Linux Analysis Report
f03XBkpBK6.elf

Overview

General Information

Sample Name: f03XBkpBK6.elf
Analysis ID: 755689
MD5: 55d542dcd32aee3788c86ab2ae634ca6
SHA1: 2d8927726e1c34cd6355c8095aef1dd27c5e86ae
SHA256: 815804338b816bf198769f53a3962dd33a04b16dffef46a87ac89e9775adae6b
Tags: 32elfmipsmirai
Infos:

Detection

Mirai
Score: 80
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample contains only a LOAD segment without any section mappings
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: f03XBkpBK6.elf ReversingLabs: Detection: 52%
Source: f03XBkpBK6.elf Virustotal: Detection: 41% Perma Link

Networking
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51072
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51074
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51076
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51080
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51082
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51090
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51092
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51096
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51102
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51106
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39808
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39818
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39822
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39824
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39826
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39828
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39834
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39836
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39838
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39844
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40012
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40014
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40016
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40018
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40020
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40022
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40024
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40034
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40038
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40040
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:35708 -> 51.81.138.210:1312
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 51.81.138.210
Source: unknown TCP traffic detected without corresponding DNS query: 187.4.90.207
Source: unknown TCP traffic detected without corresponding DNS query: 152.205.18.207
Source: unknown TCP traffic detected without corresponding DNS query: 159.88.249.87
Source: unknown TCP traffic detected without corresponding DNS query: 106.246.13.74
Source: unknown TCP traffic detected without corresponding DNS query: 211.53.224.181
Source: unknown TCP traffic detected without corresponding DNS query: 203.175.26.121
Source: unknown TCP traffic detected without corresponding DNS query: 122.86.122.44
Source: unknown TCP traffic detected without corresponding DNS query: 70.32.69.1
Source: unknown TCP traffic detected without corresponding DNS query: 223.192.30.122
Source: unknown TCP traffic detected without corresponding DNS query: 97.120.249.55
Source: unknown TCP traffic detected without corresponding DNS query: 73.175.72.101
Source: unknown TCP traffic detected without corresponding DNS query: 174.11.108.60
Source: unknown TCP traffic detected without corresponding DNS query: 208.17.24.140
Source: unknown TCP traffic detected without corresponding DNS query: 192.201.102.224
Source: unknown TCP traffic detected without corresponding DNS query: 162.94.40.160
Source: unknown TCP traffic detected without corresponding DNS query: 161.203.222.193
Source: unknown TCP traffic detected without corresponding DNS query: 216.213.38.55
Source: unknown TCP traffic detected without corresponding DNS query: 44.192.72.116
Source: unknown TCP traffic detected without corresponding DNS query: 119.105.21.129
Source: unknown TCP traffic detected without corresponding DNS query: 148.6.93.108
Source: unknown TCP traffic detected without corresponding DNS query: 251.98.141.90
Source: unknown TCP traffic detected without corresponding DNS query: 2.221.189.68
Source: unknown TCP traffic detected without corresponding DNS query: 176.56.11.138
Source: unknown TCP traffic detected without corresponding DNS query: 63.189.62.154
Source: unknown TCP traffic detected without corresponding DNS query: 98.85.211.155
Source: unknown TCP traffic detected without corresponding DNS query: 1.242.97.191
Source: unknown TCP traffic detected without corresponding DNS query: 71.148.30.157
Source: unknown TCP traffic detected without corresponding DNS query: 69.47.8.124
Source: unknown TCP traffic detected without corresponding DNS query: 197.150.216.82
Source: unknown TCP traffic detected without corresponding DNS query: 111.58.90.37
Source: unknown TCP traffic detected without corresponding DNS query: 31.206.179.135
Source: unknown TCP traffic detected without corresponding DNS query: 12.223.120.48
Source: unknown TCP traffic detected without corresponding DNS query: 5.65.68.90
Source: unknown TCP traffic detected without corresponding DNS query: 53.4.78.219
Source: unknown TCP traffic detected without corresponding DNS query: 152.121.84.156
Source: unknown TCP traffic detected without corresponding DNS query: 211.231.188.135
Source: unknown TCP traffic detected without corresponding DNS query: 153.175.99.220
Source: unknown TCP traffic detected without corresponding DNS query: 249.174.63.51
Source: unknown TCP traffic detected without corresponding DNS query: 19.79.6.61
Source: unknown TCP traffic detected without corresponding DNS query: 254.186.207.97
Source: unknown TCP traffic detected without corresponding DNS query: 96.23.24.83
Source: unknown TCP traffic detected without corresponding DNS query: 60.85.212.54
Source: unknown TCP traffic detected without corresponding DNS query: 86.253.65.233
Source: unknown TCP traffic detected without corresponding DNS query: 144.42.38.156
Source: unknown TCP traffic detected without corresponding DNS query: 211.29.40.219
Source: unknown TCP traffic detected without corresponding DNS query: 53.103.62.2
Source: unknown TCP traffic detected without corresponding DNS query: 9.35.68.16
Source: unknown TCP traffic detected without corresponding DNS query: 112.86.91.46
Source: unknown TCP traffic detected without corresponding DNS query: 191.18.48.23
Source: f03XBkpBK6.elf String found in binary or memory: http://upx.sf.net

