Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
mipsel.elf

Overview

General Information

Sample name:mipsel.elf
Analysis ID:1575423
MD5:d15ce7de0614c7af039f8de842623984
SHA1:0383d66a35c7d00692c3993c4911ca940bc33739
SHA256:86ba81725dc4638d6ef969cbfe5ccdf1718f19a636aa60037a456450c7b6ca34
Tags:elfuser-abuse_ch
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Opens /sys/class/net/* files useful for querying network interface information
Performs DNS TXT record lookups
Sample deletes itself
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1575423
Start date and time:2024-12-15 14:54:52 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 44s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:mipsel.elf
Detection:MAL
Classification:mal60.spyw.evad.linELF@0/0@1/0
Command:/tmp/mipsel.elf
PID:6240
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Firmware update in progress
Standard Error:
  • system is lnxubuntu20
  • mipsel.elf (PID: 6240, Parent: 6166, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/mipsel.elf
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: mipsel.elfReversingLabs: Detection: 13%

Networking

barindex
Source: /tmp/mipsel.elf (PID: 6244)Opens: /sys/class/net/Jump to behavior
Source: /tmp/mipsel.elf (PID: 6244)Opens: /sys/class/net/ens160/addressJump to behavior
Source: /tmp/mipsel.elf (PID: 6244)Opens: /sys/class/net/ens160/flagsJump to behavior
Source: /tmp/mipsel.elf (PID: 6244)Opens: /sys/class/net/ens160/carrierJump to behavior
Source: global trafficTCP traffic: 192.168.2.23:36476 -> 103.35.190.176:5222
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 103.35.190.176
Source: unknownTCP traffic detected without corresponding DNS query: 103.35.190.176
Source: unknownTCP traffic detected without corresponding DNS query: 103.35.190.176
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 103.35.190.176
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 103.35.190.176
Source: unknownTCP traffic detected without corresponding DNS query: 103.35.190.176
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownUDP traffic detected without corresponding DNS query: 172.217.192.127
Source: unknownUDP traffic detected without corresponding DNS query: 65.21.1.106
Source: global trafficDNS traffic detected: DNS query: iranistrash.libre
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal60.spyw.evad.linELF@0/0@1/0

Hooking and other Techniques for Hiding and Protection

barindex
Source: /tmp/mipsel.elf (PID: 6240)File: /tmp/mipsel.elfJump to behavior
Source: /tmp/mipsel.elf (PID: 6240)Queries kernel information via 'uname': Jump to behavior
Source: /tmp/mipsel.elf (PID: 6244)Queries kernel information via 'uname': Jump to behavior
Source: mipsel.elf, 6240.1.000055fee74ba000.000055fee7541000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mipsel
Source: mipsel.elf, 6240.1.00007ffdc6738000.00007ffdc6759000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/mipsel.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mipsel.elf
Source: mipsel.elf, 6240.1.000055fee74ba000.000055fee7541000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/mipsel
Source: mipsel.elf, 6240.1.00007ffdc6738000.00007ffdc6759000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mipsel

