Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
arm6.elf

Overview

General Information

Sample name:arm6.elf
Analysis ID:1579067
MD5:7e4b2fac3e1e300943387f54043dd25a
SHA1:7132ff5fa21d815523e963da2cb6b329f377ca80
SHA256:3ecb7e22d91cb6f232bbb15d2b471321b67c9ec9bbe8badf44813a2f71f9b8c5
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:64
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1579067
Start date and time:2024-12-20 19:01:07 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 34s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:arm6.elf
Detection:MAL
Classification:mal64.troj.linELF@0/0@0/0
  • VT rate limit hit for: arm6.elf
Command:/tmp/arm6.elf
PID:6231
Exit Code:139
Exit Code Info:SIGSEGV (11) Segmentation fault invalid memory reference
Killed:False
Standard Output:

Standard Error:qemu: uncaught target signal 11 (Segmentation fault) - core dumped
  • system is lnxubuntu20
  • arm6.elf (PID: 6231, Parent: 6154, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm6.elf
  • dash New Fork (PID: 6232, Parent: 4333)
  • rm (PID: 6232, Parent: 4333, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.0nwr0g4Qis /tmp/tmp.eBbhJ7Ldau /tmp/tmp.5Ap0wwvTwk
  • dash New Fork (PID: 6233, Parent: 4333)
  • rm (PID: 6233, Parent: 4333, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.0nwr0g4Qis /tmp/tmp.eBbhJ7Ldau /tmp/tmp.5Ap0wwvTwk
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
arm6.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    SourceRuleDescriptionAuthorStrings
    6231.1.00007f1510017000.00007f151002c000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      No Suricata rule has matched

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Source: arm6.elfAvira: detected
      Source: arm6.elfReversingLabs: Detection: 36%
      Source: unknownTCP traffic detected without corresponding DNS query: 54.171.230.55
      Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
      Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
      Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
      Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
      Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
      Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
      Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 33606
      Source: unknownNetwork traffic detected: HTTP traffic on port 33606 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
      Source: ELF static info symbol of initial sample.symtab present: no
      Source: classification engineClassification label: mal64.troj.linELF@0/0@0/0
      Source: /usr/bin/dash (PID: 6232)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.0nwr0g4Qis /tmp/tmp.eBbhJ7Ldau /tmp/tmp.5Ap0wwvTwkJump to behavior
      Source: /usr/bin/dash (PID: 6233)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.0nwr0g4Qis /tmp/tmp.eBbhJ7Ldau /tmp/tmp.5Ap0wwvTwkJump to behavior
      Source: /tmp/arm6.elf (PID: 6231)Queries kernel information via 'uname': Jump to behavior
      Source: arm6.elf, 6231.1.0000563d6370b000.0000563d63839000.rw-.sdmpBinary or memory string: #rc=VP%rc=VP"rc=V!/etc/qemu-binfmt/arm
      Source: arm6.elf, 6231.1.0000563d6370b000.0000563d63839000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
      Source: arm6.elf, 6231.1.00007ffd661e1000.00007ffd66202000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
      Source: arm6.elf, 6231.1.00007ffd661e1000.00007ffd66202000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm6.elf
      Source: arm6.elf, 6231.1.00007ffd661e1000.00007ffd66202000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

      Stealing of Sensitive Information

      barindex
      Source: Yara matchFile source: arm6.elf, type: SAMPLE
      Source: Yara matchFile source: 6231.1.00007f1510017000.00007f151002c000.r-x.sdmp, type: MEMORY

