Linux Analysis Report
853p3OEqFU

Overview

General Information

Sample Name: 853p3OEqFU
Analysis ID: 679621
MD5: 70e0ea0f67dc6c634740e0adfcd15e1d
SHA1: 75451c8bc20594851cda1becb5378ed80348c3cf
SHA256: b2e652870947b6e31c0043205cb94c1c64ad7e1b65a9e3c29b3673b708a3c88d
Tags: 32elfmiraisparc
Infos:

Detection

Mirai
Score: 64
Range: 0 - 100
Whitelisted: false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: 853p3OEqFU Virustotal: Detection: 38% Perma Link
Source: 853p3OEqFU ReversingLabs: Detection: 35%
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:53436 -> 46.23.109.40:1312
Sample listens on a socket
Source: /tmp/853p3OEqFU (PID: 6228) Socket: 127.0.0.1::1312 Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) Socket: 0.0.0.0::53413 Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) Socket: 0.0.0.0::80 Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) Socket: 0.0.0.0::52869 Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) Socket: 0.0.0.0::37215 Jump to behavior
Source: unknown DNS traffic detected: queries for: arcticboatz.cz
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 116.61.123.13
Source: unknown TCP traffic detected without corresponding DNS query: 75.174.105.13
Source: unknown TCP traffic detected without corresponding DNS query: 88.56.237.13
Source: unknown TCP traffic detected without corresponding DNS query: 98.161.197.198
Source: unknown TCP traffic detected without corresponding DNS query: 219.197.32.249
Source: unknown TCP traffic detected without corresponding DNS query: 253.104.244.36
Source: unknown TCP traffic detected without corresponding DNS query: 113.46.60.89
Source: unknown TCP traffic detected without corresponding DNS query: 46.126.59.122
Source: unknown TCP traffic detected without corresponding DNS query: 57.9.25.125
Source: unknown TCP traffic detected without corresponding DNS query: 245.17.75.101
Source: unknown TCP traffic detected without corresponding DNS query: 252.63.34.73
Source: unknown TCP traffic detected without corresponding DNS query: 243.49.9.252
Source: unknown TCP traffic detected without corresponding DNS query: 177.179.24.91
Source: unknown TCP traffic detected without corresponding DNS query: 45.136.152.10
Source: unknown TCP traffic detected without corresponding DNS query: 43.112.105.218
Source: unknown TCP traffic detected without corresponding DNS query: 200.173.74.193
Source: unknown TCP traffic detected without corresponding DNS query: 206.52.58.14
Source: unknown TCP traffic detected without corresponding DNS query: 163.161.83.155
Source: unknown TCP traffic detected without corresponding DNS query: 179.107.28.40
Source: unknown TCP traffic detected without corresponding DNS query: 117.45.66.177
Source: unknown TCP traffic detected without corresponding DNS query: 16.202.207.121
Source: unknown TCP traffic detected without corresponding DNS query: 18.79.120.125
Source: unknown TCP traffic detected without corresponding DNS query: 173.98.226.227
Source: unknown TCP traffic detected without corresponding DNS query: 168.169.179.136
Source: unknown TCP traffic detected without corresponding DNS query: 69.221.83.34
Source: unknown TCP traffic detected without corresponding DNS query: 102.44.72.85
Source: unknown TCP traffic detected without corresponding DNS query: 219.18.154.220
Source: unknown TCP traffic detected without corresponding DNS query: 104.42.191.185
Source: unknown TCP traffic detected without corresponding DNS query: 89.128.174.92
Source: unknown TCP traffic detected without corresponding DNS query: 248.0.19.84
Source: unknown TCP traffic detected without corresponding DNS query: 90.170.50.185
Source: unknown TCP traffic detected without corresponding DNS query: 117.33.49.57
Source: unknown TCP traffic detected without corresponding DNS query: 255.233.156.94
Source: unknown TCP traffic detected without corresponding DNS query: 66.115.78.178
Source: unknown TCP traffic detected without corresponding DNS query: 91.156.6.23
Source: unknown TCP traffic detected without corresponding DNS query: 194.223.159.110
