Source: ELF static info symbol of initial sample Name: attack_method_tcp
Source: ELF static info symbol of initial sample Name: attack_ongoing
Sample and/or dropped files contains symbols with suspicious names
Source: x86.elf ELF static info symbol of initial sample: hidepid
Source: x86.elf ELF static info symbol of initial sample: scanner_init
Source: x86.elf ELF static info symbol of initial sample: scanner_kill
Source: x86.elf ELF static info symbol of initial sample: scanner_pid
Source: x86.elf ELF static info symbol of initial sample: scanner_rawpkt
Yara signature match
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_3fe3c668 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 2a79caea707eb0ecd740106ea4bed2918e7592c1e5ad6050f6f0992cf31ba5ec, id = 3fe3c668-89f4-4601-a167-f41bbd984ae5, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_637f2c04 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 7af3d573af8b7f8252590a53adda52ecf53bdaf9a86b52ef50702f048e08ba8c, id = 637f2c04-98e4-45aa-b60a-14a96c6cebb7, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Tsunami_0e52c842 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 70fdfb7aa5d1eff98e4e216e7a60ed1ba4d75ed1f47a57bf40eeaf35a92c88e4, id = 0e52c842-f65e-4c77-8081-ae2f160e35f4, last_modified = 2021-09-16
Source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_3fe3c668 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 2a79caea707eb0ecd740106ea4bed2918e7592c1e5ad6050f6f0992cf31ba5ec, id = 3fe3c668-89f4-4601-a167-f41bbd984ae5, last_modified = 2021-09-16
Source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_637f2c04 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 7af3d573af8b7f8252590a53adda52ecf53bdaf9a86b52ef50702f048e08ba8c, id = 637f2c04-98e4-45aa-b60a-14a96c6cebb7, last_modified = 2021-09-16
Source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Tsunami_0e52c842 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 70fdfb7aa5d1eff98e4e216e7a60ed1ba4d75ed1f47a57bf40eeaf35a92c88e4, id = 0e52c842-f65e-4c77-8081-ae2f160e35f4, last_modified = 2021-09-16
Source: classification engine Classification label: mal80.troj.linELF@0/0@33/0
Source: x86.elf ELF static info symbol of initial sample: libc/string/x86_64/memcpy.S
Source: x86.elf ELF static info symbol of initial sample: libc/string/x86_64/mempcpy.S
Source: x86.elf ELF static info symbol of initial sample: libc/string/x86_64/memset.S
Source: x86.elf ELF static info symbol of initial sample: libc/string/x86_64/strcat.S
Source: x86.elf ELF static info symbol of initial sample: libc/string/x86_64/strchr.S
Source: x86.elf ELF static info symbol of initial sample: libc/string/x86_64/strcmp.S
Source: x86.elf ELF static info symbol of initial sample: libc/string/x86_64/strcpy.S
Source: x86.elf ELF static info symbol of initial sample: libc/string/x86_64/strlen.S
Source: x86.elf ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crt1.S
Source: x86.elf ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crti.S
Source: x86.elf ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crtn.S
Enumerates processes within the "proc" file system
Source: /tmp/x86.elf (PID: 5609) File opened: /proc/5680/status Jump to behavior
Source: /tmp/x86.elf (PID: 5609) File opened: /proc/5670/status Jump to behavior
Source: /tmp/x86.elf (PID: 5609) File opened: /proc/5681/status Jump to behavior
Source: /tmp/x86.elf (PID: 5609) File opened: /proc/5671/status Jump to behavior
Source: /tmp/x86.elf (PID: 5609) File opened: /proc/5682/status Jump to behavior
Source: /tmp/x86.elf (PID: 5609) File opened: /proc/5672/status Jump to behavior
Source: /tmp/x86.elf (PID: 5609) File opened: /proc/5683/status Jump to behavior
Source: /tmp/x86.elf (PID: 5609) File opened: /proc/5673/status Jump to behavior
Source: /tmp/x86.elf (PID: 5609) File opened: /proc/5684/status Jump to behavior
