Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
JEtXXZfgJc5bFQw_-twqRQ

Overview

General Information

Sample name:JEtXXZfgJc5bFQw_-twqRQ
Analysis ID:1575701
MD5:b0d81ce2bde09174695f7b6968f4919c
SHA1:13634335b4e9b5ea1fcfb0c68ddfcef60a4a5093
SHA256:8eefd119f05cd66661f76f83267d078e6430f395b8437c75441e9609d7fc1dfc
Infos:

Detection

ConnectBack
Score:68
Range:0 - 100
Whitelisted:false

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected ConnectBack
Machine Learning detection for sample
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Sample contains only a LOAD segment without any section mappings
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1575701
Start date and time:2024-12-16 08:22:05 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 3m 52s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 16.04 x64 (Kernel 4.4.0-116, Firefox 88.0, Document Viewer 3.18.2, LibreOffice 5.1.6.2, OpenJDK 1.8.0_171)
Analysis Mode:default
Sample name:JEtXXZfgJc5bFQw_-twqRQ
Detection:MAL
Classification:mal68.troj.lin@0/2@0/0

Runtime Messages

Command:/tmp/JEtXXZfgJc5bFQw_-twqRQ
PID:4682
Exit Code:139
Exit Code Info:SIGSEGV (11) Segmentation fault invalid memory reference
Killed:False
Standard Output:

Standard Error:

Process Tree

  • system is lnxubuntu1
  • JEtXXZfgJc5bFQw_-twqRQ (PID: 4682, Parent: 4587, MD5: b0d81ce2bde09174695f7b6968f4919c) Arguments: /tmp/JEtXXZfgJc5bFQw_-twqRQ
  • upstart New Fork (PID: 4693, Parent: 1656)
  • sh (PID: 4693, Parent: 1656, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: /bin/sh -e /proc/self/fd/9
    • sh New Fork (PID: 4694, Parent: 4693)
    • date (PID: 4694, Parent: 4693, MD5: 54903b613f9019bfca9f5d28a4fff34e) Arguments: date
    • sh New Fork (PID: 4704, Parent: 4693)
    • apport-checkreports (PID: 4704, Parent: 4693, MD5: 1a7d84ebc34df04e55ca3723541f48c9) Arguments: /usr/bin/python3 /usr/share/apport/apport-checkreports --system
  • upstart New Fork (PID: 4714, Parent: 1656)
  • sh (PID: 4714, Parent: 1656, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: /bin/sh -e /proc/self/fd/9
    • sh New Fork (PID: 4715, Parent: 4714)
    • date (PID: 4715, Parent: 4714, MD5: 54903b613f9019bfca9f5d28a4fff34e) Arguments: date
    • sh New Fork (PID: 4728, Parent: 4714)
    • apport-gtk (PID: 4728, Parent: 4714, MD5: ec58a49a30ef6a29406a204f28cc7d87) Arguments: /usr/bin/python3 /usr/share/apport/apport-gtk
  • upstart New Fork (PID: 4735, Parent: 1656)
  • sh (PID: 4735, Parent: 1656, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: /bin/sh -e /proc/self/fd/9
    • sh New Fork (PID: 4736, Parent: 4735)
    • date (PID: 4736, Parent: 4735, MD5: 54903b613f9019bfca9f5d28a4fff34e) Arguments: date
    • sh New Fork (PID: 4741, Parent: 4735)
    • apport-gtk (PID: 4741, Parent: 4735, MD5: ec58a49a30ef6a29406a204f28cc7d87) Arguments: /usr/bin/python3 /usr/share/apport/apport-gtk
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
ConnectBackConnectBack malware is a type of malicious software designed to establish unauthorized connections from an infected system to a remote server. Once a victim's device is compromised, ConnectBack creates a covert channel for communication, allowing the attacker to remotely control and gather sensitive information from the compromised system.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.connectback

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
JEtXXZfgJc5bFQw_-twqRQJoeSecurity_ConnectBackYara detected ConnectBackJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    4682.1.0000000000400000.0000000000401000.rwx.sdmpJoeSecurity_ConnectBackYara detected ConnectBackJoe Security

