Linux Analysis Report
0vFX7VXc9U

Overview

General Information

Sample Name: 0vFX7VXc9U
Analysis ID: 626466
MD5: 5d6cccddcb88cb4daefbc964e23de098
SHA1: 18e29b4aaad7d49a2b2adba64387494c6590c8dc
SHA256: 1dfc810854844288a6f5c6b1e8dc25059bcff19c5585773956e568eaa4794970
Tags: 32armelfmirai
Infos:

Detection

Mirai
Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample tries to kill multiple processes (SIGKILL)
Sample contains only a LOAD segment without any section mappings
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: 0vFX7VXc9U Virustotal: Detection: 40% Perma Link

Networking
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 54612
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 54616
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 54618
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 54622
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 54632
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 54640
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 54648
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 54650
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 54654
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 54656
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:60988 -> 107.172.197.117:1312
Sample listens on a socket
Source: /tmp/0vFX7VXc9U (PID: 6231) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) Socket: 0.0.0.0::53413 Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) Socket: 0.0.0.0::80 Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) Socket: 0.0.0.0::37215 Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) Socket: 0.0.0.0::53413 Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) Socket: 0.0.0.0::80 Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) Socket: 0.0.0.0::37215 Jump to behavior
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 107.172.197.117
Source: unknown TCP traffic detected without corresponding DNS query: 75.153.213.149
Source: unknown TCP traffic detected without corresponding DNS query: 44.100.148.162
Source: unknown TCP traffic detected without corresponding DNS query: 153.161.78.149
Source: unknown TCP traffic detected without corresponding DNS query: 124.122.52.227
Source: unknown TCP traffic detected without corresponding DNS query: 200.20.122.95
Source: unknown TCP traffic detected without corresponding DNS query: 209.74.247.155
Source: unknown TCP traffic detected without corresponding DNS query: 174.71.198.101
Source: unknown TCP traffic detected without corresponding DNS query: 117.236.55.110
Source: unknown TCP traffic detected without corresponding DNS query: 37.106.71.233
Source: unknown TCP traffic detected without corresponding DNS query: 222.47.177.148
Source: unknown TCP traffic detected without corresponding DNS query: 125.144.106.185
Source: unknown TCP traffic detected without corresponding DNS query: 206.15.179.149
Source: unknown TCP traffic detected without corresponding DNS query: 254.27.202.193
Source: unknown TCP traffic detected without corresponding DNS query: 201.103.134.232
Source: unknown TCP traffic detected without corresponding DNS query: 219.78.219.232
Source: unknown TCP traffic detected without corresponding DNS query: 67.141.187.33
Source: unknown TCP traffic detected without corresponding DNS query: 104.195.123.176
Source: unknown TCP traffic detected without corresponding DNS query: 120.108.63.223
Source: unknown TCP traffic detected without corresponding DNS query: 48.186.3.119
Source: unknown TCP traffic detected without corresponding DNS query: 80.133.177.198
Source: unknown TCP traffic detected without corresponding DNS query: 182.248.186.183
Source: unknown TCP traffic detected without corresponding DNS query: 71.218.165.185
Source: unknown TCP traffic detected without corresponding DNS query: 179.129.198.114
Source: unknown TCP traffic detected without corresponding DNS query: 59.240.120.127
Source: unknown TCP traffic detected without corresponding DNS query: 67.6.248.156
Source: unknown TCP traffic detected without corresponding DNS query: 171.64.241.180
Source: unknown TCP traffic detected without corresponding DNS query: 75.151.87.145
Source: unknown TCP traffic detected without corresponding DNS query: 196.183.155.18
Source: unknown TCP traffic detected without corresponding DNS query: 193.188.234.47
Source: unknown TCP traffic detected without corresponding DNS query: 185.135.188.9
Source: unknown TCP traffic detected without corresponding DNS query: 179.213.133.164
Source: unknown TCP traffic detected without corresponding DNS query: 179.242.15.168
Source: unknown TCP traffic detected without corresponding DNS query: 198.16.2.230
Source: unknown TCP traffic detected without corresponding DNS query: 191.27.73.58
Source: unknown TCP traffic detected without corresponding DNS query: 41.235.202.130
Source: unknown TCP traffic detected without corresponding DNS query: 58.241.84.58
Source: unknown TCP traffic detected without corresponding DNS query: 169.228.22.89
Source: unknown TCP traffic detected without corresponding DNS query: 79.197.67.24
Source: unknown TCP traffic detected without corresponding DNS query: 32.171.233.252
Source: unknown TCP traffic detected without corresponding DNS query: 53.169.86.102
Source: unknown TCP traffic detected without corresponding DNS query: 149.13.99.100
Source: unknown TCP traffic detected without corresponding DNS query: 115.192.179.28
Source: unknown TCP traffic detected without corresponding DNS query: 255.194.67.22
Source: unknown TCP traffic detected without corresponding DNS query: 220.114.89.247
Source: unknown TCP traffic detected without corresponding DNS query: 213.233.2.165
Source: unknown TCP traffic detected without corresponding DNS query: 32.215.205.156
Source: unknown TCP traffic detected without corresponding DNS query: 106.217.38.243
Source: unknown TCP traffic detected without corresponding DNS query: 213.149.54.237
Source: 0vFX7VXc9U String found in binary or memory: http://upx.sf.net

