Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
armv5l.elf

Overview

General Information

Sample name:armv5l.elf
Analysis ID:1575424
MD5:830776d8357e4f1c6101dc76a1a6b2ca
SHA1:26f0d2ec318ecae87f37d477e4a623e2ee9e7f77
SHA256:3d73a5656daaa94feb4ae135f78cfc6341e1de9cc730b28f8fbf91fd315a484d
Tags:elfuser-abuse_ch
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Opens /sys/class/net/* files useful for querying network interface information
Performs DNS TXT record lookups
Sample deletes itself
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1575424
Start date and time:2024-12-15 14:55:02 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 21s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:armv5l.elf
Detection:MAL
Classification:mal60.spyw.evad.linELF@0/0@1/0
Command:/tmp/armv5l.elf
PID:5525
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Firmware update in progress
Standard Error:
  • system is lnxubuntu20
  • armv5l.elf (PID: 5525, Parent: 5450, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/armv5l.elf
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: armv5l.elfReversingLabs: Detection: 13%

Networking

barindex
Source: /tmp/armv5l.elf (PID: 5527)Opens: /sys/class/net/Jump to behavior
Source: /tmp/armv5l.elf (PID: 5527)Opens: /sys/class/net/ens160/addressJump to behavior
Source: /tmp/armv5l.elf (PID: 5527)Opens: /sys/class/net/ens160/flagsJump to behavior
Source: /tmp/armv5l.elf (PID: 5527)Opens: /sys/class/net/ens160/carrierJump to behavior
Source: global trafficTCP traffic: 192.168.2.15:38182 -> 5.231.4.240:7777
Source: unknownTCP traffic detected without corresponding DNS query: 5.231.4.240
Source: unknownTCP traffic detected without corresponding DNS query: 5.231.4.240
Source: unknownTCP traffic detected without corresponding DNS query: 5.231.4.240
Source: unknownTCP traffic detected without corresponding DNS query: 5.231.4.240
Source: unknownTCP traffic detected without corresponding DNS query: 5.231.4.240
Source: unknownUDP traffic detected without corresponding DNS query: 172.217.192.127
Source: unknownUDP traffic detected without corresponding DNS query: 65.21.1.106
Source: global trafficDNS traffic detected: DNS query: iranistrash.libre
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal60.spyw.evad.linELF@0/0@1/0

Hooking and other Techniques for Hiding and Protection

barindex
Source: /tmp/armv5l.elf (PID: 5525)File: /tmp/armv5l.elfJump to behavior
Source: /tmp/armv5l.elf (PID: 5525)Queries kernel information via 'uname': Jump to behavior
Source: /tmp/armv5l.elf (PID: 5527)Queries kernel information via 'uname': Jump to behavior
Source: armv5l.elf, 5525.1.000055dd98d4c000.000055dd98e7a000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
Source: armv5l.elf, 5525.1.000055dd98d4c000.000055dd98e7a000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: armv5l.elf, 5525.1.00007ffc5959a000.00007ffc595bb000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
Source: armv5l.elf, 5525.1.00007ffc5959a000.00007ffc595bb000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/armv5l.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/armv5l.elf

HIPS / PFW / Operating System Protection Evasion

barindex
Source: TrafficDNS traffic detected: queries for: iranistrash.libre
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
File Deletion
OS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local System1
Non-Standard Port
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
armv5l.elf13%ReversingLabsLinux.Trojan.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
iranistrash.libre
unknown
unknownfalse
    high
    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs
    IPDomainCountryFlagASNASN NameMalicious
    5.231.4.240
    unknownGermany
    12586ASGHOSTNETDEfalse
    172.217.192.127
    unknownUnited States
    15169GOOGLEUSfalse
    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    5.231.4.240armv6l.elfGet hashmaliciousUnknownBrowse
      superh.elfGet hashmaliciousUnknownBrowse
        mipsel.elfGet hashmaliciousUnknownBrowse
          No context
          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          ASGHOSTNETDEarmv6l.elfGet hashmaliciousUnknownBrowse
          • 5.231.4.240
          superh.elfGet hashmaliciousUnknownBrowse
          • 5.231.4.240
          armv7l.elfGet hashmaliciousUnknownBrowse
          • 89.144.41.169
          mipsel.elfGet hashmaliciousUnknownBrowse
          • 5.231.4.240
          mipsel64.elfGet hashmaliciousUnknownBrowse
          • 5.230.251.14
          powerpc.elfGet hashmaliciousUnknownBrowse
          • 5.230.33.236
          jmggnxeedy.elfGet hashmaliciousUnknownBrowse
          • 94.249.207.54
          la.bot.mips.elfGet hashmaliciousUnknownBrowse
          • 94.249.188.214
          powerpc.nn.elfGet hashmaliciousMirai, OkiruBrowse
          • 195.200.192.218
          arm5.elfGet hashmaliciousUnknownBrowse
          • 5.83.147.14
          No context
          No context
          No created / dropped files found
          File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
          Entropy (8bit):6.06885987902641
          TrID:
          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
          File name:armv5l.elf
          File size:67'108 bytes
          MD5:830776d8357e4f1c6101dc76a1a6b2ca
          SHA1:26f0d2ec318ecae87f37d477e4a623e2ee9e7f77
          SHA256:3d73a5656daaa94feb4ae135f78cfc6341e1de9cc730b28f8fbf91fd315a484d
          SHA512:c6e1a496dfad7f7d55bf72e3245a87ae97b9be0e4a392fb7dce884d7ad7fb12d364414b910426f269d8556a4320c65525eaf463207d6f226f8394b5a2dda682f
          SSDEEP:768:6376gbLDvOSIIfM6VOP/nYVHpyNM26dBAno6LufZVawJUlNd6AZXyT7JxHLMfoIM:zcLzfR+MyNM26rAnoQuhhJW6AIvJxgc
          TLSH:2A6328867D818A12C9E43277FA1E42CD376227E8E2DE32178D225F55B7CAC2B0D37651
          File Content Preview:.ELF...a..........(.........4...l.......4. ...(.....................................................................Q.td..................................-...L."....>..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

