Click to jump to signature section
Source: z3hir.arm | Virustotal: Detection: 56% | Perma Link |
Source: z3hir.arm | ReversingLabs: Detection: 60% |
Source: global traffic | TCP traffic: 192.168.2.20:41112 -> 66.42.85.196:9375 |
Source: /tmp/z3hir.arm (PID: 4726) | Socket: 0.0.0.0:23 | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4726) | Socket: 0.0.0.0:0 | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4732) | Socket: 0.0.0.0:0 | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4732) | Socket: 0.0.0.0:22 | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4732) | Socket: 0.0.0.0:80 | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4732) | Socket: 0.0.0.0:81 | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4732) | Socket: 0.0.0.0:8443 | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4732) | Socket: 0.0.0.0:9009 | Jump to behavior |
Source: /usr/sbin/sshd (PID: 4750) | Socket: [::]:22 | Jump to behavior |
Source: unknown | TCP traffic detected without corresponding DNS query: 66.42.85.196 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.220.66.130 |
Source: unknown | TCP traffic detected without corresponding DNS query: 222.200.182.130 |
Source: unknown | TCP traffic detected without corresponding DNS query: 201.202.196.96 |
Source: unknown | TCP traffic detected without corresponding DNS query: 153.114.133.209 |
Source: unknown | TCP traffic detected without corresponding DNS query: 34.57.11.29 |
Source: unknown | TCP traffic detected without corresponding DNS query: 157.25.87.149 |
Source: unknown | TCP traffic detected without corresponding DNS query: 198.136.169.37 |
Source: unknown | TCP traffic detected without corresponding DNS query: 59.109.204.16 |
Source: unknown | TCP traffic detected without corresponding DNS query: 8.170.234.141 |
Source: unknown | TCP traffic detected without corresponding DNS query: 63.132.234.179 |
Source: unknown | TCP traffic detected without corresponding DNS query: 121.131.165.160 |
Source: unknown | TCP traffic detected without corresponding DNS query: 197.107.62.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 203.163.235.165 |
Source: unknown | TCP traffic detected without corresponding DNS query: 150.249.22.16 |
Source: unknown | TCP traffic detected without corresponding DNS query: 107.202.33.236 |
Source: unknown | TCP traffic detected without corresponding DNS query: 54.96.175.221 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.190.113.92 |
Source: unknown | TCP traffic detected without corresponding DNS query: 123.7.172.204 |
Source: unknown | TCP traffic detected without corresponding DNS query: 246.164.219.254 |
Source: unknown | TCP traffic detected without corresponding DNS query: 80.209.36.216 |
Source: unknown | TCP traffic detected without corresponding DNS query: 4.43.163.223 |
Source: unknown | TCP traffic detected without corresponding DNS query: 37.20.31.194 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.200.136.231 |
Source: unknown | TCP traffic detected without corresponding DNS query: 62.222.223.53 |
Source: unknown | TCP traffic detected without corresponding DNS query: 102.47.38.76 |
Source: unknown | TCP traffic detected without corresponding DNS query: 51.11.65.101 |
Source: unknown | TCP traffic detected without corresponding DNS query: 59.222.17.192 |
Source: unknown | TCP traffic detected without corresponding DNS query: 17.177.185.35 |
Source: unknown | TCP traffic detected without corresponding DNS query: 177.184.3.191 |
Source: unknown | TCP traffic detected without corresponding DNS query: 145.92.24.72 |
Source: unknown | TCP traffic detected without corresponding DNS query: 163.106.49.137 |
Source: unknown | TCP traffic detected without corresponding DNS query: 57.247.187.103 |
Source: unknown | TCP traffic detected without corresponding DNS query: 121.135.183.92 |
Source: unknown | TCP traffic detected without corresponding DNS query: 189.231.228.139 |
Source: unknown | TCP traffic detected without corresponding DNS query: 169.54.88.185 |
Source: unknown | TCP traffic detected without corresponding DNS query: 189.241.111.46 |
Source: unknown | TCP traffic detected without corresponding DNS query: 195.213.165.4 |
