Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
sparc.elf

Overview

General Information

Sample name:sparc.elf
Analysis ID:1582008
MD5:113307a0eff4937b6b068c0580b14d7e
SHA1:c54696651c77cdd62e31079e4f2b6a4ea4932a5c
SHA256:9abeef5bb78d3e45972495ed9cbc5f9d16deb8ac08d50abdff5f90293fdb1b30
Tags:elfuser-abuse_ch
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Detected TCP or UDP traffic on non-standard ports
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Sample has stripped symbol table
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Sets full permissions to files and/or directories
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1582008
Start date and time:2024-12-29 14:49:26 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 3m 48s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:sparc.elf
Detection:MAL
Classification:mal48.linELF@0/0@0/0

Warnings

  • Connection to analysis system has been lost, crash info: Unknown

Runtime Messages

Command:/tmp/sparc.elf
PID:5527
Exit Code:1
Exit Code Info:
Killed:False
Standard Output:
GOLDFISHGANG
Standard Error:

Process Tree

  • system is lnxubuntu20
  • sparc.elf (PID: 5527, Parent: 5442, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/sparc.elf
    • sparc.elf New Fork (PID: 5529, Parent: 5527)
      • sparc.elf New Fork (PID: 5531, Parent: 5529)
        • sh (PID: 5533, Parent: 5531, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mkdir /70q57a6xrq/ && >/70q57a6xrq/70q57a6xrq && cd /70q57a6xrq/ >/dev/null"
          • sh New Fork (PID: 5541, Parent: 5533)
          • mkdir (PID: 5541, Parent: 5533, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir /70q57a6xrq/
        • sh (PID: 5542, Parent: 5531, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /tmp/sparc.elf /70q57a6xrq/70q57a6xrq && chmod 777 /70q57a6xrq/70q57a6xrq >/dev/null"
          • sh New Fork (PID: 5547, Parent: 5542)
          • mv (PID: 5547, Parent: 5542, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /tmp/sparc.elf /70q57a6xrq/70q57a6xrq
          • sh New Fork (PID: 5548, Parent: 5542)
          • chmod (PID: 5548, Parent: 5542, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 /70q57a6xrq/70q57a6xrq
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: sparc.elfVirustotal: Detection: 42%Perma Link
Source: sparc.elfReversingLabs: Detection: 42%
Source: global trafficTCP traffic: 192.168.2.15:35710 -> 52.150.237.12:29421
Source: unknownTCP traffic detected without corresponding DNS query: 52.150.237.12
Source: unknownTCP traffic detected without corresponding DNS query: 52.150.237.12
Source: unknownTCP traffic detected without corresponding DNS query: 52.150.237.12
Source: unknownTCP traffic detected without corresponding DNS query: 52.150.237.12
Source: unknownTCP traffic detected without corresponding DNS query: 52.150.237.12
Source: unknownTCP traffic detected without corresponding DNS query: 52.150.237.12
Source: ELF static info symbol of initial sample.symtab present: no
Source: /tmp/sparc.elf (PID: 5531)SIGKILL sent: pid: 0 (kernel), result: unknownJump to behavior
Source: classification engineClassification label: mal48.linELF@0/0@0/0
Source: /tmp/sparc.elf (PID: 5533)Shell command executed: sh -c "mkdir /70q57a6xrq/ && >/70q57a6xrq/70q57a6xrq && cd /70q57a6xrq/ >/dev/null"Jump to behavior
Source: /tmp/sparc.elf (PID: 5542)Shell command executed: sh -c "mv /tmp/sparc.elf /70q57a6xrq/70q57a6xrq && chmod 777 /70q57a6xrq/70q57a6xrq >/dev/null"Jump to behavior
Source: /bin/sh (PID: 5548)Chmod executable: /usr/bin/chmod -> chmod 777 /70q57a6xrq/70q57a6xrqJump to behavior
Source: /bin/sh (PID: 5541)Mkdir executable: /usr/bin/mkdir -> mkdir /70q57a6xrq/Jump to behavior
Source: /usr/bin/chmod (PID: 5548)File: /70q57a6xrq/70q57a6xrq (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
Source: /bin/sh (PID: 5548)Chmod executable with 777: /usr/bin/chmod -> chmod 777 /70q57a6xrq/70q57a6xrqJump to behavior
Source: /tmp/sparc.elf (PID: 5527)Queries kernel information via 'uname': Jump to behavior
Source: sparc.elf, 5527.1.000055d06f4c2000.000055d06f547000.rw-.sdmp, sparc.elf, 5529.1.000055d06f4c2000.000055d06f527000.rw-.sdmp, sparc.elf, 5531.1.000055d06f4c2000.000055d06f527000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/sparc
Source: sparc.elf, 5527.1.000055d06f4c2000.000055d06f547000.rw-.sdmp, sparc.elf, 5529.1.000055d06f4c2000.000055d06f527000.rw-.sdmp, sparc.elf, 5531.1.000055d06f4c2000.000055d06f527000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/sparc
Source: sparc.elf, 5527.1.00007ffdb8215000.00007ffdb8236000.rw-.sdmp, sparc.elf, 5529.1.00007ffdb8215000.00007ffdb8236000.rw-.sdmp, sparc.elf, 5531.1.00007ffdb8215000.00007ffdb8236000.rw-.sdmpBinary or memory string: /usr/bin/qemu-sparc
Source: sparc.elf, 5527.1.00007ffdb8215000.00007ffdb8236000.rw-.sdmp, sparc.elf, 5529.1.00007ffdb8215000.00007ffdb8236000.rw-.sdmp, sparc.elf, 5531.1.00007ffdb8215000.00007ffdb8236000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-sparc/tmp/sparc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sparc.elf