Source: unknown TCP traffic detected without corresponding DNS query: 83.205.23.227
Source: unknown TCP traffic detected without corresponding DNS query: 120.151.65.93
Source: unknown TCP traffic detected without corresponding DNS query: 9.5.213.67
Source: unknown TCP traffic detected without corresponding DNS query: 92.99.31.8
Source: unknown TCP traffic detected without corresponding DNS query: 188.117.48.248
Source: unknown TCP traffic detected without corresponding DNS query: 2.211.80.21
Source: unknown TCP traffic detected without corresponding DNS query: 85.240.158.0
Source: unknown TCP traffic detected without corresponding DNS query: 153.57.199.25
Source: unknown TCP traffic detected without corresponding DNS query: 119.133.243.71
Source: unknown TCP traffic detected without corresponding DNS query: 163.130.4.75
Source: unknown TCP traffic detected without corresponding DNS query: 218.69.163.52
Source: unknown TCP traffic detected without corresponding DNS query: 240.195.124.240
Source: unknown TCP traffic detected without corresponding DNS query: 91.200.239.88
Source: unknown TCP traffic detected without corresponding DNS query: 118.115.61.249
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/853p3OEqFU (PID: 6239) SIGKILL sent: pid: 936, result: successful Jump to behavior
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox AK1K2
Source: Initial sample String containing 'busybox' found: /bin/busybox cp /bin/busybox retrieve && >retrieve && /bin/busybox chmod 777 retrieve && /bin/busybox cp /bin/busybox .t && >.t && /bin/busybox chmod 777 .t
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -en '%s' %s %s && /bin/busybox echo -en '\x45\x43\x48\x4f\x44\x4f\x4e\x45'
Source: Initial sample String containing 'busybox' found: >%st && cd %s && >retrieve; >.t/bin/busybox cp /bin/busybox retrieve && >retrieve && /bin/busybox chmod 777 retrieve && /bin/busybox cp /bin/busybox .t && >.t && /bin/busybox chmod 777 .t
Source: Initial sample String containing 'busybox' found: >>>/bin/busybox echo -en '%s' %s %s && /bin/busybox echo -en '\x45\x43\x48\x4f\x44\x4f\x4e\x45'
Source: classification engine Classification label: mal64.troj.lin@0/0@5187/0
Enumerates processes within the "proc" file system
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/491/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/793/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/772/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/796/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/774/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/797/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/777/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/799/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/658/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/912/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/759/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/936/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/918/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/1/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/761/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/785/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/884/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/720/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/721/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/788/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/789/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/800/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/801/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/847/fd Jump to behavior
Source: /tmp/853p3OEqFU (PID: 6239) File opened: /proc/904/fd Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/853p3OEqFU (PID: 6228) Queries kernel information via 'uname': Jump to behavior
Source: 853p3OEqFU, 6228.1.00007fff1f8d7000.00007fff1f8f8000.rw-.sdmp, 853p3OEqFU, 6245.1.00007fff1f8d7000.00007fff1f8f8000.rw-.sdmp, 853p3OEqFU, 6240.1.00007fff1f8d7000.00007fff1f8f8000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/853p3OEqFUSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/853p3OEqFU
