Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
mipsel.elf

Overview

General Information

Sample name:mipsel.elf
Analysis ID:1575400
MD5:719822fcf6210715febaa2430072bcc9
SHA1:d89579227bc6c5889afea3877eb8c004b8a2020c
SHA256:beafa5721c915934319e725dd291011451b41c53993ba6ff047f0c96dbb49ea8
Tags:elfuser-abuse_ch
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Opens /sys/class/net/* files useful for querying network interface information
Performs DNS TXT record lookups
Sample deletes itself
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1575400
Start date and time:2024-12-15 13:20:38 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 47s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:mipsel.elf
Detection:MAL
Classification:mal60.spyw.evad.linELF@0/0@1/0
Command:/tmp/mipsel.elf
PID:5532
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Firmware update in progress
Standard Error:
  • system is lnxubuntu20
  • mipsel.elf (PID: 5532, Parent: 5449, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/mipsel.elf
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: mipsel.elfVirustotal: Detection: 36%Perma Link
Source: mipsel.elfReversingLabs: Detection: 31%

Networking

barindex
Source: /tmp/mipsel.elf (PID: 5534)Opens: /sys/class/net/Jump to behavior
Source: /tmp/mipsel.elf (PID: 5534)Opens: /sys/class/net/ens160/addressJump to behavior
Source: /tmp/mipsel.elf (PID: 5534)Opens: /sys/class/net/ens160/flagsJump to behavior
Source: /tmp/mipsel.elf (PID: 5534)Opens: /sys/class/net/ens160/carrierJump to behavior
Source: global trafficTCP traffic: 192.168.2.14:58132 -> 5.231.4.240:2222
Source: unknownTCP traffic detected without corresponding DNS query: 5.231.4.240
Source: unknownTCP traffic detected without corresponding DNS query: 5.231.4.240
Source: unknownTCP traffic detected without corresponding DNS query: 5.231.4.240
Source: unknownTCP traffic detected without corresponding DNS query: 5.231.4.240
Source: unknownTCP traffic detected without corresponding DNS query: 5.231.4.240
Source: unknownTCP traffic detected without corresponding DNS query: 5.231.4.240
Source: unknownUDP traffic detected without corresponding DNS query: 172.217.192.127
Source: unknownUDP traffic detected without corresponding DNS query: 65.21.1.106
Source: global trafficDNS traffic detected: DNS query: iranistrash.libre
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal60.spyw.evad.linELF@0/0@1/0

Hooking and other Techniques for Hiding and Protection

barindex
Source: /tmp/mipsel.elf (PID: 5532)File: /tmp/mipsel.elfJump to behavior
Source: /tmp/mipsel.elf (PID: 5532)Queries kernel information via 'uname': Jump to behavior
Source: /tmp/mipsel.elf (PID: 5534)Queries kernel information via 'uname': Jump to behavior
Source: mipsel.elf, 5532.1.00005647b78a8000.00005647b792f000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mipsel
Source: mipsel.elf, 5532.1.00007fff2713e000.00007fff2715f000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/mipsel.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mipsel.elf
Source: mipsel.elf, 5532.1.00005647b78a8000.00005647b792f000.rw-.sdmpBinary or memory string: GV!/etc/qemu-binfmt/mipsel
Source: mipsel.elf, 5532.1.00007fff2713e000.00007fff2715f000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mipsel

HIPS / PFW / Operating System Protection Evasion

barindex
Source: TrafficDNS traffic detected: queries for: iranistrash.libre
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
File Deletion
OS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local System1
Non-Standard Port
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1575400 Sample: mipsel.elf Startdate: 15/12/2024 Architecture: LINUX Score: 60 18 iranistrash.libre 2->18 20 172.217.192.127, 3478, 39267 GOOGLEUS United States 2->20 22 5.231.4.240, 2222, 58132 ASGHOSTNETDE Germany 2->22 24 Multi AV Scanner detection for submitted file 2->24 8 mipsel.elf 2->8         started        signatures3 26 Performs DNS TXT record lookups 18->26 process4 signatures5 28 Sample deletes itself 8->28 11 mipsel.elf 8->11         started        process6 signatures7 30 Opens /sys/class/net/* files useful for querying network interface information 11->30 14 mipsel.elf 11->14         started        16 mipsel.elf 11->16         started        process8

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
mipsel.elf36%VirustotalBrowse
mipsel.elf32%ReversingLabsLinux.Backdoor.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
iranistrash.libre
unknown
unknownfalse
    high
    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs
    IPDomainCountryFlagASNASN NameMalicious
    5.231.4.240
    unknownGermany
    12586ASGHOSTNETDEfalse
    172.217.192.127
    unknownUnited States
    15169GOOGLEUSfalse
    No context
    No context
    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    ASGHOSTNETDEmipsel64.elfGet hashmaliciousUnknownBrowse
    • 5.230.251.14
    powerpc.elfGet hashmaliciousUnknownBrowse
    • 5.230.33.236
    jmggnxeedy.elfGet hashmaliciousUnknownBrowse
    • 94.249.207.54
    la.bot.mips.elfGet hashmaliciousUnknownBrowse
    • 94.249.188.214
    powerpc.nn.elfGet hashmaliciousMirai, OkiruBrowse
    • 195.200.192.218
    arm5.elfGet hashmaliciousUnknownBrowse
    • 5.83.147.14
    mpsl.elfGet hashmaliciousUnknownBrowse
    • 5.83.147.14
    arm7.elfGet hashmaliciousMiraiBrowse
    • 5.83.147.14
    x86.elfGet hashmaliciousUnknownBrowse
    • 5.83.147.14
    mips.elfGet hashmaliciousUnknownBrowse
    • 5.83.147.14
    No context
    No context
    No created / dropped files found
    File type:ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
    Entropy (8bit):5.502507231504162
    TrID:
    • ELF Executable and Linkable format (generic) (4004/1) 100.00%
    File name:mipsel.elf
    File size:100'488 bytes
    MD5:719822fcf6210715febaa2430072bcc9
    SHA1:d89579227bc6c5889afea3877eb8c004b8a2020c
    SHA256:beafa5721c915934319e725dd291011451b41c53993ba6ff047f0c96dbb49ea8
    SHA512:3c7453ff6f112072652d820e87dd7f5b2d60cd060962a3d66dd6fa5ef649746efd58d7c5c419bda6e2e6dd550e5087ef41757cbfecb5a7117a9cfc658ee537db
    SSDEEP:1536:aH0BGlPJEg2xyX9ZMBWSg8iMTPceVd3AFQ0OP8of/dfj+T:aUs0yNZMBW3MT0ozu
    TLSH:65A3E605BFA10FB3E85FDD3709E91B05198DA51722A97F36B934E818F74B24B09E3860
    File Content Preview:.ELF....................`.@.4...........4. ...(...............@...@...........................E...E.\...............Q.td...............................<,..'!......'.......................<...'!... .........9'.. ........................<...'!...........Pv9

