Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
sh4.elf

Overview

General Information

Sample name:sh4.elf
Analysis ID:1583604
MD5:d037fb7425eb7cd46a409161ed6d6e58
SHA1:0240567388fc488256d807aa6b089b08a9b7c911
SHA256:91aac3d740cd3663359d72073f53d1a4141fbe918f0670983b9bf1882d6c4ddf
Tags:elfuser-abuse_ch
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1583604
Start date and time:2025-01-03 07:52:11 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 20s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:sh4.elf
Detection:MAL
Classification:mal48.linELF@0/0@0/0

Runtime Messages

Command:/tmp/sh4.elf
PID:5434
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:

Standard Error:

Process Tree

  • system is lnxubuntu20
  • sh4.elf (PID: 5434, Parent: 5359, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/sh4.elf
    • sh4.elf New Fork (PID: 5436, Parent: 5434)
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: sh4.elfReversingLabs: Detection: 18%
Source: global trafficTCP traffic: 192.168.2.13:41480 -> 85.239.34.134:31337
Source: /tmp/sh4.elf (PID: 5434)Socket: 0.0.0.0:3142Jump to behavior
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal48.linELF@0/0@0/0
Source: /tmp/sh4.elf (PID: 5434)Queries kernel information via 'uname': Jump to behavior
Source: sh4.elf, 5434.1.00007ffde7f20000.00007ffde7f41000.rw-.sdmpBinary or memory string: |x86_64/usr/bin/qemu-sh4/tmp/sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sh4.elf
Source: sh4.elf, 5434.1.00007ffde7f20000.00007ffde7f41000.rw-.sdmpBinary or memory string: /usr/bin/qemu-sh4
Source: sh4.elf, 5434.1.0000560083a5a000.0000560083abd000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/sh4
Source: sh4.elf, 5434.1.0000560083a5a000.0000560083abd000.rw-.sdmpBinary or memory string: V5!/etc/qemu-binfmt/sh4

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
Security Software Discovery		Remote ServicesData from Local System1
Non-Standard Port		Exfiltration Over Other Network MediumAbuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
sh4.elf18%ReversingLabsLinux.Backdoor.Gafgyt

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
85.239.34.134
unknownRussian Federation
134121RAINBOW-HKRainbownetworklimitedHKfalse

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
85.239.34.134arm7.elfGet hashmaliciousUnknownBrowse
    arm.elfGet hashmaliciousUnknownBrowse
      arm7.elfGet hashmaliciousUnknownBrowse
        mpsl.elfGet hashmaliciousUnknownBrowse
          arm5.elfGet hashmaliciousUnknownBrowse
            ppc.elfGet hashmaliciousUnknownBrowse
              mips.elfGet hashmaliciousUnknownBrowse
                arm6.elfGet hashmaliciousUnknownBrowse
                  m68k.elfGet hashmaliciousUnknownBrowse
                    sh4.elfGet hashmaliciousUnknownBrowse

                      Domains

                      ⊘No context

                      ASNs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      RAINBOW-HKRainbownetworklimitedHKarm7.elfGet hashmaliciousUnknownBrowse
                      • 85.239.34.134
                      arm.elfGet hashmaliciousUnknownBrowse
                      • 85.239.34.134
                      https://klickskydd.skolverket.org/?url=https%3A%2F%2Fwww.gazeta.ru%2Fpolitics%2Fnews%2F2024%2F12%2F22%2F24684722.shtml&id=71de&rcpt=upplysningstjansten@skolverket.se&tss=1735469857&msgid=b53e7603-c5d3-11ef-8a2e-0050569b0508&html=1&h=ded85c63Get hashmaliciousHTMLPhisherBrowse
                      • 45.138.161.76
                      https://www.gazeta.ru/politics/news/2024/12/22/24684722.shtmlGet hashmaliciousHTMLPhisherBrowse
                      • 45.138.161.75
                      https://www.gazeta.ru/politics/news/2024/12/22/24684854.shtmlGet hashmaliciousHTMLPhisherBrowse
                      • 45.138.161.71
                      arm7.elfGet hashmaliciousUnknownBrowse
                      • 85.239.34.134
                      mpsl.elfGet hashmaliciousUnknownBrowse
                      • 85.239.34.134
                      arm5.elfGet hashmaliciousUnknownBrowse
                      • 85.239.34.134
                      ppc.elfGet hashmaliciousUnknownBrowse
                      • 85.239.34.134
                      mips.elfGet hashmaliciousUnknownBrowse
                      • 85.239.34.134

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      ⊘No created / dropped files found

                      Static File Info

                      General

                      File type:ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
                      Entropy (8bit):6.279946314672792
                      TrID:
                      • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                      File name:sh4.elf
                      File size:25'700 bytes
                      MD5:d037fb7425eb7cd46a409161ed6d6e58
                      SHA1:0240567388fc488256d807aa6b089b08a9b7c911
                      SHA256:91aac3d740cd3663359d72073f53d1a4141fbe918f0670983b9bf1882d6c4ddf
                      SHA512:a91aae7b33c451e393f0b2a20dab2a119ab339e63ca7d9914947f89540655cfdd9b5a5f6a61bc3a3bc10cc274c3d1f0b4774b2dc2412ac5d248ecb97460ab773
                      SSDEEP:384:80eL1hxaUOHck52TCI+XsaxnWyh5ux9eC4qc54+aYHSiOU/X8L31SS:80eJvAckXldxVu3SaSpOUC31SS
                      TLSH:14B25BE285202FB5C00EC6FEB131AB7803AB1235515B1DB4653BD6A84247D9EF9C97BC
                      File Content Preview:.ELF..............*.......@.4...4b......4. ...(...............@...@.dY..dY...............`...`@..`@....../..............|`..|`@.|`@.................Q.td............................././"O.n........#.*@........#.*@.T...o&O.n...l.............................