Source: 853p3OEqFU, 6228.1.00005557128bb000.0000555712940000.rw-.sdmp, 853p3OEqFU, 6245.1.00005557128bb000.0000555712940000.rw-.sdmp, 853p3OEqFU, 6240.1.00005557128bb000.0000555712940000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sparc
Source: 853p3OEqFU, 6228.1.00005557128bb000.0000555712940000.rw-.sdmp, 853p3OEqFU, 6245.1.00005557128bb000.0000555712940000.rw-.sdmp, 853p3OEqFU, 6240.1.00005557128bb000.0000555712940000.rw-.sdmp Binary or memory string: WU!/etc/qemu-binfmt/sparc
Source: 853p3OEqFU, 6228.1.00007fff1f8d7000.00007fff1f8f8000.rw-.sdmp, 853p3OEqFU, 6245.1.00007fff1f8d7000.00007fff1f8f8000.rw-.sdmp, 853p3OEqFU, 6240.1.00007fff1f8d7000.00007fff1f8f8000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 853p3OEqFU, type: SAMPLE
Source: Yara match File source: 6240.1.00007fe5f8011000.00007fe5f8028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6245.1.00007fe5f8011000.00007fe5f8028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6228.1.00007fe5f8011000.00007fe5f8028000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 853p3OEqFU, type: SAMPLE
Source: Yara match File source: 6240.1.00007fe5f8011000.00007fe5f8028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6245.1.00007fe5f8011000.00007fe5f8028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6228.1.00007fe5f8011000.00007fe5f8028000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
188.50.74.137
 unknown Saudi Arabia
25019 SAUDINETSTC-ASSA false
156.219.88.130
 unknown Egypt
8452 TE-ASTE-ASEG false
117.147.55.253
 unknown China
56041 CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC false
74.255.184.101
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
34.226.115.202
 unknown United States
14618 AMAZON-AESUS false
118.106.26.212
 unknown Japan 18126 CTCXChubuTelecommunicationsCompanyIncJP false
85.155.150.154
 unknown Spain
12357 COMUNITELSPAINES false
217.137.128.144
 unknown United Kingdom
5089 NTLGB false
114.203.130.193
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
157.56.241.202
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
71.147.149.67
 unknown United States
7018 ATT-INTERNET4US false
69.74.137.85
 unknown United States
6128 CABLE-NET-1US false
143.20.231.128
 unknown United States
264008 LANCAMANTOANISERVICOSDEINFORMATICALTDA-MEBR false
241.226.149.8
 unknown Reserved
unknown unknown false
43.167.17.29
 unknown Japan 4249 LILLY-ASUS false
186.15.71.61
 unknown Costa Rica
52228 CableTicaCR false
78.3.131.222
 unknown Croatia (LOCAL Name: Hrvatska)
5391 T-HTCroatianTelecomIncHR false
88.63.200.159
 unknown Italy
3269 ASN-IBSNAZIT false
65.148.246.154
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
27.0.175.49
 unknown India
132971 SIKKASTAR-AS-INSikkaStarpoweredbySikkaBroadbandIN false
70.183.76.209
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
86.90.227.206
 unknown Netherlands
1136 KPNKPNNationalEU false
19.204.60.147
 unknown United States
3 MIT-GATEWAYSUS false
203.128.215.197
 unknown Korea Republic of
17608 ABN-AS-KRABNKR false
216.142.26.151
 unknown United States
3356 LEVEL3US false
221.162.104.6
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
204.58.16.106
 unknown United States
3390 UMKCNETUS false
202.72.153.75
 unknown Australia
9543 WESTNET-AS-APWestnetInternetServicesAU false
35.215.6.233
 unknown United States
19527 GOOGLE-2US false
44.146.216.90
 unknown United States
62383 LDS-ASBE false
105.184.107.44
 unknown South Africa
37457 Telkom-InternetZA false
170.13.81.81
 unknown United States
27283 RJF-INTERNETUS false
40.57.254.7
 unknown United States
4249 LILLY-ASUS false
212.246.13.210
 unknown Finland
719 ELISA-ASHelsinkiFinlandEU false
35.117.4.195
 unknown United States
237 MERIT-AS-14US false
165.171.163.179
 unknown United States
5647 ASN-KODAKUS false
35.104.171.35
 unknown United States
237 MERIT-AS-14US false
171.250.56.5
 unknown Viet Nam
7552 VIETEL-AS-APViettelGroupVN false
