Indicators

Overview

A suspicious ELF binary (sh4) was found on a server. This lab covers the full indicator extraction workflow — file metadata, download source attribution via Zone Identifiers, hash-based threat intelligence enrichment across MalwareBazaar and VirusTotal, and manual string analysis to extract C2 infrastructure and attacker TTPs.

File Metadata — Exiftool

Running Exiftool against the sample surfaces basic file properties:

exiftool sh4

• Filename: sh4
• File Size: 98 KB
• File Type: ELF executable
• CPU Architecture: 32-bit
• CPU Type: SuperH

The SuperH architecture is a strong indicator this binary targets embedded/IoT devices — consistent with Mirai botnet variants which notoriously target routers, cameras, and DVRs.

Zone Identifier — Download Source

Windows NTFS Zone Identifiers record where files originated. Querying the alternate data stream:

Get-Content .\sh4 -Stream Zone.Identifier

Output:

[ZoneTransfer]
ZoneId=3
HostUrl=http://2.56.57.49/sh4

ZoneId=3 confirms the file was downloaded from the internet. The HostUrl gives us the exact C2 server and path the binary was pulled from:

hxxp://2[.]56[.]57[.]49/sh4

Hash Enrichment

Retrieving the SHA256 hash for threat intelligence lookups:

powershell

Get-FileHash .\sh4

SHA256: 11B73397473AA2786D4F1E0A556F557CFE2729B194A3E64D38E245428198BE56

MalwareBazaar

Searching the full hash on MalwareBazaar confirms the sample is known malware with 6 YARA rules triggered — covering signatures for Mirai variants and ELF malware families. malwarebazaar

VirusTotal

The VirusTotal detections page shows multiple vendors flagging this sample as Mirai — the notorious IoT botnet that caused major DDoS events including the 2016 Dyn attack. The binary targets SuperH architecture devices for recruitment into the botnet. Virustotal

Binary String Analysis — Notepad

Opening the binary in Notepad reveals embedded plaintext strings including hardcoded User-Agent values used by the malware’s HTTP scanner:

User-Agent: Google Chrome/60.0.3112.90 Windows
User-Agent: Hello, world
User-Agent: python-requests/2.20.0
User-Agent: r00ts3c-owned-you-python-requests/2.20.0
User-Agent: Tsunami/2.0
User-Agent: Messiah/2.0
User-Agent: r00ts3c-owned-you

7 unique User-Agent values — used to rotate headers during scanning and exploitation to evade basic detection rules.

C2 Infrastructure

IP-Based C2

The IP 2[.]56[.]57[.]49 is referenced multiple times hosting different payload files. VirusTotal details for this IP showed it running Apache as the web server framework — a common choice for simple payload hosting infrastructure. Note: the server is no longer active (1400+ day old lab) so live lookups return no results.

Domain-Based C2

A secondary GET request in the binary targets a domain rather than a raw IP:

a[.]tigoinari[.]tk/arm7

Using a domain provides the attacker flexibility to rotate infrastructure while keeping the malware functional — DNS can be updated without recompiling the binary.

Post-Download Execution

After downloading files to the victim device, the binary executes:

chmod 777 /tmp/<filename>

Files are staged in /tmp/ — a world-writable directory present on virtually all Linux/Unix systems, making it a reliable staging location regardless of the device’s configuration. The chmod 777 makes the downloaded payload executable before running it.

IOCs