Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
mipsel.elf

Overview

General Information

Sample name:mipsel.elf
Analysis ID:1582007
MD5:43c18219c40f252163e279799e613176
SHA1:ec8e5e3c3584309d2afe6ca9a40ffccff02856b9
SHA256:cbd7e4c0bd48efac38b8172d7704029ae45be12731500b77414424e44b3c4320
Tags:elfuser-abuse_ch
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Detected TCP or UDP traffic on non-standard ports
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Sample has stripped symbol table
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Sets full permissions to files and/or directories
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1582007
Start date and time:2024-12-29 14:48:40 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 3m 46s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:mipsel.elf
Detection:MAL
Classification:mal48.linELF@0/0@0/0

Warnings

  • Connection to analysis system has been lost, crash info: Unknown

Runtime Messages

Command:/tmp/mipsel.elf
PID:5432
Exit Code:1
Exit Code Info:
Killed:False
Standard Output:
GOLDFISHGANG
Standard Error:

Process Tree

  • system is lnxubuntu20
  • mipsel.elf (PID: 5432, Parent: 5357, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/mipsel.elf
    • mipsel.elf New Fork (PID: 5435, Parent: 5432)
      • mipsel.elf New Fork (PID: 5441, Parent: 5435)
        • sh (PID: 5443, Parent: 5441, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mkdir /76ukhn8k0v/ && >/76ukhn8k0v/76ukhn8k0v && cd /76ukhn8k0v/ >/dev/null"
          • sh New Fork (PID: 5448, Parent: 5443)
          • mkdir (PID: 5448, Parent: 5443, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir /76ukhn8k0v/
        • sh (PID: 5449, Parent: 5441, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /tmp/mipsel.elf /76ukhn8k0v/76ukhn8k0v && chmod 777 /76ukhn8k0v/76ukhn8k0v >/dev/null"
          • sh New Fork (PID: 5451, Parent: 5449)
          • mv (PID: 5451, Parent: 5449, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /tmp/mipsel.elf /76ukhn8k0v/76ukhn8k0v
          • sh New Fork (PID: 5452, Parent: 5449)
          • chmod (PID: 5452, Parent: 5449, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 /76ukhn8k0v/76ukhn8k0v
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: mipsel.elfVirustotal: Detection: 44%Perma Link
Source: mipsel.elfReversingLabs: Detection: 47%
Source: global trafficTCP traffic: 192.168.2.13:58802 -> 52.150.237.12:29421
Source: unknownTCP traffic detected without corresponding DNS query: 52.150.237.12
Source: unknownTCP traffic detected without corresponding DNS query: 52.150.237.12
Source: unknownTCP traffic detected without corresponding DNS query: 52.150.237.12
Source: unknownTCP traffic detected without corresponding DNS query: 52.150.237.12
Source: unknownTCP traffic detected without corresponding DNS query: 52.150.237.12
Source: unknownTCP traffic detected without corresponding DNS query: 52.150.237.12
Source: ELF static info symbol of initial sample.symtab present: no
Source: /tmp/mipsel.elf (PID: 5441)SIGKILL sent: pid: 0 (kernel), result: unknownJump to behavior
Source: classification engineClassification label: mal48.linELF@0/0@0/0
Source: /tmp/mipsel.elf (PID: 5443)Shell command executed: sh -c "mkdir /76ukhn8k0v/ && >/76ukhn8k0v/76ukhn8k0v && cd /76ukhn8k0v/ >/dev/null"Jump to behavior
Source: /tmp/mipsel.elf (PID: 5449)Shell command executed: sh -c "mv /tmp/mipsel.elf /76ukhn8k0v/76ukhn8k0v && chmod 777 /76ukhn8k0v/76ukhn8k0v >/dev/null"Jump to behavior
Source: /bin/sh (PID: 5452)Chmod executable: /usr/bin/chmod -> chmod 777 /76ukhn8k0v/76ukhn8k0vJump to behavior
Source: /bin/sh (PID: 5448)Mkdir executable: /usr/bin/mkdir -> mkdir /76ukhn8k0v/Jump to behavior
Source: /usr/bin/chmod (PID: 5452)File: /76ukhn8k0v/76ukhn8k0v (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
Source: /bin/sh (PID: 5452)Chmod executable with 777: /usr/bin/chmod -> chmod 777 /76ukhn8k0v/76ukhn8k0vJump to behavior
Source: /tmp/mipsel.elf (PID: 5432)Queries kernel information via 'uname': Jump to behavior
Source: mipsel.elf, 5432.1.0000558db03a6000.0000558db042d000.rw-.sdmp, mipsel.elf, 5435.1.0000558db03a6000.0000558db042d000.rw-.sdmp, mipsel.elf, 5441.1.0000558db03a6000.0000558db042d000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mipsel
Source: mipsel.elf, 5432.1.00007ffeea6e6000.00007ffeea707000.rw-.sdmp, mipsel.elf, 5435.1.00007ffeea6e6000.00007ffeea707000.rw-.sdmp, mipsel.elf, 5441.1.00007ffeea6e6000.00007ffeea707000.rw-.sdmpBinary or memory string: 0x86_64/usr/bin/qemu-mipsel/tmp/mipsel.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mipsel.elf
Source: mipsel.elf, 5432.1.0000558db03a6000.0000558db042d000.rw-.sdmp, mipsel.elf, 5435.1.0000558db03a6000.0000558db042d000.rw-.sdmp, mipsel.elf, 5441.1.0000558db03a6000.0000558db042d000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/mipsel
Source: mipsel.elf, 5432.1.00007ffeea6e6000.00007ffeea707000.rw-.sdmp, mipsel.elf, 5435.1.00007ffeea6e6000.00007ffeea707000.rw-.sdmp, mipsel.elf, 5441.1.00007ffeea6e6000.00007ffeea707000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mipsel

