Linux Analysis Report
lpm941yTS7

Overview

General Information

Sample Name: lpm941yTS7
Analysis ID: 680637
MD5: 3c35a776bd33e73772576d33cf8db7a9
SHA1: 2e8bfc20102b201eaf14227ac5abffea4ba73c7c
SHA256: e68f58e09f39ec1c8b2f2bf4b90f626b0b0d4906194f37a37a677f3a3c4f3434
Tags: 32elfmipsmirai
Infos:

Detection

Mirai
Score: 80
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample contains only a LOAD segment without any section mappings
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
ELF contains segments with high entropy indicating compressed/encrypted content

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: lpm941yTS7 Virustotal: Detection: 30% Perma Link

Networking
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57720
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57736
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57746
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57758
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57774
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:35686 -> 208.67.106.33:1312
Sample listens on a socket
Source: /tmp/lpm941yTS7 (PID: 6228) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) Socket: 0.0.0.0::53413 Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) Socket: 0.0.0.0::80 Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) Socket: 0.0.0.0::52869 Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) Socket: 0.0.0.0::37215 Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) Socket: 0.0.0.0::23 Jump to behavior
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.106.33
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.106.33
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.106.33
Source: unknown TCP traffic detected without corresponding DNS query: 190.132.191.225
Source: unknown TCP traffic detected without corresponding DNS query: 105.206.81.225
Source: unknown TCP traffic detected without corresponding DNS query: 59.131.106.236
Source: unknown TCP traffic detected without corresponding DNS query: 120.17.200.140
Source: unknown TCP traffic detected without corresponding DNS query: 107.43.55.13
Source: unknown TCP traffic detected without corresponding DNS query: 146.218.36.127
Source: unknown TCP traffic detected without corresponding DNS query: 182.32.164.121
Source: unknown TCP traffic detected without corresponding DNS query: 191.73.229.109
Source: unknown TCP traffic detected without corresponding DNS query: 171.82.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 186.126.13.19
Source: unknown TCP traffic detected without corresponding DNS query: 64.18.157.129
Source: unknown TCP traffic detected without corresponding DNS query: 193.178.53.130
Source: unknown TCP traffic detected without corresponding DNS query: 41.74.121.189
Source: unknown TCP traffic detected without corresponding DNS query: 92.76.124.129
Source: unknown TCP traffic detected without corresponding DNS query: 59.251.207.45
Source: unknown TCP traffic detected without corresponding DNS query: 177.112.72.195
Source: unknown TCP traffic detected without corresponding DNS query: 174.200.206.218
Source: unknown TCP traffic detected without corresponding DNS query: 172.67.128.144
Source: unknown TCP traffic detected without corresponding DNS query: 68.154.44.159
Source: unknown TCP traffic detected without corresponding DNS query: 112.164.104.255
Source: unknown TCP traffic detected without corresponding DNS query: 32.64.207.128
Source: unknown TCP traffic detected without corresponding DNS query: 125.185.40.96
Source: unknown TCP traffic detected without corresponding DNS query: 121.136.179.41
Source: unknown TCP traffic detected without corresponding DNS query: 183.223.48.119
Source: unknown TCP traffic detected without corresponding DNS query: 59.47.18.233
Source: unknown TCP traffic detected without corresponding DNS query: 68.30.7.249
Source: unknown TCP traffic detected without corresponding DNS query: 202.31.236.205
Source: unknown TCP traffic detected without corresponding DNS query: 72.15.69.180
Source: unknown TCP traffic detected without corresponding DNS query: 222.0.122.91
Source: unknown TCP traffic detected without corresponding DNS query: 103.2.74.0
Source: unknown TCP traffic detected without corresponding DNS query: 44.78.5.86
Source: unknown TCP traffic detected without corresponding DNS query: 145.195.146.193
Source: unknown TCP traffic detected without corresponding DNS query: 118.133.189.102
Source: unknown TCP traffic detected without corresponding DNS query: 37.134.15.67
Source: unknown TCP traffic detected without corresponding DNS query: 92.237.140.188
Source: unknown TCP traffic detected without corresponding DNS query: 109.192.112.130
Source: unknown TCP traffic detected without corresponding DNS query: 198.139.69.177
Source: unknown TCP traffic detected without corresponding DNS query: 209.237.221.172
Source: unknown TCP traffic detected without corresponding DNS query: 201.96.51.248
Source: unknown TCP traffic detected without corresponding DNS query: 1.103.126.187
Source: unknown TCP traffic detected without corresponding DNS query: 76.216.183.44
Source: unknown TCP traffic detected without corresponding DNS query: 250.62.192.150
Source: unknown TCP traffic detected without corresponding DNS query: 166.149.207.233
Source: unknown TCP traffic detected without corresponding DNS query: 17.111.27.56
Source: unknown TCP traffic detected without corresponding DNS query: 142.74.134.97
Source: unknown TCP traffic detected without corresponding DNS query: 135.36.125.104
Source: lpm941yTS7 String found in binary or memory: http://upx.sf.net

