Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
ahV9rJMH6X.elf

Overview

General Information

Sample name:ahV9rJMH6X.elf
renamed because original name is a hash value
Original sample name:5cb9df73057fc359592c732bb134add6.elf
Analysis ID:1543422
MD5:5cb9df73057fc359592c732bb134add6
SHA1:415198ef2a5be374f93a616388ce49ba1ebd5222
SHA256:9656fc44840828706a5045835ee4be05e044f9c7ae22c6dbace2ea5893de8641
Tags:32armelfmirai
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1543422
Start date and time:2024-10-27 20:22:05 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 50s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:ahV9rJMH6X.elf
renamed because original name is a hash value
Original Sample Name:5cb9df73057fc359592c732bb134add6.elf
Detection:MAL
Classification:mal56.linELF@0/0@0/0

Warnings

  • VT rate limit hit for: ahV9rJMH6X.elf

Runtime Messages

Command:/tmp/ahV9rJMH6X.elf
PID:5480
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
DaddyL33T Infected Your Shit
Standard Error:

Process Tree

  • system is lnxubuntu20
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: ahV9rJMH6X.elfAvira: detected
Multi AV Scanner detection for submitted file
Source: ahV9rJMH6X.elfReversingLabs: Detection: 68%
Source: global trafficTCP traffic: 192.168.2.13:43070 -> 91.229.239.50:666
Source: unknownTCP traffic detected without corresponding DNS query: 91.229.239.50
Source: unknownTCP traffic detected without corresponding DNS query: 91.229.239.50
Source: unknownTCP traffic detected without corresponding DNS query: 91.229.239.50
Source: unknownTCP traffic detected without corresponding DNS query: 91.229.239.50
Source: unknownTCP traffic detected without corresponding DNS query: 91.229.239.50
Source: unknownTCP traffic detected without corresponding DNS query: 91.229.239.50
Source: unknownTCP traffic detected without corresponding DNS query: 91.229.239.50
Source: unknownTCP traffic detected without corresponding DNS query: 91.229.239.50
Source: unknownTCP traffic detected without corresponding DNS query: 91.229.239.50
Source: unknownTCP traffic detected without corresponding DNS query: 91.229.239.50
Source: unknownTCP traffic detected without corresponding DNS query: 91.229.239.50
Source: unknownTCP traffic detected without corresponding DNS query: 91.229.239.50
Source: unknownTCP traffic detected without corresponding DNS query: 91.229.239.50
Source: unknownTCP traffic detected without corresponding DNS query: 91.229.239.50
Source: unknownTCP traffic detected without corresponding DNS query: 91.229.239.50
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal56.linELF@0/0@0/0
Source: /tmp/ahV9rJMH6X.elf (PID: 5480)Queries kernel information via 'uname': Jump to behavior
Source: ahV9rJMH6X.elf, 5480.1.000055eea8ebc000.000055eea8fea000.rw-.sdmp, ahV9rJMH6X.elf, 5482.1.000055eea8ebc000.000055eea8fea000.rw-.sdmp, ahV9rJMH6X.elf, 5485.1.000055eea8ebc000.000055eea8fea000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
Source: ahV9rJMH6X.elf, 5480.1.00007ffe47a2c000.00007ffe47a4d000.rw-.sdmp, ahV9rJMH6X.elf, 5482.1.00007ffe47a2c000.00007ffe47a4d000.rw-.sdmp, ahV9rJMH6X.elf, 5485.1.00007ffe47a2c000.00007ffe47a4d000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/ahV9rJMH6X.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ahV9rJMH6X.elf
Source: ahV9rJMH6X.elf, 5480.1.000055eea8ebc000.000055eea8fea000.rw-.sdmp, ahV9rJMH6X.elf, 5482.1.000055eea8ebc000.000055eea8fea000.rw-.sdmp, ahV9rJMH6X.elf, 5485.1.000055eea8ebc000.000055eea8fea000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: ahV9rJMH6X.elf, 5480.1.00007ffe47a2c000.00007ffe47a4d000.rw-.sdmp, ahV9rJMH6X.elf, 5482.1.00007ffe47a2c000.00007ffe47a4d000.rw-.sdmp, ahV9rJMH6X.elf, 5485.1.00007ffe47a2c000.00007ffe47a4d000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
Security Software Discovery		Remote ServicesData from Local System1
Non-Standard Port		Exfiltration Over Other Network MediumAbuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1543422 Sample: ahV9rJMH6X.elf Startdate: 27/10/2024 Architecture: LINUX Score: 56 16 91.229.239.50, 43070, 43072, 666 GRENE-ASPL Spain 2->16 18 Antivirus / Scanner detection for submitted sample 2->18 20 Multi AV Scanner detection for submitted file 2->20 8 ahV9rJMH6X.elf 2->8         started        signatures3 process4 process5 10 ahV9rJMH6X.elf 8->10         started        12 ahV9rJMH6X.elf 8->12         started        process6 14 ahV9rJMH6X.elf 10->14         started       

