Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
mips.elf

Overview

General Information

Sample name:mips.elf
Analysis ID:1582004
MD5:aba40cf46423bbd1c743770af7aa9e55
SHA1:042c965a2983fdad92ba0ca16b4db6e2135d602d
SHA256:434c0a78e67be7d4d768f4efc9680983bf65720b927d1218174e3b37d9fdc023
Tags:elfuser-abuse_ch
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Detected TCP or UDP traffic on non-standard ports
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Sample has stripped symbol table
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Sets full permissions to files and/or directories
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1582004
Start date and time:2024-12-29 14:46:02 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 3m 50s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:mips.elf
Detection:MAL
Classification:mal48.linELF@0/0@0/0

Warnings

  • Connection to analysis system has been lost, crash info: Unknown

Runtime Messages

Command:/tmp/mips.elf
PID:5549
Exit Code:1
Exit Code Info:
Killed:False
Standard Output:
GOLDFISHGANG
Standard Error:

Process Tree

  • system is lnxubuntu20
  • mips.elf (PID: 5549, Parent: 5469, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/mips.elf
    • mips.elf New Fork (PID: 5551, Parent: 5549)
      • mips.elf New Fork (PID: 5553, Parent: 5551)
        • mips.elf New Fork (PID: 5559, Parent: 5553)
        • sh (PID: 5559, Parent: 5553, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mkdir /7bsztp5oxv/ && >/7bsztp5oxv/7bsztp5oxv && cd /7bsztp5oxv/ >/dev/null"
          • sh New Fork (PID: 5561, Parent: 5559)
          • mkdir (PID: 5561, Parent: 5559, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir /7bsztp5oxv/
        • mips.elf New Fork (PID: 5562, Parent: 5553)
        • sh (PID: 5562, Parent: 5553, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /tmp/mips.elf /7bsztp5oxv/7bsztp5oxv && chmod 777 /7bsztp5oxv/7bsztp5oxv >/dev/null"
          • sh New Fork (PID: 5564, Parent: 5562)
          • mv (PID: 5564, Parent: 5562, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /tmp/mips.elf /7bsztp5oxv/7bsztp5oxv
          • sh New Fork (PID: 5565, Parent: 5562)
          • chmod (PID: 5565, Parent: 5562, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 /7bsztp5oxv/7bsztp5oxv
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: mips.elfReversingLabs: Detection: 47%
Source: global trafficTCP traffic: 192.168.2.15:35696 -> 52.150.237.12:29421
Source: unknownTCP traffic detected without corresponding DNS query: 52.150.237.12
Source: unknownTCP traffic detected without corresponding DNS query: 52.150.237.12
Source: unknownTCP traffic detected without corresponding DNS query: 52.150.237.12
Source: unknownTCP traffic detected without corresponding DNS query: 52.150.237.12
Source: unknownTCP traffic detected without corresponding DNS query: 52.150.237.12
Source: unknownTCP traffic detected without corresponding DNS query: 52.150.237.12
Source: ELF static info symbol of initial sample.symtab present: no
Source: /tmp/mips.elf (PID: 5553)SIGKILL sent: pid: 0 (kernel), result: unknownJump to behavior
Source: classification engineClassification label: mal48.linELF@0/0@0/0
Source: /tmp/mips.elf (PID: 5559)Shell command executed: sh -c "mkdir /7bsztp5oxv/ && >/7bsztp5oxv/7bsztp5oxv && cd /7bsztp5oxv/ >/dev/null"Jump to behavior
Source: /tmp/mips.elf (PID: 5562)Shell command executed: sh -c "mv /tmp/mips.elf /7bsztp5oxv/7bsztp5oxv && chmod 777 /7bsztp5oxv/7bsztp5oxv >/dev/null"Jump to behavior
Source: /bin/sh (PID: 5565)Chmod executable: /usr/bin/chmod -> chmod 777 /7bsztp5oxv/7bsztp5oxvJump to behavior
Source: /bin/sh (PID: 5561)Mkdir executable: /usr/bin/mkdir -> mkdir /7bsztp5oxv/Jump to behavior
Source: /usr/bin/chmod (PID: 5565)File: /7bsztp5oxv/7bsztp5oxv (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
Source: /bin/sh (PID: 5565)Chmod executable with 777: /usr/bin/chmod -> chmod 777 /7bsztp5oxv/7bsztp5oxvJump to behavior
Source: /tmp/mips.elf (PID: 5549)Queries kernel information via 'uname': Jump to behavior
Source: mips.elf, 5549.1.000055ad68074000.000055ad680fb000.rw-.sdmp, mips.elf, 5551.1.000055ad68074000.000055ad680fb000.rw-.sdmp, mips.elf, 5553.1.000055ad68074000.000055ad680fb000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/mips
Source: mips.elf, 5549.1.000055ad68074000.000055ad680fb000.rw-.sdmp, mips.elf, 5551.1.000055ad68074000.000055ad680fb000.rw-.sdmp, mips.elf, 5553.1.000055ad68074000.000055ad680fb000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mips
Source: mips.elf, 5549.1.00007ffd03f40000.00007ffd03f61000.rw-.sdmp, mips.elf, 5551.1.00007ffd03f40000.00007ffd03f61000.rw-.sdmp, mips.elf, 5553.1.00007ffd03f40000.00007ffd03f61000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mips
Source: mips.elf, 5549.1.00007ffd03f40000.00007ffd03f61000.rw-.sdmp, mips.elf, 5551.1.00007ffd03f40000.00007ffd03f61000.rw-.sdmp, mips.elf, 5553.1.00007ffd03f40000.00007ffd03f61000.rw-.sdmpBinary or memory string: '}x86_64/usr/bin/qemu-mips/tmp/mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mips.elf

