Linux Analysis Report
shngijernbh.arm6.elf

Overview

General Information

Sample name:	shngijernbh.arm6.elf
Analysis ID:	1546483
MD5:	143822c38a4f7303d8ff903da72a5a3b
SHA1:	fdacf7a8c72f4e1e01bd63f8a576de17a58eec83
SHA256:	66e94556dbe750425229a9000d334d56d89b6154f9b90b46f6335e7090200e62
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: shngijernbh.arm6.elf

Avira: detected

Found malware configuration

Source: shngijernbh.arm6.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "143.47.38.152:4258"}

Multi AV Scanner detection for submitted file

Source: shngijernbh.arm6.elf

ReversingLabs: Detection: 60%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/shngijernbh.arm6.elf (PID: 5477)

Opens: /proc/net/route

Jump to behavior

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.14:53486 -> 143.47.38.152:4258

Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 143.47.38.152

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: shngijernbh.arm6.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: shngijernbh.arm6.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: shngijernbh.arm6.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: shngijernbh.arm6.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: shngijernbh.arm6.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

Source: unknown	Network traffic detected: HTTP traffic on port 37902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37902
Source: unknown	Network traffic detected: HTTP traffic on port 46540 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: shngijernbh.arm6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: shngijernbh.arm6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5477.1.00007f3fdc017000.00007f3fdc02b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5477.1.00007f3fdc017000.00007f3fdc02b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5479.1.00007f3fdc017000.00007f3fdc02b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5479.1.00007f3fdc017000.00007f3fdc02b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: shngijernbh.arm6.elf PID: 5477, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: shngijernbh.arm6.elf PID: 5477, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: shngijernbh.arm6.elf PID: 5479, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: shngijernbh.arm6.elf PID: 5479, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Yara signature match

Source: shngijernbh.arm6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: shngijernbh.arm6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5477.1.00007f3fdc017000.00007f3fdc02b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5477.1.00007f3fdc017000.00007f3fdc02b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5479.1.00007f3fdc017000.00007f3fdc02b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5479.1.00007f3fdc017000.00007f3fdc02b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: shngijernbh.arm6.elf PID: 5477, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: shngijernbh.arm6.elf PID: 5477, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: shngijernbh.arm6.elf PID: 5479, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: shngijernbh.arm6.elf PID: 5479, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal92.spre.troj.linELF@0/0@2/0

Source: shngijernbh.arm6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: shngijernbh.arm6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: shngijernbh.arm6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: shngijernbh.arm6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: shngijernbh.arm6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: shngijernbh.arm6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: shngijernbh.arm6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: shngijernbh.arm6.elf	ELF static info symbol of initial sample: libc/string/arm/_memcpy.S
Source: shngijernbh.arm6.elf	ELF static info symbol of initial sample: libc/string/arm/bcopy.S
Source: shngijernbh.arm6.elf	ELF static info symbol of initial sample: libc/string/arm/bzero.S
Source: shngijernbh.arm6.elf	ELF static info symbol of initial sample: libc/string/arm/memcpy.S
Source: shngijernbh.arm6.elf	ELF static info symbol of initial sample: libc/string/arm/memmove.S
Source: shngijernbh.arm6.elf	ELF static info symbol of initial sample: libc/string/arm/memset.S
Source: shngijernbh.arm6.elf	ELF static info symbol of initial sample: libc/string/arm/strcmp.S
Source: shngijernbh.arm6.elf	ELF static info symbol of initial sample: libc/string/arm/strlen.S
Source: shngijernbh.arm6.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crt1.S
Source: shngijernbh.arm6.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crti.S
Source: shngijernbh.arm6.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crtn.S
Source: shngijernbh.arm6.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/sigrestorer.S

Executes the "rm" command used to delete files or directories

Source: /usr/bin/dash (PID: 5521)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.IBb9d2euol /tmp/tmp.qpspsEp1eC /tmp/tmp.UOEJtXuapH			Jump to behavior
Source: /usr/bin/dash (PID: 5522)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.IBb9d2euol /tmp/tmp.qpspsEp1eC /tmp/tmp.UOEJtXuapH			Jump to behavior

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/shngijernbh.arm6.elf (PID: 5477)

Queries kernel information via 'uname':

Jump to behavior

Source: shngijernbh.arm6.elf, 5477.1.00007ffc8743e000.00007ffc8745f000.rw-.sdmp, shngijernbh.arm6.elf, 5479.1.00007ffc8743e000.00007ffc8745f000.rw-.sdmp	Binary or memory string: Hx86_64/usr/bin/qemu-arm/tmp/shngijernbh.arm6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/shngijernbh.arm6.elf
Source: shngijernbh.arm6.elf, 5477.1.000055abbc2f7000.000055abbc425000.rw-.sdmp, shngijernbh.arm6.elf, 5479.1.000055abbc2f7000.000055abbc425000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: shngijernbh.arm6.elf, 5477.1.000055abbc2f7000.000055abbc425000.rw-.sdmp, shngijernbh.arm6.elf, 5479.1.000055abbc2f7000.000055abbc425000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: shngijernbh.arm6.elf, 5477.1.00007ffc8743e000.00007ffc8745f000.rw-.sdmp, shngijernbh.arm6.elf, 5479.1.00007ffc8743e000.00007ffc8745f000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: shngijernbh.arm6.elf, type: SAMPLE
Source: Yara match	File source: 5477.1.00007f3fdc017000.00007f3fdc02b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5479.1.00007f3fdc017000.00007f3fdc02b000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: shngijernbh.arm6.elf, type: SAMPLE
Source: Yara match	File source: 5477.1.00007f3fdc017000.00007f3fdc02b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5479.1.00007f3fdc017000.00007f3fdc02b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: shngijernbh.arm6.elf PID: 5477, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: shngijernbh.arm6.elf PID: 5479, type: MEMORYSTR

Sample contains strings that are user agent strings indicative of HTTP manipulation

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: shngijernbh.arm6.elf, type: SAMPLE
Source: Yara match	File source: 5477.1.00007f3fdc017000.00007f3fdc02b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5479.1.00007f3fdc017000.00007f3fdc02b000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: shngijernbh.arm6.elf, type: SAMPLE
Source: Yara match	File source: 5477.1.00007f3fdc017000.00007f3fdc02b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5479.1.00007f3fdc017000.00007f3fdc02b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: shngijernbh.arm6.elf PID: 5477, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: shngijernbh.arm6.elf PID: 5479, type: MEMORYSTR

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
143.47.38.152	unknown	Ireland	52019	ORCL-EMEA-ASSE	true
54.171.230.55	unknown	United States	16509	AMAZON-02US	false
185.125.190.26	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Contacted Domains

Name	IP	Active
daisy.ubuntu.com	162.213.35.24	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
143.47.38.152:4258	true		unknown

ID:	1546483
Product:	CloudBasic
Start time:	00:47:09
Start date:	01.11.2024
Sample:	shngijernbh.arm6.elf
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	143822c38a4f7303d8ff903da72a5a3b
SHA1:	fdacf7a8c72f4e1e01bd63f8a576de17a58eec83
SHA256:	66e94556dbe750425229a9000d334d56d89b6154f9b90b46f6335e7090200e62
Filetype:	ELF Executable and Linkable format (generic) (4004/1) 100.00%

Linux Analysis Report
shngijernbh.arm6.elf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Linux Analysis Report shngijernbh.arm6.elf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Linux Analysis Report
shngijernbh.arm6.elf