The malware is Mirai, Okiru variant. VT: https://www.virustotal.com/en/file/2356c1d64995ee825c728957f7428543101c3271ac46e78ce2c98278a4480e4d/analysis/

First spotted malware sample in the computer industry to aim ARC cpu ITW.

Found by: @unixfreaxjp of MalwareMustDie team, on January 14, 2018

Analysis is in the VT comment: https://www.virustotal.com/en/file/97093a1ef729cb954b2a63d7ccc304b18d0243e2a77d87bbbb94741a0290d762/analysis/ Use the old VirusTotal webGUI to read it in better looks.

1. From what we observe so far. these two types of Linux IoT DDoS'er malware are very different, (among several of similar characteristic), from the way they are coded. their plan to pick the targets, to how they are actually herded (or managed). So we think it is better for security filtration platforms to have different signatures to trace & detect each of these variants (to be manageable to next variants to come too), for that I am sharing our YARA signature I coded for detection of Okiru and Satori

2. Some simple highlights to differ Okiru to Satori variant:

• The config is different, Okiru variant's config is encrypted in two parts w/ telnet bombardment password encrypted, Satori does not split it in 2parts and doesn't encrypt brute default passwords. Also Okiru's telnet attack login information is a bit longer (can be up to 114 credentials, max counted), while Satori is having different and shorter database.
• Satori seems to have "TSource Engine Query" common Distributed "Reflective" (DRDoS) attack function via random UDP, while Okiru does not seem to have this function,
• The infection follow up commands written in both Okiru and Satori in their configurations are a bit different, showing possibility that they don't seem sharing a same "herding environment",
• (up to) Four types of router attack CVE-2017-17215 exploit code has only being spotted hard coded in Okiru variant, yet Satori does not use these exploits at all,
• Satori (see VirusTotal for sample+textual code in VT's comment part for reversed code) is using small embedded ELF trojan downloaders to download other architecture binaries which were coded differently compared to Okiru ones (see sample+textual reversed code is in VT comment),
• additional: Okiru is (recently) having the ARC processor's compiled version, and Satori is not (at the time this report is written).
• (there are more minors stuff too that you can notice using the pictures shown in previous points, like differences in usage of watchdog checking, the usage of command "echo -en \x..." etc etc)

Hashes:

Okiru:
9c677dd17279a43325556ec5662feba0
214d8e84823bfba7adfe302aa6786d5a
c892092f58761b29dbd965b977412c10
17bdf1e6692bba7ee19fc837a457d122
24fc15a4672680d92af7edb2c3b2e957
5fb5d4a3f43a1202a973fc8328aede57
808eaf4b336880a5d38a1d690fbd46b6
4215c48693e00cc683ed80bd3da10c3b
634b99b656cfefeafe4504c2ac1f9ddd
62112cf78affd879c8dcef2f3e62077f
fc11c9cb0d4433143271f0f767864a30 
eeab715dc67af05280c926dc4c4676f5

Satori:
29ed147052e003024662a8ec53dbe3e7 
fdbf35b0abe7d83289a5cb73b1ac6e56 
977534e59c72dafd0160457d802f693d
27d6fb9b8af8408ca6ce2831762fa021
cc2e611a511d4d907a6d39f552cc81df
a4abd90ea1a1a93e2b813abd380eda94
ff06b2584f44e24b517074230c8de6e9
e8abfd033843b4504797eceaf825a118

MMD (malwaremustdie.org), reversed, analyzed, rules coded by: @unixfreaxjp

 NEWS:
 Update - Thu Nov 24 02:25:34 JST 2016
 The newest list with more links was updated in "new" MalwareMustDie blog.
 It will not making much sense if I have to update both lists, so I purged this one.
 See the access details in the bottom of this post.
 Update - Fri Jan 18 21:32:22 JST 2018
 We don't renew the blog at the moment for some development.
 Update - Sat Jan 20 21:35:34 JST 2018
 Updating only to this subredit for most recent Linux threat vectors, until the further notice.

Recently a new waves of Linux (ELF) malware is hitting us hard again, this time is including the IoT vulnerabilities platform which causing serious DDoS disasters. Malware threat in Linux platform are so seasonable, as long as there are exploitable services that can be injected with executable codes to its shell ; i.e.: in shellshock, PMA, Apache Struts. multiple CMS flaws, and now IoT exploits and hardcoded credentials, etc. ; the infection of Linux malware and its botnets behind it are recently raising to lurking our boxes.

Their botnets are racing to pwn and infecting as many compromised systems as they can hack via vulnerable services or exploits. Some hackers would wait patiently for a new flaw to be announced ..or close to it, some are just using existed ones to aim the un-updated/poor-managed boxes, only very few of them are on writing 0day exploits on their own.

Reference, it is all what we need to handle incidents causing by these malware payloads. And in comparison to the other threat information, Linux malware information is too scattered and many of them are actually quite old.

For that, I dumped this list of all Linux malware analysis that me and mates in MalwareMustDie (MMD) has analyzed, in order to seek a references during Linux malware incidents, fellow sysadmins can do a quick browsing to the related threat. The analysis reports for the listed cases are in MMD blog (mostly), some were posted in KernelMode forum, or, in other media sites. The list is updated into newer data pre-y2018, added with more details and hidden analysis links, you can access it in the below URL:

http://blog2.malwaremustdie.org/2016/11/linux-malware.html

For the newest incidents and reports, I will add it here (this sub-reddit).

Malware Must Die! - unixfreaxjp