Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
sh4.elf

Overview

General Information

Sample name:sh4.elf
Analysis ID:1575417
MD5:3e8b52deb514fa2cb0180551afbd3f85
SHA1:d35ec899c99b695e740e17cdd21fc1673fdeadab
SHA256:8e8c5bbb9dc1ca65f0cce393493c48d15d4ef471be58178d58d8b06a1b7bb670
Tags:elfuser-abuse_ch
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Opens /sys/class/net/* files useful for querying network interface information
Performs DNS TXT record lookups
Sample deletes itself
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1575417
Start date and time:2024-12-15 14:46:28 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 38s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:sh4.elf
Detection:MAL
Classification:mal60.spyw.evad.linELF@0/0@1/0
Command:/tmp/sh4.elf
PID:5494
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Firmware update in progress
Standard Error:
  • system is lnxubuntu20
  • sh4.elf (PID: 5494, Parent: 5413, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/sh4.elf
    • sh4.elf New Fork (PID: 5496, Parent: 5494)
      • sh4.elf New Fork (PID: 5499, Parent: 5496)
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: sh4.elfReversingLabs: Detection: 13%

Networking

barindex
Source: /tmp/sh4.elf (PID: 5496)Opens: /sys/class/net/Jump to behavior
Source: /tmp/sh4.elf (PID: 5496)Opens: /sys/class/net/ens160/addressJump to behavior
Source: /tmp/sh4.elf (PID: 5496)Opens: /sys/class/net/ens160/flagsJump to behavior
Source: /tmp/sh4.elf (PID: 5496)Opens: /sys/class/net/ens160/carrierJump to behavior
Source: global trafficTCP traffic: 192.168.2.14:32912 -> 86.104.72.130:7000
Source: unknownTCP traffic detected without corresponding DNS query: 86.104.72.130
Source: unknownTCP traffic detected without corresponding DNS query: 86.104.72.130
Source: unknownTCP traffic detected without corresponding DNS query: 86.104.72.130
Source: unknownTCP traffic detected without corresponding DNS query: 86.104.72.130
Source: unknownTCP traffic detected without corresponding DNS query: 86.104.72.130
Source: unknownTCP traffic detected without corresponding DNS query: 86.104.72.130
Source: unknownUDP traffic detected without corresponding DNS query: 172.217.192.127
Source: unknownUDP traffic detected without corresponding DNS query: 217.160.70.42
Source: global trafficDNS traffic detected: DNS query: iranistrash.libre
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal60.spyw.evad.linELF@0/0@1/0

Hooking and other Techniques for Hiding and Protection

barindex
Source: /tmp/sh4.elf (PID: 5494)File: /tmp/sh4.elfJump to behavior
Source: /tmp/sh4.elf (PID: 5494)Queries kernel information via 'uname': Jump to behavior
Source: /tmp/sh4.elf (PID: 5496)Queries kernel information via 'uname': Jump to behavior
Source: sh4.elf, 5494.1.00007fffb9198000.00007fffb91b9000.rw-.sdmpBinary or memory string: Lx86_64/usr/bin/qemu-sh4/tmp/sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sh4.elf
Source: sh4.elf, 5494.1.00007fffb9198000.00007fffb91b9000.rw-.sdmpBinary or memory string: /usr/bin/qemu-sh4
Source: sh4.elf, 5494.1.0000559ea9672000.0000559ea96f6000.rw-.sdmpBinary or memory string: U5!/etc/qemu-binfmt/sh4
Source: sh4.elf, 5494.1.0000559ea9672000.0000559ea96f6000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/sh4

HIPS / PFW / Operating System Protection Evasion

barindex
Source: TrafficDNS traffic detected: queries for: iranistrash.libre
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
File Deletion
OS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local System1
Non-Standard Port
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
SourceDetectionScannerLabelLink
sh4.elf13%ReversingLabsLinux.Backdoor.Gafgyt
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
iranistrash.libre
unknown
unknownfalse
    high
    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs
    IPDomainCountryFlagASNASN NameMalicious
    172.217.192.127
    unknownUnited States
    15169GOOGLEUSfalse
    86.104.72.130
    unknownRomania
    50636TELE-ROM-ASstrAleeaPaciiBlB5Ap16ROfalse
    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    86.104.72.130mipsel64.elfGet hashmaliciousUnknownBrowse
      mips.elfGet hashmaliciousUnknownBrowse
        sparc.elfGet hashmaliciousUnknownBrowse
          No context
          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          TELE-ROM-ASstrAleeaPaciiBlB5Ap16ROmipsel64.elfGet hashmaliciousUnknownBrowse
          • 86.104.72.130
          mips.elfGet hashmaliciousUnknownBrowse
          • 86.104.72.130
          sparc.elfGet hashmaliciousUnknownBrowse
          • 86.104.72.130
          RHxJqGoGFB.exeGet hashmaliciousSalityBrowse
          • 86.104.74.51
          uniswap-sniper-bot-with-gui Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
          • 86.104.74.51
          uniswap-sniper-bot-with-gui Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
          • 86.104.74.51
          na.htaGet hashmaliciousMetasploitBrowse
          • 86.104.74.31
          g4nWvGoRNZ.exeGet hashmaliciousRemcosBrowse
          • 86.104.72.183
          5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exeGet hashmaliciousRemcosBrowse
          • 86.104.72.183
          aqB7l6kvXl.exeGet hashmaliciousRemcosBrowse
          • 86.104.72.183
          No context
          No context
          No created / dropped files found
          File type:ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
          Entropy (8bit):6.723312929752899
          TrID:
          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
          File name:sh4.elf
          File size:66'408 bytes
          MD5:3e8b52deb514fa2cb0180551afbd3f85
          SHA1:d35ec899c99b695e740e17cdd21fc1673fdeadab
          SHA256:8e8c5bbb9dc1ca65f0cce393493c48d15d4ef471be58178d58d8b06a1b7bb670
          SHA512:661fbda1b6aa0fc671a04103491634b0c6f26c221b00e63ccf8a820ea7e6f35ce30f4eba419701a0c76bf7a52dbb3ef8304e2acc0cb2c172155ac38d42f35dda
          SSDEEP:1536:eDz/OxtucWiPt0G2b5KM3tcj6w+UqcwCNE:eDz/OxtJWinJQSj7CcwF
          TLSH:36539EB3851C6E64D104C6B4F135DF7DAB47A80A924B2FB679A6C6295007E8CF14B3F8
          File Content Preview:.ELF..............*.......@.4...........4. ...(...............@...@.8...8.....................A...A.................Q.td............................././"O.n........#.*@........#.*@.....o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

