Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
zNiud1o4Jk.elf

Overview

General Information

Sample name:zNiud1o4Jk.elf
renamed because original name is a hash value
Original sample name:5b82437da0e8c0bbdc98c975b7bdb8d9.elf
Analysis ID:1431547
MD5:5b82437da0e8c0bbdc98c975b7bdb8d9
SHA1:981d076f4a78f3eb5899b7f0c0a3c54ae9a51b10
SHA256:ea4b4caa2a1d2315f25956d1a0a5894976583903365b50a1737767cb0f2b62e7
Tags:32elfmiraimotorola
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1431547
Start date and time:2024-04-25 12:28:23 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 34s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:zNiud1o4Jk.elf
renamed because original name is a hash value
Original Sample Name:5b82437da0e8c0bbdc98c975b7bdb8d9.elf
Detection:MAL
Classification:mal56.linELF@0/0@0/0

Runtime Messages

Command:/tmp/zNiud1o4Jk.elf
PID:5423
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
DaddyL33T Infected Your Shit
Standard Error:

Process Tree

  • system is lnxubuntu20
  • cleanup

Yara Signatures

⊘No yara matches

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: zNiud1o4Jk.elfAvira: detected
Multi AV Scanner detection for submitted file
Source: zNiud1o4Jk.elfReversingLabs: Detection: 70%
Source: zNiud1o4Jk.elfVirustotal: Detection: 59%Perma Link
Source: global trafficTCP traffic: 192.168.2.13:52054 -> 209.14.69.249:666
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal56.linELF@0/0@0/0
Source: /tmp/zNiud1o4Jk.elf (PID: 5423)Queries kernel information via 'uname': Jump to behavior
Source: zNiud1o4Jk.elf, 5423.1.00007ffdbb076000.00007ffdbb097000.rw-.sdmp, zNiud1o4Jk.elf, 5426.1.00007ffdbb076000.00007ffdbb097000.rw-.sdmp, zNiud1o4Jk.elf, 5430.1.00007ffdbb076000.00007ffdbb097000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-m68k/tmp/zNiud1o4Jk.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/zNiud1o4Jk.elf
Source: zNiud1o4Jk.elf, 5423.1.0000558f4ff80000.0000558f50005000.rw-.sdmp, zNiud1o4Jk.elf, 5426.1.0000558f4ff80000.0000558f50005000.rw-.sdmp, zNiud1o4Jk.elf, 5430.1.0000558f4ff80000.0000558f50005000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/m68k
Source: zNiud1o4Jk.elf, 5423.1.00007ffdbb076000.00007ffdbb097000.rw-.sdmp, zNiud1o4Jk.elf, 5426.1.00007ffdbb076000.00007ffdbb097000.rw-.sdmp, zNiud1o4Jk.elf, 5430.1.00007ffdbb076000.00007ffdbb097000.rw-.sdmpBinary or memory string: /usr/bin/qemu-m68k
Source: zNiud1o4Jk.elf, 5423.1.0000558f4ff80000.0000558f50005000.rw-.sdmp, zNiud1o4Jk.elf, 5426.1.0000558f4ff80000.0000558f50005000.rw-.sdmp, zNiud1o4Jk.elf, 5430.1.0000558f4ff80000.0000558f50005000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/m68k

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
Security Software Discovery		Remote ServicesData from Local System1
Non-Standard Port		Exfiltration Over Other Network MediumAbuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1431547 Sample: zNiud1o4Jk.elf Startdate: 25/04/2024 Architecture: LINUX Score: 56 16 209.14.69.249, 52054, 666 AS6220US United States 2->16 18 Antivirus / Scanner detection for submitted sample 2->18 20 Multi AV Scanner detection for submitted file 2->20 8 zNiud1o4Jk.elf 2->8         started        signatures3 process4 process5 10 zNiud1o4Jk.elf 8->10         started        12 zNiud1o4Jk.elf 8->12         started        process6 14 zNiud1o4Jk.elf 10->14         started       

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
zNiud1o4Jk.elf70%ReversingLabsLinux.Trojan.Mirai
zNiud1o4Jk.elf59%VirustotalBrowse
zNiud1o4Jk.elf100%AviraEXP/ELF.Mirai.T

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
209.14.69.249
unknownUnited States
6220AS6220USfalse