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting		Valid AccountsWindows Management Instrumentation1
Scripting		Path Interception2
File and Directory Permissions Modification		OS Credential Dumping11
Security Software Discovery		Remote ServicesData from Local System1
Non-Standard Port		Exfiltration Over Other Network MediumAbuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1582008 Sample: sparc.elf Startdate: 29/12/2024 Architecture: LINUX Score: 48 26 52.150.237.12, 29421, 35710 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 2->26 28 Multi AV Scanner detection for submitted file 2->28 10 sparc.elf 2->10         started        signatures3 process4 process5 12 sparc.elf 10->12         started        process6 14 sparc.elf 12->14         started        process7 16 sparc.elf sh 14->16         started        18 sparc.elf sh 14->18         started        process8 20 sh mv 16->20         started        22 sh chmod 16->22         started        24 sh mkdir 18->24         started       

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
sparc.elf43%VirustotalBrowse
sparc.elf42%ReversingLabsLinux.Backdoor.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
52.150.237.12
unknownUnited States
8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
52.150.237.12mipsel.elfGet hashmaliciousUnknownBrowse
    sh4.elfGet hashmaliciousUnknownBrowse
      arm7.elfGet hashmaliciousUnknownBrowse
        mips.elfGet hashmaliciousUnknownBrowse
          arm5.elfGet hashmaliciousUnknownBrowse
            arm.elfGet hashmaliciousUnknownBrowse
              x86_64.elfGet hashmaliciousUnknownBrowse

                Domains

                ⊘No context

                ASNs

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                MICROSOFT-CORP-MSN-AS-BLOCKUSmipsel.elfGet hashmaliciousUnknownBrowse
                • 52.150.237.12
                sh4.elfGet hashmaliciousUnknownBrowse
                • 52.150.237.12
                arm7.elfGet hashmaliciousUnknownBrowse
                • 52.150.237.12
                mips.elfGet hashmaliciousUnknownBrowse
                • 52.150.237.12
                arm5.elfGet hashmaliciousUnknownBrowse
                • 52.150.237.12
                arm.elfGet hashmaliciousUnknownBrowse
                • 52.150.237.12
                x86_64.elfGet hashmaliciousUnknownBrowse
                • 52.150.237.12
                Tool_Unlock_v1.2.exeGet hashmaliciousVidarBrowse
                • 204.79.197.219
                db0fa4b8db0333367e9bda3ab68b8042.m68k.elfGet hashmaliciousMirai, GafgytBrowse
                • 40.108.137.192
                db0fa4b8db0333367e9bda3ab68b8042.i686.elfGet hashmaliciousMirai, GafgytBrowse
                • 13.101.154.254