173.220.208.239
 unknown United States
6128 CABLE-NET-1US false
116.40.101.181
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
156.158.98.33
 unknown Tanzania United Republic of
37133 airtel-tz-asTZ false
45.20.50.214
 unknown United States
7018 ATT-INTERNET4US false
20.49.16.194
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
199.9.189.255
 unknown United States
668 DNIC-AS-00668US false
217.198.207.15
 unknown Spain
197077 AXARTEL-ASES false
216.102.77.88
 unknown United States
23369 SCOEUS false
59.141.4.4
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
243.153.37.209
 unknown Reserved
unknown unknown false
176.160.155.136
 unknown France
5410 BOUYGTEL-ISPFR false
135.246.213.18
 unknown United States
10455 LUCENT-CIOUS false
199.69.193.148
 unknown United States
7018 ATT-INTERNET4US false
246.14.123.100
 unknown Reserved
unknown unknown false
146.212.58.135
 unknown Slovenia
21283 A1SI-ASA1SlovenijaSI false
45.75.160.212
 unknown United Kingdom
49425 DIGITAL-REALTY-UKGB false
217.79.46.68
 unknown Bulgaria
56661 SOFICA-ASBG false
112.113.5.150
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
32.35.111.208
 unknown United States
8030 WORLDNET5-10US false
145.130.22.133
 unknown Netherlands
1136 KPNKPNNationalEU false
217.22.110.112
 unknown Spain
15711 IBERDROLABilbaoES false
198.77.207.190
 unknown United States
17116 BHPHOTOUS false
122.132.115.232
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
60.101.175.106
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
198.30.218.166
 unknown United States
600 OARNET-ASUS false
34.17.28.128
 unknown United States
2686 ATGS-MMD-ASUS false
175.233.21.227
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
151.222.72.119
 unknown unknown
11003 PANDGUS false
207.243.41.150
 unknown United States
7018 ATT-INTERNET4US false
243.251.196.141
 unknown Reserved
unknown unknown false
203.207.147.27
 unknown China
17964 DXTNETBeijingDian-Xin-TongNetworkTechnologiesCoLtd false
13.77.43.153
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
216.242.185.100
 unknown United States
13645 BROADBANDONEUS false
220.199.85.110
 unknown China
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
82.159.172.142
 unknown Spain
12357 COMUNITELSPAINES false
105.59.209.1
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
77.80.215.140
 unknown Sweden
760 UNIVIEUniversityofViennaAustriaAT false
19.253.153.8
 unknown United States
3 MIT-GATEWAYSUS false
184.155.224.85
 unknown United States
11492 CABLEONEUS false
64.254.99.38
 unknown United States
18489 VTLAUS false
39.95.1.249
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
86.99.207.178
 unknown United Arab Emirates
5384 EMIRATES-INTERNETEmiratesInternetAE false
174.248.32.120
 unknown United States
22394 CELLCOUS false
136.78.67.233
 unknown United States
60311 ONEFMCH false
246.87.181.87
 unknown Reserved
unknown unknown false
114.169.166.154
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
211.123.122.251
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
17.59.243.119
 unknown United States
714 APPLE-ENGINEERINGUS false
240.49.182.231
 unknown Reserved
unknown unknown false
136.67.246.234
 unknown United States
60311 ONEFMCH false
217.157.240.12
 unknown Denmark
9158 TELENOR_DANMARK_ASDK false
113.78.107.195
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
206.121.158.34
 unknown United States
7018 ATT-INTERNET4US false
164.71.189.136
 unknown Japan 2510 INFOWEBFUJITSULIMITEDJP false
109.233.253.128
 unknown Germany
50768 ICA-NET-ASDE false
32.23.213.122
 unknown United States
2686 ATGS-MMD-ASUS false
125.151.146.143
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
182.25.91.208
 unknown Indonesia
4795 INDOSATM2-IDINDOSATM2ASNID false
105.210.252.167
 unknown South Africa
16637 MTNNS-ASZA false
43.143.26.24
 unknown Japan 4249 LILLY-ASUS false
206.218.128.161
 unknown United States
7029 WINDSTREAMUS false
24.181.167.103
 unknown United States
20115 CHARTER-20115US false

Contacted Domains

Name IP Active
arcticboatz.cz 46.23.109.40 true