Malware analysis hanoi.x86 Malicious activity | ANY.RUN

Add for printing

File name:	hanoi.x86
Full analysis:	https://app.any.run/tasks/13c3c475-1e1b-4be5-b0bb-fed4cdb0686f
Verdict:	Malicious activity
Threats:	A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining. Malware Trends Tracker >>>
Analysis date:	April 07, 2025, 11:35:10
OS:	Ubuntu 22.04.2
Tags:	mirai botnet
Indicators:
MIME:	application/x-executable
File info:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
MD5:	7D4A3F6A4A6FFF8E3C562144B9E9266A
SHA1:	E8F7007DE8D4D18E42BF3D3328653E2989A1B543
SHA256:	9B8DD1882387DDC6DC7BF7354C8225C0CE9D52582E9F302D47A44F5BBBF56A38
SSDEEP:	1536:bHZm0/PRURM04CWzJBC9dKmK+Y59x6C8e:L8hWDzJQ9ANx6C8e

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- MIRAI has been detected (SURICATA)
  - hanoi.x86.elf (PID: 39496)
SUSPICIOUS
- Reads passwd file
  - hanoi.x86.elf (PID: 39491)
  - pipewire (PID: 39532)
  - gdm-session-worker (PID: 39522)
  - pipewire-media-session (PID: 39544)
  - dbus-daemon (PID: 39583)
  - pipewire (PID: 39552)
  - dbus-daemon (PID: 39568)
  - gnome-shell (PID: 39646)
  - pipewire-media-session (PID: 39692)
  - dbus-daemon (PID: 39681)
  - gvfs-udisks2-volume-monitor (PID: 39696)
  - pipewire-media-session (PID: 39553)
  - pipewire (PID: 39543)
  - pipewire-media-session (PID: 39533)
  - whoopsie (PID: 39708)
  - whoopsie (PID: 39935)
  - gsd-print-notifications (PID: 39762)
  - ibus-daemon (PID: 39755)
  - gsd-power (PID: 39811)
  - gsd-media-keys (PID: 39792)
  - ibus-daemon (PID: 39906)
- Checks DMI information (probably VM detection)
  - pipewire (PID: 39532)
  - pipewire (PID: 39543)
  - pipewire (PID: 39552)
  - pulseaudio (PID: 39554)
  - gnome-shell (PID: 39646)
- Reads profile file
  - hanoi.x86.elf (PID: 39491)
- Executes commands using command-line interpreter
  - sudo (PID: 39490)
- Modifies file or directory owner
  - sudo (PID: 39487)
- Reads /proc/mounts (likely used to find writable filesystems)
  - dbus-daemon (PID: 39568)
  - dbus-daemon (PID: 39583)
  - dbus-daemon (PID: 39681)
  - gnome-shell (PID: 39646)
  - gjs-console (PID: 39895)
  - gjs-console (PID: 39742)
- Contacting a server suspected of hosting an CnC
  - hanoi.x86.elf (PID: 39496)
- Connects to unusual port
  - hanoi.x86.elf (PID: 39496)
INFO
- Checks timezone
  - gdm-session-worker (PID: 39522)
  - dbus-daemon (PID: 39568)
  - python3.10 (PID: 39627)
  - python3.10 (PID: 39638)
  - tracker-miner-fs-3 (PID: 39673)
  - gnome-session-binary (PID: 39587)
  - whoopsie (PID: 39935)
  - whoopsie (PID: 39708)
  - gnome-shell (PID: 39646)
  - spice-vdagent (PID: 39892)
  - gsd-print-notifications (PID: 39762)
  - gsd-color (PID: 39758)
  - python3.10 (PID: 39760)
- Creates file in the temporary folder
  - gnome-shell (PID: 39646)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.o	\|	ELF Executable and Linkable format (generic) (49.8)

EXIF

EXE

CPUArchitecture:	32 bit
CPUByteOrder:	Little endian
ObjectFileType:	Executable file
CPUType:	i386