                JA3 Fingerprints

                ⊘No context

                Dropped Files

                ⊘No context

                Created / dropped Files

                ⊘No created / dropped files found

                Static File Info

                General

                File type:ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
                Entropy (8bit):6.136235359691651
                TrID:
                • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                File name:sparc.elf
                File size:51'600 bytes
                MD5:113307a0eff4937b6b068c0580b14d7e
                SHA1:c54696651c77cdd62e31079e4f2b6a4ea4932a5c
                SHA256:9abeef5bb78d3e45972495ed9cbc5f9d16deb8ac08d50abdff5f90293fdb1b30
                SHA512:5d83daf5a2141a658eea31eaed692ed1f02b3ec26bd6f860f806845b1086c41b4f1c4a16a820ed1ba6b4241097251745215a28e15e0c587c457719c34ea1f72a
                SSDEEP:768:xyO1NwJNNOfdhv2ix6b8xxZO+750Zl8X01tkIZ:xv1NwJNNEdhNDxP750/tkC
                TLSH:B3333B31B6654923C4C2583A11EB063AF5F28A8E5CF8873E7DD10F58FF64A443193EA9
                File Content Preview:.ELF...........................4.........4. ...(.......................0...0...............4...4...4......$.........dt.Q................................@..(....@.+.................#.....c...`.....!..... L..@.....".........`......$ L.. L..@...........`....

                Static ELF Info

                ELF header

                Class:ELF32
                Data:2's complement, big endian
                Version:1 (current)
                Machine:Sparc
                Version Number:0x1
                Type:EXEC (Executable file)
                OS/ABI:UNIX - System V
                ABI Version:0
                Entry Point Address:0x101a4
                Flags:0x0
                ELF Header Size:52
                Program Header Offset:52
                Program Header Size:32
                Number of Program Headers:3
                Section Header Offset:51200
                Section Header Size:40
                Number of Section Headers:10
                Header String Table Index:9

                Sections

                NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                NULL0x00x00x00x00x0000
                .initPROGBITS0x100940x940x1c0x00x6AX004
                .textPROGBITS0x100b00xb00xaee40x00x6AX004
                .finiPROGBITS0x1af940xaf940x140x00x6AX004
                .rodataPROGBITS0x1afa80xafa80x14880x00x2A008
                .ctorsPROGBITS0x2c4340xc4340x80x00x3WA004
                .dtorsPROGBITS0x2c43c0xc43c0x80x00x3WA004
                .dataPROGBITS0x2c4480xc4480x3780x00x3WA008
                .bssNOBITS0x2c7c00xc7c00x21680x00x3WA008
                .shstrtabSTRTAB0x00xc7c00x3e0x00x0001

                Program Segments

                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                LOAD0x00x100000x100000xc4300xc4306.18290x5R E0x10000.init .text .fini .rodata
                LOAD0xc4340x2c4340x2c4340x38c0x24f42.86510x6RW 0x10000.ctors .dtors .data .bss
                GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

                Network Behavior

                Network Port Distribution

                TCP Packets

                TimestampSource PortDest PortSource IPDest IP
                Dec 29, 2024 14:50:13.504519939 CET3571029421192.168.2.1552.150.237.12
                Dec 29, 2024 14:50:13.625783920 CET294213571052.150.237.12192.168.2.15
                Dec 29, 2024 14:50:13.625859976 CET3571029421192.168.2.1552.150.237.12
                Dec 29, 2024 14:50:13.626015902 CET3571029421192.168.2.1552.150.237.12
                Dec 29, 2024 14:50:13.746813059 CET294213571052.150.237.12192.168.2.15
                Dec 29, 2024 14:50:14.803906918 CET294213571052.150.237.12192.168.2.15
                Dec 29, 2024 14:50:14.804171085 CET3571029421192.168.2.1552.150.237.12
                Dec 29, 2024 14:50:14.920783997 CET3571029421192.168.2.1552.150.237.12
                Dec 29, 2024 14:50:15.042146921 CET294213571052.150.237.12192.168.2.15
                Dec 29, 2024 14:50:15.042226076 CET3571029421192.168.2.1552.150.237.12