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 6329.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6329.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6228.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6228.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6328.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6328.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6226.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6226.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6337.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6337.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6229.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6229.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6235.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6235.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6345.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6345.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: lpm941yTS7 PID: 6226, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: lpm941yTS7 PID: 6226, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: lpm941yTS7 PID: 6228, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: lpm941yTS7 PID: 6228, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: lpm941yTS7 PID: 6229, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: lpm941yTS7 PID: 6229, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: lpm941yTS7 PID: 6328, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: lpm941yTS7 PID: 6328, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: lpm941yTS7 PID: 6329, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: lpm941yTS7 PID: 6329, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: lpm941yTS7 PID: 6337, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x100000
Yara signature match
Source: 6329.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6329.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6228.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6228.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6328.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6328.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6226.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6226.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6337.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6337.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6229.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6229.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6235.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6235.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6345.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6345.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: lpm941yTS7 PID: 6226, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: lpm941yTS7 PID: 6226, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: lpm941yTS7 PID: 6228, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: lpm941yTS7 PID: 6228, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: lpm941yTS7 PID: 6229, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: lpm941yTS7 PID: 6229, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: lpm941yTS7 PID: 6328, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: lpm941yTS7 PID: 6328, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: lpm941yTS7 PID: 6329, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: lpm941yTS7 PID: 6329, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: lpm941yTS7 PID: 6337, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Sample tries to kill a process (SIGKILL)
Source: /tmp/lpm941yTS7 (PID: 6228) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal80.troj.evad.lin@0/0@0/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
Enumerates processes within the "proc" file system
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/491/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/793/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/772/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/796/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/774/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/797/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/777/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/799/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/658/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/912/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/759/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/936/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/918/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/1/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/761/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/785/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/884/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/720/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/721/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/788/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/789/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/800/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/801/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/847/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6234) File opened: /proc/904/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/491/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/793/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/772/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/796/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/774/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/797/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/777/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/799/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/658/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/912/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/759/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/936/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/918/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/1/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/761/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/785/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/884/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/720/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/721/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/788/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/789/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/800/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/801/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/847/fd Jump to behavior
Source: /tmp/lpm941yTS7 (PID: 6228) File opened: /proc/904/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57720
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57736
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57746
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57758
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57774
ELF contains segments with high entropy indicating compressed/encrypted content
Source: lpm941yTS7 Submission file: segment LOAD with 7.8921 entropy (max. 8.0)
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/lpm941yTS7 (PID: 6226) Queries kernel information via 'uname': Jump to behavior
Source: lpm941yTS7, 6226.1.00007fffed760000.00007fffed781000.rw-.sdmp, lpm941yTS7, 6228.1.00007fffed760000.00007fffed781000.rw-.sdmp, lpm941yTS7, 6329.1.00007fffed760000.00007fffed781000.rw-.sdmp, lpm941yTS7, 6345.1.00007fffed760000.00007fffed781000.rw-.sdmp, lpm941yTS7, 6337.1.00007fffed760000.00007fffed781000.rw-.sdmp, lpm941yTS7, 6229.1.00007fffed760000.00007fffed781000.rw-.sdmp, lpm941yTS7, 6328.1.00007fffed760000.00007fffed781000.rw-.sdmp, lpm941yTS7, 6235.1.00007fffed760000.00007fffed781000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/lpm941yTS7SUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/lpm941yTS7
Source: lpm941yTS7, 6226.1.000055dea86e6000.000055dea876d000.rw-.sdmp, lpm941yTS7, 6228.1.000055dea86e6000.000055dea876d000.rw-.sdmp, lpm941yTS7, 6329.1.000055dea86e6000.000055dea876d000.rw-.sdmp, lpm941yTS7, 6345.1.000055dea86e6000.000055dea876d000.rw-.sdmp, lpm941yTS7, 6337.1.000055dea86e6000.000055dea876d000.rw-.sdmp, lpm941yTS7, 6229.1.000055dea86e6000.000055dea876d000.rw-.sdmp, lpm941yTS7, 6328.1.000055dea86e6000.000055dea876d000.rw-.sdmp, lpm941yTS7, 6235.1.000055dea86e6000.000055dea876d000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mips
Source: lpm941yTS7, 6226.1.000055dea86e6000.000055dea876d000.rw-.sdmp, lpm941yTS7, 6228.1.000055dea86e6000.000055dea876d000.rw-.sdmp, lpm941yTS7, 6329.1.000055dea86e6000.000055dea876d000.rw-.sdmp, lpm941yTS7, 6345.1.000055dea86e6000.000055dea876d000.rw-.sdmp, lpm941yTS7, 6337.1.000055dea86e6000.000055dea876d000.rw-.sdmp, lpm941yTS7, 6229.1.000055dea86e6000.000055dea876d000.rw-.sdmp, lpm941yTS7, 6328.1.000055dea86e6000.000055dea876d000.rw-.sdmp, lpm941yTS7, 6235.1.000055dea86e6000.000055dea876d000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: lpm941yTS7, 6226.1.00007fffed760000.00007fffed781000.rw-.sdmp, lpm941yTS7, 6228.1.00007fffed760000.00007fffed781000.rw-.sdmp, lpm941yTS7, 6329.1.00007fffed760000.00007fffed781000.rw-.sdmp, lpm941yTS7, 6345.1.00007fffed760000.00007fffed781000.rw-.sdmp, lpm941yTS7, 6337.1.00007fffed760000.00007fffed781000.rw-.sdmp, lpm941yTS7, 6229.1.00007fffed760000.00007fffed781000.rw-.sdmp, lpm941yTS7, 6328.1.00007fffed760000.00007fffed781000.rw-.sdmp, lpm941yTS7, 6235.1.00007fffed760000.00007fffed781000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: 6329.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6228.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6328.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6226.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6337.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6229.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6235.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6345.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: dump.pcap, type: PCAP

