Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
i686.elf

Overview

General Information

Sample name:i686.elf
Analysis ID:1575428
MD5:515d44449575fb5f6e1cc10698c09189
SHA1:a27023ffcc67f3ffe6a80f3d8a4b1cca886d363d
SHA256:a262c2a7c581c95058ddfd0bcd30c20e856e036d5170f3c625d76e221db6d882
Tags:elfuser-abuse_ch
Infos:

Detection

Score:72
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Machine Learning detection for sample
Opens /sys/class/net/* files useful for querying network interface information
Performs DNS TXT record lookups
Sample deletes itself
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1575428
Start date and time:2024-12-15 14:58:56 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 58s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:i686.elf
Detection:MAL
Classification:mal72.spyw.evad.linELF@0/0@1/0
Command:/tmp/i686.elf
PID:6280
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Firmware update in progress
Standard Error:
  • system is lnxubuntu20
  • i686.elf (PID: 6280, Parent: 6204, MD5: 515d44449575fb5f6e1cc10698c09189) Arguments: /tmp/i686.elf
    • i686.elf New Fork (PID: 6281, Parent: 6280)
      • i686.elf New Fork (PID: 6282, Parent: 6281)
  • cleanup
SourceRuleDescriptionAuthorStrings
i686.elfLinux_Trojan_Mirai_cc93863bunknownunknown
  • 0xd3c2:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
SourceRuleDescriptionAuthorStrings
6280.1.0000000008048000.0000000008059000.r-x.sdmpLinux_Trojan_Mirai_cc93863bunknownunknown
  • 0xd3c2:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: i686.elfVirustotal: Detection: 15%Perma Link
Source: i686.elfJoe Sandbox ML: detected

Networking

barindex
Source: /tmp/i686.elf (PID: 6281)Opens: /sys/class/net/Jump to behavior
Source: /tmp/i686.elf (PID: 6281)Opens: /sys/class/net/ens160/addressJump to behavior
Source: /tmp/i686.elf (PID: 6281)Opens: /sys/class/net/ens160/flagsJump to behavior
Source: /tmp/i686.elf (PID: 6281)Opens: /sys/class/net/ens160/carrierJump to behavior
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 5.230.33.236
Source: unknownTCP traffic detected without corresponding DNS query: 5.230.33.236
Source: unknownTCP traffic detected without corresponding DNS query: 5.230.33.236
Source: unknownTCP traffic detected without corresponding DNS query: 5.230.33.236
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 5.230.33.236
Source: unknownUDP traffic detected without corresponding DNS query: 172.217.192.127
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: global trafficDNS traffic detected: DNS query: iranistrash.libre
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443

System Summary

barindex
Source: i686.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6280.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: ELF static info symbol of initial sample.symtab present: no
Source: i686.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6280.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: classification engineClassification label: mal72.spyw.evad.linELF@0/0@1/0

Hooking and other Techniques for Hiding and Protection

barindex
Source: /tmp/i686.elf (PID: 6280)File: /tmp/i686.elfJump to behavior
Source: /tmp/i686.elf (PID: 6281)Queries kernel information via 'uname': Jump to behavior