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

384

Monitored processes

166

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
39486	/bin/sh -c "sudo chown user /tmp/hanoi\.x86\.elf && chmod +x /tmp/hanoi\.x86\.elf && DISPLAY=:0 sudo -iu user /tmp/hanoi\.x86\.elf "	/usr/bin/dash	—	any-guest-agent
User: root Integrity Level: UNKNOWN Exit code: 0
39487	sudo chown user /tmp/hanoi.x86.elf	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
39488	chown user /tmp/hanoi.x86.elf	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
39489	chmod +x /tmp/hanoi.x86.elf	/usr/bin/chmod	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
39490	sudo -iu user /tmp/hanoi.x86.elf	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
39491	/tmp/hanoi.x86.elf	/tmp/hanoi.x86.elf	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 0
39492	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	hanoi.x86.elf
User: user Integrity Level: UNKNOWN Exit code: 0
39493	/tmp/hanoi.x86.elf	/tmp/hanoi.x86.elf	—	hanoi.x86.elf
User: user Integrity Level: UNKNOWN Exit code: 9
39494	/tmp/hanoi.x86.elf	/tmp/hanoi.x86.elf	—	hanoi.x86.elf
User: user Integrity Level: UNKNOWN
39495	/tmp/hanoi.x86.elf	/tmp/hanoi.x86.elf	—	hanoi.x86.elf
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
39611	session-migration	/var/lib/gdm3/.local/share/session_migration-(null)		text
		MD5:8477C9CC18FA194A09BCC56753B9CC79	SHA256:7D89F414BFC841359A6828F8760E1E7C8EAB3E68B78DE2DC3928C7C8AAE9A789
39673	tracker-miner-fs-3	/var/lib/gdm3/.cache/tracker3/files/http%3A%2F%2Ftracker.api.gnome.org%2Fontology%2Fv3%2Ftracker%23FileSystem.db-journal (deleted)		binary
		MD5:802E233C9056A38D196E3312B47BCF63	SHA256:9941877831FEF4D12851675A9EDE02C8FC4241F7FBBDFE7B905BC36B63A07D3E
39673	tracker-miner-fs-3	/var/lib/gdm3/.cache/tracker3/files/http%3A%2F%2Ftracker.api.gnome.org%2Fontology%2Fv3%2Ftracker%23FileSystem.db		binary
		MD5:74B1579E029D2606DE60C89C0DA9D6E3	SHA256:A928D6F73A13ED50A77A86F625D57969CCA4C120D0F1C9C9D3EBE0C4499D86CC
39673	tracker-miner-fs-3	/var/tmp/etilqs_e09f4935c817fe09 (deleted)		binary
		MD5:48AE572B9F2FD92F1EBDF3E03BEB54CD	SHA256:95082CC13AA720BE64261AE2F6535A55F8FDB9A97BE0E25BB7427D128FE54392
39673	tracker-miner-fs-3	/var/lib/gdm3/.cache/tracker3/files/meta.db		binary
		MD5:7289DF15FE8C35E0412F2D832B963E12	SHA256:67D76A3769A64AC71CFBE286C7D5CA88A4A83B89B1143378B36EFEC3F0FF1FE3
39646	gnome-shell	/tmp/.X1024-lock		text
		MD5:2C41D241EE443E1756711D3CB947AB6B	SHA256:AA265FDEFBEDF5591B2A40A8C05E27A8DC6733567DC1C144C95FC80F09E10098
39673	tracker-miner-fs-3	/var/lib/gdm3/.cache/tracker3/files/meta.db-journal (deleted)		binary
		MD5:11BAB96510FCE74B8AF0E50548604C4C	SHA256:AEE85678F05B5E0733BF582EBD1213BF9B89F5D98CD49AB43BBF589A2866C766
39556	tracker-extract-3	/var/lib/gdm3/.cache/gstreamer-1.0/registry.x86_64.bin		binary
		MD5:14FB4F352E1B5BDD9BE37EF84398D784	SHA256:0E93FE3E71752A9A2F2B1D19D162674E7680381BF4B387DE8544DD3FDC4548C4
39554	pulseaudio	/var/lib/gdm3/.cache/gstreamer-1.0/registry.x86_64.bin (deleted)		binary
		MD5:14FB4F352E1B5BDD9BE37EF84398D784	SHA256:0E93FE3E71752A9A2F2B1D19D162674E7680381BF4B387DE8544DD3FDC4548C4
39646	gnome-shell	/var/lib/gdm3/.cache/mesa_shader_cache/85/54161410f72a8519329bc315318948236a8c77		binary
		MD5:66E01CC3130FE257E1726637F67BBFED	SHA256:2728E6DAB5F768BF8682A4FF2AF328C8C479E998DFEAF3C373DDBDB0482D11B3

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.49:80	http://connectivity-check.ubuntu.com/	GB	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	185.125.190.49:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	169.150.255.181:443	odrs.gnome.org	—	GB	whitelisted
—	—	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
—	—	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
39496	hanoi.x86.elf	51.38.137.114:3778	—	OVH SAS	FR	unknown

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	185.125.190.49 185.125.190.17 91.189.91.48 185.125.190.18 185.125.190.97 91.189.91.49 185.125.190.96 91.189.91.96 91.189.91.97 91.189.91.98 185.125.190.48 185.125.190.98 2001:67c:1562::24 2620:2d:4000:1::2a 2620:2d:4002:1::197 2620:2d:4000:1::97 2620:2d:4000:1::98 2620:2d:4000:1::22 2620:2d:4000:1::96 2001:67c:1562::23 2620:2d:4000:1::2b 2620:2d:4000:1::23 2620:2d:4002:1::198 2620:2d:4002:1::196	whitelisted
odrs.gnome.org	169.150.255.181 195.181.170.18 212.102.56.178 37.19.194.81 207.211.211.26 169.150.255.183 195.181.175.40 2a02:6ea0:c700::18 2a02:6ea0:c700::101 2a02:6ea0:c700::21 2a02:6ea0:c700::112 2a02:6ea0:c700::107 2a02:6ea0:c700::19 2a02:6ea0:c700::11	whitelisted
google.com	142.250.185.238 2a00:1450:4001:800::200e	whitelisted
api.snapcraft.io	185.125.188.55 185.125.188.59 185.125.188.58 185.125.188.54 2620:2d:4000:1010::42 2620:2d:4000:1010::117 2620:2d:4000:1010::6d 2620:2d:4000:1010::344	whitelisted
12.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
39496	hanoi.x86.elf	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Mirai.Gen (Linux)
39496	hanoi.x86.elf	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Mirai.Gen (Linux)

Add for printing

No debug info

General Info

hanoi.x86

7D4A3F6A4A6FFF8E3C562144B9E9266A

E8F7007DE8D4D18E42BF3D3328653E2989A1B543

9B8DD1882387DDC6DC7BF7354C8225C0CE9D52582E9F302D47A44F5BBBF56A38

1536:bHZm0/PRURM04CWzJBC9dKmK+Y59x6C8e:L8hWDzJQ9ANx6C8e

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

MIRAI has been detected (SURICATA)

SUSPICIOUS

Reads passwd file

Checks DMI information (probably VM detection)

Reads profile file

Executes commands using command-line interpreter

Modifies file or directory owner

Reads /proc/mounts (likely used to find writable filesystems)

Contacting a server suspected of hosting an CnC

Connects to unusual port

INFO

Checks timezone

Creates file in the temporary folder

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings