Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
mips.elf

Overview

General Information

Sample name:mips.elf
Analysis ID:1589227
MD5:b30def198c7c980b410aca4039add0ba
SHA1:8f8dfb442709c7773d626c4a6dc7e1b6d64cccf4
SHA256:496de4fa27abbb7f657899e5026c099f4586948f233ab3d1b6c878d13c28c7e5
Tags:elfuser-abuse_ch
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1589227
Start date and time:2025-01-11 21:32:11 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 27s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:mips.elf
Detection:MAL
Classification:mal60.troj.linELF@0/0@0/0

Runtime Messages

Command:/tmp/mips.elf
PID:5490
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
a cat is fine too
Standard Error:

Process Tree

  • system is lnxubuntu20
  • mips.elf (PID: 5490, Parent: 5416, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/mips.elf
    • mips.elf New Fork (PID: 5494, Parent: 5490)
      • mips.elf New Fork (PID: 5496, Parent: 5494)
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: mips.elfAvira: detected
Multi AV Scanner detection for submitted file
Source: mips.elfVirustotal: Detection: 25%Perma Link
Source: mips.elfReversingLabs: Detection: 28%

Networking

barindex
Connects to many ports of the same IP (likely port scanning)
Source: global trafficTCP traffic: 154.213.187.125 ports 0,1,2,3,51320,5
Source: global trafficTCP traffic: 192.168.2.14:46534 -> 154.213.187.125:51320
Source: /tmp/mips.elf (PID: 5490)Socket: 127.0.0.1:51101Jump to behavior
Source: unknownTCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknownTCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknownTCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknownTCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknownTCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknownTCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknownTCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknownTCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknownTCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknownTCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknownTCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknownTCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknownTCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknownTCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknownTCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknownTCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknownTCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknownTCP traffic detected without corresponding DNS query: 154.213.187.125
Source: Initial sampleString containing 'busybox' found: /bin/busybox ntpd
Source: Initial sampleString containing 'busybox' found: (deleted)/proc/self/exe/proc//exe/procPPid: /proc/%d/cmdliner-bash-sh/bin/sh/proc/%s/status/. /sbin/procd/sbin/klogdsleep 1/bin/ExHttpd/bin/busybox ntpd
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal60.troj.linELF@0/0@0/0
Source: /tmp/mips.elf (PID: 5496)File opened: /proc/5332/cmdlineJump to behavior
Source: /tmp/mips.elf (PID: 5496)File opened: /proc/5520/statusJump to behavior
Source: /tmp/mips.elf (PID: 5496)File opened: /proc/5521/statusJump to behavior
Source: /tmp/mips.elf (PID: 5496)File opened: /proc/5519/statusJump to behavior
Source: /tmp/mips.elf (PID: 5496)File opened: /proc/5522/statusJump to behavior
Source: /tmp/mips.elf (PID: 5496)File opened: /proc/5523/statusJump to behavior
Source: /tmp/mips.elf (PID: 5496)File opened: /proc/5513/statusJump to behavior
Source: /tmp/mips.elf (PID: 5496)File opened: /proc/5524/statusJump to behavior
Source: /tmp/mips.elf (PID: 5496)File opened: /proc/5514/statusJump to behavior
Source: /tmp/mips.elf (PID: 5496)File opened: /proc/5525/statusJump to behavior
Source: /tmp/mips.elf (PID: 5496)File opened: /proc/5515/statusJump to behavior
Source: /tmp/mips.elf (PID: 5496)File opened: /proc/5526/statusJump to behavior
Source: /tmp/mips.elf (PID: 5496)File opened: /proc/5516/statusJump to behavior
Source: /tmp/mips.elf (PID: 5496)File opened: /proc/5527/statusJump to behavior
Source: /tmp/mips.elf (PID: 5496)File opened: /proc/5517/statusJump to behavior
Source: /tmp/mips.elf (PID: 5496)File opened: /proc/5528/statusJump to behavior
Source: /tmp/mips.elf (PID: 5496)File opened: /proc/5518/statusJump to behavior
Source: /tmp/mips.elf (PID: 5490)Queries kernel information via 'uname': Jump to behavior
Source: mips.elf, 5490.1.00007ffdad1f3000.00007ffdad214000.rw-.sdmpBinary or memory string: Nx86_64/usr/bin/qemu-mips/tmp/mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mips.elf
Source: mips.elf, 5490.1.000055bee2e12000.000055bee2eba000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/mips
Source: mips.elf, 5490.1.000055bee2e12000.000055bee2eba000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mips
Source: mips.elf, 5490.1.00007ffdad1f3000.00007ffdad214000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mips

