Edit tour

Linux Analysis Report
arm7.elf

Overview

General Information

Sample name:arm7.elf
Analysis ID:1587401
MD5:6d567b3b4dde6b0ef7ce347125cacdb3
SHA1:38507425474c11cf94c85105aa20ed5804bd4e55
SHA256:b80d60c50212807d122a5c0ae9fc6b23c5bf5029bf0843cf6c980fb31626fb9a
Tags:elfuser-abuse_ch
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Executes the "rm" command used to delete files or directories
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1587401
Start date and time:2025-01-10 10:37:06 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 43s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:arm7.elf
Detection:MAL
Classification:mal48.linELF@0/0@0/0
Command:/tmp/arm7.elf
PID:6260
Exit Code:135
Exit Code Info:
Killed:False
Standard Output:

Standard Error:
  • system is lnxubuntu20
  • dash New Fork (PID: 6231, Parent: 4332)
  • rm (PID: 6231, Parent: 4332, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.DzC3kbrUDO /tmp/tmp.FRcdRXLMwf /tmp/tmp.yjW4DJlQVO
  • dash New Fork (PID: 6232, Parent: 4332)
  • rm (PID: 6232, Parent: 4332, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.DzC3kbrUDO /tmp/tmp.FRcdRXLMwf /tmp/tmp.yjW4DJlQVO
  • arm7.elf (PID: 6260, Parent: 6161, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm7.elf
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: arm7.elfReversingLabs: Detection: 21%
Source: unknownTCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 33606
Source: unknownNetwork traffic detected: HTTP traffic on port 33606 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
Source: classification engineClassification label: mal48.linELF@0/0@0/0
Source: /usr/bin/dash (PID: 6231)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.DzC3kbrUDO /tmp/tmp.FRcdRXLMwf /tmp/tmp.yjW4DJlQVOJump to behavior
Source: /usr/bin/dash (PID: 6232)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.DzC3kbrUDO /tmp/tmp.FRcdRXLMwf /tmp/tmp.yjW4DJlQVOJump to behavior
Source: /tmp/arm7.elf (PID: 6260)Queries kernel information via 'uname': Jump to behavior
Source: arm7.elf, 6260.1.0000561f1cb00000.0000561f1cc0c000.rw-.sdmpBinary or memory string: Vrg.qemu.gdb.arm.sys.regs">
Source: arm7.elf, 6260.1.0000561f1cb00000.0000561f1cc0c000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: arm7.elf, 6260.1.00007ffe44beb000.00007ffe44c0c000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
Source: arm7.elf, 6260.1.0000561f1cb00000.0000561f1cc0c000.rw-.sdmpBinary or memory string: V!/etc/qemu-binfmt/arm
Source: arm7.elf, 6260.1.00007ffe44beb000.00007ffe44c0c000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm7.elf
Source: arm7.elf, 6260.1.0000561f1cb00000.0000561f1cc0c000.rw-.sdmpBinary or memory string: rg.qemu.gdb.arm.sys.regs">
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
File Deletion
OS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1587401 Sample: arm7.elf Startdate: 10/01/2025 Architecture: LINUX Score: 48 10 109.202.202.202, 80 INIT7CH Switzerland 2->10 12 91.189.91.42, 443 CANONICAL-ASGB United Kingdom 2->12 14 2 other IPs or domains 2->14 16 Multi AV Scanner detection for submitted file 2->16 6 dash rm arm7.elf 2->6         started        8 dash rm 2->8         started        signatures3 process4
SourceDetectionScannerLabelLink
arm7.elf21%ReversingLabsLinux.Backdoor.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

