Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
arm6.nn-20241224-0050.elf

Overview

General Information

Sample name:arm6.nn-20241224-0050.elf
Analysis ID:1580138
MD5:bca3ea80aa2fce92a1b081e08f38cf72
SHA1:9cf8fa0770b1afa1fc29f1a0a082160e5f9bd31a
SHA256:9416601ebe16398cfb70a699f78f69f8eab4c7ff6f5de9dead848736d7aaacb7
Tags:user-elfdigest
Infos:

Detection

Okiru
Score:64
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Okiru
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1580138
Start date and time:2024-12-24 01:51:08 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 29s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:arm6.nn-20241224-0050.elf
Detection:MAL
Classification:mal64.troj.linELF@0/0@2/0
Command:/tmp/arm6.nn-20241224-0050.elf
PID:5490
Exit Code:139
Exit Code Info:SIGSEGV (11) Segmentation fault invalid memory reference
Killed:False
Standard Output:

Standard Error:qemu: uncaught target signal 11 (Segmentation fault) - core dumped
  • system is lnxubuntu20
  • arm6.nn-20241224-0050.elf (PID: 5490, Parent: 5415, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm6.nn-20241224-0050.elf
  • cleanup
SourceRuleDescriptionAuthorStrings
arm6.nn-20241224-0050.elfJoeSecurity_OkiruYara detected OkiruJoe Security
    SourceRuleDescriptionAuthorStrings
    5490.1.00007ff910017000.00007ff91002f000.r-x.sdmpJoeSecurity_OkiruYara detected OkiruJoe Security
      Process Memory Space: arm6.nn-20241224-0050.elf PID: 5490JoeSecurity_OkiruYara detected OkiruJoe Security
        No Suricata rule has matched

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: arm6.nn-20241224-0050.elfAvira: detected
        Source: arm6.nn-20241224-0050.elfReversingLabs: Detection: 36%
        Source: arm6.nn-20241224-0050.elfString: getinfo xxxTSource Engine QueryNIGGERNIGGERGETCOURRPERTEDDDDDDDDDDHAHAHAHAHAHAAHAHAHHAHAMDWHO??wasHeERe.BIGDADDYCATISURDAD!/proc/self/exe(deleted)/proc/%s/exe/proc/...%s/%stmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/ /tmp/./fd/socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt/bin/login94.156.227.234malloc[start_pid_hopping] Failed to clone: %s
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
        Source: arm6.nn-20241224-0050.elfString found in binary or memory: http://94.156.227.233/
        Source: arm6.nn-20241224-0050.elfString found in binary or memory: http://94.156.227.233/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/s
        Source: Initial sampleString containing 'busybox' found: /bin/busybox
        Source: Initial sampleString containing 'busybox' found: getinfo xxxTSource Engine QueryNIGGERNIGGERGETCOURRPERTEDDDDDDDDDDHAHAHAHAHAHAAHAHAHHAHAMDWHO??wasHeERe.BIGDADDYCATISURDAD!/proc/self/exe(deleted)/proc/%s/exe/proc/...%s/%stmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/ /tmp/./fd/socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/syste
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: classification engineClassification label: mal64.troj.linELF@0/0@2/0
        Source: /tmp/arm6.nn-20241224-0050.elf (PID: 5490)Queries kernel information via 'uname': Jump to behavior
        Source: arm6.nn-20241224-0050.elf, 5490.1.00007ffda79f6000.00007ffda7a17000.rw-.sdmpBinary or memory string: Tx86_64/usr/bin/qemu-arm/tmp/arm6.nn-20241224-0050.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm6.nn-20241224-0050.elf
        Source: arm6.nn-20241224-0050.elf, 5490.1.0000557c90f6f000.0000557c9109d000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
        Source: arm6.nn-20241224-0050.elf, 5490.1.00007ffda79f6000.00007ffda7a17000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
        Source: arm6.nn-20241224-0050.elf, 5490.1.0000557c90f6f000.0000557c9109d000.rw-.sdmpBinary or memory string: |U!/etc/qemu-binfmt/arm
        Source: arm6.nn-20241224-0050.elf, 5490.1.00007ffda79f6000.00007ffda7a17000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: arm6.nn-20241224-0050.elf, type: SAMPLE
        Source: Yara matchFile source: 5490.1.00007ff910017000.00007ff91002f000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: arm6.nn-20241224-0050.elf PID: 5490, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: arm6.nn-20241224-0050.elf, type: SAMPLE
        Source: Yara matchFile source: 5490.1.00007ff910017000.00007ff91002f000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: arm6.nn-20241224-0050.elf PID: 5490, type: MEMORYSTR
        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity Information1
        Scripting
        Valid AccountsWindows Management Instrumentation1
        Scripting
        Path InterceptionDirect Volume AccessOS Credential Dumping11
        Security Software Discovery
        Remote ServicesData from Local System1
        Non-Application Layer Protocol
        Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
        Application Layer Protocol
        Exfiltration Over BluetoothNetwork Denial of Service
        No configs have been found
        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand
        SourceDetectionScannerLabelLink
        arm6.nn-20241224-0050.elf37%ReversingLabsLinux.Backdoor.Mirai
        arm6.nn-20241224-0050.elf100%AviraEXP/ELF.Mirai.W
        No Antivirus matches
        No Antivirus matches
        No Antivirus matches
        NameIPActiveMaliciousAntivirus DetectionReputation
        daisy.ubuntu.com
        162.213.35.25
        truefalse
          high
          NameSourceMaliciousAntivirus DetectionReputation
          http://94.156.227.233/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sarm6.nn-20241224-0050.elffalse
            high
            http://94.156.227.233/arm6.nn-20241224-0050.elffalse
              high
              No contacted IP infos
              No context
              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              daisy.ubuntu.comm68k.nn.elfGet hashmaliciousOkiruBrowse
              • 162.213.35.25
              sh4.nn.elfGet hashmaliciousOkiruBrowse
              • 162.213.35.25
              arm7.elfGet hashmaliciousMiraiBrowse
              • 162.213.35.25
              mipsel.elfGet hashmaliciousUnknownBrowse
              • 162.213.35.25
              arm6.elfGet hashmaliciousUnknownBrowse
              • 162.213.35.25
              jackmyi686.elfGet hashmaliciousGafgyt, MiraiBrowse
              • 162.213.35.25
              jackmyarmv5.elfGet hashmaliciousGafgyt, MiraiBrowse
              • 162.213.35.24
              jackmysparc.elfGet hashmaliciousGafgyt, MiraiBrowse
              • 162.213.35.25
              jackmyarmv6.elfGet hashmaliciousGafgyt, MiraiBrowse
              • 162.213.35.25
              jackmymips64.elfGet hashmaliciousGafgyt, MiraiBrowse
              • 162.213.35.24
              No context
              No context
              No context
              No created / dropped files found
              File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
              Entropy (8bit):6.114993404362322
              TrID:
              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
              File name:arm6.nn-20241224-0050.elf
              File size:100'256 bytes
              MD5:bca3ea80aa2fce92a1b081e08f38cf72
              SHA1:9cf8fa0770b1afa1fc29f1a0a082160e5f9bd31a
              SHA256:9416601ebe16398cfb70a699f78f69f8eab4c7ff6f5de9dead848736d7aaacb7
              SHA512:0bc0ff07a72f4058da655819efccee9b23fe94e5fa2cf9832025dfd66292712bee9d69e2b744be2c5bb973b0ac9b79e98f2264128775738e47063fe2976ac503
              SSDEEP:3072:Ut+7TLQ4Fb9mjigFpBtLFda+d6j5vtlvcLd:Ut+7TLQ4Fb9mHHtLXaWmzm
              TLSH:8DA33A52F8819B21D6C416BEF92E018E331317B8E3DE72169D246F3177CA96B0D7B906
              File Content Preview:.ELF..............(.....T...4...........4. ...(.....................`y..`y..........................L...............Q.td..................................-...L..................@-.,@...0....S..... 0....S.........../..0...0...@..../.L.............-.@0....S