HIPS / PFW / Operating System Protection Evasion

barindex
Source: TrafficDNS traffic detected: queries for: iranistrash.libre
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
File Deletion
OS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Standard Port
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Non-Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture2
Application Layer Protocol
Traffic DuplicationData Destruction
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
SourceDetectionScannerLabelLink
mipsel.elf13%ReversingLabsLinux.Backdoor.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
iranistrash.libre
unknown
unknownfalse
    high
    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs
    IPDomainCountryFlagASNASN NameMalicious
    103.35.190.176
    unknownJapan2519VECTANTARTERIANetworksCorporationJPfalse
    109.202.202.202
    unknownSwitzerland
    13030INIT7CHfalse
    172.217.192.127
    unknownUnited States
    15169GOOGLEUSfalse
    91.189.91.43
    unknownUnited Kingdom
    41231CANONICAL-ASGBfalse
    91.189.91.42
    unknownUnited Kingdom
    41231CANONICAL-ASGBfalse
    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
    • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
    91.189.91.43pulseaudio-helper-x86.elfGet hashmaliciousShikitegaBrowse
      pulseaudio-helper-x64.elfGet hashmaliciousConnectBackBrowse
        arc.elfGet hashmaliciousUnknownBrowse
          armv4eb.elfGet hashmaliciousUnknownBrowse
            sparc.elfGet hashmaliciousUnknownBrowse
              IGz.arm5.elfGet hashmaliciousMiraiBrowse
                main_m68k.elfGet hashmaliciousMiraiBrowse
                  main_x86_64.elfGet hashmaliciousMiraiBrowse
                    main_arm6.elfGet hashmaliciousMiraiBrowse
                      hidakibest.mips.elfGet hashmaliciousGafgyt, MiraiBrowse
                        91.189.91.42pulseaudio-helper-x86.elfGet hashmaliciousShikitegaBrowse
                          pulseaudio-helper-x64.elfGet hashmaliciousConnectBackBrowse
                            arc.elfGet hashmaliciousUnknownBrowse
                              armv4eb.elfGet hashmaliciousUnknownBrowse
                                sparc.elfGet hashmaliciousUnknownBrowse
                                  IGz.arm5.elfGet hashmaliciousMiraiBrowse
                                    main_m68k.elfGet hashmaliciousMiraiBrowse
                                      main_x86_64.elfGet hashmaliciousMiraiBrowse
                                        main_arm6.elfGet hashmaliciousMiraiBrowse
                                          hidakibest.mips.elfGet hashmaliciousGafgyt, MiraiBrowse
                                            No context
                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                            CANONICAL-ASGBpulseaudio-helper-x86.elfGet hashmaliciousShikitegaBrowse
                                            • 91.189.91.42
                                            pulseaudio-helper-x64.elfGet hashmaliciousConnectBackBrowse
                                            • 91.189.91.42
                                            arc.elfGet hashmaliciousUnknownBrowse
                                            • 91.189.91.42
                                            armv4eb.elfGet hashmaliciousUnknownBrowse
                                            • 91.189.91.42
                                            sparc.elfGet hashmaliciousUnknownBrowse
                                            • 91.189.91.42
                                            IGz.arm5.elfGet hashmaliciousMiraiBrowse
                                            • 91.189.91.42
                                            main_m68k.elfGet hashmaliciousMiraiBrowse
                                            • 91.189.91.42
                                            main_mpsl.elfGet hashmaliciousMiraiBrowse
                                            • 185.125.190.26
                                            main_x86_64.elfGet hashmaliciousMiraiBrowse
                                            • 91.189.91.42
                                            main_ppc.elfGet hashmaliciousMiraiBrowse
                                            • 185.125.190.26
                                            CANONICAL-ASGBpulseaudio-helper-x86.elfGet hashmaliciousShikitegaBrowse
                                            • 91.189.91.42
                                            pulseaudio-helper-x64.elfGet hashmaliciousConnectBackBrowse
                                            • 91.189.91.42
                                            arc.elfGet hashmaliciousUnknownBrowse
                                            • 91.189.91.42
                                            armv4eb.elfGet hashmaliciousUnknownBrowse
                                            • 91.189.91.42
                                            sparc.elfGet hashmaliciousUnknownBrowse
                                            • 91.189.91.42
                                            IGz.arm5.elfGet hashmaliciousMiraiBrowse
                                            • 91.189.91.42
                                            main_m68k.elfGet hashmaliciousMiraiBrowse
