Linux Analysis Report
JhgW21BqHE.elf

Overview

General Information

Sample Name: JhgW21BqHE.elf
Analysis ID: 780228
MD5: d3a4afd2425eb644fb07e695d4415aa5
SHA1: 818b61c85a6d3ad186aa24532db4e4c5017fc092
SHA256: 134825331bcbf2c60f0d876a042145d12569b2da86bd68273eae6708e010d41e
Tags: 32elfmirairenesas
Infos:

Detection

Mirai
Score: 60
Range: 0 - 100
Whitelisted: false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample tries to kill multiple processes (SIGKILL)
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: JhgW21BqHE.elf ReversingLabs: Detection: 76%
Source: JhgW21BqHE.elf Virustotal: Detection: 63% Perma Link
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:40692 -> 89.208.103.112:1312
Sample listens on a socket
Source: /tmp/JhgW21BqHE.elf (PID: 6230) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) Socket: 0.0.0.0::53413 Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) Socket: 0.0.0.0::80 Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6235) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6235) Socket: 0.0.0.0::53413 Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6235) Socket: 0.0.0.0::80 Jump to behavior
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 89.208.103.112
Source: unknown TCP traffic detected without corresponding DNS query: 89.208.103.112
Source: unknown TCP traffic detected without corresponding DNS query: 89.208.103.112
Source: unknown TCP traffic detected without corresponding DNS query: 119.11.144.92
Source: unknown TCP traffic detected without corresponding DNS query: 85.60.36.92
Source: unknown TCP traffic detected without corresponding DNS query: 1.111.235.93
Source: unknown TCP traffic detected without corresponding DNS query: 101.198.67.157
Source: unknown TCP traffic detected without corresponding DNS query: 135.209.233.58
Source: unknown TCP traffic detected without corresponding DNS query: 68.181.93.37
Source: unknown TCP traffic detected without corresponding DNS query: 65.14.27.58
Source: unknown TCP traffic detected without corresponding DNS query: 206.249.215.221
Source: unknown TCP traffic detected without corresponding DNS query: 189.155.36.195
Source: unknown TCP traffic detected without corresponding DNS query: 93.119.252.245
Source: unknown TCP traffic detected without corresponding DNS query: 194.199.101.9
Source: unknown TCP traffic detected without corresponding DNS query: 24.39.21.140
Source: unknown TCP traffic detected without corresponding DNS query: 4.82.32.121
Source: unknown TCP traffic detected without corresponding DNS query: 181.195.166.176
Source: unknown TCP traffic detected without corresponding DNS query: 158.150.100.183
Source: unknown TCP traffic detected without corresponding DNS query: 106.171.154.100
Source: unknown TCP traffic detected without corresponding DNS query: 153.19.127.234
Source: unknown TCP traffic detected without corresponding DNS query: 247.111.185.90
Source: unknown TCP traffic detected without corresponding DNS query: 72.242.205.221
Source: unknown TCP traffic detected without corresponding DNS query: 136.85.154.70
Source: unknown TCP traffic detected without corresponding DNS query: 209.84.33.111
Source: unknown TCP traffic detected without corresponding DNS query: 218.119.114.57
Source: unknown TCP traffic detected without corresponding DNS query: 255.130.78.97
Source: unknown TCP traffic detected without corresponding DNS query: 66.115.213.98
Source: unknown TCP traffic detected without corresponding DNS query: 123.209.240.228
Source: unknown TCP traffic detected without corresponding DNS query: 120.234.16.251
Source: unknown TCP traffic detected without corresponding DNS query: 200.203.236.39
Source: unknown TCP traffic detected without corresponding DNS query: 175.140.134.25
Source: unknown TCP traffic detected without corresponding DNS query: 89.211.37.126
Source: unknown TCP traffic detected without corresponding DNS query: 253.119.218.228
Source: unknown TCP traffic detected without corresponding DNS query: 99.112.165.8
Source: unknown TCP traffic detected without corresponding DNS query: 218.123.223.85
Source: unknown TCP traffic detected without corresponding DNS query: 61.98.214.160
Source: unknown TCP traffic detected without corresponding DNS query: 95.145.31.116
Source: unknown TCP traffic detected without corresponding DNS query: 100.253.207.135
Source: unknown TCP traffic detected without corresponding DNS query: 32.206.242.149
Source: unknown TCP traffic detected without corresponding DNS query: 89.203.67.83
Source: unknown TCP traffic detected without corresponding DNS query: 37.222.104.112
Source: unknown TCP traffic detected without corresponding DNS query: 103.33.242.183
Source: unknown TCP traffic detected without corresponding DNS query: 241.42.68.13
Source: unknown TCP traffic detected without corresponding DNS query: 90.222.253.242
Source: unknown TCP traffic detected without corresponding DNS query: 36.240.213.69
Source: unknown TCP traffic detected without corresponding DNS query: 60.198.84.235
Source: unknown TCP traffic detected without corresponding DNS query: 135.113.231.111
Source: unknown TCP traffic detected without corresponding DNS query: 76.107.50.50
Source: unknown TCP traffic detected without corresponding DNS query: 247.47.97.113
Source: unknown TCP traffic detected without corresponding DNS query: 198.79.150.155

System Summary
barindex
Sample tries to kill multiple processes (SIGKILL)
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 720, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 759, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 788, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 800, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 847, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 1334, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 1335, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 1872, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 2096, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 2097, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 2102, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 2180, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 2208, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 2275, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 2281, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 2285, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 2289, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 2294, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 6232, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 6235, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 6239, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6235) SIGKILL sent: pid: 936, result: successful Jump to behavior
