Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
OwBugJ5CiC.elf

Overview

General Information

Sample name:OwBugJ5CiC.elf
renamed because original name is a hash value
Original sample name:1946dc1191fada9156bbfdbbdd63e1b9.elf
Analysis ID:1546909
MD5:1946dc1191fada9156bbfdbbdd63e1b9
SHA1:9fc5ef4d23fff6bb29ccd94f3083a312e10cb401
SHA256:c01d14bbf943dda019dc2c059c483fa5ad3bccafed1817e2f20786f0a9d66405
Tags:32elfmirairenesas
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1546909
Start date and time:2024-11-01 17:31:34 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 24s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:OwBugJ5CiC.elf
renamed because original name is a hash value
Original Sample Name:1946dc1191fada9156bbfdbbdd63e1b9.elf
Detection:MAL
Classification:mal56.linELF@0/0@0/0

Warnings

  • VT rate limit hit for: OwBugJ5CiC.elf

Runtime Messages

Command:/tmp/OwBugJ5CiC.elf
PID:5487
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
DaddyL33T Infected Your Shit
Standard Error:

Process Tree

  • system is lnxubuntu20
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: OwBugJ5CiC.elfAvira: detected
Multi AV Scanner detection for submitted file
Source: OwBugJ5CiC.elfReversingLabs: Detection: 68%
Source: global trafficTCP traffic: 192.168.2.14:47270 -> 95.164.4.65:666
Source: unknownTCP traffic detected without corresponding DNS query: 95.164.4.65
Source: unknownTCP traffic detected without corresponding DNS query: 95.164.4.65
Source: unknownTCP traffic detected without corresponding DNS query: 95.164.4.65
Source: unknownTCP traffic detected without corresponding DNS query: 95.164.4.65
Source: unknownTCP traffic detected without corresponding DNS query: 95.164.4.65
Source: unknownTCP traffic detected without corresponding DNS query: 95.164.4.65
Source: unknownTCP traffic detected without corresponding DNS query: 95.164.4.65
Source: unknownTCP traffic detected without corresponding DNS query: 95.164.4.65
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal56.linELF@0/0@0/0
Source: /tmp/OwBugJ5CiC.elf (PID: 5487)Queries kernel information via 'uname': Jump to behavior
Source: OwBugJ5CiC.elf, 5487.1.00007fffa1f34000.00007fffa1f55000.rw-.sdmp, OwBugJ5CiC.elf, 5489.1.00007fffa1f34000.00007fffa1f55000.rw-.sdmp, OwBugJ5CiC.elf, 5493.1.00007fffa1f34000.00007fffa1f55000.rw-.sdmpBinary or memory string: ix86_64/usr/bin/qemu-sh4/tmp/OwBugJ5CiC.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/OwBugJ5CiC.elf
Source: OwBugJ5CiC.elf, 5487.1.00007fffa1f34000.00007fffa1f55000.rw-.sdmp, OwBugJ5CiC.elf, 5489.1.00007fffa1f34000.00007fffa1f55000.rw-.sdmp, OwBugJ5CiC.elf, 5493.1.00007fffa1f34000.00007fffa1f55000.rw-.sdmpBinary or memory string: /usr/bin/qemu-sh4
Source: OwBugJ5CiC.elf, 5487.1.0000560efe66b000.0000560efe6ce000.rw-.sdmp, OwBugJ5CiC.elf, 5489.1.0000560efe66b000.0000560efe6ce000.rw-.sdmp, OwBugJ5CiC.elf, 5493.1.0000560efe66b000.0000560efe6ce000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/sh4
Source: OwBugJ5CiC.elf, 5487.1.0000560efe66b000.0000560efe6ce000.rw-.sdmp, OwBugJ5CiC.elf, 5489.1.0000560efe66b000.0000560efe6ce000.rw-.sdmp, OwBugJ5CiC.elf, 5493.1.0000560efe66b000.0000560efe6ce000.rw-.sdmpBinary or memory string: V5!/etc/qemu-binfmt/sh4