              ELF header

              Class:ELF32
              Data:2's complement, little endian
              Version:1 (current)
              Machine:ARM
              Version Number:0x1
              Type:EXEC (Executable file)
              OS/ABI:UNIX - System V
              ABI Version:0
              Entry Point Address:0x8154
              Flags:0x4000002
              ELF Header Size:52
              Program Header Offset:52
              Program Header Size:32
              Number of Program Headers:3
              Section Header Offset:99776
              Section Header Size:40
              Number of Section Headers:12
              Header String Table Index:11
              NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
              NULL0x00x00x00x00x0000
              .initPROGBITS0x80940x940x100x00x6AX004
              .textPROGBITS0x80b00xb00x153880x00x6AX0016
              .finiPROGBITS0x1d4380x154380x100x00x6AX004
              .rodataPROGBITS0x1d4480x154480x25180x00x2A008
              .init_arrayINIT_ARRAY0x200040x180080x40x00x3WA004
              .fini_arrayFINI_ARRAY0x200080x1800c0x40x00x3WA004
              .gotPROGBITS0x200100x180140x780x40x3WA004
              .dataPROGBITS0x200880x1808c0x4c40x00x3WA004
              .bssNOBITS0x2054c0x185500x25440x00x3WA004
              .ARM.attributesARM_ATTRIBUTES0x00x185500x100x00x0001
              .shstrtabSTRTAB0x00x185600x5d0x00x0001
              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
              LOAD0x00x80000x80000x179600x179606.17920x5R E0x8000.init .text .fini .rodata
              LOAD0x180040x200040x200000x54c0xaa8c5.41500x6RW 0x8000.init_array .fini_array .got .data .bss
              GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
              TimestampSource PortDest PortSource IPDest IP
              Dec 24, 2024 01:52:00.498774052 CET6056453192.168.2.141.1.1.1
              Dec 24, 2024 01:52:00.498838902 CET4220753192.168.2.141.1.1.1
              Dec 24, 2024 01:52:00.636284113 CET53605641.1.1.1192.168.2.14
              Dec 24, 2024 01:52:00.723978996 CET53422071.1.1.1192.168.2.14
              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
              Dec 24, 2024 01:52:00.498774052 CET192.168.2.141.1.1.10xa3f5Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
              Dec 24, 2024 01:52:00.498838902 CET192.168.2.141.1.1.10xf7d5Standard query (0)daisy.ubuntu.com28IN (0x0001)false
              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
              Dec 24, 2024 01:52:00.636284113 CET1.1.1.1192.168.2.140xa3f5No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
              Dec 24, 2024 01:52:00.636284113 CET1.1.1.1192.168.2.140xa3f5No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

              System Behavior

              Start time (UTC):00:51:58
              Start date (UTC):24/12/2024
              Path:/tmp/arm6.nn-20241224-0050.elf
              Arguments:/tmp/arm6.nn-20241224-0050.elf
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1