      Remote Access Functionality

      barindex
      Source: Yara matchFile source: arm6.elf, type: SAMPLE
      Source: Yara matchFile source: 6231.1.00007f1510017000.00007f151002c000.r-x.sdmp, type: MEMORY
      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
      File Deletion
      OS Credential Dumping11
      Security Software Discovery
      Remote ServicesData from Local System1
      Encrypted Channel
      Exfiltration Over Other Network MediumAbuse Accessibility Features
      CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
      Application Layer Protocol
      Exfiltration Over BluetoothNetwork Denial of Service
      No configs have been found
      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Number of created Files
      • Is malicious
      • Internet
      SourceDetectionScannerLabelLink
      arm6.elf37%ReversingLabsLinux.Backdoor.Mirai
      arm6.elf100%AviraEXP/ELF.Mirai.W
      No Antivirus matches
      No Antivirus matches
      No Antivirus matches
      No contacted domains info
      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs
      IPDomainCountryFlagASNASN NameMalicious
      54.171.230.55
      unknownUnited States
      16509AMAZON-02USfalse
      109.202.202.202
      unknownSwitzerland
      13030INIT7CHfalse
      91.189.91.43
      unknownUnited Kingdom
      41231CANONICAL-ASGBfalse
      91.189.91.42
      unknownUnited Kingdom
      41231CANONICAL-ASGBfalse
      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      54.171.230.55http://112.31.189.32:40158Get hashmaliciousMiraiBrowse
        Aqua.mpsl.elfGet hashmaliciousMiraiBrowse
          bot.arm7.elfGet hashmaliciousMirai, OkiruBrowse
            la.bot.arc.elfGet hashmaliciousMiraiBrowse
              armv6l.elfGet hashmaliciousMiraiBrowse
                la.bot.powerpc.elfGet hashmaliciousMiraiBrowse
                  la.bot.arm6.elfGet hashmaliciousMiraiBrowse
                    hidakibest.x86.elfGet hashmaliciousMirai, GafgytBrowse
                      la.bot.arm6.elfGet hashmaliciousMiraiBrowse
                        m.elfGet hashmaliciousUnknownBrowse
                          109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                          • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                          91.189.91.43dbus.elfGet hashmaliciousUnknownBrowse
                            fenty.arm4.elfGet hashmaliciousMiraiBrowse
                              CONSTANT_STRATEGY.elfGet hashmaliciousSliverBrowse
                                10000.elfGet hashmaliciousUnknownBrowse
                                  la.bot.arc.elfGet hashmaliciousMiraiBrowse
                                    gnjqwpc.elfGet hashmaliciousMiraiBrowse
                                      copy_netaddr.elfGet hashmaliciousXmrigBrowse
                                        wiewa64.elfGet hashmaliciousMiraiBrowse
                                          njvwa4.elfGet hashmaliciousMiraiBrowse
                                            wrjkngh4.elfGet hashmaliciousMiraiBrowse
                                              No context
                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              CANONICAL-ASGBdbus.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              fenty.arm4.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              CONSTANT_STRATEGY.elfGet hashmaliciousSliverBrowse
                                              • 91.189.91.42
                                              10000.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              la.bot.arc.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              gnjqwpc.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              copy_netaddr.elfGet hashmaliciousXmrigBrowse
                                              • 91.189.91.42
                                              wiewa64.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              wkb86.elfGet hashmaliciousMiraiBrowse
                                              • 185.125.190.26
                                              njvwa4.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              AMAZON-02USnshkmpsl.elfGet hashmaliciousMiraiBrowse
                                              • 184.169.138.16
                                              INVOICE_2279_from_RealEyes Digital LLC (1).pdfGet hashmaliciousUnknownBrowse
                                              • 108.158.75.109
                                              nshkmips.elfGet hashmaliciousMiraiBrowse
                                              • 52.68.87.223
                                              nshmips.elfGet hashmaliciousMiraiBrowse
                                              • 18.176.7.234
                                              nshkarm.elfGet hashmaliciousMiraiBrowse
                                              • 54.168.12.140
                                              nshkppc.elfGet hashmaliciousMiraiBrowse
                                              • 18.157.142.187
                                              nsharm7.elfGet hashmaliciousMiraiBrowse
                                              • 54.98.64.96
                                              https://cv01zl.s3.amazonaws.com/index.html?AWSAccessKeyId=AKIAWPPO57XS4BTHJAEO&Signature=bBChlGCf3qnCt%2B4WchKJjXtb09k%3D&Expires=1734874865#stewart.thomas@cambridgeshire.gov.ukGet hashmaliciousFake CaptchaBrowse
                                              • 52.217.128.241
                                              nshmpsl.elfGet hashmaliciousMiraiBrowse
                                              • 54.70.192.56
                                              nsharm5.elfGet hashmaliciousMiraiBrowse
                                              • 18.228.79.95
                                              INIT7CHdbus.elfGet hashmaliciousUnknownBrowse
                                              • 109.202.202.202
                                              fenty.arm4.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              CONSTANT_STRATEGY.elfGet hashmaliciousSliverBrowse
                                              • 109.202.202.202
                                              10000.elfGet hashmaliciousUnknownBrowse
                                              • 109.202.202.202
                                              la.bot.arc.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              gnjqwpc.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              copy_netaddr.elfGet hashmaliciousXmrigBrowse
                                              • 109.202.202.202
                                              wiewa64.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              njvwa4.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              wrjkngh4.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              No context
                                              No context
                                              No created / dropped files found
                                              File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
                                              Entropy (8bit):6.149816430697729
                                              TrID:
                                              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                              File name:arm6.elf
                                              File size:83'784 bytes
                                              MD5:7e4b2fac3e1e300943387f54043dd25a
                                              SHA1:7132ff5fa21d815523e963da2cb6b329f377ca80
                                              SHA256:3ecb7e22d91cb6f232bbb15d2b471321b67c9ec9bbe8badf44813a2f71f9b8c5
                                              SHA512:013a2e1ff31acf83a15ef3604b5d080053dc91b7591450a5e52c44e24602a668acc4ed7f372f523d878302d05a170e7025dc61242c30b48f032a7d1e1d5c614f
                                              SSDEEP:1536:D2ndwek4H6kAQO2YRZ1y/pq2YcaGo8AQlMVisVen9+Q7dR5qYgzA:T06kHO2es/Y2YcaGyVen9+QZRE3zA
                                              TLSH:F883185AB9C19F11D5C112BAFE1E518E331317BCE3DE72129D24AB20778B86B0E7B905
                                              File Content Preview:.ELF..............(.....T...4...hE......4. ...(......................A...A...............A...A...A..X...............Q.td..................................-...L..................@-.,@...0....S..... 0....S.........../..0...0...@..../..D.......A....-.@0....S

