Linux Analysis Report
BMJzumU0MX.elf

Overview

General Information

Sample name: BMJzumU0MX.elf
renamed because original name is a hash value
Original sample name: c70ebab9f818f25c1767aa90c1bb1aaab06ac04b11ed455ff860755d46438fb2.elf
Analysis ID: 1417472
MD5: ac2539d4888f6ff431339608c52b7924
SHA1: 5979ab5e194b1385ded8e2f23140b778eb581160
SHA256: c70ebab9f818f25c1767aa90c1bb1aaab06ac04b11ed455ff860755d46438fb2
Tags: elf
Infos:

Detection

Mirai
Score: 76
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Machine Learning detection for sample
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings that are user agent strings indicative of HTTP manipulation
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: BMJzumU0MX.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: BMJzumU0MX.elf ReversingLabs: Detection: 55%
Source: BMJzumU0MX.elf Virustotal: Detection: 45% Perma Link
Machine Learning detection for sample
Source: BMJzumU0MX.elf Joe Sandbox ML: detected
Found strings indicative of a multi-platform dropper
Source: BMJzumU0MX.elf String: /system/proc/self/exe/proc/proc//cmdlineld.sowgettftpcurl
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:36032 -> 185.224.128.34:33335
Sample listens on a socket
Source: /tmp/BMJzumU0MX.elf (PID: 6239) Socket: 127.0.0.1::33337 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 199.133.141.230
Source: unknown TCP traffic detected without corresponding DNS query: 95.138.191.82
Source: unknown TCP traffic detected without corresponding DNS query: 187.127.45.82
Source: unknown TCP traffic detected without corresponding DNS query: 67.56.113.146
Source: unknown TCP traffic detected without corresponding DNS query: 164.54.146.94
Source: unknown TCP traffic detected without corresponding DNS query: 243.34.195.80
Source: unknown TCP traffic detected without corresponding DNS query: 215.24.100.235
Source: unknown TCP traffic detected without corresponding DNS query: 217.209.202.144
Source: unknown TCP traffic detected without corresponding DNS query: 19.87.50.152
Source: unknown TCP traffic detected without corresponding DNS query: 73.137.22.27
Source: unknown TCP traffic detected without corresponding DNS query: 84.209.109.255
Source: unknown TCP traffic detected without corresponding DNS query: 55.233.25.204
Source: unknown TCP traffic detected without corresponding DNS query: 92.77.162.22
Source: unknown TCP traffic detected without corresponding DNS query: 176.199.77.180
Source: unknown TCP traffic detected without corresponding DNS query: 198.6.152.24
Source: unknown TCP traffic detected without corresponding DNS query: 31.203.235.138
Source: unknown TCP traffic detected without corresponding DNS query: 118.179.11.125
Source: unknown TCP traffic detected without corresponding DNS query: 66.205.132.17
Source: unknown TCP traffic detected without corresponding DNS query: 248.68.184.225
Source: unknown TCP traffic detected without corresponding DNS query: 118.15.159.9
Source: unknown TCP traffic detected without corresponding DNS query: 222.40.84.83
Source: unknown TCP traffic detected without corresponding DNS query: 46.54.242.247
Source: unknown TCP traffic detected without corresponding DNS query: 212.29.22.203
Source: unknown TCP traffic detected without corresponding DNS query: 40.38.36.144
Source: unknown TCP traffic detected without corresponding DNS query: 197.161.160.133
Source: unknown TCP traffic detected without corresponding DNS query: 146.57.69.227
Source: unknown TCP traffic detected without corresponding DNS query: 15.52.221.113
Source: unknown TCP traffic detected without corresponding DNS query: 92.190.134.102
Source: unknown TCP traffic detected without corresponding DNS query: 169.180.67.185
Source: unknown TCP traffic detected without corresponding DNS query: 82.164.155.80
Source: unknown TCP traffic detected without corresponding DNS query: 143.98.112.118
Source: unknown TCP traffic detected without corresponding DNS query: 205.128.125.228
Source: unknown TCP traffic detected without corresponding DNS query: 27.8.143.68
Source: unknown TCP traffic detected without corresponding DNS query: 9.226.145.46
Source: unknown TCP traffic detected without corresponding DNS query: 18.157.215.208
Source: unknown TCP traffic detected without corresponding DNS query: 246.21.104.249
Source: unknown TCP traffic detected without corresponding DNS query: 57.205.196.89
Source: unknown TCP traffic detected without corresponding DNS query: 143.122.171.8
Source: unknown TCP traffic detected without corresponding DNS query: 36.193.168.253
Source: unknown TCP traffic detected without corresponding DNS query: 130.163.199.168
Source: unknown TCP traffic detected without corresponding DNS query: 221.237.75.193
Source: unknown TCP traffic detected without corresponding DNS query: 103.32.64.241
Source: unknown TCP traffic detected without corresponding DNS query: 242.163.49.167
Source: unknown TCP traffic detected without corresponding DNS query: 3.227.178.249
Source: unknown TCP traffic detected without corresponding DNS query: 116.56.65.138
Source: unknown TCP traffic detected without corresponding DNS query: 160.240.73.205
Source: unknown TCP traffic detected without corresponding DNS query: 217.56.137.56
Source: unknown TCP traffic detected without corresponding DNS query: 205.136.43.239
Source: unknown TCP traffic detected without corresponding DNS query: 99.41.214.5
Source: unknown TCP traffic detected without corresponding DNS query: 72.183.173.66