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
ahV9rJMH6X.elf68%ReversingLabsLinux.Trojan.Mirai
ahV9rJMH6X.elf100%AviraEXP/ELF.Mirai.T

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
91.229.239.50
unknownSpain
197928GRENE-ASPLfalse

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
91.229.239.50TYO3XI7R9u.elfGet hashmaliciousUnknownBrowse
    na.elfGet hashmaliciousUnknownBrowse
      na.elfGet hashmaliciousUnknownBrowse
        na.elfGet hashmaliciousUnknownBrowse
          na.elfGet hashmaliciousMiraiBrowse
            na.elfGet hashmaliciousUnknownBrowse
              na.elfGet hashmaliciousUnknownBrowse
                na.elfGet hashmaliciousUnknownBrowse

                  Domains

                  ⊘No context

                  ASNs

                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                  GRENE-ASPLTYO3XI7R9u.elfGet hashmaliciousUnknownBrowse
                  • 91.229.239.50
                  na.elfGet hashmaliciousUnknownBrowse
                  • 91.229.239.50
                  na.elfGet hashmaliciousUnknownBrowse
                  • 91.229.239.50
                  na.elfGet hashmaliciousUnknownBrowse
                  • 91.229.239.50
                  na.elfGet hashmaliciousMiraiBrowse
                  • 91.229.239.50
                  na.elfGet hashmaliciousUnknownBrowse
                  • 91.229.239.50
                  na.elfGet hashmaliciousUnknownBrowse
                  • 91.229.239.50
                  na.elfGet hashmaliciousUnknownBrowse
                  • 91.229.239.50
                  SecuriteInfo.com.Win32.MalwareX-gen.10154.29348.exeGet hashmaliciousLummaCBrowse
                  • 91.229.239.92
                  https://hch1backh.site/Bin/support.Client.exe?h=hch1backh.site&p=8041&k=BgIAAACkAABSU0ExAAgAAAEAAQABI1KmcZtacSQT9a5YyhI7BCsHk3eVslYIh48AjRVst8XiidoInsqZrW%2FfaFgp7Jga3wcX%2FEZ%2F24mibKiQWTibv8rJDjRH8QXKWT61cTXdyFa7hPgzOsuLRF1MsMBubNSgk7TgMOJ6hE3PXqaXLLk%2BKSgbJkP9%2FQ2rMesTTcjfnxG09H0LzD1tg%2BAL9XYDWh1eZhT2cOX2Sg6OyrheUSJeVpjRcbQLCq61jaXwC8Jg5qnQz2jEZssKjlWSvZ%2FMQ0k3WrQTqKs3X7Uk%2BzPRghPwLVs9vXSMYkcBaTZXpah5q1eoBOI5lw2vsk6g7vZXMKhEHUvxA8qWZ54RA4sQ9JKt&s=a7b676fe-158f-42b1-808b-7c0140483add&i=UnGet hashmaliciousScreenConnect ToolBrowse
                  • 91.229.239.57

                  JA3 Fingerprints

                  ⊘No context

                  Dropped Files

                  ⊘No context

                  Created / dropped Files

                  ⊘No created / dropped files found

                  Static File Info

                  General

                  File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
                  Entropy (8bit):5.927252419984304
                  TrID:
                  • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                  File name:ahV9rJMH6X.elf
                  File size:57'148 bytes
                  MD5:5cb9df73057fc359592c732bb134add6
                  SHA1:415198ef2a5be374f93a616388ce49ba1ebd5222
                  SHA256:9656fc44840828706a5045835ee4be05e044f9c7ae22c6dbace2ea5893de8641
                  SHA512:c26266f404f882cd7e5e1731d35c482daebbd7288dbe0a97e62c5d8085fa20d8e40673c49d5918a633e54e8d98793d85bc45121394941a6736d0e2414bbdaacb
                  SSDEEP:1536:u8fvjy2XlHsWf12113CoRNr7UTJY6QAX:u83jMRWC6P
                  TLSH:284307A57C825A23C6EC137AF56E028D336527A8D1DF3227CE232F11B78591F0DA7691
                  File Content Preview:.ELF...a..........(.........4...........4. ...(.....................@...@...............D...D...D...(...T...........Q.td..................................-...L."....2..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

                  Static ELF Info

                  ELF header

                  Class:ELF32
                  Data:2's complement, little endian
                  Version:1 (current)
                  Machine:ARM
                  Version Number:0x1
                  Type:EXEC (Executable file)
                  OS/ABI:ARM - ABI
                  ABI Version:0
                  Entry Point Address:0x8190
                  Flags:0x202
                  ELF Header Size:52
                  Program Header Offset:52
                  Program Header Size:32
                  Number of Program Headers:3
                  Section Header Offset:56748
                  Section Header Size:40
                  Number of Section Headers:10
                  Header String Table Index:9