                      Static ELF Info

                      ELF header

                      Class:ELF32
                      Data:2's complement, little endian
                      Version:1 (current)
                      Machine:<unknown>
                      Version Number:0x1
                      Type:EXEC (Executable file)
                      OS/ABI:UNIX - System V
                      ABI Version:0
                      Entry Point Address:0x4001c0
                      Flags:0x9
                      ELF Header Size:52
                      Program Header Offset:52
                      Program Header Size:32
                      Number of Program Headers:4
                      Section Header Offset:25140
                      Section Header Size:40
                      Number of Section Headers:14
                      Header String Table Index:13

                      Sections

                      NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                      NULL0x00x00x00x00x0000
                      .initPROGBITS0x4000b40xb40x300x00x6AX004
                      .textPROGBITS0x4001000x1000x54a00x00x6AX0032
                      .finiPROGBITS0x4055a00x55a00x240x00x6AX004
                      .rodataPROGBITS0x4055c40x55c40x3a00x00x2A004
                      .eh_framePROGBITS0x4060000x60000x7c0x00x3WA004
                      .tbssNOBITS0x40607c0x607c0x80x00x403WAT004
                      .ctorsPROGBITS0x40607c0x607c0x80x00x3WA004
                      .dtorsPROGBITS0x4060840x60840x80x00x3WA004
                      .jcrPROGBITS0x40608c0x608c0x40x00x3WA004
                      .dataPROGBITS0x4060900x60900x1380x00x3WA004
                      .gotPROGBITS0x4061c80x61c80x140x40x3WA004
                      .bssNOBITS0x4061dc0x61dc0x2db00x00x3WA004
                      .shstrtabSTRTAB0x00x61dc0x580x00x0001

                      Program Segments

                      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                      LOAD0x00x4000000x4000000x59640x59646.67240x5R E0x1000.init .text .fini .rodata
                      LOAD0x60000x4060000x4060000x1dc0x2f8c2.51370x6RW 0x1000.eh_frame .tbss .ctors .dtors .jcr .data .got .bss
                      TLS0x607c0x40607c0x40607c0x00x80.00000x4R 0x4.tbss
                      GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                      Network Behavior

                      Network Port Distribution

                      TCP Packets

                      TimestampSource PortDest PortSource IPDest IP
                      Jan 3, 2025 07:52:54.003468037 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:52:54.008409023 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:52:54.008486032 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:52:54.008717060 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:52:54.013494015 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:52:54.745075941 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:52:54.745270014 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:52:54.745449066 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:52:54.750240088 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:52:54.967098951 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:52:54.967375040 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:53:04.977622032 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:53:04.982573032 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:53:05.199100971 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:53:05.199218035 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:53:05.199737072 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:53:05.204467058 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:53:15.208807945 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:53:15.215014935 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:53:15.430288076 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:53:15.430545092 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:53:25.440881014 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:53:25.445851088 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:53:25.664925098 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:53:25.665009975 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:53:35.672538042 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:53:35.677328110 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:53:35.894222021 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:53:35.894366980 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:53:45.904459000 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:53:45.909369946 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:53:46.160527945 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:53:46.160806894 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:53:56.170882940 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:53:56.175837994 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:53:56.427546024 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:53:56.427701950 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:54:06.437875032 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:54:06.442693949 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:54:06.659296989 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:54:06.659432888 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:54:16.669831038 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:54:16.674762964 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:54:16.891252995 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:54:16.891422987 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:54:26.901675940 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:54:26.906524897 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:54:27.127578020 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:54:27.127679110 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:54:37.129414082 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:54:37.135834932 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:54:37.352643967 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:54:37.352742910 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:54:47.361356020 CET4148031337192.168.2.1385.239.34.134
                      Jan 3, 2025 07:54:47.366244078 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:54:47.582827091 CET313374148085.239.34.134192.168.2.13
                      Jan 3, 2025 07:54:47.583090067 CET4148031337192.168.2.1385.239.34.134

                      System Behavior

                      General

                      Start time (UTC):06:52:52
                      Start date (UTC):03/01/2025
                      Path:/tmp/sh4.elf
                      Arguments:/tmp/sh4.elf
                      File size:4139976 bytes
                      MD5 hash:8943e5f8f8c280467b4472c15ae93ba9

                      Chronological Activities


                      General

                      Start time (UTC):06:52:52
                      Start date (UTC):03/01/2025
                      Path:/tmp/sh4.elf
                      Arguments:-
                      File size:4139976 bytes
                      MD5 hash:8943e5f8f8c280467b4472c15ae93ba9

                      Chronological Activities