          ELF header

          Class:ELF32
          Data:2's complement, little endian
          Version:1 (current)
          Machine:<unknown>
          Version Number:0x1
          Type:EXEC (Executable file)
          OS/ABI:UNIX - System V
          ABI Version:0
          Entry Point Address:0x4001a0
          Flags:0x9
          ELF Header Size:52
          Program Header Offset:52
          Program Header Size:32
          Number of Program Headers:3
          Section Header Offset:66008
          Section Header Size:40
          Number of Section Headers:10
          Header String Table Index:9
          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
          NULL0x00x00x00x00x0000
          .initPROGBITS0x4000940x940x300x00x6AX004
          .textPROGBITS0x4000e00xe00xf2e00x00x6AX0032
          .finiPROGBITS0x40f3c00xf3c00x240x00x6AX004
          .rodataPROGBITS0x40f3e40xf3e40x7540x00x2A004
          .ctorsPROGBITS0x4100000x100000x80x00x3WA004
          .dtorsPROGBITS0x4100080x100080x80x00x3WA004
          .dataPROGBITS0x4100140x100140x1840x00x3WA004
          .bssNOBITS0x4101980x101980x14580x00x3WA004
          .shstrtabSTRTAB0x00x101980x3e0x00x0001
          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
          LOAD0x00x4000000x4000000xfb380xfb386.83170x5R E0x10000.init .text .fini .rodata
          LOAD0x100000x4100000x4100000x1980x15f01.25230x6RW 0x10000.ctors .dtors .data .bss
          GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
          TimestampSource PortDest PortSource IPDest IP
          Dec 15, 2024 14:47:26.090162992 CET329127000192.168.2.1486.104.72.130
          Dec 15, 2024 14:47:26.218414068 CET70003291286.104.72.130192.168.2.14
          Dec 15, 2024 14:47:26.218499899 CET329127000192.168.2.1486.104.72.130
          Dec 15, 2024 14:47:26.218975067 CET329127000192.168.2.1486.104.72.130
          Dec 15, 2024 14:47:26.447402000 CET70003291286.104.72.130192.168.2.14
          Dec 15, 2024 14:47:27.423048019 CET70003291286.104.72.130192.168.2.14
          Dec 15, 2024 14:47:27.423446894 CET329127000192.168.2.1486.104.72.130
          Dec 15, 2024 14:49:07.520786047 CET329127000192.168.2.1486.104.72.130
          Dec 15, 2024 14:49:07.641010046 CET70003291286.104.72.130192.168.2.14
          Dec 15, 2024 14:49:08.074635983 CET70003291286.104.72.130192.168.2.14
          Dec 15, 2024 14:49:08.074961901 CET329127000192.168.2.1486.104.72.130
          TimestampSource PortDest PortSource IPDest IP
          Dec 15, 2024 14:47:24.621665955 CET184783478192.168.2.14172.217.192.127
          Dec 15, 2024 14:47:25.822173119 CET347818478172.217.192.127192.168.2.14
          Dec 15, 2024 14:47:25.843617916 CET5243253192.168.2.14217.160.70.42
          Dec 15, 2024 14:47:26.088550091 CET5352432217.160.70.42192.168.2.14
          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
          Dec 15, 2024 14:47:25.843617916 CET192.168.2.14217.160.70.420x940aStandard query (0)iranistrash.libre16IN (0x0001)false
          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
          Dec 15, 2024 14:47:26.088550091 CET217.160.70.42192.168.2.140x940aNo error (0)iranistrash.libreTXT (Text strings)IN (0x0001)false

          System Behavior

          Start time (UTC):13:47:21
          Start date (UTC):15/12/2024
          Path:/tmp/sh4.elf
          Arguments:/tmp/sh4.elf
          File size:4139976 bytes
          MD5 hash:8943e5f8f8c280467b4472c15ae93ba9

          Start time (UTC):13:47:23
          Start date (UTC):15/12/2024
          Path:/tmp/sh4.elf
          Arguments:-
          File size:4139976 bytes
          MD5 hash:8943e5f8f8c280467b4472c15ae93ba9

          Start time (UTC):13:47:25
          Start date (UTC):15/12/2024
          Path:/tmp/sh4.elf
          Arguments:-
          File size:4139976 bytes
          MD5 hash:8943e5f8f8c280467b4472c15ae93ba9