Linux Analysis Report
csqe8VS0YI

Overview

General Information

Sample Name: csqe8VS0YI
Analysis ID: 626473
MD5: beae05ed2e1e2189d5f44fe5fe95111a
SHA1: ad4d569675210467533e6093f3b13f805c860a28
SHA256: a5cb465d21d9171b83bbbb658bbea9c875e421e37603f5e576c6387570fed6c6
Tags: 32elfmiraimotorola
Infos:

Detection

Mirai
Score: 60
Range: 0 - 100
Whitelisted: false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Uses known network protocols on non-standard ports
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

AV Detection

barindex
Source: csqe8VS0YI Virustotal: Detection: 54% Perma Link

Networking

barindex
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 58834
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 58842
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 58844
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 58848
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 58858
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 58864
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 58868
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 58870
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 58874
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 58876
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36090
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36092
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36094
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36098
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36100
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36104
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36108
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36110
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36112
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36118
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46728
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46730
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46732
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46734
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46738
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46744
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46756
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46768
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46780
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46782
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37450
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37456
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37464
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37484
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37492
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37498
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37502
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37510
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37520
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37532
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 49996
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50000
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50006
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50008
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50012
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50016
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50018
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50026
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50028
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50030
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:60988 -> 107.172.197.117:1312
Source: /tmp/csqe8VS0YI (PID: 6232) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) Socket: 0.0.0.0::0 Jump to behavior
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 107.172.197.117
Source: unknown TCP traffic detected without corresponding DNS query: 13.0.164.21
Source: unknown TCP traffic detected without corresponding DNS query: 109.74.44.219
Source: unknown TCP traffic detected without corresponding DNS query: 91.146.53.149
Source: unknown TCP traffic detected without corresponding DNS query: 200.3.132.206
Source: unknown TCP traffic detected without corresponding DNS query: 40.130.28.180
Source: unknown TCP traffic detected without corresponding DNS query: 57.50.234.50
Source: unknown TCP traffic detected without corresponding DNS query: 84.225.48.252
Source: unknown TCP traffic detected without corresponding DNS query: 87.116.152.152
Source: unknown TCP traffic detected without corresponding DNS query: 16.40.254.63
Source: unknown TCP traffic detected without corresponding DNS query: 109.221.53.232
Source: unknown TCP traffic detected without corresponding DNS query: 125.158.147.235
Source: unknown TCP traffic detected without corresponding DNS query: 180.235.64.76
Source: unknown TCP traffic detected without corresponding DNS query: 119.114.96.176
Source: unknown TCP traffic detected without corresponding DNS query: 254.156.93.201
Source: unknown TCP traffic detected without corresponding DNS query: 200.12.231.204
Source: unknown TCP traffic detected without corresponding DNS query: 170.237.5.40
Source: unknown TCP traffic detected without corresponding DNS query: 20.137.109.105
Source: unknown TCP traffic detected without corresponding DNS query: 12.150.146.55
Source: unknown TCP traffic detected without corresponding DNS query: 155.29.204.24
Source: unknown TCP traffic detected without corresponding DNS query: 188.213.44.241
Source: unknown TCP traffic detected without corresponding DNS query: 249.23.145.34
Source: unknown TCP traffic detected without corresponding DNS query: 200.18.228.173
Source: unknown TCP traffic detected without corresponding DNS query: 75.41.202.169
Source: unknown TCP traffic detected without corresponding DNS query: 126.105.222.202
Source: unknown TCP traffic detected without corresponding DNS query: 153.70.148.14
Source: unknown TCP traffic detected without corresponding DNS query: 23.23.94.132
Source: unknown TCP traffic detected without corresponding DNS query: 65.213.102.187
Source: unknown TCP traffic detected without corresponding DNS query: 207.168.78.221
Source: unknown TCP traffic detected without corresponding DNS query: 48.40.215.16
Source: unknown TCP traffic detected without corresponding DNS query: 240.52.146.115
Source: unknown TCP traffic detected without corresponding DNS query: 92.232.247.111
Source: unknown TCP traffic detected without corresponding DNS query: 196.172.39.72
Source: unknown TCP traffic detected without corresponding DNS query: 178.149.134.76
Source: unknown TCP traffic detected without corresponding DNS query: 126.44.231.157
Source: unknown TCP traffic detected without corresponding DNS query: 141.194.26.246
Source: unknown TCP traffic detected without corresponding DNS query: 87.78.65.88
Source: unknown TCP traffic detected without corresponding DNS query: 219.200.159.231
Source: unknown TCP traffic detected without corresponding DNS query: 170.246.202.65
Source: unknown TCP traffic detected without corresponding DNS query: 59.36.111.29
Source: unknown TCP traffic detected without corresponding DNS query: 200.244.143.83
Source: unknown TCP traffic detected without corresponding DNS query: 216.72.26.76
Source: unknown TCP traffic detected without corresponding DNS query: 60.205.3.37
Source: unknown TCP traffic detected without corresponding DNS query: 174.243.166.20
Source: unknown TCP traffic detected without corresponding DNS query: 121.65.191.75
Source: unknown TCP traffic detected without corresponding DNS query: 247.197.213.37
Source: unknown TCP traffic detected without corresponding DNS query: 60.139.134.173
Source: unknown TCP traffic detected without corresponding DNS query: 190.182.241.250
Source: unknown TCP traffic detected without corresponding DNS query: 191.61.152.28
Source: unknown TCP traffic detected without corresponding DNS query: 251.42.123.253
Source: ELF static info symbol of initial sample .symtab present: no
Source: /tmp/csqe8VS0YI (PID: 6232) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal60.troj.lin@0/0@0/0
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/491/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/793/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/772/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/796/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/774/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/797/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/777/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/799/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/658/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/912/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/759/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/936/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/918/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/1/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/761/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/785/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/884/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/720/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/721/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/788/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/789/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/800/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/801/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/847/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6232) File opened: /proc/904/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/491/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/793/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/772/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/796/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/774/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/797/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/777/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/799/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/658/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/912/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/759/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/936/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/918/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/1/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/761/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/785/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/884/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/720/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/721/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/788/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/789/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/800/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/801/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/847/fd Jump to behavior
Source: /tmp/csqe8VS0YI (PID: 6238) File opened: /proc/904/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection

barindex
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 58834
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 58842
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 58844
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 58848
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 58858
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 58864
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 58868
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 58870
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 58874
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 58876
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36090
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36092
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36094
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36098
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36100
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36104
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36108
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36110
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36112
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36118
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46728
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46730
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46732
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46734
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46738
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46744
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46756
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46768
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46780
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46782
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37450
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37456
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37464
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37484
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37492
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37498
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37502
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37510
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37520
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37532
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 49996
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50000
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50006
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50008
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50012
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50016
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50018
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50026
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50028
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50030
Source: /tmp/csqe8VS0YI (PID: 6230) Queries kernel information via 'uname': Jump to behavior
Source: csqe8VS0YI, 6230.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6232.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6329.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6347.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6335.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6233.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6340.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6239.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: csqe8VS0YI, 6230.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6232.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6329.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6347.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6335.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6233.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6340.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6239.1.000000008aa52aac.000000001b30196b.rw-.sdmp Binary or memory string: /usr/bin/qemu-m68k
Source: csqe8VS0YI, 6230.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6232.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6329.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6347.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6335.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6233.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6340.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6239.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/m68k
Source: csqe8VS0YI, 6230.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6232.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6329.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6347.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6335.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6233.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6340.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6239.1.000000008aa52aac.000000001b30196b.rw-.sdmp Binary or memory string: Piyx86_64/usr/bin/qemu-m68k/tmp/csqe8VS0YISUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/csqe8VS0YI

Stealing of Sensitive Information

barindex
Source: Yara match File source: dump.pcap, type: PCAP

Remote Access Functionality

barindex
Source: Yara match File source: dump.pcap, type: PCAP
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs