Malware Analysis Report

2025-03-15 06:20

Sample ID 240703-y8zjtsxgpf
Target SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf
SHA256 30740993a23d70da2be1f3a488a7964557d2087a95a1dff7c6c0bb73137865ad
Tags
upx mirai botnet
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

30740993a23d70da2be1f3a488a7964557d2087a95a1dff7c6c0bb73137865ad

Threat Level: Known bad

The file SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf was found to be: Known bad.

Malicious Activity Summary

upx mirai botnet

Mirai

UPX packed file

Enumerates running processes

Changes its process name

Reads runtime system information

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-07-03 20:28

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-03 20:28

Reported

2024-07-03 20:30

Platform

ubuntu2404-amd64-20240523-en

Max time kernel

36s

Max time network

39s

Command Line

[/tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf]

Signatures

Mirai

botnet mirai

Enumerates running processes

Changes its process name

Description Indicator Process Target
Changes the process name, possibly in an attempt to hide itself a /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A

Reads runtime system information

Description Indicator Process Target
File opened for reading /proc/2/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/48/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/63/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/1820/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/2039/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/3/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/383/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/587/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/2195/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/2452/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/2476/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/258/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/1651/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/2250/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/29/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/1648/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/1917/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/2186/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/33/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/39/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/191/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/1394/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/2224/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/15/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/24/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/27/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/11/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/37/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/2399/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/self/exe /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/1868/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/1951/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/2447/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/22/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/766/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/1066/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/1856/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/1932/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/2090/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/51/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/2094/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/25/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/1067/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/1765/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/1903/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/1923/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/9/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/7/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/140/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/780/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/1823/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/1927/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/788/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/795/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/2280/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/2378/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/1122/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/2445/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/189/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/194/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/384/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/2481/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/55/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A
File opened for reading /proc/514/cmdline /tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf N/A

Processes

/tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf

[/tmp/SecuriteInfo.com.Linux.Siggen.9999.8878.19249.elf]

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
NL 91.92.242.155:55301 tcp
NL 91.92.242.155:55301 tcp
NL 91.92.242.155:55301 tcp
NL 91.92.242.155:55301 tcp
NL 91.92.242.155:55301 tcp
NL 91.92.242.155:55301 tcp
NL 91.92.242.155:55301 tcp
NL 91.92.242.155:55301 tcp
US 8.8.8.8:53 _http._tcp.se.archive.ubuntu.com udp
US 8.8.8.8:53 _http._tcp.security.ubuntu.com udp
US 8.8.8.8:53 security.ubuntu.com udp
US 8.8.8.8:53 security.ubuntu.com udp
US 8.8.8.8:53 se.archive.ubuntu.com udp
US 8.8.8.8:53 se.archive.ubuntu.com udp
US 91.189.91.82:80 security.ubuntu.com tcp
SE 194.71.11.165:80 se.archive.ubuntu.com tcp
NL 91.92.242.155:55301 tcp

Files

memory/2448-1-0x0000000000400000-0x0000000000508a48-memory.dmp