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting		Valid AccountsWindows Management Instrumentation1
Scripting		Path Interception2
File and Directory Permissions Modification		OS Credential Dumping11
Security Software Discovery		Remote ServicesData from Local System1
Non-Standard Port		Exfiltration Over Other Network MediumAbuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1582004 Sample: mips.elf Startdate: 29/12/2024 Architecture: LINUX Score: 48 26 52.150.237.12, 29421, 35696 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 2->26 28 Multi AV Scanner detection for submitted file 2->28 10 mips.elf 2->10         started        signatures3 process4 process5 12 mips.elf 10->12         started        process6 14 mips.elf 12->14         started        process7 16 mips.elf sh 14->16         started        18 mips.elf sh 14->18         started        process8 20 sh mv 16->20         started        22 sh chmod 16->22         started        24 sh mkdir 18->24         started       

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
mips.elf47%ReversingLabsLinux.Backdoor.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
52.150.237.12
unknownUnited States
8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
52.150.237.12arm5.elfGet hashmaliciousUnknownBrowse
    arm.elfGet hashmaliciousUnknownBrowse
      x86_64.elfGet hashmaliciousUnknownBrowse

        Domains

        ⊘No context

        ASNs

        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        MICROSOFT-CORP-MSN-AS-BLOCKUSarm5.elfGet hashmaliciousUnknownBrowse
        • 52.150.237.12
        arm.elfGet hashmaliciousUnknownBrowse
        • 52.150.237.12
        x86_64.elfGet hashmaliciousUnknownBrowse
        • 52.150.237.12
        Tool_Unlock_v1.2.exeGet hashmaliciousVidarBrowse
        • 204.79.197.219
        db0fa4b8db0333367e9bda3ab68b8042.m68k.elfGet hashmaliciousMirai, GafgytBrowse
        • 40.108.137.192
        db0fa4b8db0333367e9bda3ab68b8042.i686.elfGet hashmaliciousMirai, GafgytBrowse
        • 13.101.154.254
        fxsound_setup.exeGet hashmaliciousUnknownBrowse
        • 20.233.83.145
        phish_alert_iocp_v1.4.48 - 2024-12-27T140703.193.emlGet hashmaliciousUnknownBrowse
        • 52.109.76.243
        https://greensofttech1-my.sharepoint.com/:f:/g/personal/stella_huang_greensofttech1_onmicrosoft_com/EuOSopXBEUpFhaHAwqFRDM8BeWLY-Gsl0U9Az2fOy4x80A?e=GhPegT&xsdata=MDV8MDJ8TVB1Z2FAaHljaXRlLmNvbXxjMDM5NmJhZjcxOTM0YzBkMTc3ZDA4ZGQxMzcwNWQ3MnxmYzVjNjhmNjk3ZjM0ZWZlYjY4OWViNWMxMjM0ZjgyMXwwfDB8NjM4Njg4MDk1NTQ0NTA0NzA2fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=SVpsejJNYUlwY213VjNreGxSNU1LaFJXcnpXS3pwWjhYR2k5ZUthLzlsMD0%3dGet hashmaliciousHTMLPhisherBrowse
        • 104.47.55.156
        https://greensofttech1-my.sharepoint.com/:f:/g/personal/stella_huang_greensofttech1_onmicrosoft_com/EuOSopXBEUpFhaHAwqFRDM8BeWLY-Gsl0U9Az2fOy4x80A?e=GhPegT&xsdata=MDV8MDJ8TVB1Z2FAaHljaXRlLmNvbXxjMDM5NmJhZjcxOTM0YzBkMTc3ZDA4ZGQxMzcwNWQ3MnxmYzVjNjhmNjk3ZjM0ZWZlYjY4OWViNWMxMjM0ZjgyMXwwfDB8NjM4Njg4MDk1NTQ0NTA0NzA2fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=SVpsejJNYUlwY213VjNreGxSNU1LaFJXcnpXS3pwWjhYR2k5ZUthLzlsMD0%3dGet hashmaliciousHTMLPhisherBrowse
        • 104.47.55.156