HIPS / PFW / Operating System Protection Evasion

barindex
Source: TrafficDNS traffic detected: queries for: iranistrash.libre
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
File Deletion
OS Credential Dumping1
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
SourceDetectionScannerLabelLink
i686.elf15%VirustotalBrowse
i686.elf11%ReversingLabsLinux.Trojan.Mirai
i686.elf100%Joe Sandbox ML
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
iranistrash.libre
unknown
unknownfalse
    high
    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs
    IPDomainCountryFlagASNASN NameMalicious
    5.230.33.236
    unknownGermany
    12586ASGHOSTNETDEfalse
    109.202.202.202
    unknownSwitzerland
    13030INIT7CHfalse
    172.217.192.127
    unknownUnited States
    15169GOOGLEUSfalse
    91.189.91.42
    unknownUnited Kingdom
    41231CANONICAL-ASGBfalse
    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    5.230.33.236powerpc.elfGet hashmaliciousUnknownBrowse
      109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
      • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
      91.189.91.42mipsel.elfGet hashmaliciousUnknownBrowse
        pulseaudio-helper-x86.elfGet hashmaliciousShikitegaBrowse
          pulseaudio-helper-x64.elfGet hashmaliciousConnectBackBrowse
            arc.elfGet hashmaliciousUnknownBrowse
              armv4eb.elfGet hashmaliciousUnknownBrowse
                sparc.elfGet hashmaliciousUnknownBrowse
                  IGz.arm5.elfGet hashmaliciousMiraiBrowse
                    main_m68k.elfGet hashmaliciousMiraiBrowse
                      main_x86_64.elfGet hashmaliciousMiraiBrowse
                        main_arm6.elfGet hashmaliciousMiraiBrowse
                          No context
                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          CANONICAL-ASGBmipsel.elfGet hashmaliciousUnknownBrowse
                          • 91.189.91.42
                          pulseaudio-helper-x86.elfGet hashmaliciousShikitegaBrowse
                          • 91.189.91.42
                          pulseaudio-helper-x64.elfGet hashmaliciousConnectBackBrowse
                          • 91.189.91.42
                          arc.elfGet hashmaliciousUnknownBrowse
                          • 91.189.91.42
                          armv4eb.elfGet hashmaliciousUnknownBrowse
                          • 91.189.91.42
                          sparc.elfGet hashmaliciousUnknownBrowse
                          • 91.189.91.42
                          IGz.arm5.elfGet hashmaliciousMiraiBrowse
                          • 91.189.91.42
                          main_m68k.elfGet hashmaliciousMiraiBrowse
                          • 91.189.91.42
                          main_mpsl.elfGet hashmaliciousMiraiBrowse
                          • 185.125.190.26
                          main_x86_64.elfGet hashmaliciousMiraiBrowse
                          • 91.189.91.42
                          INIT7CHmipsel.elfGet hashmaliciousUnknownBrowse
                          • 109.202.202.202
                          pulseaudio-helper-x86.elfGet hashmaliciousShikitegaBrowse
                          • 109.202.202.202
                          pulseaudio-helper-x64.elfGet hashmaliciousConnectBackBrowse
                          • 109.202.202.202
                          arc.elfGet hashmaliciousUnknownBrowse
                          • 109.202.202.202
                          armv4eb.elfGet hashmaliciousUnknownBrowse
                          • 109.202.202.202
                          sparc.elfGet hashmaliciousUnknownBrowse
                          • 109.202.202.202
                          IGz.arm5.elfGet hashmaliciousMiraiBrowse
                          • 109.202.202.202
                          main_m68k.elfGet hashmaliciousMiraiBrowse
                          • 109.202.202.202
                          main_x86_64.elfGet hashmaliciousMiraiBrowse
                          • 109.202.202.202
                          main_arm6.elfGet hashmaliciousMiraiBrowse
                          • 109.202.202.202
                          ASGHOSTNETDEarmv5l.elfGet hashmaliciousUnknownBrowse
                          • 5.231.4.240
                          armv6l.elfGet hashmaliciousUnknownBrowse
                          • 5.231.4.240
                          superh.elfGet hashmaliciousUnknownBrowse
                          • 5.231.4.240
                          armv7l.elfGet hashmaliciousUnknownBrowse
                          • 89.144.41.169
                          mipsel.elfGet hashmaliciousUnknownBrowse
                          • 5.231.4.240
                          mipsel64.elfGet hashmaliciousUnknownBrowse
                          • 5.230.251.14
                          powerpc.elfGet hashmaliciousUnknownBrowse
                          • 5.230.33.236
                          jmggnxeedy.elfGet hashmaliciousUnknownBrowse
                          • 94.249.207.54
                          la.bot.mips.elfGet hashmaliciousUnknownBrowse
                          • 94.249.188.214
                          powerpc.nn.elfGet hashmaliciousMirai, OkiruBrowse
                          • 195.200.192.218
                          No context
                          No context
                          No created / dropped files found
                          File type:ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
                          Entropy (8bit):6.330152008160656
                          TrID:
                          • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
                          • ELF Executable and Linkable format (generic) (4004/1) 49.84%
                          File name:i686.elf
                          File size:66'212 bytes
                          MD5:515d44449575fb5f6e1cc10698c09189
                          SHA1:a27023ffcc67f3ffe6a80f3d8a4b1cca886d363d
                          SHA256:a262c2a7c581c95058ddfd0bcd30c20e856e036d5170f3c625d76e221db6d882
                          SHA512:491166e8bc8858c6b83283179e31e12501d19b2c0c80d49a11e5f6b3a6ad5de3b6b66178c91aacbb109e51bfe3719c98e5b0d8f8f8f6db4112c00de04e9b0cd6
                          SSDEEP:768:JD3UKOqcPkfKmL0XSodeE/fg7BWo0vjwZ2nvP3NtA+Th8HRolbzF12LDm3oRyXsg:FkbkiC4J3n8BWDN3ZSS1uyXskmXsU
                          TLSH:AB534CC5B90B81F1D4274A7481ABF67FCF30E57A5020894EEF9CEE39CE77985660424A
                          File Content Preview:.ELF....................h...4...........4. ...(..................... ... ...............$...$...$.......|...........Q.td............................U..S............h........[]...$.............U......=.....t..1....H......H.......u........t...$ ............

