Linux Analysis Report
armv4l.elf

Overview

General Information

Sample name: armv4l.elf
Analysis ID: 1529367
MD5: c65422933221048f481668f3cc3778a1
SHA1: ff07b65e0083d41d405189195935f91c24a73d6e
SHA256: 66373dd7cd49272ebef18c81c3c0026c159038f1159f00777b52a78d2c169e4d
Tags: botnetelfMioriuser-NDA0E
Infos:

Detection

Miori
Score: 64
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Miori
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: armv4l.elf ReversingLabs: Detection: 31%

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46874 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46876 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46878 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46882 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46872 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46884 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46880 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46896 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46904 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46918 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46890 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46936 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46902 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46930 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46892 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46894 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46922 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46940 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46912 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46932 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46888 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46906 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46950 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46948 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46952 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46910 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46926 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46966 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46928 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46958 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46898 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46968 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46974 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46978 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46946 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46982 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46990 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46916 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46900 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46960 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47004 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46970 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46944 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46914 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46984 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46996 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46992 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47008 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46988 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47020 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47006 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47018 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46962 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46956 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46954 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46942 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46920 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47026 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47036 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47002 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47028 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46972 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47044 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47042 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46986 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47046 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47024 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47038 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47012 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47054 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47032 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47000 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47014 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47034 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46980 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46964 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47052 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46924 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46976 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47068 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47016 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47010 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47064 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47066 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47078 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47058 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46994 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47072 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46998 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47060 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47050 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47080 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47082 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47062 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47030 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47094 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47098 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47096 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47022 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47090 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47074 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47104 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47040 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47100 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47110 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47084 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46908 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47106 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47122 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47126 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47112 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47056 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47128 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47116 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47132 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47124 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47088 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47120 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47138 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47086 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47102 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47092 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47142 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47146 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47136 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47108 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47144 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47118 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47134 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47140 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46886 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46934 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47114 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:46938 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47130 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47048 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47148 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47070 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.14:47076 -> 209.200.246.150:10019
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:46872 -> 209.200.246.150:10019
Sample listens on a socket
Source: /tmp/armv4l.elf (PID: 5485) Socket: 127.0.0.1:12121 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: armv4l.elf String found in binary or memory: https://bugs.launchpad.net/ubuntu/
Source: armv4l.elf String found in binary or memory: https://root_senpai.selly.store/
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal64.troj.linELF@0/0@2/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/armv4l.elf (PID: 5485) Queries kernel information via 'uname': Jump to behavior
Source: armv4l.elf, 5485.1.00007ffc2ba93000.00007ffc2bab4000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/armv4l.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/armv4l.elf
Source: armv4l.elf, 5485.1.0000558dcbd89000.0000558dcbed8000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: armv4l.elf, 5485.1.0000558dcbd89000.0000558dcbed8000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: armv4l.elf, 5485.1.00007ffc2ba93000.00007ffc2bab4000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information
barindex
Yara detected Miori
Source: Yara match File source: armv4l.elf, type: SAMPLE
Source: Yara match File source: 5485.1.00007f9f2c01f000.00007f9f2c0b8000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Miori
Source: Yara match File source: armv4l.elf, type: SAMPLE
Source: Yara match File source: 5485.1.00007f9f2c01f000.00007f9f2c0b8000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
209.200.246.150
 unknown United States
15244 ADDD2NET-INCUS true

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true