        JA3 Fingerprints

        ⊘No context

        Dropped Files

        ⊘No context

        Created / dropped Files

        ⊘No created / dropped files found

        Static File Info

        General

        File type:ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
        Entropy (8bit):5.480485991165351
        TrID:
        • ELF Executable and Linkable format (generic) (4004/1) 100.00%
        File name:mips.elf
        File size:61'456 bytes
        MD5:aba40cf46423bbd1c743770af7aa9e55
        SHA1:042c965a2983fdad92ba0ca16b4db6e2135d602d
        SHA256:434c0a78e67be7d4d768f4efc9680983bf65720b927d1218174e3b37d9fdc023
        SHA512:63f04ce20c094536f49c80611a601a07bb71b538511962c68a8d4ef1da4438e466370959766b2bc8c93e60cc1276fbe4a5740eeb84b9824b89239badb8f505c3
        SSDEEP:1536:EtJRDhR+hRRRvRjhRLTNKGiT8v2ezxH6X:PNuT8vHH6X
        TLSH:0353B85E6E618FECF7ACC33447B799216359338633E09689D29CD6105F6024D681FBE8
        File Content Preview:.ELF.....................@.`...4.........4. ...(.............@...@...........................D...D........*T........dt.Q............................<...'.h....!'.......................<...'.g....!... ....'9... ......................<...'.g....!........'9.

        Static ELF Info

        ELF header

        Class:ELF32
        Data:2's complement, big endian
        Version:1 (current)
        Machine:MIPS R3000
        Version Number:0x1
        Type:EXEC (Executable file)
        OS/ABI:UNIX - System V
        ABI Version:0
        Entry Point Address:0x400260
        Flags:0x1007
        ELF Header Size:52
        Program Header Offset:52
        Program Header Size:32
        Number of Program Headers:3
        Section Header Offset:60896
        Section Header Size:40
        Number of Section Headers:14
        Header String Table Index:13

        Sections

        NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
        NULL0x00x00x00x00x0000
        .initPROGBITS0x4000940x940x8c0x00x6AX004
        .textPROGBITS0x4001200x1200xcf200x00x6AX0016
        .finiPROGBITS0x40d0400xd0400x5c0x00x6AX004
        .rodataPROGBITS0x40d0a00xd0a00x14400x00x2A0016
        .ctorsPROGBITS0x44e4e40xe4e40x80x00x3WA004
        .dtorsPROGBITS0x44e4ec0xe4ec0x80x00x3WA004
        .data.rel.roPROGBITS0x44e4f80xe4f80x80x00x3WA004
        .dataPROGBITS0x44e5000xe5000x3b00x00x3WA0016
        .gotPROGBITS0x44e8b00xe8b00x4cc0x40x10000003WAp0016
        .sbssNOBITS0x44ed7c0xed7c0x100x00x10000003WAp004
        .bssNOBITS0x44ed900xed7c0x21a80x00x3WA0016
        .mdebug.abi32PROGBITS0x9900xed7c0x00x00x0001
        .shstrtabSTRTAB0x00xed7c0x640x00x0001

        Program Segments

        TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
        LOAD0x00x4000000x4000000xe4e00xe4e05.54030x5R E0x10000.init .text .fini .rodata
        LOAD0xe4e40x44e4e40x44e4e40x8980x2a543.36110x6RW 0x10000.ctors .dtors .data.rel.ro .data .got .sbss .bss
        GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