Source: unknown DNS traffic detected: queries for: rooty.cc
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: BMJzumU0MX.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: BMJzumU0MX.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: BMJzumU0MX.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: BMJzumU0MX.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: BMJzumU0MX.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: BMJzumU0MX.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: BMJzumU0MX.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: BMJzumU0MX.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_1cb033f3 Author: unknown
Source: 6239.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6239.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6239.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6239.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6239.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6239.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6239.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6239.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_1cb033f3 Author: unknown
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/BMJzumU0MX.elf (PID: 6240) SIGKILL sent: pid: 788, result: successful Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) SIGKILL sent: pid: 2096, result: successful Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) SIGKILL sent: pid: 2102, result: successful Jump to behavior
Yara signature match
Source: BMJzumU0MX.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: BMJzumU0MX.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: BMJzumU0MX.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: BMJzumU0MX.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: BMJzumU0MX.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: BMJzumU0MX.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: BMJzumU0MX.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: BMJzumU0MX.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_1cb033f3 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 49201ab37ff0b5cdfa9b0b34b6faa170bd25f04df51c24b0b558b7534fecc358, id = 1cb033f3-68c1-4fe5-9cd1-b5d066c1d86e, last_modified = 2021-09-16
Source: 6239.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6239.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6239.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6239.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6239.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6239.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6239.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6239.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_1cb033f3 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 49201ab37ff0b5cdfa9b0b34b6faa170bd25f04df51c24b0b558b7534fecc358, id = 1cb033f3-68c1-4fe5-9cd1-b5d066c1d86e, last_modified = 2021-09-16
Source: classification engine Classification label: mal76.troj.linELF@0/0@1/0
Enumerates processes within the "proc" file system
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2033/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2033/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1582/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1582/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2275/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2275/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1612/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1612/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1579/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1579/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1699/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1699/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1335/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1335/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1698/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1698/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2028/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2028/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1334/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1334/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1576/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1576/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2302/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2302/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/3236/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/3236/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2025/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2025/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2146/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2146/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/912/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/912/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/759/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/759/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2307/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2307/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/918/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/918/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/6243/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/6243/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1594/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