Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
fenty.arm4.elf

Overview

General Information

Sample name:fenty.arm4.elf
Analysis ID:1578785
MD5:11220ec913121ec4204d2351edb4aaa5
SHA1:421c63fd360bbf0a104b0497c5914864b035cfd5
SHA256:0326d1fb73677ec4620d798179c36bb859a545cb3e68920014efe4083730139f
Tags:user-elfdigest
Infos:

Detection

Mirai
Score:64
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Yara detected Mirai
Sample deletes itself
Sample is packed with UPX
ELF contains segments with high entropy indicating compressed/encrypted content
Sample contains only a LOAD segment without any section mappings
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1578785
Start date and time:2024-12-20 12:51:07 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 34s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:fenty.arm4.elf
Detection:MAL
Classification:mal64.troj.evad.linELF@0/0@0/0
Command:/tmp/fenty.arm4.elf
PID:6223
Exit Code:1
Exit Code Info:
Killed:False
Standard Output:

Standard Error:
  • system is lnxubuntu20
  • fenty.arm4.elf (PID: 6223, Parent: 6138, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/fenty.arm4.elf
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
6223.1.00007f0074017000.00007f0074028000.r-x.sdmpJoeSecurity_Mirai_9Yara detected MiraiJoe Security
    6223.1.00007f0074017000.00007f0074028000.r-x.sdmpMirai_Botnet_MalwareDetects Mirai Botnet MalwareFlorian Roth
    • 0xf268:$x2: /dev/misc/watchdog
    • 0xf258:$x3: /dev/watchdog
    • 0xf2a4:$x3: /dev/watchdog
    • 0xf418:$s1: LCOGQGPTGP
    No Suricata rule has matched

    Click to jump to signature section

    Show All Signature Results
    Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
    Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
    Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
    Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
    Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
    Source: fenty.arm4.elfString found in binary or memory: http://upx.sf.net
    Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443

    System Summary

    barindex
    Source: 6223.1.00007f0074017000.00007f0074028000.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
    Source: LOAD without section mappingsProgram segment: 0x8000
    Source: Initial sampleString containing 'busybox' found: busybox
    Source: 6223.1.00007f0074017000.00007f0074028000.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
    Source: classification engineClassification label: mal64.troj.evad.linELF@0/0@0/0

    Data Obfuscation

    barindex
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

    Hooking and other Techniques for Hiding and Protection

    barindex
    Source: /tmp/fenty.arm4.elf (PID: 6223)File: /tmp/fenty.arm4.elfJump to behavior
    Source: fenty.arm4.elfSubmission file: segment LOAD with 7.7514 entropy (max. 8.0)
    Source: /tmp/fenty.arm4.elf (PID: 6223)Queries kernel information via 'uname': Jump to behavior
    Source: fenty.arm4.elf, 6223.1.00005568a46dd000.00005568a48cb000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
    Source: fenty.arm4.elf, 6223.1.00007fffcccb2000.00007fffcccd3000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
    Source: fenty.arm4.elf, 6223.1.00007fffcccb2000.00007fffcccd3000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/fenty.arm4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/fenty.arm4.elf
    Source: fenty.arm4.elf, 6223.1.00005568a46dd000.00005568a48cb000.rw-.sdmpBinary or memory string: hU!/etc/qemu-binfmt/arm

    Stealing of Sensitive Information

    barindex
    Source: Yara matchFile source: 6223.1.00007f0074017000.00007f0074028000.r-x.sdmp, type: MEMORY