Source: unknown | TCP traffic detected without corresponding DNS query: 159.73.247.5 |
Source: unknown | TCP traffic detected without corresponding DNS query: 66.162.96.100 |
Source: unknown | TCP traffic detected without corresponding DNS query: 193.7.148.170 |
Source: unknown | TCP traffic detected without corresponding DNS query: 142.32.213.64 |
Source: unknown | TCP traffic detected without corresponding DNS query: 13.176.196.223 |
Source: unknown | TCP traffic detected without corresponding DNS query: 255.196.15.208 |
Source: unknown | TCP traffic detected without corresponding DNS query: 37.176.120.2 |
Source: unknown | TCP traffic detected without corresponding DNS query: 79.237.251.12 |
Source: unknown | TCP traffic detected without corresponding DNS query: 172.195.71.6 |
Source: unknown | TCP traffic detected without corresponding DNS query: 191.235.21.50 |
Source: unknown | TCP traffic detected without corresponding DNS query: 105.139.103.241 |
Source: unknown | TCP traffic detected without corresponding DNS query: 63.233.87.99 |
Source: z3hir.arm | String found in binary or memory: http://upx.sf.net |
Source: 4718.1.00007f7d8fb62000.00007f7d8fb73000.r-x.sdmp, type: MEMORY | Matched rule: Detects Mirai Botnet Malware Author: Florian Roth |
Source: 4718.1.00007f7d8fb62000.00007f7d8fb73000.r-x.sdmp, type: MEMORY | Matched rule: Detects ELF malware Mirai related Author: Florian Roth |
Source: 4734.1.00007f7d8fb62000.00007f7d8fb73000.r-x.sdmp, type: MEMORY | Matched rule: Detects Mirai Botnet Malware Author: Florian Roth |
Source: 4734.1.00007f7d8fb62000.00007f7d8fb73000.r-x.sdmp, type: MEMORY | Matched rule: Detects ELF malware Mirai related Author: Florian Roth |
Source: 4727.1.00007f7d8fb62000.00007f7d8fb73000.r-x.sdmp, type: MEMORY | Matched rule: Detects Mirai Botnet Malware Author: Florian Roth |
Source: 4727.1.00007f7d8fb62000.00007f7d8fb73000.r-x.sdmp, type: MEMORY | Matched rule: Detects ELF malware Mirai related Author: Florian Roth |
Source: LOAD without section mappings | Program segment: 0x8000 |
Source: /tmp/z3hir.arm (PID: 4726) | SIGKILL sent: pid: 1346, result: successful | Jump to behavior |
Source: 4718.1.00007f7d8fb62000.00007f7d8fb73000.r-x.sdmp, type: MEMORY | Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b |
Source: 4718.1.00007f7d8fb62000.00007f7d8fb73000.r-x.sdmp, type: MEMORY | Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research |
Source: 4734.1.00007f7d8fb62000.00007f7d8fb73000.r-x.sdmp, type: MEMORY | Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b |
Source: 4734.1.00007f7d8fb62000.00007f7d8fb73000.r-x.sdmp, type: MEMORY | Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research |
Source: 4727.1.00007f7d8fb62000.00007f7d8fb73000.r-x.sdmp, type: MEMORY | Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b |
Source: 4727.1.00007f7d8fb62000.00007f7d8fb73000.r-x.sdmp, type: MEMORY | Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research |
Source: classification engine | Classification label: mal84.troj.evad.linARM@0/2@0/0 |
Source: initial sample | String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $ |
Source: initial sample | String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $ |
Source: initial sample | String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $ |
Source: /tmp/z3hir.arm (PID: 4726) | File opened: /proc/1010/fd | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4726) | File opened: /proc/1076/fd | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4726) | File opened: /proc/1120/fd | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4726) | File opened: /proc/1051/fd | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4726) | File opened: /proc/471/fd | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4726) | File opened: /proc/1338/fd | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4726) | File opened: /proc/1/fd | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4726) | File opened: /proc/980/fd | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4726) | File opened: /proc/1018/fd | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4726) | File opened: /proc/1017/fd | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4726) | File