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting		Valid AccountsWindows Management Instrumentation1
Scripting		Path Interception2
File and Directory Permissions Modification		OS Credential Dumping11
Security Software Discovery		Remote ServicesData from Local System1
Non-Standard Port		Exfiltration Over Other Network MediumAbuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1582007 Sample: mipsel.elf Startdate: 29/12/2024 Architecture: LINUX Score: 48 26 52.150.237.12, 29421, 58802 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 2->26 28 Multi AV Scanner detection for submitted file 2->28 10 mipsel.elf 2->10         started        signatures3 process4 process5 12 mipsel.elf 10->12         started        process6 14 mipsel.elf 12->14         started        process7 16 mipsel.elf sh 14->16         started        18 mipsel.elf sh 14->18         started        process8 20 sh mv 16->20         started        22 sh chmod 16->22         started        24 sh mkdir 18->24         started       

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
mipsel.elf44%VirustotalBrowse
mipsel.elf47%ReversingLabsLinux.Backdoor.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
52.150.237.12
unknownUnited States
8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
52.150.237.12arm7.elfGet hashmaliciousUnknownBrowse
    mips.elfGet hashmaliciousUnknownBrowse
      arm5.elfGet hashmaliciousUnknownBrowse
        arm.elfGet hashmaliciousUnknownBrowse
          x86_64.elfGet hashmaliciousUnknownBrowse

            Domains

            ⊘No context

            ASNs

            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            MICROSOFT-CORP-MSN-AS-BLOCKUSarm7.elfGet hashmaliciousUnknownBrowse
            • 52.150.237.12
            mips.elfGet hashmaliciousUnknownBrowse
            • 52.150.237.12
            arm5.elfGet hashmaliciousUnknownBrowse
            • 52.150.237.12
            arm.elfGet hashmaliciousUnknownBrowse
            • 52.150.237.12
            x86_64.elfGet hashmaliciousUnknownBrowse
            • 52.150.237.12
            Tool_Unlock_v1.2.exeGet hashmaliciousVidarBrowse
            • 204.79.197.219
            db0fa4b8db0333367e9bda3ab68b8042.m68k.elfGet hashmaliciousMirai, GafgytBrowse
            • 40.108.137.192
            db0fa4b8db0333367e9bda3ab68b8042.i686.elfGet hashmaliciousMirai, GafgytBrowse
            • 13.101.154.254
            fxsound_setup.exeGet hashmaliciousUnknownBrowse
            • 20.233.83.145
            phish_alert_iocp_v1.4.48 - 2024-12-27T140703.193.emlGet hashmaliciousUnknownBrowse
            • 52.109.76.243