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 720, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 759, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 788, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 800, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 847, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 1334, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 1335, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 1872, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 2096, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 2097, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 2102, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 2180, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 2208, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 2275, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 2281, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 2285, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 2289, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 2294, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 6232, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 6235, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) SIGKILL sent: pid: 6239, result: successful Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6235) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal60.spre.troj.linELF@0/0@0/0
Enumerates processes within the "proc" file system
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/6232/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/6235/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1582/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/2033/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/2275/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/3088/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1612/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1579/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1699/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1335/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1698/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/2028/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1334/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1576/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/2302/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/3236/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/2025/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/2146/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/910/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/912/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/912/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/912/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/759/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/759/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/759/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/517/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/2307/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/918/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/918/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/918/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/6243/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1594/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/2285/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/2281/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1349/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1623/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/761/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/761/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/761/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1622/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/884/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/884/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/884/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1983/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/2038/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1344/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1465/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1586/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1463/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/2156/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/800/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/800/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/800/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/801/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/801/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/801/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1629/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/6239/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1627/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1900/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/3021/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/491/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/491/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/491/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/2294/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/2050/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1877/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/772/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/772/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/772/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1633/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1599/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1632/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/774/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/774/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/774/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1477/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/654/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/896/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1476/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1872/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/2048/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/655/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1475/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/2289/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/777/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/777/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/777/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/656/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/657/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/4466/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/658/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/658/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/658/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/4467/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/4500/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/4468/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/4469/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/936/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/936/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/936/fd Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/419/exe Jump to behavior
Source: /tmp/JhgW21BqHE.elf (PID: 6230) File opened: /proc/1639/exe Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/JhgW21BqHE.elf (PID: 6228) Queries kernel information via 'uname': Jump to behavior
Source: JhgW21BqHE.elf, 6230.1.000055a8f420a000.000055a8f422a000.rw-.sdmp, JhgW21BqHE.elf, 6333.1.000055a8f420a000.000055a8f422a000.rw-.sdmp Binary or memory string: U/sh4/ro10 /usr/bin/qemu-sh4!/proc/797/fd/391 r!
