Linux Analysis Report
VBeQtQfmgh

Overview

General Information

Sample Name: VBeQtQfmgh
Analysis ID: 679493
MD5: 147b877d92cb69a4f47a6d6c9e4481db
SHA1: c37890898f0faef6f92fe1cd2506bf11be2fcf75
SHA256: 323eb2ac9034ac59a744a4743f3de35307a4a05a24af0cf75b89bf17ff8d0d6d
Tags: 32armelfmirai
Infos:

Detection

Mirai
Score: 100
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample deletes itself
Uses known network protocols on non-standard ports
Contains symbols with names commonly found in malware
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample and/or dropped files contains symbols with suspicious names
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: VBeQtQfmgh Avira: detected
Multi AV Scanner detection for submitted file
Source: VBeQtQfmgh Virustotal: Detection: 62% Perma Link

Networking
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56956
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56960
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56964
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56972
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56974
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:53692 -> 163.123.143.71:34241
Sample listens on a socket
Source: /tmp/VBeQtQfmgh (PID: 6229) Socket: 127.0.0.1::42516 Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) Socket: 0.0.0.0::23 Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) Socket: 0.0.0.0::80 Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) Socket: 0.0.0.0::81 Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) Socket: 0.0.0.0::8443 Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) Socket: 0.0.0.0::9009 Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) Socket: 0.0.0.0::23 Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) Socket: 0.0.0.0::80 Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) Socket: 0.0.0.0::81 Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) Socket: 0.0.0.0::8443 Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) Socket: 0.0.0.0::9009 Jump to behavior
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 242.0.40.176
Source: unknown TCP traffic detected without corresponding DNS query: 207.104.38.176
Source: unknown TCP traffic detected without corresponding DNS query: 80.149.81.191
Source: unknown TCP traffic detected without corresponding DNS query: 246.173.169.254
Source: unknown TCP traffic detected without corresponding DNS query: 130.204.157.39
Source: unknown TCP traffic detected without corresponding DNS query: 190.195.249.68
Source: unknown TCP traffic detected without corresponding DNS query: 213.236.72.245
Source: unknown TCP traffic detected without corresponding DNS query: 204.233.118.138
Source: unknown TCP traffic detected without corresponding DNS query: 80.65.137.39
Source: unknown TCP traffic detected without corresponding DNS query: 92.44.167.219
Source: unknown TCP traffic detected without corresponding DNS query: 57.217.33.64
Source: unknown TCP traffic detected without corresponding DNS query: 182.105.94.154
Source: unknown TCP traffic detected without corresponding DNS query: 5.44.7.185
Source: unknown TCP traffic detected without corresponding DNS query: 119.244.49.234
Source: unknown TCP traffic detected without corresponding DNS query: 179.244.229.1
Source: unknown TCP traffic detected without corresponding DNS query: 173.186.225.71
Source: unknown TCP traffic detected without corresponding DNS query: 39.67.106.113
Source: unknown TCP traffic detected without corresponding DNS query: 212.62.233.135
Source: unknown TCP traffic detected without corresponding DNS query: 243.175.32.92
Source: unknown TCP traffic detected without corresponding DNS query: 4.184.16.160
Source: unknown TCP traffic detected without corresponding DNS query: 93.120.68.226
Source: unknown TCP traffic detected without corresponding DNS query: 120.93.222.3
Source: unknown TCP traffic detected without corresponding DNS query: 24.143.151.136
Source: unknown TCP traffic detected without corresponding DNS query: 47.31.211.92
Source: unknown TCP traffic detected without corresponding DNS query: 171.201.64.211
Source: unknown TCP traffic detected without corresponding DNS query: 222.100.218.22
Source: unknown TCP traffic detected without corresponding DNS query: 17.230.119.245
Source: unknown TCP traffic detected without corresponding DNS query: 167.216.231.176
Source: unknown TCP traffic detected without corresponding DNS query: 101.58.237.46
Source: unknown TCP traffic detected without corresponding DNS query: 111.202.237.32
Source: unknown TCP traffic detected without corresponding DNS query: 62.217.236.3
Source: unknown TCP traffic detected without corresponding DNS query: 223.114.20.235
Source: unknown TCP traffic detected without corresponding DNS query: 68.61.196.101
Source: unknown TCP traffic detected without corresponding DNS query: 243.14.57.171
Source: unknown TCP traffic detected without corresponding DNS query: 113.177.96.195
Source: unknown TCP traffic detected without corresponding DNS query: 62.56.54.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.72.72.163
Source: unknown TCP traffic detected without corresponding DNS query: 40.26.233.34
Source: unknown TCP traffic detected without corresponding DNS query: 85.96.48.149
Source: unknown TCP traffic detected without corresponding DNS query: 178.147.100.32
Source: unknown TCP traffic detected without corresponding DNS query: 183.60.226.92
Source: unknown TCP traffic detected without corresponding DNS query: 19.73.144.109
Source: unknown TCP traffic detected without corresponding DNS query: 169.16.51.38
Source: unknown TCP traffic detected without corresponding DNS query: 18.41.50.12
Source: unknown TCP traffic detected without corresponding DNS query: 243.43.141.110
Source: unknown TCP traffic detected without corresponding DNS query: 160.105.106.26
Source: unknown TCP traffic detected without corresponding DNS query: 109.37.60.227
Source: unknown TCP traffic detected without corresponding DNS query: 98.70.226.64

