Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
arm6.nn.elf

Overview

General Information

Sample name:arm6.nn.elf
Analysis ID:1579947
MD5:e17307c8ee12d5c7b919349cb59882ef
SHA1:c7c54f8181fffdc5a4dad9c6fb96cd7b7dfd25b6
SHA256:d5fb0b6ddbc88d974dc3aebcc21948c3aa812a6613ddfdf44caecb4a33c46151
Tags:elfuser-abuse_ch
Infos:

Detection

Okiru
Score:64
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Okiru
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1579947
Start date and time:2024-12-23 16:41:06 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 31s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:arm6.nn.elf
Detection:MAL
Classification:mal64.troj.linELF@0/0@0/0
  • VT rate limit hit for: arm6.nn.elf
Command:/tmp/arm6.nn.elf
PID:6242
Exit Code:139
Exit Code Info:SIGSEGV (11) Segmentation fault invalid memory reference
Killed:False
Standard Output:

Standard Error:qemu: uncaught target signal 11 (Segmentation fault) - core dumped
  • system is lnxubuntu20
  • arm6.nn.elf (PID: 6242, Parent: 6157, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm6.nn.elf
  • cleanup
SourceRuleDescriptionAuthorStrings
arm6.nn.elfJoeSecurity_OkiruYara detected OkiruJoe Security
    SourceRuleDescriptionAuthorStrings
    6242.1.00007f3b4c017000.00007f3b4c02f000.r-x.sdmpJoeSecurity_OkiruYara detected OkiruJoe Security
      Process Memory Space: arm6.nn.elf PID: 6242JoeSecurity_OkiruYara detected OkiruJoe Security
        No Suricata rule has matched