      Suricata Signatures

      ⊘No Suricata rule has matched

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Found malware configuration
      Source: JEtXXZfgJc5bFQw_-twqRQMalware Configuration Extractor: ConnectBack {"C2": "103.244.89.124:4444"}
      Multi AV Scanner detection for submitted file
      Source: JEtXXZfgJc5bFQw_-twqRQVirustotal: Detection: 43%Perma Link
      Machine Learning detection for sample
      Source: JEtXXZfgJc5bFQw_-twqRQJoe Sandbox ML: detected
      Source: global trafficTCP traffic: 192.168.2.20:44522 -> 103.244.89.124:4444
      Source: unknownTCP traffic detected without corresponding DNS query: 103.244.89.124
      Source: unknownTCP traffic detected without corresponding DNS query: 103.244.89.124
      Source: unknownTCP traffic detected without corresponding DNS query: 103.244.89.124
      Source: unknownTCP traffic detected without corresponding DNS query: 103.244.89.124
      Source: LOAD without section mappingsProgram segment: 0x400000
      Source: classification engineClassification label: mal68.troj.lin@0/2@0/0
      Source: /usr/share/apport/apport-gtk (PID: 4728)Directory: /home/james/.XauthorityJump to behavior
      Source: /usr/share/apport/apport-gtk (PID: 4728)Directory: /home/james/.XauthorityJump to behavior
      Source: /usr/share/apport/apport-gtk (PID: 4741)Directory: /home/james/.XauthorityJump to behavior
      Source: /usr/share/apport/apport-gtk (PID: 4741)Directory: /home/james/.XauthorityJump to behavior
      Source: /usr/share/apport/apport-gtk (PID: 4728)Queries kernel information via 'uname': Jump to behavior
      Source: /usr/share/apport/apport-gtk (PID: 4741)Queries kernel information via 'uname': Jump to behavior

      Stealing of Sensitive Information

      barindex
      Yara detected ConnectBack
      Source: Yara matchFile source: JEtXXZfgJc5bFQw_-twqRQ, type: SAMPLE
      Source: Yara matchFile source: 4682.1.0000000000400000.0000000000401000.rwx.sdmp, type: MEMORY

      Remote Access Functionality

      barindex
      Yara detected ConnectBack
      Source: Yara matchFile source: JEtXXZfgJc5bFQw_-twqRQ, type: SAMPLE
      Source: Yara matchFile source: 4682.1.0000000000400000.0000000000401000.rwx.sdmp, type: MEMORY

      Mitre Att&ck Matrix

      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
      Hidden Files and Directories      		OS Credential Dumping1
      Security Software Discovery      		Remote ServicesData from Local System1
      Non-Standard Port      		Exfiltration Over Other Network MediumAbuse Accessibility Features

      Malware Configuration

      Threatname: ConnectBack

      {"C2": "103.244.89.124:4444"}

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Number of created Files
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1575701 Sample: JEtXXZfgJc5bFQw_-twqRQ Startdate: 16/12/2024 Architecture: LINUX Score: 68 27 103.244.89.124, 4444, 44522 CLOUDIE-AS-APCloudieLimitedHK Hong Kong 2->27 29 Found malware configuration 2->29 31 Multi AV Scanner detection for submitted file 2->31 33 Yara detected ConnectBack 2->33 35 Machine Learning detection for sample 2->35 7 upstart sh 2->7         started        9 upstart sh 2->9         started        11 upstart sh 2->11         started        13 JEtXXZfgJc5bFQw_-twqRQ 2->13         started        signatures3 process4 process5 15 sh date 7->15         started        17 sh apport-checkreports 7->17         started        19 sh date 9->19         started        21 sh apport-gtk 9->21         started        23 sh date 11->23         started        25 sh apport-gtk 11->25         started       

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      JEtXXZfgJc5bFQw_-twqRQ44%VirustotalBrowse
      JEtXXZfgJc5bFQw_-twqRQ100%Joe Sandbox ML

      Dropped Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      ⊘No Antivirus matches

      Domains and IPs

      Contacted Domains

      ⊘No contacted domains info

      World Map of Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public IPs

      IPDomainCountryFlagASNASN NameMalicious
      103.244.89.124
      		unknownHong Kong
      		55933CLOUDIE-AS-APCloudieLimitedHKtrue

      Joe Sandbox View / Context

      IPs

      ⊘No context

      Domains

      ⊘No context

      ASNs

      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      CLOUDIE-AS-APCloudieLimitedHKQMpaV1OK1w.exeGet hashmaliciousCobaltStrike, MetasploitBrowse
      • 103.96.75.36
      file.exeGet hashmaliciousGhostRat, MimikatzBrowse
      • 202.181.25.108
      file.exeGet hashmaliciousUnknownBrowse
      • 202.181.25.108
      la.bot.powerpc.elfGet hashmaliciousMiraiBrowse
      • 45.192.33.233
      botnet.m68k.elfGet hashmaliciousMirai, MoobotBrowse
      • 122.10.88.94
      sora.mpsl.elfGet hashmaliciousMiraiBrowse
      • 144.48.249.121
      la.bot.powerpc.elfGet hashmaliciousUnknownBrowse
      • 103.118.226.120
      bot.mpsl.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
      • 191.96.235.60
      bot.arm5.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
      • 191.96.235.60
      bot.x86.elfGet hashmaliciousMirai, OkiruBrowse
      • 191.96.235.60