Source: /tmp/x86.elf (PID: 5609) File opened: /proc/5652/status Jump to behavior
Source: /tmp/x86.elf (PID: 5609) File opened: /proc/5674/status Jump to behavior
Source: /tmp/x86.elf (PID: 5609) File opened: /proc/5685/status Jump to behavior
Source: /tmp/x86.elf (PID: 5609) File opened: /proc/5675/status Jump to behavior
Source: /tmp/x86.elf (PID: 5609) File opened: /proc/5686/status Jump to behavior
Source: /tmp/x86.elf (PID: 5609) File opened: /proc/5445/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 5609) File opened: /proc/5676/status Jump to behavior
Source: /tmp/x86.elf (PID: 5609) File opened: /proc/5677/status Jump to behavior
Source: /tmp/x86.elf (PID: 5609) File opened: /proc/5678/status Jump to behavior
Source: /tmp/x86.elf (PID: 5609) File opened: /proc/5679/status Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: x86.elf, type: SAMPLE
Source: Yara match File source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: x86.elf, type: SAMPLE
Source: Yara match File source: 5607.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
86.88.75.238
 unknown Netherlands
1136 KPNKPNNationalEU false
117.114.147.253
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
190.53.135.23
 unknown El Salvador
27773 MILLICOMCABLEELSALVADORSADECVSV false
26.174.50.87
 unknown United States
7922 COMCAST-7922US false
180.172.248.161
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
73.162.139.36
 unknown United States
7922 COMCAST-7922US false
45.109.69.107
 unknown Egypt
37069 MOBINILEG false
146.10.40.131
 unknown United States
197938 TRAVIANGAMESDE false
112.243.121.13
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
40.27.122.110
 unknown United States
4249 LILLY-ASUS false
29.210.198.72
 unknown United States
7922 COMCAST-7922US false
167.235.230.116
 unknown United States
3525 ALBERTSONSUS false
143.180.254.89
 unknown Switzerland
8803 MIGROSCH false
212.167.25.138
 unknown European Union
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
213.87.196.118
 unknown Russian Federation
42115 BASHCELL-ASRU false
219.36.118.90
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
187.188.56.80
 unknown Mexico
22884 TOTALPLAYTELECOMUNICACIONESSADECVMX false
169.18.199.48
 unknown United States
37611 AfrihostZA false
212.41.74.182
 unknown Switzerland
9044 SOLNETCH false
38.112.91.24
 unknown United States
35884 SECUREDATA365-OH1US false
4.148.32.110
 unknown United States
3356 LEVEL3US false
93.2.49.31
 unknown France
15557 LDCOMNETFR false
122.225.201.191
 unknown China
4809 CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr false
153.147.232.251
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
65.195.47.53
 unknown United States
701 UUNETUS false
187.10.79.87
 unknown Brazil
27699 TELEFONICABRASILSABR false
23.16.230.138
 unknown Canada
852 ASN852CA false
146.175.178.16
 unknown Belgium
2611 BELNETBE false
123.105.47.126
 unknown Japan 9595 XEPHIONNTT-MECorporationJP false
160.131.108.127
 unknown United States
8103 STATE-OF-FLAUS false
149.19.12.77
 unknown United States
10250 DATAFIVEUS false
183.224.4.206
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
153.74.2.111
 unknown United States
14962 NCR-252US false
88.123.212.21
 unknown France
12322 PROXADFR false
45.201.177.23
 unknown Seychelles
131178 KINGCORP-KHOpenNetISPCambodiaKH false
19.213.47.3
 unknown United States
3 MIT-GATEWAYSUS false
105.15.211.61
 unknown South Africa
37168 CELL-CZA false
44.194.145.149
 unknown United States
14618 AMAZON-AESUS false
112.107.186.94
 unknown Korea Republic of
6619 SAMSUNGSDS-AS-KRSamsungSDSIncKR false
195.65.243.38
 unknown Switzerland
199642 AS_ADUNO_2CH false
101.103.46.71
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
66.87.160.225
 unknown United States
10507 SPCSUS false
3.179.154.87
 unknown United States
16509 AMAZON-02US false
6.58.57.0
 unknown United States
