Linux Analysis Report
mpsl.elf

Overview

General Information

Sample name: mpsl.elf
Analysis ID: 1529368
MD5: 016541d7023eefb63fcbb82a942e41d7
SHA1: bd1ba39bb02a078e87b156a7726f0181cdbc8d2d
SHA256: 71508673e34262efc16aceb5844634e928fbd965309e63bc11460c625c67fd03
Tags: botnetelfMioriuser-NDA0E
Infos:

Detection

Miori
Score: 64
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Miori
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: mpsl.elf ReversingLabs: Detection: 26%

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33782 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33798 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33816 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33794 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33792 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33802 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33788 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33800 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33820 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33822 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33844 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33840 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33824 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33848 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33808 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33796 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33810 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33852 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33832 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33892 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33814 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33786 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33818 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33790 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33842 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33850 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33826 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33784 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33812 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33836 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33834 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33870 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33878 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33858 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33856 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33838 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33874 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33876 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33886 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33894 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33846 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33898 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33862 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33860 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33902 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33872 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33854 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33900 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33866 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33804 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33880 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33868 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33828 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33806 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33864 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33888 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33896 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33882 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33830 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33908 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33906 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33910 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33912 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33914 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33918 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33916 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33884 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33920 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33922 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33904 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33890 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33924 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33928 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33938 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33926 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33932 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33936 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33942 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33930 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33948 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33940 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33950 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33946 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33956 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33944 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33954 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33934 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33952 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33958 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33964 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33962 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33974 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33966 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33972 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33968 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33960 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33976 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33970 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33986 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33978 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33984 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33980 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33988 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33982 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33990 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33996 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33992 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33998 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34004 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:33994 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34000 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34002 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34008 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34010 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34012 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34006 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34016 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34014 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34022 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34018 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34020 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34024 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34026 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34032 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34028 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34030 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34034 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34036 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34038 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34040 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34042 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34046 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34050 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34044 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34048 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34054 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34052 -> 209.200.246.150:10019
Source: Network traffic Suricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.15:34056 -> 209.200.246.150:10019
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.15:33782 -> 209.200.246.150:10019
Sample listens on a socket
Source: /tmp/mpsl.elf (PID: 5514) Socket: 127.0.0.1:12121 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.246.150
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: mpsl.elf String found in binary or memory: https://bugs.launchpad.net/ubuntu/
Source: mpsl.elf String found in binary or memory: https://root_senpai.selly.store/
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal64.troj.linELF@0/0@2/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/mpsl.elf (PID: 5514) Queries kernel information via 'uname': Jump to behavior
Source: mpsl.elf, 5514.1.00005558c2def000.00005558c2e97000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mipsel
Source: mpsl.elf, 5514.1.00007ffd4f8b6000.00007ffd4f8d7000.rw-.sdmp Binary or memory string: z&(x86_64/usr/bin/qemu-mipsel/tmp/mpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mpsl.elf
Source: mpsl.elf, 5514.1.00005558c2def000.00005558c2e97000.rw-.sdmp Binary or memory string: XU!/etc/qemu-binfmt/mipsel
Source: mpsl.elf, 5514.1.00007ffd4f8b6000.00007ffd4f8d7000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsel

Stealing of Sensitive Information
barindex
Yara detected Miori
Source: Yara match File source: mpsl.elf, type: SAMPLE
Source: Yara match File source: 5514.1.00007f77f4400000.00007f77f44b0000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Miori
Source: Yara match File source: mpsl.elf, type: SAMPLE
Source: Yara match File source: 5514.1.00007f77f4400000.00007f77f44b0000.r-x.sdmp, type: MEMORY
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
209.200.246.150
 unknown United States
15244 ADDD2NET-INCUS true

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true