      JA3 Fingerprints

      ⊘No context

      Dropped Files

      ⊘No context

      Created / dropped Files

      /var/crash/_usr_share_apport_apport-checkreports.1000.crash

      Download File
      Process:/usr/share/apport/apport-checkreports
      File Type:ASCII text
      Category:dropped
      Size (bytes):14916
      Entropy (8bit):4.687178321221095
      Encrypted:false
      SSDEEP:192:OUqdfhm8+hU2XvNWfUwNErDEEwPZeUzhbm:d5vNWsFEEQA
      MD5:68621E83BD6E65CF4D40FC607EC76325
      SHA1:A1E44BEA2A1995DE09381D8D99A3399E9FFA7BA3
      SHA-256:902B4E10458B75DA6A44E4BB92D5DCFDAEFD4837BE39FC7B685042A4C5CAD390
      SHA-512:FB04A1769259DA9EDC226800AFC892119BA95BAE5C8964E192EBC6A25A3B8ECE5067C4A0DB498BB2D51E956DC975236CDB21072CBE1749D46F29ACE19894D4B5
      Malicious:false
      Reputation:low
      Preview:ProblemType: Crash.Date: Mon Dec 16 01:22:44 2024.ExecutablePath: /usr/share/apport/apport-checkreports.ExecutableTimestamp: 1527175189.InterpreterPath: /usr/bin/python3.5.ProcCmdline: /usr/bin/python3 /usr/share/apport/apport-checkreports --system.ProcCwd: /home/james.ProcEnviron:. LANGUAGE=en_US. PATH=(custom, user). XDG_RUNTIME_DIR=<set>. LANG=en_US.UTF-8. SHELL=/bin/bash.ProcMaps:. 00400000-007aa000 r-xp 00000000 08:01 260422 /usr/bin/python3.5. 009a9000-009ab000 r--p 003a9000 08:01 260422 /usr/bin/python3.5. 009ab000-00a42000 rw-p 003ab000 08:01 260422 /usr/bin/python3.5. 00a42000-00a73000 rw-p 00000000 00:00 0 . 01853000-01bae000 rw-p 00000000 00:00 0 [heap]. 7fbd392ae000-7fbd3942f000 rw-p 00000000 00:00 0 . 7fbd3942f000-7fbd39446000 r-xp 00000000 08:01 262588 /usr/lib/x86_64-linux-gnu/liblz4.so.1.7.1. 7fbd39446000-7fbd39645000 ---p 00017000 08:

      /var/crash/_usr_share_apport_apport-gtk.1000.crash

      Download File
      Process:/usr/share/apport/apport-gtk
      File Type:ASCII text
      Category:dropped
      Size (bytes):47096
      Entropy (8bit):4.495589366711142
      Encrypted:false
      SSDEEP:768:MJTuZN3r2XiHC9YyXzcu+PhWUAERPuSoHMi:gTuZN3r2Xi2Xz8AERPuSoHMi
      MD5:27344099863917A6677C1896A4C63F3C
      SHA1:C2E74E89BEE2888FF43DB177287C04CBFED383B1
      SHA-256:44821F27F8CBB800FA0CECBD3CCECF7033466E82962FD9582B83389ACD6139CC
      SHA-512:DA2791E901850098D2F32BD83926BF287626123D4A57AB32DEE2834B4B2DF710B9A0D64E7DE41527D48D27FB5215584D27303E87C61ED332E849920762024B36
      Malicious:false
      Reputation:low
      Preview:ProblemType: Crash.Date: Mon Dec 16 01:22:45 2024.ExecutablePath: /usr/share/apport/apport-gtk.ExecutableTimestamp: 1527175189.InterpreterPath: /usr/bin/python3.5.ProcCmdline: /usr/bin/python3 /usr/share/apport/apport-gtk.ProcCwd: /home/james.ProcEnviron:. LANGUAGE=en_US. PATH=(custom, user). XDG_RUNTIME_DIR=<set>. LANG=en_US.UTF-8. SHELL=/bin/bash.ProcMaps:. 00400000-007aa000 r-xp 00000000 08:01 260422 /usr/bin/python3.5. 009a9000-009ab000 r--p 003a9000 08:01 260422 /usr/bin/python3.5. 009ab000-00a42000 rw-p 003ab000 08:01 260422 /usr/bin/python3.5. 00a42000-00a73000 rw-p 00000000 00:00 0 . 029d8000-02efa000 rw-p 00000000 00:00 0 [heap]. 7f4a043f4000-7f4a044f4000 rw-p 00000000 00:00 0 . 7f4a044f4000-7f4a0450b000 r-xp 00000000 08:01 262588 /usr/lib/x86_64-linux-gnu/liblz4.so.1.7.1. 7f4a0450b000-7f4a0470a000 ---p 00017000 08:01 262588