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: arm6.nn.elfAvira: detected
        Source: arm6.nn.elfReversingLabs: Detection: 36%
        Source: arm6.nn.elfString: getinfo xxxTSource Engine QueryNIGGERNIGGERGETCOURRPERTEDDDDDDDDDDHAHAHAHAHAHAAHAHAHHAHAMDWHO??wasHeERe.BIGDADDYCATISURDAD!/proc/self/exe(deleted)/proc/%s/exe/proc/...%s/%stmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.234Found And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s2surf2/proc/%d/exe/proc/%d/cmdlinewgetcurlunknown%s (URL: %s)/./fd/socket/proc/%d/mountinfo/ /proc-altered/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/init/opt/app/var/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/ping/pswiresharkechotcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt/bin/loginnfstftpftpmalloc[start_pid_hopping] Failed to clone: %s
        Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
        Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
        Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
        Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
        Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
        Source: arm6.nn.elfString found in binary or memory: http://94.156.227.233/
        Source: arm6.nn.elfString found in binary or memory: http://94.156.227.233/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/s
        Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
        Source: Initial sampleString containing 'busybox' found: /bin/busybox
        Source: Initial sampleString containing 'busybox' found: getinfo xxxTSource Engine QueryNIGGERNIGGERGETCOURRPERTEDDDDDDDDDDHAHAHAHAHAHAAHAHAHHAHAMDWHO??wasHeERe.BIGDADDYCATISURDAD!/proc/self/exe(deleted)/proc/%s/exe/proc/...%s/%stmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.234Found And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s2surf2/proc/%d/exe/proc/%d/cmdlinewgetcurlunknown%s (URL: %s)/./fd/socket/proc/%d/mountinfo/ /proc-altered/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/init/opt/app/var/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/anko
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: classification engineClassification label: mal64.troj.linELF@0/0@0/0
        Source: /tmp/arm6.nn.elf (PID: 6242)Queries kernel information via 'uname': Jump to behavior
        Source: arm6.nn.elf, 6242.1.00007ffc7dbdd000.00007ffc7dbfe000.rw-.sdmpBinary or memory string: 2x86_64/usr/bin/qemu-arm/tmp/arm6.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm6.nn.elf
        Source: arm6.nn.elf, 6242.1.00005578e62d6000.00005578e6404000.rw-.sdmpBinary or memory string: xU!/etc/qemu-binfmt/arm
        Source: arm6.nn.elf, 6242.1.00005578e62d6000.00005578e6404000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
        Source: arm6.nn.elf, 6242.1.00007ffc7dbdd000.00007ffc7dbfe000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
        Source: arm6.nn.elf, 6242.1.00007ffc7dbdd000.00007ffc7dbfe000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: arm6.nn.elf, type: SAMPLE
        Source: Yara matchFile source: 6242.1.00007f3b4c017000.00007f3b4c02f000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: arm6.nn.elf PID: 6242, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: arm6.nn.elf, type: SAMPLE
        Source: Yara matchFile source: 6242.1.00007f3b4c017000.00007f3b4c02f000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: arm6.nn.elf PID: 6242, type: MEMORYSTR
        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity Information1
        Scripting
        Valid AccountsWindows Management Instrumentation1
        Scripting
        Path InterceptionDirect Volume AccessOS Credential Dumping11
        Security Software Discovery
        Remote ServicesData from Local System1
        Encrypted Channel
        Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
        Application Layer Protocol
        Exfiltration Over BluetoothNetwork Denial of Service
        No configs have been found
        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        SourceDetectionScannerLabelLink
        arm6.nn.elf37%ReversingLabsLinux.Backdoor.Mirai
        arm6.nn.elf100%AviraEXP/ELF.Mirai.W
        No Antivirus matches
        No Antivirus matches
        No Antivirus matches
        No contacted domains info
        NameSourceMaliciousAntivirus DetectionReputation
        http://94.156.227.233/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sarm6.nn.elffalse
          high
          http://94.156.227.233/arm6.nn.elffalse
            high
            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs
            IPDomainCountryFlagASNASN NameMalicious
            109.202.202.202
            unknownSwitzerland
            13030INIT7CHfalse
            91.189.91.43
            unknownUnited Kingdom
            41231CANONICAL-ASGBfalse
            91.189.91.42
            unknownUnited Kingdom
            41231CANONICAL-ASGBfalse
            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
            • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
            91.189.91.43mips.nn.elfGet hashmaliciousOkiruBrowse
              x86_64.nn.elfGet hashmaliciousOkiruBrowse
                sparc.nn.elfGet hashmaliciousOkiruBrowse
                  sh4.nn.elfGet hashmaliciousOkiruBrowse
                    arm7.nn-20241223-1416.elfGet hashmaliciousMirai, OkiruBrowse
                      most-x86.elfGet hashmaliciousUnknownBrowse
                        mipsel.elfGet hashmaliciousUnknownBrowse
                          powerpc.elfGet hashmaliciousUnknownBrowse
                            Mozi.m.elfGet hashmaliciousMiraiBrowse
                              mips.elfGet hashmaliciousUnknownBrowse
                                91.189.91.42mips.nn.elfGet hashmaliciousOkiruBrowse
                                  x86_64.nn.elfGet hashmaliciousOkiruBrowse
                                    sparc.nn.elfGet hashmaliciousOkiruBrowse
                                      sh4.nn.elfGet hashmaliciousOkiruBrowse
                                        arm7.nn-20241223-1416.elfGet hashmaliciousMirai, OkiruBrowse
                                          most-x86.elfGet hashmaliciousUnknownBrowse
                                            mipsel.elfGet hashmaliciousUnknownBrowse
                                              powerpc.elfGet hashmaliciousUnknownBrowse
                                                Mozi.m.elfGet hashmaliciousMiraiBrowse
                                                  mips.elfGet hashmaliciousUnknownBrowse
                                                    No context
                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                    CANONICAL-ASGBmips.nn.elfGet hashmaliciousOkiruBrowse
                                                    • 91.189.91.42
                                                    x86_64.nn.elfGet hashmaliciousOkiruBrowse
                                                    • 91.189.91.42
                                                    sparc.nn.elfGet hashmaliciousOkiruBrowse
                                                    • 91.189.91.42
                                                    sh4.nn.elfGet hashmaliciousOkiruBrowse
                                                    • 91.189.91.42
                                                    arm7.nn-20241223-1416.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 91.189.91.42
                                                    arm.nn-20241223-1416.elfGet hashmaliciousOkiruBrowse
                                                    • 185.125.190.26
                                                    most-x86.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    mipsel.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    powerpc.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    Mozi.m.elfGet hashmaliciousMiraiBrowse
                                                    • 91.189.91.42
                                                    CANONICAL-ASGBmips.nn.elfGet hashmaliciousOkiruBrowse
                                                    • 91.189.91.42
                                                    x86_64.nn.elfGet hashmaliciousOkiruBrowse
                                                    • 91.189.91.42
                                                    sparc.nn.elfGet hashmaliciousOkiruBrowse
                                                    • 91.189.91.42
                                                    sh4.nn.elfGet hashmaliciousOkiruBrowse
                                                    • 91.189.91.42
                                                    arm7.nn-20241223-1416.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 91.189.91.42
                                                    arm.nn-20241223-1416.elfGet hashmaliciousOkiruBrowse
                                                    • 185.125.190.26
                                                    most-x86.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    mipsel.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    powerpc.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    Mozi.m.elfGet hashmaliciousMiraiBrowse
                                                    • 91.189.91.42
                                                    INIT7CHmips.nn.elfGet hashmaliciousOkiruBrowse
                                                    • 109.202.202.202
                                                    x86_64.nn.elfGet hashmaliciousOkiruBrowse
                                                    • 109.202.202.202
                                                    sparc.nn.elfGet hashmaliciousOkiruBrowse
                                                    • 109.202.202.202
                                                    sh4.nn.elfGet hashmaliciousOkiruBrowse
                                                    • 109.202.202.202
                                                    arm7.nn-20241223-1416.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 109.202.202.202
                                                    most-x86.elfGet hashmaliciousUnknownBrowse
                                                    • 109.202.202.202
                                                    mipsel.elfGet hashmaliciousUnknownBrowse
                                                    • 109.202.202.202
                                                    powerpc.elfGet hashmaliciousUnknownBrowse
                                                    • 109.202.202.202
                                                    Mozi.m.elfGet hashmaliciousMiraiBrowse
                                                    • 109.202.202.202
                                                    mips.elfGet hashmaliciousUnknownBrowse
                                                    • 109.202.202.202
                                                    No context
                                                    No context
                                                    No created / dropped files found
                                                    File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
                                                    Entropy (8bit):6.122104036196292
                                                    TrID:
                                                    • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                    File name:arm6.nn.elf
                                                    File size:100'280 bytes
                                                    MD5:e17307c8ee12d5c7b919349cb59882ef
                                                    SHA1:c7c54f8181fffdc5a4dad9c6fb96cd7b7dfd25b6
                                                    SHA256:d5fb0b6ddbc88d974dc3aebcc21948c3aa812a6613ddfdf44caecb4a33c46151
                                                    SHA512:b356cfcb1c301fece2f0104b70531b05fc9eb26a0141b15d6e879641372e4ad9cb27e552bf73541a5b64c19972fc0e28782c9839d065a42413b5baef3f1a4489
                                                    SSDEEP:1536:12nCT9U+0Ths8VZ/KNcb+Ke6PZwz6WQi9/aQ7Vk+NR3d0iIVbsl5HY25Dd:o+0FscSqb+sPZ6wi9/aQEVbslh1Dd
                                                    TLSH:B3A33B52F8819B21C6C4067AF92E018E332313B8E3EE72169D149F3177CB96B0D7B956
                                                    File Content Preview:.ELF..............(.....T...4...........4. ...(......................y...y..........................d...............Q.td..................................-...L..................@-.,@...0....S..... 0....S.........../..0...0...@..../.d.............-.@0....S