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: 6329.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6228.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6328.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6226.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6337.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6229.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6235.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6345.1.00007f56f8400000.00007f56f8414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: dump.pcap, type: PCAP

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
161.136.104.16
 unknown United States
17311 ECMC-BGPUS false
65.1.40.142
 unknown United States
16509 AMAZON-02US false
189.39.203.79
 unknown Brazil
262669 KONNETINFORMATICAEIRELI-EPPBR false
206.168.101.180
 unknown United States
21777 MASSIVE-NETWORKSUS false
200.54.58.160
 unknown Chile
16629 CTCCORPSATELEFONICAEMPRESASCL false
95.122.127.127
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
247.76.132.121
 unknown Reserved
unknown unknown false
245.13.115.95
 unknown Reserved
unknown unknown false
222.212.148.244
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
81.119.247.66
 unknown Italy
20746 ASN-IDCTNOOMINCIT false
159.1.39.156
 unknown United States
4193 WA-STATE-GOVUS false
244.152.15.37
 unknown Reserved
unknown unknown false
180.201.226.243
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
75.152.119.197
 unknown Canada
852 ASN852CA false
60.120.70.64
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
83.197.144.194
 unknown France
3215 FranceTelecom-OrangeFR false
218.2.241.218
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
190.229.106.190
 unknown Argentina
7303 TelecomArgentinaSAAR false
90.204.93.152
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
89.166.0.137
 unknown Finland
16086 DNAFI false
152.186.220.34
 unknown United States
701 UUNETUS false
24.218.235.19
 unknown United States
7922 COMCAST-7922US false
1.215.11.168
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
198.54.236.99
 unknown United States
19878 MEDIMPACTUS false
203.18.46.218
 unknown Australia
58980 M5NETWORKS-AS-APM5NetworksAustraliaPTYLTDAU false
44.161.29.189
 unknown United States
7377 UCSDUS false
152.107.33.135
 unknown South Africa
36994 Vodacom-VBZA false
189.101.229.36
 unknown Brazil
28573 CLAROSABR false
209.135.157.127
 unknown United States
6428 CDMUS false
60.41.1.157
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
181.40.129.219
 unknown Paraguay
23201 TelecelSAPY false
100.30.104.187
 unknown United States
14618 AMAZON-AESUS false
12.157.74.215
 unknown United States
54940 BFS-49-54940US false
92.123.156.134
 unknown European Union
16625 AKAMAI-ASUS false
125.76.82.37
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
154.28.148.131
 unknown United States
174 COGENT-174US false
195.170.35.113
 unknown Russian Federation
8395 EAST-ASRU false
135.248.251.92
 unknown United States
10455 LUCENT-CIOUS false
40.138.179.142
 unknown United States
7029 WINDSTREAMUS false
188.18.193.157
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
133.159.9.73
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
24.219.2.202
 unknown United States
8092 AMHUS false
204.28.35.22
 unknown United States
13325 STOMIUS false
109.142.52.113
 unknown Belgium
5432 PROXIMUS-ISP-ASBE false
16.247.101.210
 unknown United States
unknown unknown false
179.150.209.225
 unknown Brazil
26599 TELEFONICABRASILSABR false