      Static File Info

      General

      File type:ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, no section header
      Entropy (8bit):4.25425400144545
      TrID:
      • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
      • ELF Executable and Linkable format (generic) (4004/1) 49.84%
      File name:JEtXXZfgJc5bFQw_-twqRQ
      File size:250 bytes
      MD5:b0d81ce2bde09174695f7b6968f4919c
      SHA1:13634335b4e9b5ea1fcfb0c68ddfcef60a4a5093
      SHA256:8eefd119f05cd66661f76f83267d078e6430f395b8437c75441e9609d7fc1dfc
      SHA512:41af6d55846ad5265103eecc5e597ff8bcef6dc6ea035bd7d33f0c341ff9d3f6a054cd70bc327beb1daa9f7069fdce1f3511f48016dffbfda861915e6bcec095
      SSDEEP:6:BnX//In8/r1uBxHocmT5ZzQ3RQdygg5XJYD:BvwncrAH3m9a532D
      TLSH:5AD080331F0A40DEDFD4163F6574595CD77B8B765749623108A0DC010C096045F62C75
      File Content Preview:.ELF..............>.....x.@.....@...................@.8...........................@.......@.............|...............1.j.X...H..M1.j"AZj.Z..H..xQj.AYPj)X.j._j.^..H..x;H.H....\g.Y|QH..j.Zj*X..YH..y%I..t.Wj#Xj.j.H..H1...YY_H..y.j<Xj._..^j~Z..H..x...

      Static ELF Info

      ELF header

      Class:ELF64
      Data:2's complement, little endian
      Version:1 (current)
      Machine:Advanced Micro Devices X86-64
      Version Number:0x1
      Type:EXEC (Executable file)
      OS/ABI:UNIX - System V
      ABI Version:0
      Entry Point Address:0x400078
      Flags:0x0
      ELF Header Size:64
      Program Header Offset:64
      Program Header Size:56
      Number of Program Headers:1
      Section Header Offset:0
      Section Header Size:0
      Number of Section Headers:0
      Header String Table Index:0

      Program Segments

      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
      LOAD0x00x4000000x4000000xfa0x17c4.25430x7RWE0x1000

      Network Behavior

      Network Port Distribution

      TCP Packets

      TimestampSource PortDest PortSource IPDest IP
      Dec 16, 2024 08:22:41.092853069 CET445224444192.168.2.20103.244.89.124
      Dec 16, 2024 08:22:41.212713003 CET444444522103.244.89.124192.168.2.20
      Dec 16, 2024 08:22:41.212933064 CET445224444192.168.2.20103.244.89.124
      Dec 16, 2024 08:22:43.757102966 CET444444522103.244.89.124192.168.2.20
      Dec 16, 2024 08:22:43.757915974 CET445224444192.168.2.20103.244.89.124
      Dec 16, 2024 08:22:44.833126068 CET445224444192.168.2.20103.244.89.124
      Dec 16, 2024 08:22:44.952860117 CET444444522103.244.89.124192.168.2.20

      System Behavior

      General

      Start time (UTC):07:22:40
      Start date (UTC):16/12/2024
      Path:/tmp/JEtXXZfgJc5bFQw_-twqRQ
      Arguments:/tmp/JEtXXZfgJc5bFQw_-twqRQ
      File size:250 bytes
      MD5 hash:b0d81ce2bde09174695f7b6968f4919c

      General

      Start time (UTC):07:22:43
      Start date (UTC):16/12/2024
      Path:/sbin/upstart
      Arguments:-
      File size:0 bytes
      MD5 hash:unknown

      Chronological Activities


      General

      Start time (UTC):07:22:43
      Start date (UTC):16/12/2024
      Path:/bin/sh
      Arguments:/bin/sh -e /proc/self/fd/9
      File size:4 bytes
      MD5 hash:e02ea3c3450d44126c46d658fa9e654c