                ICMP Packets

                TimestampSource IPDest IPChecksumCodeType
                Dec 29, 2024 14:50:22.872323036 CET192.168.2.15192.168.2.1827b(Port unreachable)Destination Unreachable
                Dec 29, 2024 14:51:42.883419991 CET192.168.2.15192.168.2.1827b(Port unreachable)Destination Unreachable

                System Behavior

                General

                Start time (UTC):13:50:12
                Start date (UTC):29/12/2024
                Path:/tmp/sparc.elf
                Arguments:/tmp/sparc.elf
                File size:4379400 bytes
                MD5 hash:7dc1c0e23cd5e102bb12e5c29403410e

                Chronological Activities


                General

                Start time (UTC):13:50:12
                Start date (UTC):29/12/2024
                Path:/tmp/sparc.elf
                Arguments:-
                File size:4379400 bytes
                MD5 hash:7dc1c0e23cd5e102bb12e5c29403410e

                Chronological Activities


                General

                Start time (UTC):13:50:12
                Start date (UTC):29/12/2024
                Path:/tmp/sparc.elf
                Arguments:-
                File size:4379400 bytes
                MD5 hash:7dc1c0e23cd5e102bb12e5c29403410e

                Chronological Activities


                General

                Start time (UTC):13:50:12
                Start date (UTC):29/12/2024
                Path:/tmp/sparc.elf
                Arguments:-
                File size:4379400 bytes
                MD5 hash:7dc1c0e23cd5e102bb12e5c29403410e

                Chronological Activities


                General

                Start time (UTC):13:50:12
                Start date (UTC):29/12/2024
                Path:/bin/sh
                Arguments:sh -c "mkdir /70q57a6xrq/ && >/70q57a6xrq/70q57a6xrq && cd /70q57a6xrq/ >/dev/null"
                File size:129816 bytes
                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                Chronological Activities


                General

                Start time (UTC):13:50:12
                Start date (UTC):29/12/2024
                Path:/bin/sh
                Arguments:-
                File size:129816 bytes
                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                Chronological Activities


                General

                Start time (UTC):13:50:12
                Start date (UTC):29/12/2024
                Path:/usr/bin/mkdir
                Arguments:mkdir /70q57a6xrq/
                File size:88408 bytes
                MD5 hash:088c9d1df5a28ed16c726eca15964cb7

                Chronological Activities


                General

                Start time (UTC):13:50:12
                Start date (UTC):29/12/2024
                Path:/tmp/sparc.elf
                Arguments:-
                File size:4379400 bytes
                MD5 hash:7dc1c0e23cd5e102bb12e5c29403410e

                Chronological Activities


                General

                Start time (UTC):13:50:12
                Start date (UTC):29/12/2024
                Path:/bin/sh
                Arguments:sh -c "mv /tmp/sparc.elf /70q57a6xrq/70q57a6xrq && chmod 777 /70q57a6xrq/70q57a6xrq >/dev/null"
                File size:129816 bytes
                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                Chronological Activities


                General

                Start time (UTC):13:50:12
                Start date (UTC):29/12/2024
                Path:/bin/sh
                Arguments:-
                File size:129816 bytes
                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                Chronological Activities


                General

                Start time (UTC):13:50:12
                Start date (UTC):29/12/2024
                Path:/usr/bin/mv
                Arguments:mv /tmp/sparc.elf /70q57a6xrq/70q57a6xrq
                File size:149888 bytes
                MD5 hash:504f0590fa482d4da070a702260e3716

                Chronological Activities


                General

                Start time (UTC):13:50:12
                Start date (UTC):29/12/2024
                Path:/bin/sh
                Arguments:-
                File size:129816 bytes
                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                Chronological Activities


                General

                Start time (UTC):13:50:12
                Start date (UTC):29/12/2024
                Path:/usr/bin/chmod
                Arguments:chmod 777 /70q57a6xrq/70q57a6xrq
                File size:63864 bytes
                MD5 hash:739483b900c045ae1374d6f53a86a279

                Chronological Activities