System Summary
barindex
Sample tries to kill multiple processes (SIGKILL)
Source: /tmp/0vFX7VXc9U (PID: 6231) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 6231, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 720, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 759, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 788, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 800, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 847, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 1334, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 1335, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 1860, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 1872, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 2096, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 2097, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 2102, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 2180, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 2208, result: successful Jump to behavior
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x8000
Sample tries to kill a process (SIGKILL)
Source: /tmp/0vFX7VXc9U (PID: 6231) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 6231, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 720, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 759, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 788, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 800, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 847, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 1334, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 1335, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 1860, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 1872, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 2096, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 2097, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 2102, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 2180, result: successful Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) SIGKILL sent: pid: 2208, result: successful Jump to behavior
Source: classification engine Classification label: mal68.spre.troj.evad.lin@0/0@0/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
Enumerates processes within the "proc" file system
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/491/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/793/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/772/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/796/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/774/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/797/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/777/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/799/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/658/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/912/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/759/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/936/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/918/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/1/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/761/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/785/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/884/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/720/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/721/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/788/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/789/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/800/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/801/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/847/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6231) File opened: /proc/904/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/6231/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/2033/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/2033/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1582/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1582/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/2275/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1612/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1612/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1579/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1579/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1699/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1699/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1335/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1335/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1698/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1698/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/2028/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/2028/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1334/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1334/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1576/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1576/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/2302/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/3236/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/2025/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/2025/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/2146/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/2146/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/910/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/912/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/912/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