      Chronological Activities


      General

      Start time (UTC):07:22:43
      Start date (UTC):16/12/2024
      Path:/bin/sh
      Arguments:-
      File size:4 bytes
      MD5 hash:e02ea3c3450d44126c46d658fa9e654c

      Chronological Activities


      General

      Start time (UTC):07:22:43
      Start date (UTC):16/12/2024
      Path:/bin/date
      Arguments:date
      File size:68464 bytes
      MD5 hash:54903b613f9019bfca9f5d28a4fff34e

      Chronological Activities


      General

      Start time (UTC):07:22:43
      Start date (UTC):16/12/2024
      Path:/bin/sh
      Arguments:-
      File size:4 bytes
      MD5 hash:e02ea3c3450d44126c46d658fa9e654c

      Chronological Activities


      General

      Start time (UTC):07:22:43
      Start date (UTC):16/12/2024
      Path:/usr/share/apport/apport-checkreports
      Arguments:/usr/bin/python3 /usr/share/apport/apport-checkreports --system
      File size:1269 bytes
      MD5 hash:1a7d84ebc34df04e55ca3723541f48c9

      Chronological Activities


      General

      Start time (UTC):07:22:44
      Start date (UTC):16/12/2024
      Path:/sbin/upstart
      Arguments:-
      File size:0 bytes
      MD5 hash:unknown

      Chronological Activities


      General

      Start time (UTC):07:22:44
      Start date (UTC):16/12/2024
      Path:/bin/sh
      Arguments:/bin/sh -e /proc/self/fd/9
      File size:4 bytes
      MD5 hash:e02ea3c3450d44126c46d658fa9e654c

      Chronological Activities


      General

      Start time (UTC):07:22:44
      Start date (UTC):16/12/2024
      Path:/bin/sh
      Arguments:-
      File size:4 bytes
      MD5 hash:e02ea3c3450d44126c46d658fa9e654c

      Chronological Activities


      General

      Start time (UTC):07:22:44
      Start date (UTC):16/12/2024
      Path:/bin/date
      Arguments:date
      File size:68464 bytes
      MD5 hash:54903b613f9019bfca9f5d28a4fff34e

      Chronological Activities


      General

      Start time (UTC):07:22:44
      Start date (UTC):16/12/2024
      Path:/bin/sh
      Arguments:-
      File size:4 bytes
      MD5 hash:e02ea3c3450d44126c46d658fa9e654c

      Chronological Activities


      General

      Start time (UTC):07:22:44
      Start date (UTC):16/12/2024
      Path:/usr/share/apport/apport-gtk
      Arguments:/usr/bin/python3 /usr/share/apport/apport-gtk
      File size:23806 bytes
      MD5 hash:ec58a49a30ef6a29406a204f28cc7d87

      Chronological Activities


      General

      Start time (UTC):07:22:45
      Start date (UTC):16/12/2024
      Path:/sbin/upstart
      Arguments:-
      File size:0 bytes
      MD5 hash:unknown

      Chronological Activities


      General

      Start time (UTC):07:22:45
      Start date (UTC):16/12/2024
      Path:/bin/sh
      Arguments:/bin/sh -e /proc/self/fd/9
      File size:4 bytes
      MD5 hash:e02ea3c3450d44126c46d658fa9e654c

      Chronological Activities


      General

      Start time (UTC):07:22:45
      Start date (UTC):16/12/2024
      Path:/bin/sh
      Arguments:-
      File size:4 bytes
      MD5 hash:e02ea3c3450d44126c46d658fa9e654c

      Chronological Activities


      General

      Start time (UTC):07:22:45
      Start date (UTC):16/12/2024
      Path:/bin/date
      Arguments:date
      File size:68464 bytes
      MD5 hash:54903b613f9019bfca9f5d28a4fff34e

      Chronological Activities


      General

      Start time (UTC):07:22:45
      Start date (UTC):16/12/2024
      Path:/bin/sh
      Arguments:-
      File size:4 bytes
      MD5 hash:e02ea3c3450d44126c46d658fa9e654c

      Chronological Activities


      General

      Start time (UTC):07:22:45
      Start date (UTC):16/12/2024
      Path:/usr/share/apport/apport-gtk
      Arguments:/usr/bin/python3 /usr/share/apport/apport-gtk
      File size:23806 bytes
      MD5 hash:ec58a49a30ef6a29406a204f28cc7d87

      Chronological Activities