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: VBeQtQfmgh, type: SAMPLE Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: VBeQtQfmgh, type: SAMPLE Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6234.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6234.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6249.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6249.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6229.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6229.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6233.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6233.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Contains symbols with names commonly found in malware
Source: ELF static info symbol of initial sample Name: attack.c
Source: ELF static info symbol of initial sample Name: attack_app.c
Source: ELF static info symbol of initial sample Name: attack_app_http
Source: ELF static info symbol of initial sample Name: attack_get_opt_int
Source: ELF static info symbol of initial sample Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample Name: attack_get_opt_str
Source: ELF static info symbol of initial sample Name: attack_init
Source: ELF static info symbol of initial sample Name: attack_parse
Source: ELF static info symbol of initial sample Name: attack_start
Source: ELF static info symbol of initial sample Name: attack_tcp.c
Yara signature match
Source: VBeQtQfmgh, type: SAMPLE Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: VBeQtQfmgh, type: SAMPLE Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: VBeQtQfmgh, type: SAMPLE Matched rule: MAL_ARM_LNX_Mirai_Mar13_2022 date = 2022-03-16, hash1 = 0283b72913b8a78b2a594b2d40ebc3c873e4823299833a1ff6854421378f5a68, author = Mehmet Ali Kerimoglu a.k.a. CYB3RMX, description = Detects new ARM Mirai variant
Source: 6234.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6234.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6249.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6249.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6229.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6229.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6233.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6233.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Sample and/or dropped files contains symbols with suspicious names
Source: VBeQtQfmgh ELF static info symbol of initial sample: __gnu_unwind_execute
Source: VBeQtQfmgh ELF static info symbol of initial sample: scanner.c
Source: VBeQtQfmgh ELF static info symbol of initial sample: scanner_init
Source: VBeQtQfmgh ELF static info symbol of initial sample: scanner_pid
Source: VBeQtQfmgh ELF static info symbol of initial sample: scanner_rawpkt
Sample tries to kill a process (SIGKILL)
Source: /tmp/VBeQtQfmgh (PID: 6233) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) SIGKILL sent: pid: 6233, result: successful Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) SIGKILL sent: pid: 759, result: successful Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.lin@0/0@0/0
Enumerates processes within the "proc" file system
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/491/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/793/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/772/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/796/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/774/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/797/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/777/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/799/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/658/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/912/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/759/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/936/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/918/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/1/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/761/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/785/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/884/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/720/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/721/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/788/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/789/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/800/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/801/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/847/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6233) File opened: /proc/904/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/6233/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/6236/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/2033/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/2033/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1582/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1582/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/2275/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/2275/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/6191/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/6191/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/3088/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/6192/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/6192/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1612/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1612/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1579/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1579/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1699/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1699/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1335/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1335/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1698/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1698/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