1594/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2285/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2285/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2281/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2281/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1349/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1349/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1623/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1623/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/761/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/761/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1622/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1622/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/884/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1983/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1983/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2038/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2038/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1586/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1586/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1465/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1465/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1344/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1344/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1463/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1463/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2156/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2156/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/800/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/800/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/801/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/801/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1629/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1629/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1627/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1627/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1900/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1900/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/491/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/491/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2294/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2294/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2050/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/2050/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1877/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1877/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/772/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/772/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1633/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1633/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1599/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1599/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1632/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1632/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1477/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1477/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/774/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/774/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1476/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1476/cmdline Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1872/exe Jump to behavior
Source: /tmp/BMJzumU0MX.elf (PID: 6240) File opened: /proc/1872/cmdline Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Sample contains strings that are user agent strings indicative of HTTP manipulation
Source: Initial sample User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
Source: Initial sample User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
Source: Initial sample User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
Source: Initial sample User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
Source: Initial sample User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
246.124.110.160
 unknown Reserved
unknown unknown false
31.136.125.72
 unknown Netherlands
15480 VFNL-ASVodafoneNLAutonomousSystemNL false
144.150.124.179
 unknown United States
58541 CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN false
182.159.148.0
 unknown Japan 4725 ODNSoftBankMobileCorpJP false
102.82.135.225
 unknown Uganda
37075 ZAINUGASUG false
52.116.151.191
 unknown United States
36351 SOFTLAYERUS false
90.229.255.29
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
110.124.201.69
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
31.210.114.130
 unknown Turkey
197328 INETLTDTR false
77.203.246.233
 unknown France
15557 LDCOMNETFR false
208.250.98.133
 unknown United States
4208 THE-ISERV-COMPANYUS false
199.133.141.230
 unknown United States
4152 USDA-1US false
88.180.44.199
 unknown France
12322 PROXADFR false
83.228.51.145
 unknown Bulgaria
8866 BTC-ASBULGARIABG false
98.103.137.21
 unknown United States
10796 TWC-10796-MIDWESTUS false
121.247.68.241
 unknown India
17908 TCISLTataCommunicationsIN false
84.17.27.208
 unknown Russian Federation
8359 MTSRU false
27.189.117.88
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
121.76.76.184
 unknown China
9812 CNNIC-CN-COLNETOrientalCableNetworkCoLtdCN false
107.233.255.164
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
45.214.253.26
 unknown Zambia
37287 ZAIN-ZAMBIAZM false
146.240.126.172
 unknown United States
25400 TELIA-NORWAY-ASTeliaNorwayCoreNetworksNO false
107.71.226.117
 unknown United States
7018 ATT-INTERNET4US false
221.154.254.54
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
122.243.157.221
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
19.224.140.195
 unknown United States
3 MIT-GATEWAYSUS false
249.163.199.69
 unknown Reserved
unknown unknown false
14.93.107.28
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
208.199.118.49
 unknown United States
1699 ANS-1699-ASUS false
89.60.22.38
 unknown Germany
5430 FREENETDEfreenetDatenkommunikationsGmbHDE false
223.1.83.220
 unknown China
63555 CNBIDCCBeijingBeilongYunhaiNetworkDataTechnologyCorpo false
63.243.90.39
 unknown United States
7029 WINDSTREAMUS false
181.78.49.203
 unknown Argentina
18747 IFX18747US false
201.112.113.218
 unknown Mexico
8151 UninetSAdeCVMX false
51.242.161.55
 unknown United Kingdom
2686 ATGS-MMD-ASUS false
6.142.157.224
 unknown United States
3356 LEVEL3US false
82.101.175.180
 unknown Nigeria
37443 UsmanuNG false
78.66.47.28
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
157.160.187.243
 unknown United States
22192 SSHENETUS false
110.24.34.42
 unknown Taiwan; Republic of China (ROC)
9674 FET-TWFarEastToneTelecommunicationCoLtdTW false
55.44.33.253
 unknown United States
306 DNIC-ASBLK-00306-00371US false
153.120.10.224
 unknown Japan 7684 SAKURA-ASAKURAInternetIncJP false
91.53.207.26
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
106.134.247.237
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
128.101.58.38
 unknown United States
217 UMN-SYSTEMUS false
159.48.112.200
 unknown United States
11351 TWC-11351-NORTHEASTUS false
157.201.93.217
 unknown United States
33281 BRIGHAM-YOUNG-UNIVERSITY-IDAHOUS false
122.34.177.220
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
49.237.107.24
 unknown Thailand
7470 TRUEINTERNET-AS-APTRUEINTERNETCoLtdTH false
134.16.105.212
 unknown United States
385 AFCONC-BLOCK1-ASUS false
94.37.228.180
 unknown Italy
8612 TISCALI-IT false
18.151.37.68
 unknown United States
16509 AMAZON-02US false
201.175.190.28
 unknown Mexico
28469 ATTCOMUNICACIONESDIGITALESSDERLMX false
73.199.234.242
 unknown United States
7922 COMCAST-7922US false
141.244.186.224
 unknown Austria
1117 BOKUUniversitaetfuerBodenkulturWienEU false
44.115.210.160
 unknown United States
7377 UCSDUS false
59.124.110.243
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
105.190.13.112
 unknown Morocco
36925 ASMediMA false
16.200.159.245
 unknown United States
unknown unknown false
181.31.237.17
 unknown Argentina
10318 TelecomArgentinaSAAR false
40.222.150.108
 unknown United States
4249 LILLY-ASUS false
3.41.83.191
 unknown United States
8987 AMAZONEXPANSIONGB false
250.135.213.215
 unknown Reserved
unknown unknown false
166.138.34.252
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
84.190.75.158
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
137.217.130.193
 unknown Norway
25400 TELIA-NORWAY-ASTeliaNorwayCoreNetworksNO false
123.232.172.23
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
51.124.228.66
 unknown United Kingdom
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
182.40.182.140
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
102.49.171.37
 unknown Morocco
6713 IAM-ASMA false
17.227.159.15
 unknown United States
714 APPLE-ENGINEERINGUS false
92.12.81.34
 unknown United Kingdom
13285 OPALTELECOM-ASTalkTalkCommunicationsLimitedGB false
124.129.143.106
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
5.51.215.36
 unknown France
5410 BOUYGTEL-ISPFR false
173.160.145.0
 unknown United States
7922 COMCAST-7922US false
159.18.63.36
 unknown Canada
15290 ALLST-15290CA false
212.156.156.223
 unknown Turkey
9121 TTNETTR false
68.66.143.251
 unknown United States
393571 ALLCOVERED-EAST1-ASUS false
36.195.207.247
 unknown China
24138 CTTNETChinaTieTongTelecommunicationsCorporationCN false
15.165.124.157
 unknown United States
16509 AMAZON-02US false
143.232.103.78
 unknown United States
270 AS270US false
130.172.36.213
 unknown United States
12173 UAUS false
107.66.217.40
 unknown United States
7018 ATT-INTERNET4US false
160.152.29.198
 unknown Nigeria
37637 Smile-Nigeria-ASNG false
240.194.183.126
 unknown Reserved
unknown unknown false
61.172.89.133
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
182.57.90.116
 unknown India
17813 MTNL-APMahanagarTelephoneNigamLimitedIN false
25.152.73.220
 unknown United Kingdom
7922 COMCAST-7922US false
196.206.130.210
 unknown Morocco
36903 MT-MPLSMA false
206.123.196.76
 unknown United States
30688 FASTTRACK-NET-ASUS false
98.145.117.247
 unknown United States
20001 TWC-20001-PACWESTUS false
206.151.74.112
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
204.66.176.80
 unknown United States
1761 TDIR-CAPNETUS false
73.35.211.165
 unknown United States
7922 COMCAST-7922US false
115.236.164.167
 unknown China
58461 CT-HANGZHOU-IDCNo288Fu-chunRoadCN false
92.240.172.42
 unknown Czech Republic
16246 AS16246InternetProviderCZ false
72.130.231.157
 unknown United States
20001 TWC-20001-PACWESTUS false
158.174.239.179
 unknown United Kingdom
8473 BAHNHOFhttpwwwbahnhofnetSE false
180.151.223.69
 unknown India
10029 SHYAMSPECTRA-ASSHYAMSPECTRAPVTLTDIN false
131.14.200.151
 unknown United States
61458 GOBIERNOAUTONOMOMUNICIPALDELAPAZBO false

Contacted Domains

Name IP Active
rooty.cc 185.224.128.34 true