            JA3 Fingerprints

            ⊘No context

            Dropped Files

            ⊘No context

            Created / dropped Files

            ⊘No created / dropped files found

            Static File Info

            General

            File type:ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
            Entropy (8bit):5.420460784509125
            TrID:
            • ELF Executable and Linkable format (generic) (4004/1) 100.00%
            File name:mipsel.elf
            File size:64'304 bytes
            MD5:43c18219c40f252163e279799e613176
            SHA1:ec8e5e3c3584309d2afe6ca9a40ffccff02856b9
            SHA256:cbd7e4c0bd48efac38b8172d7704029ae45be12731500b77414424e44b3c4320
            SHA512:f60d19af6deaa01e8f666c1a8f9accd99a8b01c9ce248a22b5af877edee772bb4a0fd437173e0ed626ebb4f0a1e59ec3f15790ee5ee74dee1185751b453593b0
            SSDEEP:1536:hzcXv+9ccTclzxda3C3V1DXxZYk69UaBVeg:hwXv+9c31DhI3e
            TLSH:1853D616FF914FEBD86BCD3301AC8701399D695612B87B357A30C929F25E68F12E3894
            File Content Preview:.ELF....................`.@.4...........4. ...(...............@...@...........................D...D.....X*..........Q.td...............................<,s.'!......'.......................<.s.'!... .........9'.. ........................<.r.'!.............9

            Static ELF Info

            ELF header

            Class:ELF32
            Data:2's complement, little endian
            Version:1 (current)
            Machine:MIPS R3000
            Version Number:0x1
            Type:EXEC (Executable file)
            OS/ABI:UNIX - System V
            ABI Version:0
            Entry Point Address:0x400260
            Flags:0x1007
            ELF Header Size:52
            Program Header Offset:52
            Program Header Size:32
            Number of Program Headers:3
            Section Header Offset:63744
            Section Header Size:40
            Number of Section Headers:14
            Header String Table Index:13

            Sections

            NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
            NULL0x00x00x00x00x0000
            .initPROGBITS0x4000940x940x8c0x00x6AX004
            .textPROGBITS0x4001200x1200xd5200x00x6AX0016
            .finiPROGBITS0x40d6400xd6400x5c0x00x6AX004
            .rodataPROGBITS0x40d6a00xd6a00x14400x00x2A0016
            .ctorsPROGBITS0x44f0000xf0000x80x00x3WA004
            .dtorsPROGBITS0x44f0080xf0080x80x00x3WA004
            .data.rel.roPROGBITS0x44f0140xf0140x80x00x3WA004
            .dataPROGBITS0x44f0200xf0200x3b00x00x3WA0016
            .gotPROGBITS0x44f3d00xf3d00x4cc0x40x10000003WAp0016
            .sbssNOBITS0x44f89c0xf89c0x100x00x10000003WAp004
            .bssNOBITS0x44f8b00xf89c0x21a80x00x3WA0016
            .mdebug.abi32PROGBITS0x9900xf89c0x00x00x0001
            .shstrtabSTRTAB0x00xf89c0x640x00x0001

            Program Segments

            TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
            LOAD0x00x4000000x4000000xeae00xeae05.55740x5R E0x10000.init .text .fini .rodata
            LOAD0xf0000x44f0000x44f0000x89c0x2a583.32110x6RW 0x10000.ctors .dtors .data.rel.ro .data .got .sbss .bss
            GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

            Network Behavior

            Network Port Distribution

            TCP Packets

            TimestampSource PortDest PortSource IPDest IP
            Dec 29, 2024 14:49:22.183612108 CET5880229421192.168.2.1352.150.237.12
            Dec 29, 2024 14:49:22.304485083 CET294215880252.150.237.12192.168.2.13
            Dec 29, 2024 14:49:22.304758072 CET5880229421192.168.2.1352.150.237.12
            Dec 29, 2024 14:49:22.304820061 CET5880229421192.168.2.1352.150.237.12
            Dec 29, 2024 14:49:22.425662041 CET294215880252.150.237.12192.168.2.13
            Dec 29, 2024 14:49:23.483012915 CET294215880252.150.237.12192.168.2.13
            Dec 29, 2024 14:49:23.483397961 CET5880229421192.168.2.1352.150.237.12
            Dec 29, 2024 14:49:23.602849007 CET5880229421192.168.2.1352.150.237.12
            Dec 29, 2024 14:49:23.724097013 CET294215880252.150.237.12192.168.2.13
            Dec 29, 2024 14:49:23.724220991 CET5880229421192.168.2.1352.150.237.12