    Remote Access Functionality

    barindex
    Source: Yara matchFile source: 6223.1.00007f0074017000.00007f0074028000.r-x.sdmp, type: MEMORY
    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception11
    Obfuscated Files or Information
    OS Credential Dumping11
    Security Software Discovery
    Remote ServicesData from Local System1
    Encrypted Channel
    Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
    File Deletion
    LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
    Application Layer Protocol
    Exfiltration Over BluetoothNetwork Denial of Service
    No configs have been found
    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand
    SourceDetectionScannerLabelLink
    fenty.arm4.elf11%ReversingLabs
    No Antivirus matches
    No Antivirus matches
    No Antivirus matches
    No contacted domains info
    NameSourceMaliciousAntivirus DetectionReputation
    http://upx.sf.netfenty.arm4.elffalse
      high
      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs
      IPDomainCountryFlagASNASN NameMalicious
      109.202.202.202
      unknownSwitzerland
      13030INIT7CHfalse
      91.189.91.43
      unknownUnited Kingdom
      41231CANONICAL-ASGBfalse
      91.189.91.42
      unknownUnited Kingdom
      41231CANONICAL-ASGBfalse
      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
      • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
      91.189.91.43CONSTANT_STRATEGY.elfGet hashmaliciousSliverBrowse
        10000.elfGet hashmaliciousUnknownBrowse
          la.bot.arc.elfGet hashmaliciousMiraiBrowse
            gnjqwpc.elfGet hashmaliciousMiraiBrowse
              copy_netaddr.elfGet hashmaliciousXmrigBrowse
                wiewa64.elfGet hashmaliciousMiraiBrowse
                  njvwa4.elfGet hashmaliciousMiraiBrowse
                    wrjkngh4.elfGet hashmaliciousMiraiBrowse
                      woega6.elfGet hashmaliciousMiraiBrowse
                        arm5.elfGet hashmaliciousMiraiBrowse
                          91.189.91.42CONSTANT_STRATEGY.elfGet hashmaliciousSliverBrowse
                            10000.elfGet hashmaliciousUnknownBrowse
                              la.bot.arc.elfGet hashmaliciousMiraiBrowse
                                gnjqwpc.elfGet hashmaliciousMiraiBrowse
                                  copy_netaddr.elfGet hashmaliciousXmrigBrowse
                                    wiewa64.elfGet hashmaliciousMiraiBrowse
                                      njvwa4.elfGet hashmaliciousMiraiBrowse
                                        wrjkngh4.elfGet hashmaliciousMiraiBrowse
                                          woega6.elfGet hashmaliciousMiraiBrowse
                                            arm5.elfGet hashmaliciousMiraiBrowse
                                              No context
                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              CANONICAL-ASGBCONSTANT_STRATEGY.elfGet hashmaliciousSliverBrowse
                                              • 91.189.91.42
                                              10000.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              la.bot.arc.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              gnjqwpc.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              copy_netaddr.elfGet hashmaliciousXmrigBrowse
                                              • 91.189.91.42
                                              wiewa64.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              wkb86.elfGet hashmaliciousMiraiBrowse
                                              • 185.125.190.26
                                              njvwa4.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              wrjkngh4.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              woega6.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              CANONICAL-ASGBCONSTANT_STRATEGY.elfGet hashmaliciousSliverBrowse
                                              • 91.189.91.42
                                              10000.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              la.bot.arc.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              gnjqwpc.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              copy_netaddr.elfGet hashmaliciousXmrigBrowse
                                              • 91.189.91.42
                                              wiewa64.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              wkb86.elfGet hashmaliciousMiraiBrowse
                                              • 185.125.190.26
                                              njvwa4.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              wrjkngh4.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              woega6.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              INIT7CHCONSTANT_STRATEGY.elfGet hashmaliciousSliverBrowse
                                              • 109.202.202.202
                                              10000.elfGet hashmaliciousUnknownBrowse
                                              • 109.202.202.202
                                              la.bot.arc.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              gnjqwpc.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              copy_netaddr.elfGet hashmaliciousXmrigBrowse
                                              • 109.202.202.202
                                              wiewa64.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              njvwa4.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              wrjkngh4.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              woega6.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              arm5.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              No context
                                              No context
                                              No created / dropped files found
                                              File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, no section header
                                              Entropy (8bit):7.747989557196288
                                              TrID:
                                              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                              File name:fenty.arm4.elf
                                              File size:32'308 bytes
                                              MD5:11220ec913121ec4204d2351edb4aaa5
                                              SHA1:421c63fd360bbf0a104b0497c5914864b035cfd5
                                              SHA256:0326d1fb73677ec4620d798179c36bb859a545cb3e68920014efe4083730139f
                                              SHA512:14178e7e9af6ee6de28211b7350727a3ae077c0a0dc65f764df56101bf1125ba54e57a5b1be43975be4aa6d419eb7a1ecafc219b5df2cf7b1ac6354fb55bdf3c
                                              SSDEEP:768:xkavW9ZZxjaIGp0h82J0Ag6+M+hIaeasWfupd5cvLdll:x1W9ZuFpI82mA77uqZWfupd52ll
                                              TLSH:BCE2E1DB3BA144C9DE5FC776316E90B6620FD5964C992042AC802C8F399E4EBE75FC41
                                              File Content Preview:.ELF...a..........(.........4...........4. ...(.....................;}..;}...............)...)...)..................Q.td............................~..v1eg!T...................[.........ELF.ra....(........4.....[... .................6.......l...h.....%...

                                              ELF header

                                              Class:ELF32
                                              Data:2's complement, little endian
                                              Version:1 (current)
                                              Machine:ARM
                                              Version Number:0x1
                                              Type:EXEC (Executable file)
                                              OS/ABI:ARM - ABI
                                              ABI Version:0
                                              Entry Point Address:0xf400
                                              Flags:0x202
                                              ELF Header Size:52
                                              Program Header Offset:52
                                              Program Header Size:32
                                              Number of Program Headers:3
                                              Section Header Offset:0
                                              Section Header Size:40
                                              Number of Section Headers:0
                                              Header String Table Index:0
                                              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                              LOAD0x00x80000x80000x7d3b0x7d3b7.75140x5R E0x8000
                                              LOAD0x29d00x229d00x229d00x00x00.00000x6RW 0x8000
                                              GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
                                              TimestampSource PortDest PortSource IPDest IP
                                              Dec 20, 2024 12:51:47.247729063 CET43928443192.168.2.2391.189.91.42
                                              Dec 20, 2024 12:51:52.878854990 CET42836443192.168.2.2391.189.91.43
                                              Dec 20, 2024 12:51:54.414638042 CET4251680192.168.2.23109.202.202.202
                                              Dec 20, 2024 12:52:08.748775005 CET43928443192.168.2.2391.189.91.42
                                              Dec 20, 2024 12:52:18.987454891 CET42836443192.168.2.2391.189.91.43
                                              Dec 20, 2024 12:52:25.130506992 CET4251680192.168.2.23109.202.202.202
                                              Dec 20, 2024 12:52:49.703181982 CET43928443192.168.2.2391.189.91.42

                                              System Behavior

                                              Start time (UTC):11:51:45
                                              Start date (UTC):20/12/2024
                                              Path:/tmp/fenty.arm4.elf
                                              Arguments:/tmp/fenty.arm4.elf
                                              File size:4956856 bytes
                                              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1