    ELF header

    Class:ELF32
    Data:2's complement, little endian
    Version:1 (current)
    Machine:MIPS R3000
    Version Number:0x1
    Type:EXEC (Executable file)
    OS/ABI:UNIX - System V
    ABI Version:0
    Entry Point Address:0x400260
    Flags:0x1007
    ELF Header Size:52
    Program Header Offset:52
    Program Header Size:32
    Number of Program Headers:3
    Section Header Offset:100008
    Section Header Size:40
    Number of Section Headers:12
    Header String Table Index:11
    NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
    NULL0x00x00x00x00x0000
    .initPROGBITS0x4000940x940x8c0x00x6AX004
    .textPROGBITS0x4001200x1200x175a00x00x6AX0016
    .finiPROGBITS0x4176c00x176c00x5c0x00x6AX004
    .rodataPROGBITS0x4177200x177200x8b00x00x2A0016
    .ctorsPROGBITS0x4580000x180000x80x00x3WA004
    .dtorsPROGBITS0x4580080x180080x80x00x3WA004
    .dataPROGBITS0x4580200x180200x1b00x00x3WA0016
    .gotPROGBITS0x4581d00x181d00x48c0x40x10000003WAp0016
    .sbssNOBITS0x45865c0x1865c0x80x00x10000003WAp004
    .bssNOBITS0x4586700x1865c0x14a40x00x3WA0016
    .shstrtabSTRTAB0x00x1865c0x490x00x0001
    TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
    LOAD0x00x4000000x4000000x17fd00x17fd05.51720x5R E0x10000.init .text .fini .rodata
    LOAD0x180000x4580000x4580000x65c0x1b143.69440x6RW 0x10000.ctors .dtors .data .got .sbss .bss
    GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
    TimestampSource PortDest PortSource IPDest IP
    Dec 15, 2024 13:21:44.134932995 CET581322222192.168.2.145.231.4.240
    Dec 15, 2024 13:21:44.255043983 CET2222581325.231.4.240192.168.2.14
    Dec 15, 2024 13:21:44.255247116 CET581322222192.168.2.145.231.4.240
    Dec 15, 2024 13:21:44.255855083 CET581322222192.168.2.145.231.4.240
    Dec 15, 2024 13:21:44.375701904 CET2222581325.231.4.240192.168.2.14
    Dec 15, 2024 13:21:45.593552113 CET2222581325.231.4.240192.168.2.14
    Dec 15, 2024 13:21:45.593823910 CET581322222192.168.2.145.231.4.240
    Dec 15, 2024 13:22:55.646143913 CET581322222192.168.2.145.231.4.240
    Dec 15, 2024 13:22:55.766511917 CET2222581325.231.4.240192.168.2.14
    Dec 15, 2024 13:22:56.126163006 CET2222581325.231.4.240192.168.2.14
    Dec 15, 2024 13:22:56.126255035 CET581322222192.168.2.145.231.4.240
    TimestampSource PortDest PortSource IPDest IP
    Dec 15, 2024 13:21:42.554605007 CET392673478192.168.2.14172.217.192.127
    Dec 15, 2024 13:21:43.818440914 CET347839267172.217.192.127192.168.2.14
    Dec 15, 2024 13:21:43.868968010 CET3494353192.168.2.1465.21.1.106
    Dec 15, 2024 13:21:44.133398056 CET533494365.21.1.106192.168.2.14
    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
    Dec 15, 2024 13:21:43.868968010 CET192.168.2.1465.21.1.1060x7be2Standard query (0)iranistrash.libre16IN (0x0001)false
    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
    Dec 15, 2024 13:21:44.133398056 CET65.21.1.106192.168.2.140x7be2No error (0)iranistrash.libreTXT (Text strings)IN (0x0001)false

    System Behavior

    Start time (UTC):12:21:39
    Start date (UTC):15/12/2024
    Path:/tmp/mipsel.elf
    Arguments:/tmp/mipsel.elf
    File size:5773336 bytes
    MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

    Start time (UTC):12:21:41
    Start date (UTC):15/12/2024
    Path:/tmp/mipsel.elf
    Arguments:-
    File size:5773336 bytes
    MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

    Start time (UTC):12:21:43
    Start date (UTC):15/12/2024
    Path:/tmp/mipsel.elf
    Arguments:-
    File size:5773336 bytes
    MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

    Start time (UTC):12:21:43
    Start date (UTC):15/12/2024
    Path:/tmp/mipsel.elf
    Arguments:-
    File size:5773336 bytes
    MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9