                          ELF header

                          Class:ELF32
                          Data:2's complement, little endian
                          Version:1 (current)
                          Machine:Intel 80386
                          Version Number:0x1
                          Type:EXEC (Executable file)
                          OS/ABI:UNIX - System V
                          ABI Version:0
                          Entry Point Address:0x8048168
                          Flags:0x0
                          ELF Header Size:52
                          Program Header Offset:52
                          Program Header Size:32
                          Number of Program Headers:3
                          Section Header Offset:65812
                          Section Header Size:40
                          Number of Section Headers:10
                          Header String Table Index:9
                          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                          NULL0x00x00x00x00x0000
                          .initPROGBITS0x80480940x940x1c0x00x6AX001
                          .textPROGBITS0x80480b00xb00xf5210x00x6AX0016
                          .finiPROGBITS0x80575d10xf5d10x170x00x6AX001
                          .rodataPROGBITS0x80576000xf6000xa200x00x2A0032
                          .ctorsPROGBITS0x80590240x100240x80x00x3WA004
                          .dtorsPROGBITS0x805902c0x1002c0x80x00x3WA004
                          .dataPROGBITS0x80590440x100440x900x00x3WA004
                          .bssNOBITS0x80590e00x100d40x17c00x00x3WA0032
                          .shstrtabSTRTAB0x00x100d40x3e0x00x0001
                          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                          LOAD0x00x80480000x80480000x100200x100206.34810x5R E0x1000.init .text .fini .rodata
                          LOAD0x100240x80590240x80590240xb00x187c2.31510x6RW 0x1000.ctors .dtors .data .bss
                          GNU_STACK0x00x00x00x00x00.00000x6RW 0x4
                          TimestampSource PortDest PortSource IPDest IP
                          Dec 15, 2024 15:00:11.533113956 CET43928443192.168.2.2391.189.91.42
                          Dec 15, 2024 15:00:16.907692909 CET392165223192.168.2.235.230.33.236
                          Dec 15, 2024 15:00:17.027827978 CET5223392165.230.33.236192.168.2.23
                          Dec 15, 2024 15:00:17.027904034 CET392165223192.168.2.235.230.33.236
                          Dec 15, 2024 15:00:17.027956963 CET392165223192.168.2.235.230.33.236
                          Dec 15, 2024 15:00:17.148005009 CET5223392165.230.33.236192.168.2.23
                          Dec 15, 2024 15:00:18.365300894 CET5223392165.230.33.236192.168.2.23
                          Dec 15, 2024 15:00:18.365757942 CET392165223192.168.2.235.230.33.236
                          Dec 15, 2024 15:00:30.218823910 CET4251680192.168.2.23109.202.202.202
                          Dec 15, 2024 15:00:32.266557932 CET43928443192.168.2.2391.189.91.42
                          Dec 15, 2024 15:01:13.220737934 CET43928443192.168.2.2391.189.91.42
                          Dec 15, 2024 15:01:28.408324957 CET392165223192.168.2.235.230.33.236
                          Dec 15, 2024 15:01:28.528120995 CET5223392165.230.33.236192.168.2.23
                          TimestampSource PortDest PortSource IPDest IP
                          Dec 15, 2024 15:00:15.444576979 CET258303478192.168.2.23172.217.192.127
                          Dec 15, 2024 15:00:16.646178961 CET347825830172.217.192.127192.168.2.23
                          Dec 15, 2024 15:00:16.666752100 CET3967153192.168.2.23202.61.197.122
                          Dec 15, 2024 15:00:16.907566071 CET5339671202.61.197.122192.168.2.23
                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                          Dec 15, 2024 15:00:16.666752100 CET192.168.2.23202.61.197.1220xdd72Standard query (0)iranistrash.libre16IN (0x0001)false
                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                          Dec 15, 2024 15:00:16.907566071 CET202.61.197.122192.168.2.230xdd72No error (0)iranistrash.libreTXT (Text strings)IN (0x0001)false

                          System Behavior

                          Start time (UTC):14:00:12
                          Start date (UTC):15/12/2024
                          Path:/tmp/i686.elf
                          Arguments:/tmp/i686.elf
                          File size:66212 bytes
                          MD5 hash:515d44449575fb5f6e1cc10698c09189

                          Start time (UTC):14:00:14
                          Start date (UTC):15/12/2024
                          Path:/tmp/i686.elf
                          Arguments:-
                          File size:66212 bytes
                          MD5 hash:515d44449575fb5f6e1cc10698c09189

                          Start time (UTC):14:00:15
                          Start date (UTC):15/12/2024
                          Path:/tmp/i686.elf
                          Arguments:-
                          File size:66212 bytes
                          MD5 hash:515d44449575fb5f6e1cc10698c09189