/912/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/759/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/759/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/759/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/517/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/2307/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/918/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/918/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/918/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1594/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1594/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/2285/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/2281/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1349/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1349/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1623/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1623/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/761/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/761/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/761/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1622/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1622/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/884/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/884/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/884/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1983/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1983/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/2038/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/2038/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1586/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1586/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1465/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1465/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1344/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1344/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1860/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1860/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1463/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/1463/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/2156/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/2156/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/800/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/800/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/800/exe Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/801/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/801/fd Jump to behavior
Source: /tmp/0vFX7VXc9U (PID: 6237) File opened: /proc/801/exe Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 54612
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 54616
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 54618
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 54622
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 54632
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 54640
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 54648
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 54650
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 54654
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 54656
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/0vFX7VXc9U (PID: 6229) Queries kernel information via 'uname': Jump to behavior
Source: 0vFX7VXc9U, 6229.1.00000000631ea211.00000000c91328e8.rw-.sdmp, 0vFX7VXc9U, 6231.1.00000000631ea211.00000000c91328e8.rw-.sdmp, 0vFX7VXc9U, 6233.1.00000000631ea211.00000000c91328e8.rw-.sdmp, 0vFX7VXc9U, 6239.1.00000000631ea211.00000000c91328e8.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: 0vFX7VXc9U, 6229.1.0000000037e28d0d.00000000d1298c36.rw-.sdmp, 0vFX7VXc9U, 6231.1.0000000037e28d0d.00000000d1298c36.rw-.sdmp, 0vFX7VXc9U, 6233.1.0000000037e28d0d.00000000d1298c36.rw-.sdmp, 0vFX7VXc9U, 6239.1.0000000037e28d0d.00000000d1298c36.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/0vFX7VXc9USUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/0vFX7VXc9U
Source: 0vFX7VXc9U, 6229.1.00000000631ea211.00000000c91328e8.rw-.sdmp, 0vFX7VXc9U, 6231.1.00000000631ea211.00000000c91328e8.rw-.sdmp, 0vFX7VXc9U, 6233.1.00000000631ea211.00000000c91328e8.rw-.sdmp, 0vFX7VXc9U, 6239.1.00000000631ea211.00000000c91328e8.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: 0vFX7VXc9U, 6229.1.0000000037e28d0d.00000000d1298c36.rw-.sdmp, 0vFX7VXc9U, 6231.1.0000000037e28d0d.00000000d1298c36.rw-.sdmp, 0vFX7VXc9U, 6233.1.0000000037e28d0d.00000000d1298c36.rw-.sdmp, 0vFX7VXc9U, 6239.1.0000000037e28d0d.00000000d1298c36.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
159.199.38.171
 unknown United States
11363 FUJITSU-USAUS false
126.210.129.155
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
193.197.13.107
 unknown Germany
553 BELWUEBelWue-KoordinationEU false
38.162.241.46
 unknown United States
174 COGENT-174US false
158.34.190.148
 unknown United States
721 DNIC-ASBLK-00721-00726US false
17.68.111.77
 unknown United States
714 APPLE-ENGINEERINGUS false
202.211.43.114
 unknown Japan 23637 BI-CDN-IXEquinixJpapanEnterpriseKKJP false
58.49.78.189
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
187.44.116.221
 unknown Brazil
28303 UNASSIGNED false
167.194.166.140
 unknown United States
2897 GEORGIA-1US false
155.103.234.205
 unknown United States
17055 UTAHUS false
117.20.6.89
 unknown Australia
45671 AS45671-NET-AUWholesaleServicesProviderAU false
123.123.10.10
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
211.215.142.151