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
209.14.69.249zznAzmTdd6.elfGet hashmaliciousMiraiBrowse
    XM3JcqhdgB.elfGet hashmaliciousUnknownBrowse
      CSS2FGGrkv.elfGet hashmaliciousUnknownBrowse
        gCqnbN34QY.elfGet hashmaliciousUnknownBrowse
          VUjiythPAQ.elfGet hashmaliciousUnknownBrowse
            PylIt4izlJ.elfGet hashmaliciousUnknownBrowse

              Domains

              ⊘No context

              ASNs

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              AS6220USzznAzmTdd6.elfGet hashmaliciousMiraiBrowse
              • 209.14.69.249
              XM3JcqhdgB.elfGet hashmaliciousUnknownBrowse
              • 209.14.69.249
              CSS2FGGrkv.elfGet hashmaliciousUnknownBrowse
              • 209.14.69.249
              gCqnbN34QY.elfGet hashmaliciousUnknownBrowse
              • 209.14.69.249
              VUjiythPAQ.elfGet hashmaliciousUnknownBrowse
              • 209.14.69.249
              PylIt4izlJ.elfGet hashmaliciousUnknownBrowse
              • 209.14.69.249
              sora.armGet hashmaliciousMiraiBrowse
              • 207.166.94.107
              s422uUu30YGet hashmaliciousMiraiBrowse
              • 209.14.76.114
              37F1aDw0RcGet hashmaliciousMiraiBrowse
              • 207.166.94.118

              JA3 Fingerprints

              ⊘No context

              Dropped Files

              ⊘No context

              Created / dropped Files

              ⊘No created / dropped files found

              Static File Info

              General

              File type:ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
              Entropy (8bit):6.195021966284082
              TrID:
              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
              File name:zNiud1o4Jk.elf
              File size:52'156 bytes
              MD5:5b82437da0e8c0bbdc98c975b7bdb8d9
              SHA1:981d076f4a78f3eb5899b7f0c0a3c54ae9a51b10
              SHA256:ea4b4caa2a1d2315f25956d1a0a5894976583903365b50a1737767cb0f2b62e7
              SHA512:ea7ba0a443666bb74f6c4ef6a8da6f1dad192555be874c5dd850566616e6bd54ea2ab482ede095e711aeb0143569f0d9779850159244d8dff64d37bdd0d74ee2
              SSDEEP:768:zGelHkpJEoft9dg77ooIclElQ8y88X4rBfWRksiqo:q1pyoftg77ooIpI88X+fWR3iT
              TLSH:0C334DF9F4125D2DF8CFE9BF5C254A18ED61234162830B1A57ABFC935C331649E12E62
              File Content Preview:.ELF.......................D...4...,.....4. ...(.................................. ....................$.......... .dt.Q............................NV..a....da.....N^NuNV..J9....f>"y.... QJ.g.X.#.....N."y.... QJ.f.A.....J.g.Hy....N.X.........N^NuNV..N^NuN

              Static ELF Info

              ELF header

              Class:ELF32
              Data:2's complement, big endian
              Version:1 (current)
              Machine:MC68000
              Version Number:0x1
              Type:EXEC (Executable file)
              OS/ABI:UNIX - System V
              ABI Version:0
              Entry Point Address:0x80000144
              Flags:0x0
              ELF Header Size:52
              Program Header Offset:52
              Program Header Size:32
              Number of Program Headers:3
              Section Header Offset:51756
              Section Header Size:40
              Number of Section Headers:10
              Header String Table Index:9

              Sections

              NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
              NULL0x00x00x00x00x0000
              .initPROGBITS0x800000940x940x140x00x6AX002
              .textPROGBITS0x800000a80xa80xb82e0x00x6AX004
              .finiPROGBITS0x8000b8d60xb8d60xe0x00x6AX002
              .rodataPROGBITS0x8000b8e40xb8e40xede0x00x2A002
              .ctorsPROGBITS0x8000e7c80xc7c80x80x00x3WA004
              .dtorsPROGBITS0x8000e7d00xc7d00x80x00x3WA004
              .dataPROGBITS0x8000e7dc0xc7dc0x2100x00x3WA004
              .bssNOBITS0x8000e9ec0xc9ec0x1ec0x00x3WA004
              .shstrtabSTRTAB0x00xc9ec0x3e0x00x0001