Source: JhgW21BqHE.elf, 6339.1.000055a8f420a000.000055a8f422a000.rw-.sdmp Binary or memory string: U/sh4/0 /proc/491/fd/41!/proc/777/fd/52/sh4/pro1/usr/bin/vmtoolsdh4/0!/proc/491/fd/42!/proc/777/fd/51/sh4/pro1
Source: JhgW21BqHE.elf, 6228.1.00007ffd59875000.00007ffd59896000.rw-.sdmp, JhgW21BqHE.elf, 6230.1.000055a8f420a000.000055a8f422a000.rw-.sdmp, JhgW21BqHE.elf, 6230.1.00007ffd59875000.00007ffd59896000.rw-.sdmp, JhgW21BqHE.elf, 6333.1.000055a8f420a000.000055a8f422a000.rw-.sdmp, JhgW21BqHE.elf, 6333.1.00007ffd59875000.00007ffd59896000.rw-.sdmp, JhgW21BqHE.elf, 6349.1.00007ffd59875000.00007ffd59896000.rw-.sdmp, JhgW21BqHE.elf, 6349.1.000055a8f420a000.000055a8f422a000.rw-.sdmp, JhgW21BqHE.elf, 6339.1.000055a8f420a000.000055a8f422a000.rw-.sdmp, JhgW21BqHE.elf, 6339.1.00007ffd59875000.00007ffd59896000.rw-.sdmp, JhgW21BqHE.elf, 6231.1.00007ffd59875000.00007ffd59896000.rw-.sdmp, JhgW21BqHE.elf, 6232.1.00007ffd59875000.00007ffd59896000.rw-.sdmp, JhgW21BqHE.elf, 6235.1.00007ffd59875000.00007ffd59896000.rw-.sdmp, JhgW21BqHE.elf, 6237.1.00007ffd59875000.00007ffd59896000.rw-.sdmp, JhgW21BqHE.elf, 6239.1.00007ffd59875000.00007ffd59896000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: JhgW21BqHE.elf, 6339.1.000055a8f420a000.000055a8f422a000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: JhgW21BqHE.elf, 6228.1.00007ffd59875000.00007ffd59896000.rw-.sdmp, JhgW21BqHE.elf, 6230.1.00007ffd59875000.00007ffd59896000.rw-.sdmp, JhgW21BqHE.elf, 6333.1.00007ffd59875000.00007ffd59896000.rw-.sdmp, JhgW21BqHE.elf, 6349.1.00007ffd59875000.00007ffd59896000.rw-.sdmp, JhgW21BqHE.elf, 6339.1.00007ffd59875000.00007ffd59896000.rw-.sdmp, JhgW21BqHE.elf, 6231.1.00007ffd59875000.00007ffd59896000.rw-.sdmp, JhgW21BqHE.elf, 6232.1.00007ffd59875000.00007ffd59896000.rw-.sdmp, JhgW21BqHE.elf, 6235.1.00007ffd59875000.00007ffd59896000.rw-.sdmp, JhgW21BqHE.elf, 6237.1.00007ffd59875000.00007ffd59896000.rw-.sdmp, JhgW21BqHE.elf, 6239.1.00007ffd59875000.00007ffd59896000.rw-.sdmp Binary or memory string: 2x86_64/usr/bin/qemu-sh4/tmp/JhgW21BqHE.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/JhgW21BqHE.elf
Source: JhgW21BqHE.elf, 6228.1.000055a8f41a7000.000055a8f420a000.rw-.sdmp, JhgW21BqHE.elf, 6230.1.000055a8f41a7000.000055a8f420a000.rw-.sdmp, JhgW21BqHE.elf, 6333.1.000055a8f41a7000.000055a8f420a000.rw-.sdmp, JhgW21BqHE.elf, 6349.1.000055a8f41a7000.000055a8f420a000.rw-.sdmp, JhgW21BqHE.elf, 6339.1.000055a8f41a7000.000055a8f420a000.rw-.sdmp, JhgW21BqHE.elf, 6231.1.000055a8f41a7000.000055a8f420a000.rw-.sdmp, JhgW21BqHE.elf, 6232.1.000055a8f41a7000.000055a8f420a000.rw-.sdmp, JhgW21BqHE.elf, 6235.1.000055a8f41a7000.000055a8f420a000.rw-.sdmp, JhgW21BqHE.elf, 6237.1.000055a8f41a7000.000055a8f420a000.rw-.sdmp, JhgW21BqHE.elf, 6239.1.000055a8f41a7000.000055a8f420a000.rw-.sdmp Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: JhgW21BqHE.elf, 6228.1.000055a8f41a7000.000055a8f420a000.rw-.sdmp, JhgW21BqHE.elf, 6230.1.000055a8f41a7000.000055a8f420a000.rw-.sdmp, JhgW21BqHE.elf, 6333.1.000055a8f41a7000.000055a8f420a000.rw-.sdmp, JhgW21BqHE.elf, 6349.1.000055a8f41a7000.000055a8f420a000.rw-.sdmp, JhgW21BqHE.elf, 6339.1.000055a8f41a7000.000055a8f420a000.rw-.sdmp, JhgW21BqHE.elf, 6231.1.000055a8f41a7000.000055a8f420a000.rw-.sdmp, JhgW21BqHE.elf, 6232.1.000055a8f41a7000.000055a8f420a000.rw-.sdmp, JhgW21BqHE.elf, 6235.1.000055a8f41a7000.000055a8f420a000.rw-.sdmp, JhgW21BqHE.elf, 6237.1.000055a8f41a7000.000055a8f420a000.rw-.sdmp, JhgW21BqHE.elf, 6239.1.000055a8f41a7000.000055a8f420a000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4