        Network Behavior

        Network Port Distribution

        TCP Packets

        TimestampSource PortDest PortSource IPDest IP
        Dec 29, 2024 14:46:52.770598888 CET3569629421192.168.2.1552.150.237.12
        Dec 29, 2024 14:46:52.891693115 CET294213569652.150.237.12192.168.2.15
        Dec 29, 2024 14:46:52.891802073 CET3569629421192.168.2.1552.150.237.12
        Dec 29, 2024 14:46:52.891956091 CET3569629421192.168.2.1552.150.237.12
        Dec 29, 2024 14:46:53.012897015 CET294213569652.150.237.12192.168.2.15
        Dec 29, 2024 14:46:54.070039034 CET294213569652.150.237.12192.168.2.15
        Dec 29, 2024 14:46:54.070303917 CET3569629421192.168.2.1552.150.237.12
        Dec 29, 2024 14:46:54.205845118 CET3569629421192.168.2.1552.150.237.12
        Dec 29, 2024 14:46:54.327349901 CET294213569652.150.237.12192.168.2.15
        Dec 29, 2024 14:46:54.327581882 CET3569629421192.168.2.1552.150.237.12

        ICMP Packets

        TimestampSource IPDest IPChecksumCodeType
        Dec 29, 2024 14:47:01.540365934 CET192.168.2.15192.168.2.1827b(Port unreachable)Destination Unreachable
        Dec 29, 2024 14:48:21.553601980 CET192.168.2.15192.168.2.1827b(Port unreachable)Destination Unreachable

        System Behavior

        General

        Start time (UTC):13:46:52
        Start date (UTC):29/12/2024
        Path:/tmp/mips.elf
        Arguments:/tmp/mips.elf
        File size:5777432 bytes
        MD5 hash:0083f1f0e77be34ad27f849842bbb00c

        Chronological Activities


        General

        Start time (UTC):13:46:52
        Start date (UTC):29/12/2024
        Path:/tmp/mips.elf
        Arguments:-
        File size:5777432 bytes
        MD5 hash:0083f1f0e77be34ad27f849842bbb00c

        Chronological Activities


        General

        Start time (UTC):13:46:52
        Start date (UTC):29/12/2024
        Path:/tmp/mips.elf
        Arguments:-
        File size:5777432 bytes
        MD5 hash:0083f1f0e77be34ad27f849842bbb00c

        Chronological Activities


        General

        Start time (UTC):13:46:52
        Start date (UTC):29/12/2024
        Path:/tmp/mips.elf
        Arguments:-
        File size:5777432 bytes
        MD5 hash:0083f1f0e77be34ad27f849842bbb00c

        Chronological Activities


        General

        Start time (UTC):13:46:52
        Start date (UTC):29/12/2024
        Path:/bin/sh
        Arguments:sh -c "mkdir /7bsztp5oxv/ && >/7bsztp5oxv/7bsztp5oxv && cd /7bsztp5oxv/ >/dev/null"
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):13:46:52
        Start date (UTC):29/12/2024
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):13:46:52
        Start date (UTC):29/12/2024
        Path:/usr/bin/mkdir
        Arguments:mkdir /7bsztp5oxv/
        File size:88408 bytes
        MD5 hash:088c9d1df5a28ed16c726eca15964cb7

        Chronological Activities


        General

        Start time (UTC):13:46:52
        Start date (UTC):29/12/2024
        Path:/tmp/mips.elf
        Arguments:-
        File size:5777432 bytes
        MD5 hash:0083f1f0e77be34ad27f849842bbb00c

        Chronological Activities


        General

        Start time (UTC):13:46:52
        Start date (UTC):29/12/2024
        Path:/bin/sh
        Arguments:sh -c "mv /tmp/mips.elf /7bsztp5oxv/7bsztp5oxv && chmod 777 /7bsztp5oxv/7bsztp5oxv >/dev/null"
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):13:46:52
        Start date (UTC):29/12/2024
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):13:46:52
        Start date (UTC):29/12/2024
        Path:/usr/bin/mv
        Arguments:mv /tmp/mips.elf /7bsztp5oxv/7bsztp5oxv
        File size:149888 bytes
        MD5 hash:504f0590fa482d4da070a702260e3716

        Chronological Activities


        General

        Start time (UTC):13:46:52
        Start date (UTC):29/12/2024
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):13:46:52
        Start date (UTC):29/12/2024
        Path:/usr/bin/chmod
        Arguments:chmod 777 /7bsztp5oxv/7bsztp5oxv
        File size:63864 bytes
        MD5 hash:739483b900c045ae1374d6f53a86a279

        Chronological Activities