No contacted domains info
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs
IPDomainCountryFlagASNASN NameMalicious
54.171.230.55
unknownUnited States
16509AMAZON-02USfalse
109.202.202.202
unknownSwitzerland
13030INIT7CHfalse
91.189.91.43
unknownUnited Kingdom
41231CANONICAL-ASGBfalse
91.189.91.42
unknownUnited Kingdom
41231CANONICAL-ASGBfalse
MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
54.171.230.55wind.ppc.elfGet hashmaliciousMiraiBrowse
    Fantazy.arc.elfGet hashmaliciousUnknownBrowse
      i.elfGet hashmaliciousUnknownBrowse
        main_x86.elfGet hashmaliciousMiraiBrowse
          2.elfGet hashmaliciousUnknownBrowse
            sst.elfGet hashmaliciousGafgytBrowse
              12.elfGet hashmaliciousUnknownBrowse
                2.elfGet hashmaliciousUnknownBrowse
                  ssl.elfGet hashmaliciousGafgytBrowse
                    2.elfGet hashmaliciousUnknownBrowse
                      109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                      • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                      91.189.91.43arm.elfGet hashmaliciousMiraiBrowse
                        fenty.arm4.elfGet hashmaliciousMiraiBrowse
                          2.elfGet hashmaliciousUnknownBrowse
                            bin.sh.elfGet hashmaliciousUnknownBrowse
                              12.elfGet hashmaliciousUnknownBrowse
                                Aqua.ppc.elfGet hashmaliciousUnknownBrowse
                                  2.elfGet hashmaliciousUnknownBrowse
                                    ssa.elfGet hashmaliciousUnknownBrowse
                                      main_arm.elfGet hashmaliciousMiraiBrowse
                                        arm7.elfGet hashmaliciousMiraiBrowse
                                          91.189.91.42arm.elfGet hashmaliciousMiraiBrowse
                                            fenty.arm4.elfGet hashmaliciousMiraiBrowse
                                              2.elfGet hashmaliciousUnknownBrowse
                                                bin.sh.elfGet hashmaliciousUnknownBrowse
                                                  12.elfGet hashmaliciousUnknownBrowse
                                                    Aqua.ppc.elfGet hashmaliciousUnknownBrowse
                                                      2.elfGet hashmaliciousUnknownBrowse
                                                        ssa.elfGet hashmaliciousUnknownBrowse
                                                          main_arm.elfGet hashmaliciousMiraiBrowse
                                                            arm7.elfGet hashmaliciousMiraiBrowse
                                                              No context
                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                              CANONICAL-ASGBarm.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              fenty.arm4.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              2.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              bin.sh.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              12.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              Aqua.ppc.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              2.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              ssa.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              main_arm.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              arm7.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              CANONICAL-ASGBarm.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              fenty.arm4.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              2.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              bin.sh.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              12.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              Aqua.ppc.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              2.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              ssa.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              main_arm.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              arm7.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              AMAZON-02USClient.exeGet hashmaliciousAsyncRATBrowse
                                                              • 35.154.189.194
                                                              1162-201.exeGet hashmaliciousFormBookBrowse
                                                              • 76.223.67.189
                                                              https://cdn.btmessage.com/Get hashmaliciousHTMLPhisherBrowse
                                                              • 52.211.89.170
                                                              3.elfGet hashmaliciousUnknownBrowse
                                                              • 18.151.37.43
                                                              http://www.jmclmedia.phGet hashmaliciousUnknownBrowse
                                                              • 13.32.121.98
                                                              5.elfGet hashmaliciousUnknownBrowse
                                                              • 34.248.106.44
                                                              6.elfGet hashmaliciousUnknownBrowse
                                                              • 13.213.186.124
                                                              https://ik.imagekit.io/nrof2h909/Sherman%20Pruitt,%20Chief%20of%20Police,%20MSCJ.pdf?updatedAt=1736444487005Get hashmaliciousUnknownBrowse
                                                              • 65.9.66.13
                                                              armv6l.elfGet hashmaliciousUnknownBrowse
                                                              • 3.65.161.32
                                                              https://paybxss.716as7qy3nzyy2eo1omfskt9q0wrkj88.oastify.com/Get hashmaliciousUnknownBrowse
                                                              • 3.248.33.252
                                                              INIT7CHarm.elfGet hashmaliciousMiraiBrowse
                                                              • 109.202.202.202
                                                              fenty.arm4.elfGet hashmaliciousMiraiBrowse
                                                              • 109.202.202.202
                                                              2.elfGet hashmaliciousUnknownBrowse
                                                              • 109.202.202.202
                                                              bin.sh.elfGet hashmaliciousUnknownBrowse
                                                              • 109.202.202.202
                                                              12.elfGet hashmaliciousUnknownBrowse
                                                              • 109.202.202.202
                                                              Aqua.ppc.elfGet hashmaliciousUnknownBrowse
                                                              • 109.202.202.202
                                                              2.elfGet hashmaliciousUnknownBrowse
                                                              • 109.202.202.202
                                                              ssa.elfGet hashmaliciousUnknownBrowse
                                                              • 109.202.202.202
                                                              main_arm.elfGet hashmaliciousMiraiBrowse
                                                              • 109.202.202.202
                                                              arm7.elfGet hashmaliciousMiraiBrowse
                                                              • 109.202.202.202
                                                              No context
                                                              No context
                                                              No created / dropped files found
                                                              File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, missing section headers at 85388
                                                              Entropy (8bit):6.018267899030141
                                                              TrID:
                                                              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                              File name:arm7.elf
                                                              File size:77'929 bytes
                                                              MD5:6d567b3b4dde6b0ef7ce347125cacdb3
                                                              SHA1:38507425474c11cf94c85105aa20ed5804bd4e55
                                                              SHA256:b80d60c50212807d122a5c0ae9fc6b23c5bf5029bf0843cf6c980fb31626fb9a
                                                              SHA512:d0a7b0cef15716b9e7439e699708015cbe2ae1c890ac3788d65ff2307df591f759a10e642ae69226fe0b104194bdf3e7dbddecedb10d7fd460238a000f7808eb
                                                              SSDEEP:1536:iZnilT4XOqEd+MPYCEqWp3uenuHrDqKmbCpGqCQPaCqXllyPiBXp3c2:vGOU+YCd82r2Km2pGqCQPaGwXps2
                                                              TLSH:6273F64ABC819B5595E822FEFA5E01CD331357ACE3EF7112DD115B24378A92B0E77A02
                                                              File Content Preview:.ELF..............(.........4....K......4. ...(........p<G..<...<...................................TH..TH..............TH..TH..TH......DA..............XH..XH..XH..................Q.td..................................-...L..................@-.,@...0....S