            ICMP Packets

            TimestampSource IPDest IPChecksumCodeType
            Dec 29, 2024 14:49:32.117549896 CET192.168.2.13192.168.2.18279(Port unreachable)Destination Unreachable
            Dec 29, 2024 14:50:52.130796909 CET192.168.2.13192.168.2.18279(Port unreachable)Destination Unreachable

            System Behavior

            General

            Start time (UTC):13:49:20
            Start date (UTC):29/12/2024
            Path:/tmp/mipsel.elf
            Arguments:/tmp/mipsel.elf
            File size:5773336 bytes
            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

            Chronological Activities


            General

            Start time (UTC):13:49:20
            Start date (UTC):29/12/2024
            Path:/tmp/mipsel.elf
            Arguments:-
            File size:5773336 bytes
            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

            Chronological Activities


            General

            Start time (UTC):13:49:20
            Start date (UTC):29/12/2024
            Path:/tmp/mipsel.elf
            Arguments:-
            File size:5773336 bytes
            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

            Chronological Activities


            General

            Start time (UTC):13:49:21
            Start date (UTC):29/12/2024
            Path:/tmp/mipsel.elf
            Arguments:-
            File size:5773336 bytes
            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

            Chronological Activities


            General

            Start time (UTC):13:49:21
            Start date (UTC):29/12/2024
            Path:/bin/sh
            Arguments:sh -c "mkdir /76ukhn8k0v/ && >/76ukhn8k0v/76ukhn8k0v && cd /76ukhn8k0v/ >/dev/null"
            File size:129816 bytes
            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

            Chronological Activities


            General

            Start time (UTC):13:49:21
            Start date (UTC):29/12/2024
            Path:/bin/sh
            Arguments:-
            File size:129816 bytes
            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

            Chronological Activities


            General

            Start time (UTC):13:49:21
            Start date (UTC):29/12/2024
            Path:/usr/bin/mkdir
            Arguments:mkdir /76ukhn8k0v/
            File size:88408 bytes
            MD5 hash:088c9d1df5a28ed16c726eca15964cb7

            Chronological Activities


            General

            Start time (UTC):13:49:21
            Start date (UTC):29/12/2024
            Path:/tmp/mipsel.elf
            Arguments:-
            File size:5773336 bytes
            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

            Chronological Activities


            General

            Start time (UTC):13:49:21
            Start date (UTC):29/12/2024
            Path:/bin/sh
            Arguments:sh -c "mv /tmp/mipsel.elf /76ukhn8k0v/76ukhn8k0v && chmod 777 /76ukhn8k0v/76ukhn8k0v >/dev/null"
            File size:129816 bytes
            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

            Chronological Activities


            General

            Start time (UTC):13:49:21
            Start date (UTC):29/12/2024
            Path:/bin/sh
            Arguments:-
            File size:129816 bytes
            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

            Chronological Activities


            General

            Start time (UTC):13:49:21
            Start date (UTC):29/12/2024
            Path:/usr/bin/mv
            Arguments:mv /tmp/mipsel.elf /76ukhn8k0v/76ukhn8k0v
            File size:149888 bytes
            MD5 hash:504f0590fa482d4da070a702260e3716

            Chronological Activities


            General

            Start time (UTC):13:49:21
            Start date (UTC):29/12/2024
            Path:/bin/sh
            Arguments:-
            File size:129816 bytes
            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

            Chronological Activities


            General

            Start time (UTC):13:49:21
            Start date (UTC):29/12/2024
            Path:/usr/bin/chmod
            Arguments:chmod 777 /76ukhn8k0v/76ukhn8k0v
            File size:63864 bytes
            MD5 hash:739483b900c045ae1374d6f53a86a279

            Chronological Activities