Edit tour

Linux Analysis Report
fenty.arm7.elf

Overview

General Information

Sample name:fenty.arm7.elf
Analysis ID:1584363
MD5:3f64031622ac9d7acff9a0d24224699c
SHA1:39b5e576399233695baa913cd90f112896bb3d52
SHA256:1ff770a807f9d78dddaa653c21f7a2fd3a23ca029b0854e1d05ee9b71aea49dc
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:72
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample deletes itself
Sample is packed with UPX
ELF contains segments with high entropy indicating compressed/encrypted content
Sample contains only a LOAD segment without any section mappings
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:41.0.0 Charoite
Analysis ID:1584363
Start date and time:2025-01-05 09:32:05 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 19s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:fenty.arm7.elf
Detection:MAL
Classification:mal72.troj.evad.linELF@0/0@0/0
Command:/tmp/fenty.arm7.elf
PID:6217
Exit Code:1
Exit Code Info:
Killed:False
Standard Output:

Standard Error:
  • system is lnxubuntu20
  • fenty.arm7.elf (PID: 6217, Parent: 6136, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/fenty.arm7.elf
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
6217.1.00007fcebc017000.00007fcebc034000.r-x.sdmpJoeSecurity_Mirai_9Yara detected MiraiJoe Security
    6217.1.00007fcebc017000.00007fcebc034000.r-x.sdmpMirai_Botnet_MalwareDetects Mirai Botnet MalwareFlorian Roth
    • 0x1b8a0:$x2: /dev/misc/watchdog
    • 0x1b890:$x3: /dev/watchdog
    • 0x1b8dc:$x3: /dev/watchdog
    • 0x1ba50:$s1: LCOGQGPTGP
    No Suricata rule has matched

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Source: fenty.arm7.elfReversingLabs: Detection: 21%
    Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
    Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
    Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
    Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
    Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
    Source: fenty.arm7.elfString found in binary or memory: http://upx.sf.net
    Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443

    System Summary

    barindex
    Source: 6217.1.00007fcebc017000.00007fcebc034000.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
    Source: LOAD without section mappingsProgram segment: 0x8000
    Source: Initial sampleString containing 'busybox' found: busybox
    Source: 6217.1.00007fcebc017000.00007fcebc034000.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
    Source: classification engineClassification label: mal72.troj.evad.linELF@0/0@0/0

    Data Obfuscation

    barindex
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

    Hooking and other Techniques for Hiding and Protection

    barindex
    Source: /tmp/fenty.arm7.elf (PID: 6217)File: /tmp/fenty.arm7.elfJump to behavior
    Source: fenty.arm7.elfSubmission file: segment LOAD with 7.7899 entropy (max. 8.0)
    Source: /tmp/fenty.arm7.elf (PID: 6217)Queries kernel information via 'uname': Jump to behavior
    Source: fenty.arm7.elf, 6217.1.00007ffc73f6a000.00007ffc73f8b000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/fenty.arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/fenty.arm7.elf
    Source: fenty.arm7.elf, 6217.1.0000563438aa1000.0000563438c2f000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
    Source: fenty.arm7.elf, 6217.1.00007ffc73f6a000.00007ffc73f8b000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
    Source: fenty.arm7.elf, 6217.1.0000563438aa1000.0000563438c2f000.rw-.sdmpBinary or memory string: 84V!/etc/qemu-binfmt/arm

    Stealing of Sensitive Information

    barindex
    Source: Yara matchFile source: 6217.1.00007fcebc017000.00007fcebc034000.r-x.sdmp, type: MEMORY