                                            • 91.189.91.42
                                            main_mpsl.elfGet hashmaliciousMiraiBrowse
                                            • 185.125.190.26
                                            main_x86_64.elfGet hashmaliciousMiraiBrowse
                                            • 91.189.91.42
                                            main_ppc.elfGet hashmaliciousMiraiBrowse
                                            • 185.125.190.26
                                            INIT7CHpulseaudio-helper-x86.elfGet hashmaliciousShikitegaBrowse
                                            • 109.202.202.202
                                            pulseaudio-helper-x64.elfGet hashmaliciousConnectBackBrowse
                                            • 109.202.202.202
                                            arc.elfGet hashmaliciousUnknownBrowse
                                            • 109.202.202.202
                                            armv4eb.elfGet hashmaliciousUnknownBrowse
                                            • 109.202.202.202
                                            sparc.elfGet hashmaliciousUnknownBrowse
                                            • 109.202.202.202
                                            IGz.arm5.elfGet hashmaliciousMiraiBrowse
                                            • 109.202.202.202
                                            main_m68k.elfGet hashmaliciousMiraiBrowse
                                            • 109.202.202.202
                                            main_x86_64.elfGet hashmaliciousMiraiBrowse
                                            • 109.202.202.202
                                            main_arm6.elfGet hashmaliciousMiraiBrowse
                                            • 109.202.202.202
                                            hidakibest.mips.elfGet hashmaliciousGafgyt, MiraiBrowse
                                            • 109.202.202.202
                                            VECTANTARTERIANetworksCorporationJParmv6l.elfGet hashmaliciousMiraiBrowse
                                            • 122.222.53.192
                                            armv7l.elfGet hashmaliciousMiraiBrowse
                                            • 36.2.2.159
                                            armv6l.elfGet hashmaliciousUnknownBrowse
                                            • 115.179.195.14
                                            IGz.arm7.elfGet hashmaliciousMiraiBrowse
                                            • 122.222.149.128
                                            loligang.arm.elfGet hashmaliciousMiraiBrowse
                                            • 220.158.63.63
                                            2.elfGet hashmaliciousUnknownBrowse
                                            • 157.250.108.34
                                            mpsl.elfGet hashmaliciousMirai, MoobotBrowse
                                            • 157.14.224.60
                                            rebirth.spc.elfGet hashmaliciousMirai, OkiruBrowse
                                            • 122.222.149.142
                                            la.bot.sparc.elfGet hashmaliciousMiraiBrowse
                                            • 122.223.193.108
                                            Fantazy.i686.elfGet hashmaliciousUnknownBrowse
                                            • 210.170.44.74
                                            No context
                                            No context
                                            No created / dropped files found
                                            File type:ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
                                            Entropy (8bit):5.457542853440533
                                            TrID:
                                            • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                            File name:mipsel.elf
                                            File size:92'288 bytes
                                            MD5:d15ce7de0614c7af039f8de842623984
                                            SHA1:0383d66a35c7d00692c3993c4911ca940bc33739
                                            SHA256:86ba81725dc4638d6ef969cbfe5ccdf1718f19a636aa60037a456450c7b6ca34
                                            SHA512:64dbc04ff0be608587cc9e6ebfe9f0d779c7602f7589939c73b3be6b123ebc74b1e097502e166c1090d851e434314d0b7dbbf9fd7e293caf02beca510f35d2fd
                                            SSDEEP:1536:Zyd7X0WVOBWy326dTWl8uU0ZqkBB+eiH4gGgwVOPWKAjh7:Z4r8Wm26dTWycqk2jr2
                                            TLSH:8F93D505BF510FB7E86FCD374AE91B02158D961A22A97F367E34DC18F64B64B09E3860
                                            File Content Preview:.ELF....................`.@.4....f......4. ...(...............@...@..[...[...............`...`E..`E.T...............Q.td...............................<<..'!......'.......................<...'!... .........9'.. ........................<...'!...........@S9