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
184.183.128.14
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
27.91.141.132
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
191.69.208.120
 unknown Colombia
26611 COMCELSACO false
179.181.230.189
 unknown Brazil
18881 TELEFONICABRASILSABR false
106.178.36.12
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
79.212.37.114
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
242.191.215.50
 unknown Reserved
unknown unknown false
173.159.96.56
 unknown United States
10507 SPCSUS false
192.70.114.91
 unknown France
2200 FR-RENATERReseauNationaldetelecommunicationspourlaTec false
188.65.30.16
 unknown Oman
15679 CISOM false
252.233.33.84
 unknown Reserved
unknown unknown false
155.174.155.129
 unknown United States
797 AMERITECH-ASUS false
190.87.78.146
 unknown El Salvador
14754 TelguaGT false
18.132.24.3
 unknown United States
16509 AMAZON-02US false
112.135.85.14
 unknown Sri Lanka
9329 SLTINT-AS-APSriLankaTelecomInternetLK false
122.238.160.53
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
63.222.211.96
 unknown United States
3491 BTN-ASNUS false
47.111.235.144
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
60.78.199.133
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
113.151.235.184
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
210.151.10.111
 unknown Japan 4725 ODNSoftBankMobileCorpJP false
67.150.211.85
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
221.161.108.168
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
172.127.100.178
 unknown United States
7018 ATT-INTERNET4US false
241.170.151.161
 unknown Reserved
unknown unknown false
209.221.88.255
 unknown Canada
17054 AS17054US false
255.103.13.193
 unknown Reserved
unknown unknown false
216.46.11.151
 unknown Canada
11478 OPENFACECA false
189.197.247.189
 unknown Mexico
13999 MegaCableSAdeCVMX false
145.245.19.10
 unknown Switzerland
2047 ASN-ROCHE-BASLEGlobalcorporateIPnetworkCH false
57.62.76.32
 unknown Belgium
2686 ATGS-MMD-ASUS false
202.231.94.147
 unknown Japan 2519 VECTANTARTERIANetworksCorporationJP false
135.166.174.163
 unknown United States
14962 NCR-252US false
165.26.68.176
 unknown United States
14381 CATERPILLAR-INCUS false
147.147.16.159
 unknown United Kingdom
6871 PLUSNETUKInternetServiceProviderGB false
4.138.164.110
 unknown United States
3356 LEVEL3US false
34.38.58.196
 unknown United States
2686 ATGS-MMD-ASUS false
84.239.71.93
 unknown France
20926 PULSATION-ASFR false
152.47.196.81
 unknown United States
81 NCRENUS false
188.103.181.52
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
85.186.170.195
 unknown Romania
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
34.66.240.213
 unknown United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
20.151.130.134
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
177.167.27.22
 unknown Brazil
26615 TIMSABR false
247.149.253.146
 unknown Reserved
unknown unknown false
243.95.58.195
 unknown Reserved
unknown unknown false
5.19.186.80
 unknown Russian Federation
41733 ZTELECOM-ASRU false
62.8.167.45
 unknown Germany
20676 PLUSNETDE false
68.40.94.171
 unknown United States
7922 COMCAST-7922US false
176.67.2.141
 unknown Ukraine
25133 MCLAUT-ASUA false
110.3.119.105
 unknown Japan 10013 FBDCFreeBitCoLtdJP false
24.232.201.65
 unknown Argentina
10318 TelecomArgentinaSAAR false
24.237.4.6
 unknown United States
8047 GCIUS false
58.253.21.183
 unknown China
17622 CNCGROUP-GZChinaUnicomGuangzhounetworkCN false
212.214.203.146
 unknown Sweden
3246 TDCSONGTele2BusinessTDCSwedenSE false
47.19.240.28
 unknown United States
6128 CABLE-NET-1US false
79.94.237.131
 unknown France
15557 LDCOMNETFR false
12.170.33.63
 unknown United States
7018 ATT-INTERNET4US false
35.115.167.133
 unknown United States
237 MERIT-AS-14US false
40.131.167.165
 unknown United States
7029 WINDSTREAMUS false
168.223.68.65
 unknown United States
7202 FAMUUS false
251.241.122.248
 unknown Reserved
unknown unknown false
188.102.19.180
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
121.137.248.232
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
5.40.190.26
 unknown Spain
43160 ES-MDC-DATACENTERMalagaDataCenterES false
92.175.5.148
 unknown France
3215 FranceTelecom-OrangeFR false
201.188.216.73
 unknown Chile
7418 TELEFONICACHILESACL false
120.168.146.194
 unknown Indonesia
4761 INDOSAT-INP-APINDOSATInternetNetworkProviderID false
242.205.249.210
 unknown Reserved
unknown unknown false
129.3.73.40
 unknown United States
14433 SUNY-OSWEGO-ASNUS false
135.251.35.234
 unknown United States
10455 LUCENT-CIOUS false
192.89.10.120
 unknown Finland
1759 TSF-IP-CORETeliaFinlandOyjEU false
250.57.212.23
 unknown Reserved
unknown unknown false
36.118.159.83
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
24.69.73.98
 unknown Canada
6327 SHAWCA false
117.53.253.20
 unknown Korea Republic of
9770 SPEEDONSTV-AS-KRLGHelloVisionCorpKR false
253.198.199.189
 unknown Reserved
unknown unknown false
113.35.47.165
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
31.53.204.8
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
194.223.115.79
 unknown United Kingdom
138384 RMNI-AS-APRakutenMobileNetworkIncJP false
254.55.175.61
 unknown Reserved
unknown unknown false
186.112.241.175
 unknown Colombia
3816 COLOMBIATELECOMUNICACIONESSAESPCO false
202.137.122.48
 unknown Philippines
38553 DCTECHDVO-AS-APInternetServiceProviderandDataCenterP false
119.109.212.116
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
45.25.50.42
 unknown United States
7018 ATT-INTERNET4US false
99.11.105.169
 unknown United States
7018 ATT-INTERNET4US false