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 6226.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6235.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6229.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x100000
Yara signature match
Source: 6226.1.00007fc8b8455000.00007fc8b8457000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6229.1.00007fc8b8455000.00007fc8b8457000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6226.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6226.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6235.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6235.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6235.1.00007fc8b8455000.00007fc8b8457000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6229.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6229.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: classification engine Classification label: mal80.troj.evad.linELF@0/0@0/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
Enumerates processes within the "proc" file system
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1582/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/2033/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/2275/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/3088/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/6191/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/6190/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1612/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1579/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1699/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1335/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1698/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/2028/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1334/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1576/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/2302/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/3236/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/2025/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/2146/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/910/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/912/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/517/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/759/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/6228/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/2307/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/918/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/6240/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1594/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/2285/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/2281/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1349/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1623/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/761/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1622/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/884/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1983/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/2038/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1344/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1465/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1586/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1860/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1463/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/2156/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/800/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/801/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/6237/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1629/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1627/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1900/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/4470/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/3021/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/491/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/2294/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/2050/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1877/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/772/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1633/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1599/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1632/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/774/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1477/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/654/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/896/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1476/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1872/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/2048/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/655/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1475/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/2289/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/656/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/777/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/657/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/658/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/4467/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/4468/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/4469/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/4502/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/419/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/936/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1639/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1638/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/2208/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/2180/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1809/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1494/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1890/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/2063/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/2062/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1888/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1886/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/420/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1489/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/785/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1642/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/788/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/667/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/789/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/1648/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/4491/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/6155/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/4498/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/2078/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/2077/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/2074/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/2195/exe Jump to behavior
Source: /tmp/f03XBkpBK6.elf (PID: 6234) File opened: /proc/670/exe Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51072
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51074
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51076
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51080
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51082
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51090
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51092
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51096
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51102
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51106
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39808
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39818
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39822
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39824
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39826
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39828
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39834
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39836
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39838
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39844
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40012
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40014
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40016
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40018
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40020
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40022
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40024
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40034
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40038
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40040
ELF contains segments with high entropy indicating compressed/encrypted content
Source: f03XBkpBK6.elf Submission file: segment LOAD with 7.9039 entropy (max. 8.0)
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/f03XBkpBK6.elf (PID: 6226) Queries kernel information via 'uname': Jump to behavior
Source: f03XBkpBK6.elf, 6226.1.000055975821d000.00005597582c4000.rw-.sdmp, f03XBkpBK6.elf, 6229.1.000055975821d000.00005597582a4000.rw-.sdmp, f03XBkpBK6.elf, 6235.1.000055975821d000.00005597582a4000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mipsel
Source: f03XBkpBK6.elf, 6226.1.00007ffdd4bd1000.00007ffdd4bf2000.rw-.sdmp, f03XBkpBK6.elf, 6229.1.00007ffdd4bd1000.00007ffdd4bf2000.rw-.sdmp, f03XBkpBK6.elf, 6235.1.00007ffdd4bd1000.00007ffdd4bf2000.rw-.sdmp Binary or memory string: 5x86_64/usr/bin/qemu-mipsel/tmp/f03XBkpBK6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/f03XBkpBK6.elf
Source: f03XBkpBK6.elf, 6226.1.000055975821d000.00005597582c4000.rw-.sdmp, f03XBkpBK6.elf, 6229.1.000055975821d000.00005597582a4000.rw-.sdmp, f03XBkpBK6.elf, 6235.1.000055975821d000.00005597582a4000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: f03XBkpBK6.elf, 6226.1.00007ffdd4bd1000.00007ffdd4bf2000.rw-.sdmp, f03XBkpBK6.elf, 6229.1.00007ffdd4bd1000.00007ffdd4bf2000.rw-.sdmp, f03XBkpBK6.elf, 6235.1.00007ffdd4bd1000.00007ffdd4bf2000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsel

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: 6226.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6235.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6229.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: dump.pcap, type: PCAP

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: 6226.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6235.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6229.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: dump.pcap, type: PCAP

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
155.35.98.213
 unknown United States
24324 KORDIA-TRANSIT-AS-APKordiaLimitedNZ false
101.228.227.91
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
204.30.147.16
 unknown United States
3356 LEVEL3US false
40.83.2.247
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
35.231.235.136
 unknown United States
15169 GOOGLEUS false
158.151.234.190
 unknown United States
26442 DNB-US false
20.132.231.191
 unknown United States
206 CSC-IGN-AMERUS false
32.250.225.133
 unknown United States
2686 ATGS-MMD-ASUS false
212.246.61.101
 unknown Finland
719 ELISA-ASHelsinkiFinlandEU false
197.204.101.52
 unknown Algeria
36947 ALGTEL-ASDZ false
101.8.222.161
 unknown Taiwan; Republic of China (ROC)
701 UUNETUS false
70.202.90.164
 unknown United States
22394 CELLCOUS false
172.123.164.243
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
104.235.30.136
 unknown United States
22379 MANIFOLDUS false
242.150.57.1
 unknown Reserved
unknown unknown false
144.80.148.191
 unknown United States
62989 IUPUS false
97.45.39.141
 unknown United States
22394 CELLCOUS false
80.36.110.218
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
31.48.217.190
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
90.217.222.125
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
187.121.39.106
 unknown Brazil
19182 TELEFONICABRASILSABR false
66.236.63.185
 unknown United States
2828 XO-AS15US false
145.116.23.144
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
122.117.147.238
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
248.77.126.194
 unknown Reserved
unknown unknown false
253.254.230.97
 unknown Reserved
unknown unknown false
218.193.82.71
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
142.31.170.14
 unknown Canada
3633 PROVINCE-OF-BRITISH-COLUMBIACA false
107.127.53.141
 unknown United States
7018 ATT-INTERNET4US false
223.245.245.95
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
123.63.98.82
 unknown India
55410 VIL-AS-APVodafoneIdeaLtdIN false
80.50.183.227
 unknown Poland
5617 TPNETPL false
65.248.145.171
 unknown United States
701 UUNETUS false
133.195.181.231
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
73.83.162.186
 unknown United States
7922 COMCAST-7922US false
76.41.20.91
 unknown United States
18494 CENTURYLINK-LEGACY-EMBARQ-WRBGUS false
185.216.12.42
 unknown Russian Federation
41161 REALWEB-ASRU false
59.180.5.108
 unknown India
17813 MTNL-APMahanagarTelephoneNigamLimitedIN false
60.121.113.4
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
75.9.72.18
 unknown United States
7018 ATT-INTERNET4US false
133.98.75.26
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
172.131.55.193
 unknown United States
7018 ATT-INTERNET4US false
12.203.71.89
 unknown United States
22983 FISERV-INCUS false
249.33.223.198
 unknown Reserved
unknown unknown false
85.77.171.140
 unknown Finland
719 ELISA-ASHelsinkiFinlandEU false
156.63.125.11
 unknown United States