          ELF header

          Class:ELF32
          Data:2's complement, little endian
          Version:1 (current)
          Machine:ARM
          Version Number:0x1
          Type:EXEC (Executable file)
          OS/ABI:ARM - ABI
          ABI Version:0
          Entry Point Address:0x8190
          Flags:0x2
          ELF Header Size:52
          Program Header Offset:52
          Program Header Size:32
          Number of Program Headers:3
          Section Header Offset:66668
          Section Header Size:40
          Number of Section Headers:11
          Header String Table Index:10
          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
          NULL0x00x00x00x00x0000
          .initPROGBITS0x80940x940x180x00x6AX004
          .textPROGBITS0x80b00xb00xfa6c0x00x6AX0016
          .finiPROGBITS0x17b1c0xfb1c0x140x00x6AX004
          .rodataPROGBITS0x17b300xfb300x7540x00x2A004
          .eh_framePROGBITS0x182840x102840x40x00x2A004
          .ctorsPROGBITS0x202880x102880x80x00x3WA004
          .dtorsPROGBITS0x202900x102900x80x00x3WA004
          .dataPROGBITS0x2029c0x1029c0x1880x00x3WA004
          .bssNOBITS0x204240x104240x14580x00x3WA004
          .shstrtabSTRTAB0x00x104240x480x00x0001
          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
          LOAD0x00x80000x80000x102880x102886.09600x5R E0x8000.init .text .fini .rodata .eh_frame
          LOAD0x102880x202880x202880x19c0x15f41.24720x6RW 0x8000.ctors .dtors .data .bss
          GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
          TimestampSource PortDest PortSource IPDest IP
          Dec 15, 2024 14:55:45.406306982 CET381827777192.168.2.155.231.4.240
          Dec 15, 2024 14:55:45.526374102 CET7777381825.231.4.240192.168.2.15
          Dec 15, 2024 14:55:45.526632071 CET381827777192.168.2.155.231.4.240
          Dec 15, 2024 14:55:45.527065992 CET381827777192.168.2.155.231.4.240
          Dec 15, 2024 14:55:45.646892071 CET7777381825.231.4.240192.168.2.15
          Dec 15, 2024 14:55:46.889523983 CET7777381825.231.4.240192.168.2.15
          Dec 15, 2024 14:55:46.889715910 CET381827777192.168.2.155.231.4.240
          Dec 15, 2024 14:56:56.959445000 CET381827777192.168.2.155.231.4.240
          Dec 15, 2024 14:56:57.079905033 CET7777381825.231.4.240192.168.2.15
          TimestampSource PortDest PortSource IPDest IP
          Dec 15, 2024 14:55:43.919951916 CET251683478192.168.2.15172.217.192.127
          Dec 15, 2024 14:55:45.120307922 CET347825168172.217.192.127192.168.2.15
          Dec 15, 2024 14:55:45.139931917 CET5078453192.168.2.1565.21.1.106
          Dec 15, 2024 14:55:45.404457092 CET535078465.21.1.106192.168.2.15
          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
          Dec 15, 2024 14:55:45.139931917 CET192.168.2.1565.21.1.1060xe32dStandard query (0)iranistrash.libre16IN (0x0001)false
          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
          Dec 15, 2024 14:55:45.404457092 CET65.21.1.106192.168.2.150xe32dNo error (0)iranistrash.libreTXT (Text strings)IN (0x0001)false

          System Behavior

          Start time (UTC):13:55:40
          Start date (UTC):15/12/2024
          Path:/tmp/armv5l.elf
          Arguments:/tmp/armv5l.elf
          File size:4956856 bytes
          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

          Start time (UTC):13:55:43
          Start date (UTC):15/12/2024
          Path:/tmp/armv5l.elf
          Arguments:-
          File size:4956856 bytes
          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

          Start time (UTC):13:55:44
          Start date (UTC):15/12/2024
          Path:/tmp/armv5l.elf
          Arguments:-
          File size:4956856 bytes
          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1