62.19.114.206
 unknown Italy
16232 ASN-TIMServiceProviderIT false
165.112.152.191
 unknown United States
3527 NIH-NETUS false
57.219.161.214
 unknown Belgium
2686 ATGS-MMD-ASUS false
4.40.43.230
 unknown United States
3356 LEVEL3US false
174.35.223.130
 unknown Canada
22995 BARR-XPLR-ASNCA false
255.140.153.133
 unknown Reserved
unknown unknown false
20.23.44.40
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
100.61.17.144
 unknown United States
701 UUNETUS false
111.99.71.66
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
66.98.44.150
 unknown Dominican Republic
6400 CompaniaDominicanadeTelefonosSADO false
183.251.91.55
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
57.208.205.191
 unknown Belgium
2686 ATGS-MMD-ASUS false
67.86.198.169
 unknown United States
6128 CABLE-NET-1US false
170.73.237.218
 unknown United States
16761 FEDMOG-ASN-01US false
186.137.104.2
 unknown Argentina
10318 TelecomArgentinaSAAR false
195.6.117.95
 unknown France
3215 FranceTelecom-OrangeFR false
156.247.76.131
 unknown Seychelles
54600 PEGTECHINCUS false
247.52.25.65
 unknown Reserved
unknown unknown false
123.171.223.85
 unknown China
4809 CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr false
202.58.175.68
 unknown Indonesia
24526 BINUSBinaNusantaraUniversityID false
188.216.156.208
 unknown Italy
30722 VODAFONE-IT-ASNIT false
119.111.53.73
 unknown Philippines
9299 IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH false
27.77.16.88
 unknown Viet Nam
7552 VIETEL-AS-APViettelGroupVN false
17.88.236.23
 unknown United States
714 APPLE-ENGINEERINGUS false
63.132.44.153
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
112.198.173.248
 unknown Philippines
132199 GLOBE-MOBILE-5TH-GEN-ASGlobeTelecomIncPH false
122.31.101.190
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
40.119.109.110
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
102.216.78.32
 unknown unknown
36926 CKL1-ASNKE false
58.19.60.76
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
102.99.177.195
 unknown Morocco
36925 ASMediMA false
32.39.52.250
 unknown United States
2686 ATGS-MMD-ASUS false
114.154.139.151
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
89.141.144.182
 unknown Spain
12430 VODAFONE_ESES false
73.101.23.224
 unknown United States
7922 COMCAST-7922US false
54.140.144.79
 unknown United States
14618 AMAZON-AESUS false
243.163.200.109
 unknown Reserved
unknown unknown false
141.88.195.47
 unknown Germany
48778 IHK-NETDE false
119.126.143.148
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
14.184.247.123
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
76.176.102.102
 unknown United States
20001 TWC-20001-PACWESTUS false
36.40.5.35
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
57.129.81.255
 unknown Belgium
2686 ATGS-MMD-ASUS false
68.80.0.77
 unknown United States
7922 COMCAST-7922US false
242.224.73.37
 unknown Reserved
unknown unknown false
57.253.127.143
 unknown Belgium
2686 ATGS-MMD-ASUS false
120.186.107.130
 unknown Indonesia
4761 INDOSAT-INP-APINDOSATInternetNetworkProviderID false
219.44.234.205
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
99.187.244.142
 unknown United States
7018 ATT-INTERNET4US false
241.4.106.88
 unknown Reserved
unknown unknown false
40.39.119.169
 unknown United States
4249 LILLY-ASUS false
40.240.246.178
 unknown United States
4249 LILLY-ASUS false
98.226.129.162
 unknown United States
7922 COMCAST-7922US false
185.248.70.79
 unknown Netherlands
202374 PREWESTNL false