Source: JhgW21BqHE.elf, 6349.1.000055a8f420a000.000055a8f422a000.rw-.sdmp, JhgW21BqHE.elf, 6339.1.000055a8f420a000.000055a8f422a000.rw-.sdmp Binary or memory string: U/sh4/ro10 /usr/bin/qemu-sh4!/proc/797/fd/391

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
117.65.71.158
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
158.131.25.237
 unknown Finland
55 UPENNUS false
118.230.33.248
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
169.204.243.222
 unknown United States
10430 WA-K20US false
213.21.10.14
 unknown Russian Federation
39102 AS-ATHMbrandAtHomeRU false
218.2.239.92
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
120.241.244.130
 unknown China
56040 CMNET-GUANGDONG-APChinaMobilecommunicationscorporation false
168.108.141.231
 unknown United States
3597 FundacionInnovaTAR false
251.42.237.111
 unknown Reserved
unknown unknown false
14.172.150.21
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
65.43.112.213
 unknown United States
7018 ATT-INTERNET4US false
88.223.35.64
 unknown Lithuania
39354 INIT-MGNT-LT false
103.117.108.100
 unknown Bangladesh
137935 ILIS-AS-APILinkInternetServiceBD false
179.133.81.177
 unknown Brazil
26599 TELEFONICABRASILSABR false
246.182.65.48
 unknown Reserved
unknown unknown false
42.178.17.251
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
102.142.143.175
 unknown Gabon
36924 GVA-CanalboxBJ false
113.17.198.4
 unknown China
134419 CHINATELECOM-GUANGXI-BEIHAI-MANBeihaiCN false
82.175.129.155
 unknown Netherlands
13127 VERSATELASfortheTrans-EuropeanTele2IPTransportbackbo false
64.229.95.64
 unknown Canada
577 BACOMCA false
205.176.15.147
 unknown United States
8103 STATE-OF-FLAUS false
40.38.130.143
 unknown United States
4249 LILLY-ASUS false
107.33.165.120
 unknown United States
16567 NETRIX-16567US false
247.184.181.222
 unknown Reserved
unknown unknown false
34.91.114.108
 unknown United States
15169 GOOGLEUS false
72.180.77.119
 unknown United States
11427 TWC-11427-TEXASUS false
163.193.1.205
 unknown United States
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
84.216.36.105
 unknown Sweden
2119 TELENOR-NEXTELTelenorNorgeASNO false
83.247.75.248
 unknown Netherlands
12414 NL-SOLCONSOLCONNL false
163.213.230.45
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
241.223.124.182
 unknown Reserved
unknown unknown false
182.149.90.141
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
242.38.159.152
 unknown Reserved
unknown unknown false
168.44.123.13
 unknown United States
1761 TDIR-CAPNETUS false
153.132.251.0
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
148.13.57.17
 unknown United States
394673 9408US false
98.61.107.149
 unknown United States
7922 COMCAST-7922US false
65.170.163.22
 unknown United States
14861 ISC-GROUPUS false
220.185.96.120
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
57.102.94.118
 unknown Belgium
2647 SITABE false
183.242.57.111
 unknown China
56048 CMNET-BEIJING-APChinaMobileCommunicaitonsCorporationCN false
75.73.68.200
 unknown United States
7922 COMCAST-7922US false
104.221.41.157
 unknown Canada
5769 VIDEOTRONCA false
139.154.136.23
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
153.186.72.47
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
178.226.185.159
 unknown Netherlands
31615 TMO-NL-ASNL false
139.236.16.138
 unknown United States
1462 DNIC-ASBLK-01462-01463US false
133.73.232.160
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
122.146.5.168