                                                    ELF header

                                                    Class:ELF32
                                                    Data:2's complement, little endian
                                                    Version:1 (current)
                                                    Machine:ARM
                                                    Version Number:0x1
                                                    Type:EXEC (Executable file)
                                                    OS/ABI:UNIX - System V
                                                    ABI Version:0
                                                    Entry Point Address:0x8154
                                                    Flags:0x4000002
                                                    ELF Header Size:52
                                                    Program Header Offset:52
                                                    Program Header Size:32
                                                    Number of Program Headers:3
                                                    Section Header Offset:99800
                                                    Section Header Size:40
                                                    Number of Section Headers:12
                                                    Header String Table Index:11
                                                    NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                    NULL0x00x00x00x00x0000
                                                    .initPROGBITS0x80940x940x100x00x6AX004
                                                    .textPROGBITS0x80b00xb00x153780x00x6AX0016
                                                    .finiPROGBITS0x1d4280x154280x100x00x6AX004
                                                    .rodataPROGBITS0x1d4380x154380x25800x00x2A008
                                                    .init_arrayINIT_ARRAY0x200040x180080x40x00x3WA004
                                                    .fini_arrayFINI_ARRAY0x200080x1800c0x40x00x3WA004
                                                    .gotPROGBITS0x200100x180140x780x40x3WA004
                                                    .dataPROGBITS0x200880x1808c0x4dc0x00x3WA004
                                                    .bssNOBITS0x205640x185680x253c0x00x3WA004
                                                    .ARM.attributesARM_ATTRIBUTES0x00x185680x100x00x0001
                                                    .shstrtabSTRTAB0x00x185780x5d0x00x0001
                                                    TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                    LOAD0x00x80000x80000x179b80x179b86.18270x5R E0x8000.init .text .fini .rodata
                                                    LOAD0x180040x200040x200000x5640xaa9c5.42650x6RW 0x8000.init_array .fini_array .got .data .bss
                                                    GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
                                                    TimestampSource PortDest PortSource IPDest IP
                                                    Dec 23, 2024 16:41:52.170195103 CET43928443192.168.2.2391.189.91.42
                                                    Dec 23, 2024 16:41:57.801497936 CET42836443192.168.2.2391.189.91.43
                                                    Dec 23, 2024 16:41:59.337371111 CET4251680192.168.2.23109.202.202.202
                                                    Dec 23, 2024 16:42:12.135557890 CET43928443192.168.2.2391.189.91.42
                                                    Dec 23, 2024 16:42:24.421907902 CET42836443192.168.2.2391.189.91.43
                                                    Dec 23, 2024 16:42:30.565002918 CET4251680192.168.2.23109.202.202.202
                                                    Dec 23, 2024 16:42:53.089843988 CET43928443192.168.2.2391.189.91.42

                                                    System Behavior

                                                    Start time (UTC):15:41:49
                                                    Start date (UTC):23/12/2024
                                                    Path:/tmp/arm6.nn.elf
                                                    Arguments:/tmp/arm6.nn.elf
                                                    File size:4956856 bytes
                                                    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1