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
Security Software Discovery		Remote ServicesData from Local System1
Non-Standard Port		Exfiltration Over Other Network MediumAbuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1546909 Sample: OwBugJ5CiC.elf Startdate: 01/11/2024 Architecture: LINUX Score: 56 16 95.164.4.65, 47270, 666 NASSIST-ASGI Gibraltar 2->16 18 Antivirus / Scanner detection for submitted sample 2->18 20 Multi AV Scanner detection for submitted file 2->20 8 OwBugJ5CiC.elf 2->8         started        signatures3 process4 process5 10 OwBugJ5CiC.elf 8->10         started        12 OwBugJ5CiC.elf 8->12         started        process6 14 OwBugJ5CiC.elf 10->14         started       

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
OwBugJ5CiC.elf68%ReversingLabsLinux.Trojan.Mirai
OwBugJ5CiC.elf100%AviraEXP/ELF.Mirai.T

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
95.164.4.65
unknownGibraltar
29632NASSIST-ASGIfalse

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
95.164.4.65H5LPetzgXV.elfGet hashmaliciousUnknownBrowse
    4l9YKCc7qQ.elfGet hashmaliciousUnknownBrowse
      mCR2IJsjgy.elfGet hashmaliciousUnknownBrowse
        Josho.arm7.elfGet hashmaliciousMiraiBrowse

          Domains

          ⊘No context

          ASNs

          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          NASSIST-ASGIH5LPetzgXV.elfGet hashmaliciousUnknownBrowse
          • 95.164.4.65
          4l9YKCc7qQ.elfGet hashmaliciousUnknownBrowse
          • 95.164.4.65
          mCR2IJsjgy.elfGet hashmaliciousUnknownBrowse
          • 95.164.4.65
          Josho.arm7.elfGet hashmaliciousMiraiBrowse
          • 95.164.4.65
          J3m5xLlT8D.exeGet hashmaliciousDCRatBrowse
          • 95.164.6.175
          na.elfGet hashmaliciousUnknownBrowse
          • 94.131.118.154
          na.elfGet hashmaliciousUnknownBrowse
          • 94.131.118.154
          na.elfGet hashmaliciousUnknownBrowse
          • 94.131.118.154
          SecuriteInfo.com.ELF.Mirai-CVD.31968.3467.elfGet hashmaliciousUnknownBrowse
          • 94.131.118.154
          SecuriteInfo.com.ELF.Mirai-CVD.11330.22523.elfGet hashmaliciousUnknownBrowse
          • 94.131.118.154

          JA3 Fingerprints

          ⊘No context

          Dropped Files

          ⊘No context

          Created / dropped Files

          ⊘No created / dropped files found

          Static File Info

          General

          File type:ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
          Entropy (8bit):6.650754204028297
          TrID:
          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
          File name:OwBugJ5CiC.elf
          File size:50'164 bytes
          MD5:1946dc1191fada9156bbfdbbdd63e1b9
          SHA1:9fc5ef4d23fff6bb29ccd94f3083a312e10cb401
          SHA256:c01d14bbf943dda019dc2c059c483fa5ad3bccafed1817e2f20786f0a9d66405
          SHA512:fcda079089999a99f0040ba631101f122320c7a1dfa62cb6cf5d91f82fdc25f1732f53c1a76c2a68a18c9992103ed72b2c00b795dda0bceca5c02ef10cb311c7
          SSDEEP:768:Z8aoebGWleqg23MTwt6rkLyiXOGDg7xLEFCHogN6eL:WaoZCX8TwtVg7xLEFrgbL
          TLSH:2A337C76C62AADC4CD5985B4AC769E740B93F018C3261DFB2BC549A5809FF78F6083E1
          File Content Preview:.ELF..............*.......@.4...d.......4. ...(...............@...@...........................A...A.$...P...........Q.td............................././"O.n........#.*@........#.*@L....o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

          Static ELF Info

          ELF header

          Class:ELF32
          Data:2's complement, little endian
          Version:1 (current)
          Machine:<unknown>
          Version Number:0x1
          Type:EXEC (Executable file)
          OS/ABI:UNIX - System V
          ABI Version:0
          Entry Point Address:0x4001a0
          Flags:0x9
          ELF Header Size:52
          Program Header Offset:52
          Program Header Size:32
          Number of Program Headers:3
          Section Header Offset:49764
          Section Header Size:40
          Number of Section Headers:10
          Header String Table Index:9