 unknown Taiwan; Republic of China (ROC)
9919 NCIC-TWNewCenturyInfoCommTechCoLtdTW false
175.12.134.233
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
165.36.166.215
 unknown United States
37053 RSAWEB-ASZA false
123.154.17.246
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
156.130.0.84
 unknown United States
29975 VODACOM-ZA false
161.153.72.71
 unknown United States
9328 DATACOM-AUDATACOMSYSTEMSAUPTYLTDAU false
209.47.188.199
 unknown United States
701 UUNETUS false
75.134.22.122
 unknown United States
20115 CHARTER-20115US false
198.113.9.30
 unknown United States
3356 LEVEL3US false
96.181.213.226
 unknown United States
7922 COMCAST-7922US false
47.149.220.123
 unknown United States
5650 FRONTIER-FRTRUS false
189.212.136.208
 unknown Mexico
6503 AxtelSABdeCVMX false
107.151.165.63
 unknown United States
21859 ZNETUS false
38.218.17.63
 unknown United States
174 COGENT-174US false
243.173.63.91
 unknown Reserved
unknown unknown false
218.83.9.52
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
180.251.193.134
 unknown Indonesia
7713 TELKOMNET-AS-APPTTelekomunikasiIndonesiaID false
153.40.154.181
 unknown United States
14365 ADOBE-NETUS false
168.67.37.38
 unknown United States
265240 ULTRANETSERVICOSEMINTERNETLTDABR false
40.238.166.104
 unknown United States
4249 LILLY-ASUS false
171.102.140.39
 unknown Thailand
7470 TRUEINTERNET-AS-APTRUEINTERNETCoLtdTH false
179.31.207.4
 unknown Uruguay
6057 AdministracionNacionaldeTelecomunicacionesUY false
72.159.171.144
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
110.126.105.237
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
197.221.108.111
 unknown South Africa
37236 Reflex-SolutionsZA false
122.100.88.214
 unknown Taiwan; Republic of China (ROC)
4662 QTCN-ASN1GCNetReachRangeIncTW false
152.49.80.179
 unknown United States
81 NCRENUS false
165.103.166.4
 unknown United States
394053 NAICWEBUS false
152.145.142.184
 unknown United States
6400 CompaniaDominicanadeTelefonosSADO false
114.171.18.149
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
208.144.203.116
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
153.250.183.64
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
79.3.165.223
 unknown Italy
3269 ASN-IBSNAZIT false
148.15.168.173
 unknown United States
394673 9408US false
196.31.223.112
 unknown South Africa
16637 MTNNS-ASZA false
175.222.170.116
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
142.84.146.140
 unknown Canada
11489 BACICA false
86.179.107.49
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
36.56.30.210
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
80.14.1.179
 unknown France
3215 FranceTelecom-OrangeFR false
177.77.153.108
 unknown Brazil
26599 TELEFONICABRASILSABR false
9.31.145.232
 unknown United States
3356 LEVEL3US false
20.199.232.189
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
58.51.217.122
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
70.2.215.32
 unknown United States
10507 SPCSUS false
101.39.68.101
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
36.141.1.194
 unknown China
56044 CMNET-AS-LIAONINGChinaMobilecommunicationscorporationC false
246.197.45.224
 unknown Reserved
unknown unknown false
36.194.65.178
 unknown China
24138 CTTNETChinaTieTongTelecommunicationsCorporationCN false
119.21.239.138
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
198.179.14.115
 unknown United States
26810 HHSNET-NOC-ASNUS false
18.2.100.92
 unknown United States
10578 GIGAPOP-NEUS false