                                                              Download Network PCAP: filteredfull

                                                              • Total Packets: 8
                                                              • 443 (HTTPS)
                                                              • 80 (HTTP)
                                                              TimestampSource PortDest PortSource IPDest IP
                                                              Jan 10, 2025 10:37:49.465862036 CET4433360654.171.230.55192.168.2.23
                                                              Jan 10, 2025 10:37:49.466341019 CET33606443192.168.2.2354.171.230.55
                                                              Jan 10, 2025 10:37:49.471348047 CET4433360654.171.230.55192.168.2.23
                                                              Jan 10, 2025 10:37:51.360955954 CET43928443192.168.2.2391.189.91.42
                                                              Jan 10, 2025 10:37:56.736406088 CET42836443192.168.2.2391.189.91.43
                                                              Jan 10, 2025 10:37:58.528034925 CET4251680192.168.2.23109.202.202.202
                                                              Jan 10, 2025 10:38:11.326493979 CET43928443192.168.2.2391.189.91.42
                                                              Jan 10, 2025 10:38:23.612615108 CET42836443192.168.2.2391.189.91.43
                                                              Jan 10, 2025 10:38:29.755753040 CET4251680192.168.2.23109.202.202.202
                                                              Jan 10, 2025 10:38:52.280694962 CET43928443192.168.2.2391.189.91.42

                                                              System Behavior

                                                              Start time (UTC):09:37:48
                                                              Start date (UTC):10/01/2025
                                                              Path:/usr/bin/dash
                                                              Arguments:-
                                                              File size:129816 bytes
                                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                              Start time (UTC):09:37:48
                                                              Start date (UTC):10/01/2025
                                                              Path:/usr/bin/rm
                                                              Arguments:rm -f /tmp/tmp.DzC3kbrUDO /tmp/tmp.FRcdRXLMwf /tmp/tmp.yjW4DJlQVO
                                                              File size:72056 bytes
                                                              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                              Start time (UTC):09:37:48
                                                              Start date (UTC):10/01/2025
                                                              Path:/usr/bin/dash
                                                              Arguments:-
                                                              File size:129816 bytes
                                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                              Start time (UTC):09:37:48
                                                              Start date (UTC):10/01/2025
                                                              Path:/usr/bin/rm
                                                              Arguments:rm -f /tmp/tmp.DzC3kbrUDO /tmp/tmp.FRcdRXLMwf /tmp/tmp.yjW4DJlQVO
                                                              File size:72056 bytes
                                                              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                              Start time (UTC):09:37:49
                                                              Start date (UTC):10/01/2025
                                                              Path:/tmp/arm7.elf
                                                              Arguments:/tmp/arm7.elf
                                                              File size:4956856 bytes
                                                              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1