/2028/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/2028/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1334/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1334/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1576/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1576/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/2302/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/2302/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/3236/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/3236/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/2025/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/2025/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/2146/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/2146/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/910/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/912/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/912/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/912/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/759/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/759/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/759/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/517/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/2307/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/2307/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/918/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/918/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/918/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1594/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1594/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/2285/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/2285/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/2281/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/2281/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1349/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1349/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1623/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1623/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/761/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/761/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/761/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1622/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1622/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/884/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/884/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/884/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1983/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1983/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/2038/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/2038/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1586/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1586/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1465/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1465/exe Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1344/fd Jump to behavior
Source: /tmp/VBeQtQfmgh (PID: 6247) File opened: /proc/1344/exe Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Sample deletes itself
Source: /tmp/VBeQtQfmgh (PID: 6229) File: /tmp/VBeQtQfmgh Jump to behavior
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56956
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56960
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56964
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56972
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56974
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/VBeQtQfmgh (PID: 6229) Queries kernel information via 'uname': Jump to behavior
Source: VBeQtQfmgh, 6229.1.00007ffeac865000.00007ffeac886000.rw-.sdmp, VBeQtQfmgh, 6233.1.00007ffeac865000.00007ffeac886000.rw-.sdmp, VBeQtQfmgh, 6234.1.00007ffeac865000.00007ffeac886000.rw-.sdmp, VBeQtQfmgh, 6249.1.00007ffeac865000.00007ffeac886000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/VBeQtQfmghSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/VBeQtQfmgh
Source: VBeQtQfmgh, 6229.1.0000564b4a401000.0000564b4a554000.rw-.sdmp, VBeQtQfmgh, 6233.1.0000564b4a401000.0000564b4a52f000.rw-.sdmp, VBeQtQfmgh, 6234.1.0000564b4a401000.0000564b4a52f000.rw-.sdmp, VBeQtQfmgh, 6249.1.0000564b4a401000.0000564b4a52f000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: VBeQtQfmgh, 6229.1.0000564b4a401000.0000564b4a554000.rw-.sdmp, VBeQtQfmgh, 6233.1.0000564b4a401000.0000564b4a52f000.rw-.sdmp, VBeQtQfmgh, 6234.1.0000564b4a401000.0000564b4a52f000.rw-.sdmp, VBeQtQfmgh, 6249.1.0000564b4a401000.0000564b4a52f000.rw-.sdmp Binary or memory string: AJKV!/etc/qemu-binfmt/arm
Source: VBeQtQfmgh, 6229.1.00007ffeac865000.00007ffeac886000.rw-.sdmp, VBeQtQfmgh, 6233.1.00007ffeac865000.00007ffeac886000.rw-.sdmp, VBeQtQfmgh, 6234.1.00007ffeac865000.00007ffeac886000.rw-.sdmp, VBeQtQfmgh, 6249.1.00007ffeac865000.00007ffeac886000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: VBeQtQfmgh, type: SAMPLE
Source: Yara match File source: 6234.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6249.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6229.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6233.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: VBeQtQfmgh, type: SAMPLE
Source: Yara match File source: 6234.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6249.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6229.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6233.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
204.6.82.198
 unknown United States
174 COGENT-174US false
179.53.118.59
 unknown Dominican Republic
6400 CompaniaDominicanadeTelefonosSADO false
101.74.50.185
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
186.241.56.209
 unknown Brazil
7738 TelemarNorteLesteSABR false
17.215.102.114
 unknown United States
714 APPLE-ENGINEERINGUS false
63.213.192.147
 unknown United States