                  Sections

                  NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                  NULL0x00x00x00x00x0000
                  .initPROGBITS0x80940x940x180x00x6AX004
                  .textPROGBITS0x80b00xb00xc8b00x00x6AX0016
                  .finiPROGBITS0x149600xc9600x140x00x6AX004
                  .rodataPROGBITS0x149740xc9740x11cc0x00x2A004
                  .ctorsPROGBITS0x1db440xdb440x80x00x3WA004
                  .dtorsPROGBITS0x1db4c0xdb4c0x80x00x3WA004
                  .dataPROGBITS0x1db580xdb580x2140x00x3WA004
                  .bssNOBITS0x1dd6c0xdd6c0x22c0x00x3WA004
                  .shstrtabSTRTAB0x00xdd6c0x3e0x00x0001

                  Program Segments

                  TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                  LOAD0x00x80000x80000xdb400xdb405.94960x5R E0x8000.init .text .fini .rodata
                  LOAD0xdb440x1db440x1db440x2280x4542.94100x6RW 0x8000.ctors .dtors .data .bss
                  GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                  Network Behavior

                  Network Port Distribution

                  TCP Packets

                  TimestampSource PortDest PortSource IPDest IP
                  Oct 27, 2024 20:23:08.568037033 CET43070666192.168.2.1391.229.239.50
                  Oct 27, 2024 20:23:08.573915958 CET6664307091.229.239.50192.168.2.13
                  Oct 27, 2024 20:23:08.573977947 CET43070666192.168.2.1391.229.239.50
                  Oct 27, 2024 20:23:08.659080029 CET43070666192.168.2.1391.229.239.50
                  Oct 27, 2024 20:23:08.665791035 CET6664307091.229.239.50192.168.2.13
                  Oct 27, 2024 20:23:08.665855885 CET43070666192.168.2.1391.229.239.50
                  Oct 27, 2024 20:23:08.672091007 CET6664307091.229.239.50192.168.2.13
                  Oct 27, 2024 20:23:09.474503040 CET6664307091.229.239.50192.168.2.13
                  Oct 27, 2024 20:23:09.474797010 CET43070666192.168.2.1391.229.239.50
                  Oct 27, 2024 20:23:09.474973917 CET43070666192.168.2.1391.229.239.50
                  Oct 27, 2024 20:23:09.475902081 CET43072666192.168.2.1391.229.239.50
                  Oct 27, 2024 20:23:09.481796980 CET6664307291.229.239.50192.168.2.13
                  Oct 27, 2024 20:23:09.482028008 CET43072666192.168.2.1391.229.239.50
                  Oct 27, 2024 20:23:09.483334064 CET43072666192.168.2.1391.229.239.50
                  Oct 27, 2024 20:23:09.489712954 CET6664307291.229.239.50192.168.2.13
                  Oct 27, 2024 20:23:09.489860058 CET43072666192.168.2.1391.229.239.50
                  Oct 27, 2024 20:23:09.495528936 CET6664307291.229.239.50192.168.2.13
                  Oct 27, 2024 20:23:19.493686914 CET43072666192.168.2.1391.229.239.50
                  Oct 27, 2024 20:23:19.703746080 CET43072666192.168.2.1391.229.239.50
                  Oct 27, 2024 20:23:19.907457113 CET6664307291.229.239.50192.168.2.13
                  Oct 27, 2024 20:23:19.907802105 CET6664307291.229.239.50192.168.2.13
                  Oct 27, 2024 20:23:20.183392048 CET6664307291.229.239.50192.168.2.13
                  Oct 27, 2024 20:23:20.183738947 CET43072666192.168.2.1391.229.239.50
                  Oct 27, 2024 20:24:20.244246006 CET43072666192.168.2.1391.229.239.50
                  Oct 27, 2024 20:24:20.250267029 CET6664307291.229.239.50192.168.2.13
                  Oct 27, 2024 20:24:20.516671896 CET6664307291.229.239.50192.168.2.13
                  Oct 27, 2024 20:24:20.516841888 CET43072666192.168.2.1391.229.239.50

                  System Behavior

                  General

                  Start time (UTC):19:23:07
                  Start date (UTC):27/10/2024
                  Path:/tmp/ahV9rJMH6X.elf
                  Arguments:/tmp/ahV9rJMH6X.elf
                  File size:4956856 bytes
                  MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                  Chronological Activities


                  General

                  Start time (UTC):19:23:07
                  Start date (UTC):27/10/2024
                  Path:/tmp/ahV9rJMH6X.elf
                  Arguments:-
                  File size:4956856 bytes
                  MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                  Chronological Activities


                  General

                  Start time (UTC):19:23:07
                  Start date (UTC):27/10/2024
                  Path:/tmp/ahV9rJMH6X.elf
                  Arguments:-
                  File size:4956856 bytes
                  MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                  Chronological Activities


                  General

                  Start time (UTC):19:23:07
                  Start date (UTC):27/10/2024
                  Path:/tmp/ahV9rJMH6X.elf
                  Arguments:-
                  File size:4956856 bytes
                  MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                  Chronological Activities