                                              ELF header

                                              Class:ELF32
                                              Data:2's complement, little endian
                                              Version:1 (current)
                                              Machine:ARM
                                              Version Number:0x1
                                              Type:EXEC (Executable file)
                                              OS/ABI:UNIX - System V
                                              ABI Version:0
                                              Entry Point Address:0x8154
                                              Flags:0x4000002
                                              ELF Header Size:52
                                              Program Header Offset:52
                                              Program Header Size:32
                                              Number of Program Headers:3
                                              Section Header Offset:83304
                                              Section Header Size:40
                                              Number of Section Headers:12
                                              Header String Table Index:11
                                              NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                              NULL0x00x00x00x00x0000
                                              .initPROGBITS0x80940x940x100x00x6AX004
                                              .textPROGBITS0x80b00xb00x12af40x00x6AX0016
                                              .finiPROGBITS0x1aba40x12ba40x100x00x6AX004
                                              .rodataPROGBITS0x1abb80x12bb80x15e40x00x2A008
                                              .init_arrayINIT_ARRAY0x241a00x141a40x40x00x3WA004
                                              .fini_arrayFINI_ARRAY0x241a40x141a80x40x00x3WA004
                                              .gotPROGBITS0x241ac0x141b00x740x40x3WA004
                                              .dataPROGBITS0x242200x142240x2d40x00x3WA004
                                              .bssNOBITS0x244f40x144f80x54740x00x3WA004
                                              .ARM.attributesARM_ATTRIBUTES0x00x144f80x100x00x0001
                                              .shstrtabSTRTAB0x00x145080x5d0x00x0001
                                              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                              LOAD0x00x80000x80000x1419c0x1419c6.16480x5R E0x8000.init .text .fini .rodata
                                              LOAD0x141a00x241a00x2419c0x3580xd7c84.42360x6RW 0x8000.init_array .fini_array .got .data .bss
                                              GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
                                              TimestampSource PortDest PortSource IPDest IP
                                              Dec 20, 2024 19:01:51.408464909 CET4433360654.171.230.55192.168.2.23
                                              Dec 20, 2024 19:01:51.408622026 CET33606443192.168.2.2354.171.230.55
                                              Dec 20, 2024 19:01:51.528675079 CET4433360654.171.230.55192.168.2.23
                                              Dec 20, 2024 19:01:52.174966097 CET43928443192.168.2.2391.189.91.42
                                              Dec 20, 2024 19:01:57.806221962 CET42836443192.168.2.2391.189.91.43
                                              Dec 20, 2024 19:01:59.342092037 CET4251680192.168.2.23109.202.202.202
                                              Dec 20, 2024 19:02:12.652280092 CET43928443192.168.2.2391.189.91.42
                                              Dec 20, 2024 19:02:24.938671112 CET42836443192.168.2.2391.189.91.43
                                              Dec 20, 2024 19:02:29.033891916 CET4251680192.168.2.23109.202.202.202
                                              Dec 20, 2024 19:02:53.606422901 CET43928443192.168.2.2391.189.91.42

                                              System Behavior

                                              Start time (UTC):18:01:50
                                              Start date (UTC):20/12/2024
                                              Path:/tmp/arm6.elf
                                              Arguments:/tmp/arm6.elf
                                              File size:4956856 bytes
                                              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                              Start time (UTC):18:01:50
                                              Start date (UTC):20/12/2024
                                              Path:/usr/bin/dash
                                              Arguments:-
                                              File size:129816 bytes
                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                              Start time (UTC):18:01:50
                                              Start date (UTC):20/12/2024
                                              Path:/usr/bin/rm
                                              Arguments:rm -f /tmp/tmp.0nwr0g4Qis /tmp/tmp.eBbhJ7Ldau /tmp/tmp.5Ap0wwvTwk
                                              File size:72056 bytes
                                              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                              Start time (UTC):18:01:50
                                              Start date (UTC):20/12/2024
                                              Path:/usr/bin/dash
                                              Arguments:-
                                              File size:129816 bytes
                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                              Start time (UTC):18:01:50
                                              Start date (UTC):20/12/2024
                                              Path:/usr/bin/rm
                                              Arguments:rm -f /tmp/tmp.0nwr0g4Qis /tmp/tmp.eBbhJ7Ldau /tmp/tmp.5Ap0wwvTwk
                                              File size:72056 bytes
                                              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b