3356 LEVEL3US false
38.200.159.254
 unknown United States
174 COGENT-174US false
200.210.43.141
 unknown Brazil
4230 CLAROSABR false
219.157.67.160
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
104.121.103.178
 unknown United States
16625 AKAMAI-ASUS false
136.75.201.58
 unknown United States
60311 ONEFMCH false
253.76.224.142
 unknown Reserved
unknown unknown false
159.182.17.200
 unknown United States
11892 PEARSON-NAUS false
83.89.235.187
 unknown Denmark
3292 TDCTDCASDK false
42.131.165.106
 unknown China
4249 LILLY-ASUS false
37.8.194.18
 unknown Poland
29314 VECTRANET-ASAlZwyciestwa25381-525GdyniaPolandPL false
201.238.234.107
 unknown Chile
14259 GtdInternetSACL false
105.19.47.211
 unknown Mauritius
37100 SEACOM-ASMU false
85.0.181.96
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
251.6.32.78
 unknown Reserved
unknown unknown false
125.131.134.127
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
159.99.43.101
 unknown United States
3371 MCI-ASNUS false
197.75.135.242
 unknown South Africa
16637 MTNNS-ASZA false
165.33.173.211
 unknown United States
37053 RSAWEB-ASZA false
190.223.30.36
 unknown Peru
12252 AmericaMovilPeruSACPE false
16.144.23.142
 unknown United States
unknown unknown false
65.81.6.23
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
170.86.31.158
 unknown United States
7726 FITC-ASUS false
53.210.90.26
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
87.201.156.198
 unknown United Arab Emirates
15802 DU-AS1AE false
222.12.115.235
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
99.2.98.142
 unknown United States
7018 ATT-INTERNET4US false
255.94.93.21
 unknown Reserved
unknown unknown false
82.82.106.41
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
204.14.230.229
 unknown United States
15176 AS-INOCUS false
36.33.76.86
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
48.188.11.240
 unknown United States
2686 ATGS-MMD-ASUS false
12.46.36.245
 unknown United States
2386 INS-ASUS false
105.100.195.38
 unknown Algeria
36947 ALGTEL-ASDZ false
73.162.139.51
 unknown United States
7922 COMCAST-7922US false
84.187.171.97
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
207.12.140.72
 unknown United States
54321 COMPUTEXUS false
2.163.127.40
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
255.20.240.50
 unknown Reserved
unknown unknown false
106.130.91.13
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
248.246.73.133
 unknown Reserved
unknown unknown false
186.96.76.234
 unknown Venezuela
28007 GoldDataCAVE false
133.226.186.123
 unknown Japan 17958 KCVKasaokaCableVisionCoLTDJP false
119.142.224.180
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
54.127.156.227
 unknown United States
16509 AMAZON-02US false
184.6.29.81
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
42.30.124.95
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
112.237.193.113
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
163.180.209.11
 unknown Korea Republic of
17870 KHU-AS-KRKyungHeeUniversityKR false
72.157.207.4
 unknown United States
7018 ATT-INTERNET4US false
182.248.10.103
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
212.103.108.45
 unknown Russian Federation
31585 ASN-RAIDRU false
124.73.249.113
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
80.41.57.220
 unknown United Kingdom
9105 TISCALI-UKTalkTalkCommunicationsLimitedGB false
66.182.195.175
 unknown United States
20135 MTL-19US false
251.94.27.111
 unknown Reserved
unknown unknown false
189.254.158.0
 unknown Mexico
8151 UninetSAdeCVMX false
161.37.102.28
 unknown Spain
158 ERI-ASUS false
124.7.137.144
 unknown India
9583 SIFY-AS-INSifyLimitedIN false
86.102.184.24
 unknown Russian Federation
12332 PRIMORYE-ASRU false
135.161.31.220
 unknown United States
14962 NCR-252US false
78.129.59.141
 unknown Belgium
12392 ASBRUTELEVOOBE false
104.101.91.162
 unknown United States
4818 DIGIIX-APDiGiTelecommunicationsSdnBhdMY false
41.35.35.147
 unknown Egypt
8452 TE-ASTE-ASEG false
66.238.202.187
 unknown United States
2828 XO-AS15US false
58.21.171.101
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
179.5.202.118
 unknown El Salvador
14754 TelguaGT false
117.103.186.38
 unknown Japan 2914 NTT-COMMUNICATIONS-2914US false
247.207.28.159
 unknown Reserved
unknown unknown false
205.168.80.8
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
20.104.60.14
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
155.225.196.242
 unknown United States
2939 SCAROLINA-ASUS false
163.67.45.198
 unknown France
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
146.132.148.82
 unknown United States
10695 WAL-MARTUS false
65.189.10.124
 unknown United States
10796 TWC-10796-MIDWESTUS false
216.96.131.232
 unknown United States
3450 UTKUS false
210.188.193.23
 unknown Japan 9371 SAKURA-CSAKURAInternetIncJP false
240.52.250.93
 unknown Reserved
unknown unknown false
252.80.61.190
 unknown Reserved
unknown unknown false
152.79.211.5
 unknown United States
6192 UCDAVIS-COREUS false
159.21.68.141
 unknown United States
62195 MWH-UK-ASGB false
181.102.35.153
 unknown Argentina
7303 TelecomArgentinaSAAR false
14.255.165.255
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
208.43.78.252
 unknown United States
36351 SOFTLAYERUS false
180.117.121.174
 unknown China
137702 CHINATELECOM-JIANGSU-NANJING-IDCNanjingJiangsuProvince false
13.121.229.31
 unknown United States
16509 AMAZON-02US false
99.11.56.165
 unknown United States
7018 ATT-INTERNET4US false
160.18.158.247
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
216.192.110.227
 unknown United States
17184 ATL-CBEYONDUS false
178.40.197.55
 unknown Slovakia (SLOVAK Republic)
6855 SK-TELEKOMSK false
100.201.253.252
 unknown United States
21928 T-MOBILE-AS21928US false
5.151.151.65
 unknown United Kingdom
42689 GLIDEGB false
158.198.222.44
 unknown Japan 17511 OPTAGEOPTAGEIncJP false
135.17.183.214
 unknown United States
8983 NOKIA-ASFI false
98.42.30.235
 unknown United States
7922 COMCAST-7922US false