opened: /proc/1039/fd | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4726) | File opened: /proc/1027/fd | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4726) | File opened: /proc/1346/fd | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4726) | File opened: /proc/1113/fd | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4726) | File opened: /proc/611/fd | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4726) | File opened: /proc/1321/fd | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4726) | File opened: /proc/527/fd | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4726) | File opened: /proc/1317/fd | Jump to behavior |
Source: /tmp/z3hir.arm (PID: 4726) | File opened: /proc/1339/fd | Jump to behavior |
Source: z3hir.arm | Submission file: segment LOAD with 7.9516 entropy (max. 8.0) |
Source: /tmp/z3hir.arm (PID: 4718) | Queries kernel information via 'uname': | Jump to behavior |
Source: z3hir.arm, 4718.1.0000559f18e43000.0000559f18fbc000.r-x.sdmp, z3hir.arm, 4727.1.0000559f18e43000.0000559f18fbc000.r-x.sdmp, z3hir.arm, 4732.1.0000559f18e43000.0000559f18fbc000.r-x.sdmp, z3hir.arm, 4734.1.0000559f18e43000.0000559f18fbc000.r-x.sdmp | Binary or memory string: qemu_opts_set_defaults |
Source: z3hir.arm, 4718.1.0000559f18e43000.0000559f18fbc000.r-x.sdmp, z3hir.arm, 4727.1.0000559f18e43000.0000559f18fbc000.r-x.sdmp, z3hir.arm, 4732.1.0000559f18e43000.0000559f18fbc000.r-x.sdmp, z3hir.arm, 4734.1.0000559f18e43000.0000559f18fbc000.r-x.sdmp | Binary or memory string: qemu_oom_check |
Source: z3hir.arm, 4718.1.0000559f18e43000.0000559f18fbc000.r-x.sdmp, z3hir.arm, 4727.1.0000559f18e43000.0000559f18fbc000.r-x.sdmp, z3hir.arm, 4734.1.0000559f18e43000.0000559f18fbc000.r-x.sdmp | Binary or memory string: BlockdevOptionsGenericCOWFormatACPI_DEVICE_OSTqovqapi-event.cobj != NULLBALLOON_CHANGEBLOCK_IMAGE_CORRUPTEDfatalBLOCK_IO_ERRORoperationreasonBLOCK_JOB_CANCELLEDBLOCK_JOB_COMPLETEDBLOCK_JOB_ERRORBLOCK_JOB_READYBLOCK_WRITE_THRESHOLDamount-exceededwrite-thresholdDEVICE_DELETEDDEVICE_TRAY_MOVEDtray-openGUEST_PANICKEDMEM_UNPLUG_ERRORMIGRATIONNIC_RX_FILTER_CHANGEDPOWERDOWNQUORUM_FAILUREsector-numsectors-countQUORUM_REPORT_BADRTC_CHANGESHUTDOWNSPICE_CONNECTEDSPICE_DISCONNECTEDSPICE_INITIALIZEDSPICE_MIGRATE_COMPLETEDSUSPEND_DISKVNC_CONNECTEDVNC_DISCONNECTEDVNC_INITIALIZEDVSERPORT_CHANGEWAKEUPWATCHDOGqapi_event_send_watchdogqapi_event_send_vserport_changeqapi_event_send_vnc_initializedqapi_event_send_vnc_disconnectedqapi_event_send_vnc_connectedqapi_event_send_spice_initializedqapi_event_send_spice_disconnectedqapi_event_send_spice_connectedqapi_event_send_rtc_changeqapi_event_send_quorum_report_badqapi_event_send_quorum_failureqapi_event_send_nic_rx_filter_changedqapi_event_send_migrationqapi_event_send_mem_unplug_errorqapi_event_send_guest_panickedqapi_event_send_device_tray_movedqapi_event_send_device_deletedqapi_event_send_block_write_thresholdqapi_event_send_block_job_readyqapi_event_send_block_job_errorqapi_event_send_block_job_completedqapi_event_send_block_job_cancelledqapi_event_send_block_io_errorqapi_event_send_block_image_corruptedqapi_event_send_balloon_changeqobject_decrefqapi_event_send_acpi_device_ostuint8_tuint16_tuint32_tstringsInvalid parameter '%s'/build/qemu-hP0tKe/qemu-2.5+dfsg/qapi/qapi-visit-core.cinput_type_enuminput_type_enumoutput_type_enumoutput_type_enumvisit_type_int32visit_type_int16visit_type_int8visit_type_uint32visit_type_uint16visit_type_uint8/build/qemu-hP0tKe/qemu-2.5+dfsg/qapi/qapi-dealloc-visitor.cobj == NULLqapi_dealloc_end_listqobject_decref/build/qemu-hP0tKe/qemu-2.5+dfsg/qapi/qmp-input-visitor.cQMP input object member '%s' is unexpectedParameter '%s' is missingintegerqiv->nb_stack > 0An internal buffer overranQDictqmp_input_pushqmp_input_start_structqmp_input_start_listqmp_input_popqmp_input_popqmp_input_type_intqmp_input_type_boolqmp_input_type_strqmp_input_type_numberqobject_typeqmp_input_get_next_typeqobject_decref/build/qemu-hP0tKe/qemu-2.5+dfsg/qapi/qmp-output-visitor.cqmp_output_next_listqobject_typeqobject_decrefyestruean int64 value or range/build/qemu-hP0tKe/qemu-2.5+dfsg/qapi/string-input-visitor.cparse_type_intparse_type_sizeparse_type_boolparse_type_strparse_type_number%f"%s"<null> |