          Sections

          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
          NULL0x00x00x00x00x0000
          .initPROGBITS0x4000940x940x300x00x6AX004
          .textPROGBITS0x4000e00xe00xa9600x00x6AX0032
          .finiPROGBITS0x40aa400xaa400x240x00x6AX004
          .rodataPROGBITS0x40aa640xaa640x11740x00x2A004
          .ctorsPROGBITS0x41c0000xc0000x80x00x3WA004
          .dtorsPROGBITS0x41c0080xc0080x80x00x3WA004
          .dataPROGBITS0x41c0140xc0140x2100x00x3WA004
          .bssNOBITS0x41c2240xc2240x22c0x00x3WA004
          .shstrtabSTRTAB0x00xc2240x3e0x00x0001

          Program Segments

          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
          LOAD0x00x4000000x4000000xbbd80xbbd86.78280x5R E0x10000.init .text .fini .rodata
          LOAD0xc0000x41c0000x41c0000x2240x4502.98070x6RW 0x10000.ctors .dtors .data .bss
          GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

          Network Behavior

          Network Port Distribution

          TCP Packets

          TimestampSource PortDest PortSource IPDest IP
          Nov 1, 2024 17:32:19.959919930 CET47270666192.168.2.1495.164.4.65
          Nov 1, 2024 17:32:19.965493917 CET6664727095.164.4.65192.168.2.14
          Nov 1, 2024 17:32:19.965558052 CET47270666192.168.2.1495.164.4.65
          Nov 1, 2024 17:32:19.971666098 CET47270666192.168.2.1495.164.4.65
          Nov 1, 2024 17:32:19.976931095 CET6664727095.164.4.65192.168.2.14
          Nov 1, 2024 17:32:19.976991892 CET47270666192.168.2.1495.164.4.65
          Nov 1, 2024 17:32:19.982134104 CET6664727095.164.4.65192.168.2.14
          Nov 1, 2024 17:32:29.981749058 CET47270666192.168.2.1495.164.4.65
          Nov 1, 2024 17:32:29.987013102 CET6664727095.164.4.65192.168.2.14
          Nov 1, 2024 17:32:30.260323048 CET6664727095.164.4.65192.168.2.14
          Nov 1, 2024 17:32:30.260617971 CET47270666192.168.2.1495.164.4.65
          Nov 1, 2024 17:33:30.313659906 CET47270666192.168.2.1495.164.4.65
          Nov 1, 2024 17:33:30.319185972 CET6664727095.164.4.65192.168.2.14
          Nov 1, 2024 17:33:30.583751917 CET6664727095.164.4.65192.168.2.14
          Nov 1, 2024 17:33:30.583826065 CET47270666192.168.2.1495.164.4.65

          System Behavior

          General

          Start time (UTC):16:32:19
          Start date (UTC):01/11/2024
          Path:/tmp/OwBugJ5CiC.elf
          Arguments:/tmp/OwBugJ5CiC.elf
          File size:4139976 bytes
          MD5 hash:8943e5f8f8c280467b4472c15ae93ba9

          Chronological Activities


          General

          Start time (UTC):16:32:19
          Start date (UTC):01/11/2024
          Path:/tmp/OwBugJ5CiC.elf
          Arguments:-
          File size:4139976 bytes
          MD5 hash:8943e5f8f8c280467b4472c15ae93ba9

          Chronological Activities


          General

          Start time (UTC):16:32:19
          Start date (UTC):01/11/2024
          Path:/tmp/OwBugJ5CiC.elf
          Arguments:-
          File size:4139976 bytes
          MD5 hash:8943e5f8f8c280467b4472c15ae93ba9

          Chronological Activities


          General

          Start time (UTC):16:32:19
          Start date (UTC):01/11/2024
          Path:/tmp/OwBugJ5CiC.elf
          Arguments:-
          File size:4139976 bytes
          MD5 hash:8943e5f8f8c280467b4472c15ae93ba9

          Chronological Activities