1464 DNIC-ASBLK-01464-01465US false
85.2.39.228
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
33.142.84.92
 unknown United States
2686 ATGS-MMD-ASUS false
29.148.78.1
 unknown United States
7922 COMCAST-7922US false
72.154.237.83
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
24.187.253.21
 unknown United States
6128 CABLE-NET-1US false
119.63.57.7
 unknown China
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
183.152.181.197
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
218.86.26.84
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
148.135.162.91
 unknown Sweden
158 ERI-ASUS false
26.174.50.59
 unknown United States
7922 COMCAST-7922US false
14.40.255.188
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
213.236.241.87
 unknown Norway
25400 TELIA-NORWAY-ASTeliaNorwayCoreNetworksNO false
223.241.164.185
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
194.107.85.231
 unknown Austria
8447 TELEKOM-ATA1TelekomAustriaAGAT false
101.66.77.106
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
117.10.48.130
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
169.251.221.146
 unknown United States
47024 THE-METROHEALTH-SYSTEMUS false
166.173.75.142
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
49.56.54.180
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
122.7.204.154
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
142.34.227.181
 unknown Canada
30715 Q9-AS-KML1CA false
145.86.70.171
 unknown Netherlands
47886 EQUINIX-NL-ASNNL false
41.122.114.201
 unknown South Africa
16637 MTNNS-ASZA false
161.211.41.70
 unknown United States
14513 DMACCUS false
31.143.175.34
 unknown Turkey
16135 TURKCELL-ASTurkcellASTR false
118.101.247.26
 unknown Malaysia
4788 TMNET-AS-APTMNetInternetServiceProviderMY false
110.35.194.32
 unknown Korea Republic of
10175 HCNKUMHO-AS-KRKumhoCableKR false
77.86.251.4
 unknown Finland
29422 NBLNETWORKS-ASNebulaOyFI false
108.77.72.212
 unknown United States
7018 ATT-INTERNET4US false
158.8.29.26
 unknown United States
5180 DNIC-ASBLK-05120-05376US false
206.17.40.51
 unknown United States
4265 CERNET-ASN-BLOCKUS false
60.59.139.90
 unknown Japan 9824 JTCL-JP-ASJupiterTelecommunicationCoLtdJP false
42.4.251.187
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
13.26.67.149
 unknown United States
26662 XEROX-WVUS false
135.48.40.253
 unknown United States
54614 CIKTELECOM-CABLECA false
24.53.67.207
 unknown United States
4922 SHENTELUS false
31.245.105.237
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
121.32.80.9
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
167.155.168.12
 unknown United States
19273 LGEENERGYUS false
160.215.185.176
 unknown Japan 3352 TELEFONICA_DE_ESPANAES false
136.138.85.205
 unknown United States
60311 ONEFMCH false
102.142.67.250
 unknown Gabon
36924 GVA-CanalboxBJ false
154.140.143.107
 unknown Egypt
37069 MOBINILEG false
196.230.8.212
 unknown Tunisia
37492 ORANGE-TN false
91.85.78.232
 unknown United Kingdom
12513 ECLIPSEGB false
149.52.168.147
 unknown United States
174 COGENT-174US false
82.235.175.151
 unknown France
12322 PROXADFR false
61.85.109.247
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
144.20.235.231
 unknown Sweden
58541 CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN false
206.86.202.118
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
37.202.175.56
 unknown Iran (ISLAMIC Republic Of)
31549 RASANAIR false
100.187.9.126
 unknown United States
21928 T-MOBILE-AS21928US false
17.78.14.88
 unknown United States
714 APPLE-ENGINEERINGUS false
196.14.85.55
 unknown South Africa
3741 ISZA false
191.91.248.214
 unknown Colombia
27831 ColombiaMovilCO false
184.32.5.5
 unknown United States
5778 CENTURYLINK-LEGACY-EMBARQ-RCMTUS false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.24 true
kingstonwikkerink.dyn 45.144.172.147 true