              Program Segments

              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
              LOAD0x00x800000000x800000000xc7c20xc7c26.23280x5R E0x2000.init .text .fini .rodata
              LOAD0xc7c80x8000e7c80x8000e7c80x2240x4102.98810x6RW 0x2000.ctors .dtors .data .bss
              GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

              Network Behavior

              Network Port Distribution

              TCP Packets

              TimestampSource PortDest PortSource IPDest IP
              Apr 25, 2024 12:29:10.604397058 CEST52054666192.168.2.13209.14.69.249
              Apr 25, 2024 12:29:10.847457886 CEST66652054209.14.69.249192.168.2.13
              Apr 25, 2024 12:29:10.847553968 CEST52054666192.168.2.13209.14.69.249
              Apr 25, 2024 12:29:10.848000050 CEST52054666192.168.2.13209.14.69.249
              Apr 25, 2024 12:29:11.092067957 CEST66652054209.14.69.249192.168.2.13
              Apr 25, 2024 12:29:11.092173100 CEST52054666192.168.2.13209.14.69.249
              Apr 25, 2024 12:29:11.335223913 CEST66652054209.14.69.249192.168.2.13
              Apr 25, 2024 12:29:20.853702068 CEST52054666192.168.2.13209.14.69.249
              Apr 25, 2024 12:29:21.097320080 CEST66652054209.14.69.249192.168.2.13
              Apr 25, 2024 12:29:21.097496986 CEST66652054209.14.69.249192.168.2.13
              Apr 25, 2024 12:29:21.097719908 CEST52054666192.168.2.13209.14.69.249
              Apr 25, 2024 12:29:36.366827965 CEST66652054209.14.69.249192.168.2.13
              Apr 25, 2024 12:29:36.367041111 CEST52054666192.168.2.13209.14.69.249
              Apr 25, 2024 12:29:51.614567995 CEST66652054209.14.69.249192.168.2.13
              Apr 25, 2024 12:29:51.614789963 CEST52054666192.168.2.13209.14.69.249
              Apr 25, 2024 12:30:06.857451916 CEST66652054209.14.69.249192.168.2.13
              Apr 25, 2024 12:30:06.857608080 CEST52054666192.168.2.13209.14.69.249
              Apr 25, 2024 12:30:21.158348083 CEST52054666192.168.2.13209.14.69.249
              Apr 25, 2024 12:30:21.781194925 CEST52054666192.168.2.13209.14.69.249
              Apr 25, 2024 12:30:22.026412964 CEST66652054209.14.69.249192.168.2.13
              Apr 25, 2024 12:30:22.026619911 CEST52054666192.168.2.13209.14.69.249
              Apr 25, 2024 12:30:37.271372080 CEST66652054209.14.69.249192.168.2.13
              Apr 25, 2024 12:30:37.271512032 CEST52054666192.168.2.13209.14.69.249
              Apr 25, 2024 12:30:52.518471003 CEST66652054209.14.69.249192.168.2.13
              Apr 25, 2024 12:30:52.518588066 CEST52054666192.168.2.13209.14.69.249
              Apr 25, 2024 12:31:07.761373997 CEST66652054209.14.69.249192.168.2.13
              Apr 25, 2024 12:31:07.761481047 CEST52054666192.168.2.13209.14.69.249

              System Behavior

              General

              Start time (UTC):10:29:09
              Start date (UTC):25/04/2024
              Path:/tmp/zNiud1o4Jk.elf
              Arguments:/tmp/zNiud1o4Jk.elf
              File size:4463432 bytes
              MD5 hash:cd177594338c77b895ae27c33f8f86cc

              Chronological Activities


              General

              Start time (UTC):10:29:09
              Start date (UTC):25/04/2024
              Path:/tmp/zNiud1o4Jk.elf
              Arguments:-
              File size:4463432 bytes
              MD5 hash:cd177594338c77b895ae27c33f8f86cc

              Chronological Activities


              General

              Start time (UTC):10:29:09
              Start date (UTC):25/04/2024
              Path:/tmp/zNiud1o4Jk.elf
              Arguments:-
              File size:4463432 bytes
              MD5 hash:cd177594338c77b895ae27c33f8f86cc

              Chronological Activities


              General

              Start time (UTC):10:29:09
              Start date (UTC):25/04/2024
              Path:/tmp/zNiud1o4Jk.elf
              Arguments:-
              File size:4463432 bytes
              MD5 hash:cd177594338c77b895ae27c33f8f86cc

              Chronological Activities