    Remote Access Functionality

    barindex
    Source: Yara matchFile source: 6217.1.00007fcebc017000.00007fcebc034000.r-x.sdmp, type: MEMORY
    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception11
    Obfuscated Files or Information
    OS Credential Dumping11
    Security Software Discovery
    Remote ServicesData from Local System1
    Encrypted Channel
    Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
    File Deletion
    LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
    Application Layer Protocol
    Exfiltration Over BluetoothNetwork Denial of Service
    No configs have been found
    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1584363 Sample: fenty.arm7.elf Startdate: 05/01/2025 Architecture: LINUX Score: 72 9 109.202.202.202, 80 INIT7CH Switzerland 2->9 11 91.189.91.42, 443 CANONICAL-ASGB United Kingdom 2->11 13 91.189.91.43, 443 CANONICAL-ASGB United Kingdom 2->13 15 Malicious sample detected (through community Yara rule) 2->15 17 Multi AV Scanner detection for submitted file 2->17 19 Yara detected Mirai 2->19 21 Sample is packed with UPX 2->21 6 fenty.arm7.elf 2->6         started        signatures3 process4 signatures5 23 Sample deletes itself 6->23

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand
    SourceDetectionScannerLabelLink
    fenty.arm7.elf21%ReversingLabsLinux.Trojan.Mirai
    No Antivirus matches
    No Antivirus matches
    No Antivirus matches

    Download Network PCAP: filteredfull

    No contacted domains info
    NameSourceMaliciousAntivirus DetectionReputation
    http://upx.sf.netfenty.arm7.elffalse
      high
      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs
      IPDomainCountryFlagASNASN NameMalicious
      109.202.202.202
      unknownSwitzerland
      13030INIT7CHfalse
      91.189.91.43
      unknownUnited Kingdom
      41231CANONICAL-ASGBfalse
      91.189.91.42
      unknownUnited Kingdom
      41231CANONICAL-ASGBfalse
      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
      • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
      91.189.91.43fenty.arm6.elfGet hashmaliciousMiraiBrowse
        h.elfGet hashmaliciousGafgytBrowse
          Mozi.m.elfGet hashmaliciousUnknownBrowse
            byte.mpsl.elfGet hashmaliciousMiraiBrowse
              main_mips.elfGet hashmaliciousMiraiBrowse
                i.elfGet hashmaliciousGafgytBrowse
                  sshd.elfGet hashmaliciousUnknownBrowse
                    fenty.arm6.elfGet hashmaliciousMiraiBrowse
                      fenty.arm4.elfGet hashmaliciousMiraiBrowse
                        Space.m68k.elfGet hashmaliciousMiraiBrowse
                          91.189.91.42fenty.arm6.elfGet hashmaliciousMiraiBrowse
                            fenty.arm5.elfGet hashmaliciousMiraiBrowse
                              h.elfGet hashmaliciousGafgytBrowse
                                c.elfGet hashmaliciousGafgytBrowse
                                  Mozi.m.elfGet hashmaliciousUnknownBrowse
                                    byte.mpsl.elfGet hashmaliciousMiraiBrowse
                                      main_mips.elfGet hashmaliciousMiraiBrowse
                                        i.elfGet hashmaliciousGafgytBrowse
                                          sshd.elfGet hashmaliciousUnknownBrowse
                                            fenty.arm6.elfGet hashmaliciousMiraiBrowse
                                              No context
                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              CANONICAL-ASGBfenty.arm6.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              fenty.arm5.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              h.elfGet hashmaliciousGafgytBrowse
                                              • 91.189.91.42
                                              c.elfGet hashmaliciousGafgytBrowse
                                              • 91.189.91.42
                                              a.elfGet hashmaliciousGafgytBrowse
                                              • 185.125.190.26
                                              Mozi.m.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              byte.mpsl.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              main_mips.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              i.elfGet hashmaliciousGafgytBrowse
                                              • 91.189.91.42
                                              sshd.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              CANONICAL-ASGBfenty.arm6.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              fenty.arm5.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              h.elfGet hashmaliciousGafgytBrowse
                                              • 91.189.91.42
                                              c.elfGet hashmaliciousGafgytBrowse
                                              • 91.189.91.42
                                              a.elfGet hashmaliciousGafgytBrowse
                                              • 185.125.190.26
                                              Mozi.m.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              byte.mpsl.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              main_mips.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              i.elfGet hashmaliciousGafgytBrowse
                                              • 91.189.91.42
                                              sshd.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              INIT7CHfenty.arm6.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              fenty.arm5.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              h.elfGet hashmaliciousGafgytBrowse
                                              • 109.202.202.202
                                              c.elfGet hashmaliciousGafgytBrowse
                                              • 109.202.202.202
                                              Mozi.m.elfGet hashmaliciousUnknownBrowse
                                              • 109.202.202.202
                                              byte.mpsl.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              main_mips.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              i.elfGet hashmaliciousGafgytBrowse
                                              • 109.202.202.202
                                              sshd.elfGet hashmaliciousUnknownBrowse
                                              • 109.202.202.202
                                              fenty.arm6.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              No context
                                              No context
                                              No created / dropped files found
                                              File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (GNU/Linux), statically linked, no section header
                                              Entropy (8bit):7.827926019726686
                                              TrID:
                                              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                              File name:fenty.arm7.elf
                                              File size:78'540 bytes
                                              MD5:3f64031622ac9d7acff9a0d24224699c
                                              SHA1:39b5e576399233695baa913cd90f112896bb3d52
                                              SHA256:1ff770a807f9d78dddaa653c21f7a2fd3a23ca029b0854e1d05ee9b71aea49dc
                                              SHA512:396ed110fa71ec25e43a0ab521cd5d14946c0d9ca83a4b982ac97d73df253f2e1e9b8318134c23ee916c997f24286e00f6d705b74150816be01312326c5f2d0e
                                              SSDEEP:1536:36wR/Xcbq2dXiiiCUhvtgnQnGX1nS7XxG3BE92RpYIrT9S7td5kv:qwRqqGiiiCMq8GXlS7XxG3BEARpYqhSu
                                              TLSH:B47302D01360546AB147CC2B918BFEFB7B1132BB421642752DC88E2D9CC653F5D679CA
                                              File Content Preview:.ELF..............(......Y..4...........4. ...(.........................................\...\...\...................Q.td............................;/'3UPX!....................u.........ELF.d.?..(.~...[4..p7...... ...w.....p(...(K..<8.....M.M.g.`......9..