19902 NET-STATE-OHIOUS false
153.119.253.101
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
154.95.51.164
 unknown Seychelles
54600 PEGTECHINCUS false
253.238.149.215
 unknown Reserved
unknown unknown false
87.143.249.130
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
250.246.178.84
 unknown Reserved
unknown unknown false
82.204.20.201
 unknown Netherlands
15670 BBNED-AS1NL false
200.175.108.106
 unknown Brazil
18881 TELEFONICABRASILSABR false
105.88.235.219
 unknown Egypt
36992 ETISALAT-MISREG false
190.87.62.2
 unknown El Salvador
14754 TelguaGT false
240.156.18.94
 unknown Reserved
unknown unknown false
90.80.141.126
 unknown France
3215 FranceTelecom-OrangeFR false
253.173.143.152
 unknown Reserved
unknown unknown false
246.33.49.77
 unknown Reserved
unknown unknown false
102.63.100.89
 unknown Egypt
36992 ETISALAT-MISREG false
241.141.146.48
 unknown Reserved
unknown unknown false
133.25.175.80
 unknown Japan 55379 HOSEI-NETHoseiUniversityJP false
158.49.59.106
 unknown Spain
766 REDIRISRedIRISAutonomousSystemES false
158.128.204.184
 unknown Canada
721 DNIC-ASBLK-00721-00726US false
196.130.79.57
 unknown Egypt
36935 Vodafone-EG false
171.60.231.176
 unknown India
24560 AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServices false
100.149.110.121
 unknown United States
21928 T-MOBILE-AS21928US false
23.196.34.233
 unknown United States
20940 AKAMAI-ASN1EU false
125.120.126.142
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
58.65.191.26
 unknown Pakistan
23674 NAYATEL-PKNayatelPvtLtdPK false
12.150.234.90
 unknown United States
2386 INS-ASUS false
240.9.25.12
 unknown Reserved
unknown unknown false
88.211.88.51
 unknown United Kingdom
35575 VAIONIGB false
140.230.5.22
 unknown Canada
8111 DALUNIVCA false
160.18.19.56
 unknown Japan 9370 SAKURA-BSAKURAInternetIncJP false
126.1.101.35
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
160.168.12.233
 unknown Morocco
6713 IAM-ASMA false
147.144.77.90
 unknown United States
2152 CSUNET-NWUS false
85.231.153.146
 unknown Sweden
2119 TELENOR-NEXTELTelenorNorgeASNO false
87.120.3.93
 unknown Bulgaria
34577 SKATTV-ASBG false
42.176.235.4
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
2.209.235.24
 unknown Germany
6805 TDDE-ASN1DE false
156.134.58.77
 unknown United States
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
168.181.68.212
 unknown Brazil
265357 KDINTERNETBR false
179.68.220.84
 unknown Brazil
7738 TelemarNorteLesteSABR false
73.244.217.200
 unknown United States
7922 COMCAST-7922US false
145.170.88.101
 unknown Netherlands
59524 KPN-IAASNL false
114.140.203.30
 unknown Taiwan; Republic of China (ROC)
9674 FET-TWFarEastToneTelecommunicationCoLtdTW false
45.222.232.161
 unknown Ghana
37282 MAINONENG false
153.51.249.240
 unknown United States
14962 NCR-252US false
206.70.233.170
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
217.230.103.141
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
120.13.218.124
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
192.110.155.171
 unknown United States
393835 CCS-COLOUS false
169.255.104.242
 unknown Kenya
327906 EMBARQKE false
124.5.1.168
 unknown Korea Republic of
10036 CNM-AS-KRDLIVEKR false
117.180.195.198
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
147.177.133.237
 unknown United States
243 HARRIS-ATD-ASUS false
161.50.51.158
 unknown Australia
7575 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe false
58.192.78.190
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false