Find similar analyses in TI Lookup

Analysis date (UTC): 7 April 2025, 11:35Analysis environment: Ubuntu 22.04.2

hanoi.x86

MD5:7D4A3F6A4A6FFF8E3C562144B9E9266A

SHA1:E8F7007DE8D4D18E42BF3D3328653E2989A1B543

SHA256:9B8DD1882387DDC6DC7BF7354C8225C0CE9D52582E9F302D47A44F5BBBF56A38

Analysis result

Threat level:Malicious activity

Tags:

miraibotnet

Full analysis:Analysis hanoi.x86 (MD5: 7D4A3F6A4A6FFF8E3C562144B9E9266A) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

MIRAI has been detected (SURICATA)

hanoi.x86.elf (PID: 39496)

SUSPICIOUS

Reads passwd file

hanoi.x86.elf (PID: 39491)
pipewire (PID: 39532)
gdm-session-worker (PID: 39522)
pipewire-media-session (PID: 39544)
dbus-daemon (PID: 39583)
pipewire (PID: 39552)
dbus-daemon (PID: 39568)
gnome-shell (PID: 39646)
pipewire-media-session (PID: 39692)
dbus-daemon (PID: 39681)
gvfs-udisks2-volume-monitor (PID: 39696)
pipewire-media-session (PID: 39553)
pipewire (PID: 39543)
pipewire-media-session (PID: 39533)
whoopsie (PID: 39708)
whoopsie (PID: 39935)
gsd-print-notifications (PID: 39762)
ibus-daemon (PID: 39755)
gsd-power (PID: 39811)
gsd-media-keys (PID: 39792)
ibus-daemon (PID: 39906)

Checks DMI information (probably VM detection)

pipewire (PID: 39532)
pipewire (PID: 39543)
pipewire (PID: 39552)
pulseaudio (PID: 39554)
gnome-shell (PID: 39646)

Reads profile file

hanoi.x86.elf (PID: 39491)

Executes commands using command-line interpreter

sudo (PID: 39490)

Modifies file or directory owner

sudo (PID: 39487)

Reads /proc/mounts (likely used to find writable filesystems)

dbus-daemon (PID: 39568)
dbus-daemon (PID: 39583)
dbus-daemon (PID: 39681)
gnome-shell (PID: 39646)
gjs-console (PID: 39895)
gjs-console (PID: 39742)

Contacting a server suspected of hosting an CnC

hanoi.x86.elf (PID: 39496)

Connects to unusual port

hanoi.x86.elf (PID: 39496)

INFO

Checks timezone

gdm-session-worker (PID: 39522)
dbus-daemon (PID: 39568)
python3.10 (PID: 39627)
python3.10 (PID: 39638)
tracker-miner-fs-3 (PID: 39673)
gnome-session-binary (PID: 39587)
whoopsie (PID: 39935)
whoopsie (PID: 39708)
gnome-shell (PID: 39646)
spice-vdagent (PID: 39892)
gsd-print-notifications (PID: 39762)
gsd-color (PID: 39758)
python3.10 (PID: 39760)

Creates file in the temporary folder

gnome-shell (PID: 39646)

Threats

PID	Process	Class	Message
39496	hanoi.x86.elf	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Mirai.Gen (Linux)
39496	hanoi.x86.elf	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Mirai.Gen (Linux)