                                              ELF header

                                              Class:ELF32
                                              Data:2's complement, little endian
                                              Version:1 (current)
                                              Machine:ARM
                                              Version Number:0x1
                                              Type:EXEC (Executable file)
                                              OS/ABI:UNIX - Linux
                                              ABI Version:0
                                              Entry Point Address:0x15980
                                              Flags:0x4000002
                                              ELF Header Size:52
                                              Program Header Offset:52
                                              Program Header Size:32
                                              Number of Program Headers:3
                                              Section Header Offset:0
                                              Section Header Size:40
                                              Number of Section Headers:0
                                              Header String Table Index:0
                                              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                              LOAD0x00x80000x80000xe2fb0xe2fb7.78990x5R E0x8000
                                              LOAD0x7f5c0x2ff5c0x2ff5c0x00x00.00000x6RW 0x8000
                                              GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                                              Download Network PCAP: filteredfull

                                              • Total Packets: 7
                                              • 443 (HTTPS)
                                              • 80 (HTTP)
                                              TimestampSource PortDest PortSource IPDest IP
                                              Jan 5, 2025 09:32:44.449893951 CET43928443192.168.2.2391.189.91.42
                                              Jan 5, 2025 09:32:49.825197935 CET42836443192.168.2.2391.189.91.43
                                              Jan 5, 2025 09:32:51.616851091 CET4251680192.168.2.23109.202.202.202
                                              Jan 5, 2025 09:33:04.927016020 CET43928443192.168.2.2391.189.91.42
                                              Jan 5, 2025 09:33:17.213330984 CET42836443192.168.2.2391.189.91.43
                                              Jan 5, 2025 09:33:21.308753014 CET4251680192.168.2.23109.202.202.202
                                              Jan 5, 2025 09:33:45.881262064 CET43928443192.168.2.2391.189.91.42

                                              System Behavior

                                              Start time (UTC):08:32:42
                                              Start date (UTC):05/01/2025
                                              Path:/tmp/fenty.arm7.elf
                                              Arguments:/tmp/fenty.arm7.elf
                                              File size:4956856 bytes
                                              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1