                                            ELF header

                                            Class:ELF32
                                            Data:2's complement, little endian
                                            Version:1 (current)
                                            Machine:MIPS R3000
                                            Version Number:0x1
                                            Type:EXEC (Executable file)
                                            OS/ABI:UNIX - System V
                                            ABI Version:0
                                            Entry Point Address:0x400260
                                            Flags:0x1007
                                            ELF Header Size:52
                                            Program Header Offset:52
                                            Program Header Size:32
                                            Number of Program Headers:3
                                            Section Header Offset:91808
                                            Section Header Size:40
                                            Number of Section Headers:12
                                            Header String Table Index:11
                                            NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                            NULL0x00x00x00x00x0000
                                            .initPROGBITS0x4000940x940x8c0x00x6AX004
                                            .textPROGBITS0x4001200x1200x152900x00x6AX0016
                                            .finiPROGBITS0x4153b00x153b00x5c0x00x6AX004
                                            .rodataPROGBITS0x4154100x154100x7e00x00x2A0016
                                            .ctorsPROGBITS0x4560000x160000x80x00x3WA004
                                            .dtorsPROGBITS0x4560080x160080x80x00x3WA004
                                            .dataPROGBITS0x4560200x160200x1b80x00x3WA0016
                                            .gotPROGBITS0x4561e00x161e00x4740x40x10000003WAp0016
                                            .sbssNOBITS0x4566540x166540x80x00x10000003WAp004
                                            .bssNOBITS0x4566600x166540x14940x00x3WA0016
                                            .shstrtabSTRTAB0x00x166540x490x00x0001
                                            TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                            LOAD0x00x4000000x4000000x15bf00x15bf05.51710x5R E0x10000.init .text .fini .rodata
                                            LOAD0x160000x4560000x4560000x6540x1af43.56870x6RW 0x10000.ctors .dtors .data .got .sbss .bss
                                            GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
                                            TimestampSource PortDest PortSource IPDest IP
                                            Dec 15, 2024 14:55:42.755728960 CET43928443192.168.2.2391.189.91.42
                                            Dec 15, 2024 14:55:47.660505056 CET364765222192.168.2.23103.35.190.176
                                            Dec 15, 2024 14:55:47.780894995 CET522236476103.35.190.176192.168.2.23
                                            Dec 15, 2024 14:55:47.780956030 CET364765222192.168.2.23103.35.190.176
                                            Dec 15, 2024 14:55:47.781367064 CET364765222192.168.2.23103.35.190.176
                                            Dec 15, 2024 14:55:47.901179075 CET522236476103.35.190.176192.168.2.23
                                            Dec 15, 2024 14:55:48.386893034 CET42836443192.168.2.2391.189.91.43
                                            Dec 15, 2024 14:55:48.991697073 CET522236476103.35.190.176192.168.2.23
                                            Dec 15, 2024 14:55:48.992276907 CET364765222192.168.2.23103.35.190.176
                                            Dec 15, 2024 14:55:49.154782057 CET4251680192.168.2.23109.202.202.202
                                            Dec 15, 2024 14:56:04.000914097 CET43928443192.168.2.2391.189.91.42
                                            Dec 15, 2024 14:56:14.239559889 CET42836443192.168.2.2391.189.91.43
                                            Dec 15, 2024 14:56:20.382539034 CET4251680192.168.2.23109.202.202.202
                                            Dec 15, 2024 14:56:44.955277920 CET43928443192.168.2.2391.189.91.42
                                            Dec 15, 2024 14:56:59.031723022 CET364765222192.168.2.23103.35.190.176
                                            Dec 15, 2024 14:56:59.151906967 CET522236476103.35.190.176192.168.2.23
                                            Dec 15, 2024 14:56:59.349208117 CET522236476103.35.190.176192.168.2.23
                                            Dec 15, 2024 14:56:59.349431992 CET364765222192.168.2.23103.35.190.176
                                            Dec 15, 2024 14:57:05.432353020 CET42836443192.168.2.2391.189.91.43
                                            TimestampSource PortDest PortSource IPDest IP
                                            Dec 15, 2024 14:55:46.074331045 CET42053478192.168.2.23172.217.192.127
                                            Dec 15, 2024 14:55:47.301932096 CET34784205172.217.192.127192.168.2.23
                                            Dec 15, 2024 14:55:47.385883093 CET5034153192.168.2.2365.21.1.106
                                            Dec 15, 2024 14:55:47.650218010 CET535034165.21.1.106192.168.2.23
                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                            Dec 15, 2024 14:55:47.385883093 CET192.168.2.2365.21.1.1060x3042Standard query (0)iranistrash.libre16IN (0x0001)false
                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                            Dec 15, 2024 14:55:47.650218010 CET65.21.1.106192.168.2.230x3042No error (0)iranistrash.libreTXT (Text strings)IN (0x0001)false

                                            System Behavior

                                            Start time (UTC):13:55:42
                                            Start date (UTC):15/12/2024
                                            Path:/tmp/mipsel.elf
                                            Arguments:/tmp/mipsel.elf
                                            File size:5773336 bytes
                                            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                                            Start time (UTC):13:55:44
                                            Start date (UTC):15/12/2024
                                            Path:/tmp/mipsel.elf
                                            Arguments:-
                                            File size:5773336 bytes
                                            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                                            Start time (UTC):13:55:46
                                            Start date (UTC):15/12/2024
                                            Path:/tmp/mipsel.elf
                                            Arguments:-
                                            File size:5773336 bytes
                                            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9