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume Access1
OS Credential Dumping		11
Security Software Discovery		Remote ServicesData from Local System1
Non-Standard Port		Exfiltration Over Other Network MediumAbuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
mips.elf25%VirustotalBrowse
mips.elf29%ReversingLabsLinux.Trojan.Mirai
mips.elf100%AviraEXP/ELF.Agent.J.8

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
154.213.187.125
unknownSeychelles
22769DDOSING-BGP-NETWORKUStrue

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
154.213.187.125arm7.elfGet hashmaliciousMiraiBrowse
    gmpsl.elfGet hashmaliciousUnknownBrowse
      garm5.elfGet hashmaliciousUnknownBrowse
        garm7.elfGet hashmaliciousMiraiBrowse
          garm.elfGet hashmaliciousUnknownBrowse
            gmips.elfGet hashmaliciousUnknownBrowse
              87.120.127.227-arm-2024-12-25T12_37_29.elfGet hashmaliciousUnknownBrowse
                garm7.elfGet hashmaliciousMiraiBrowse
                  gmpsl.elfGet hashmaliciousUnknownBrowse
                    mpsl.elfGet hashmaliciousUnknownBrowse

                      Domains

                      ⊘No context

                      ASNs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      DDOSING-BGP-NETWORKUSarm7.elfGet hashmaliciousMiraiBrowse
                      • 154.213.187.125
                      arm7.elfGet hashmaliciousMirai, MoobotBrowse
                      • 154.213.187.118
                      spc.elfGet hashmaliciousMirai, MoobotBrowse
                      • 154.213.187.118
                      ppc.elfGet hashmaliciousMirai, MoobotBrowse
                      • 154.213.187.118
                      sh4.elfGet hashmaliciousMirai, MoobotBrowse
                      • 154.213.187.118
                      arm.elfGet hashmaliciousMirai, MoobotBrowse
                      • 154.213.187.118
                      m68k.elfGet hashmaliciousMirai, MoobotBrowse
                      • 154.213.187.118
                      x86.elfGet hashmaliciousMirai, MoobotBrowse
                      • 154.213.187.118
                      mpsl.elfGet hashmaliciousMirai, MoobotBrowse
                      • 154.213.187.118
                      mips.elfGet hashmaliciousMirai, MoobotBrowse
                      • 154.213.187.118

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      ⊘No created / dropped files found

                      Static File Info

                      General

                      File type:ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
                      Entropy (8bit):5.480664484599792
                      TrID:
                      • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                      File name:mips.elf
                      File size:80'876 bytes
                      MD5:b30def198c7c980b410aca4039add0ba
                      SHA1:8f8dfb442709c7773d626c4a6dc7e1b6d64cccf4
                      SHA256:496de4fa27abbb7f657899e5026c099f4586948f233ab3d1b6c878d13c28c7e5
                      SHA512:ac030e4f2bf2480475fdba11fa5240af740bd7f544e70b658d05c05c0b1ce87348628fd4e4ebd4a8a2e58d1c1850871e32d1bcd85e6371ed76f77ce8c6c4536e
                      SSDEEP:1536:7KnNK+T1Qr7yJkuNdMCWnCWjSWWrNmyxiudxPuhe9flDi:7m9T1+7mNmxubPuglDi
                      TLSH:3483B61E6E218FEDF669C23547B34E25A39833D637E1C685E25CD6002F6034E645FBA8
                      File Content Preview:.ELF.....................@.`...4..9......4. ...(.............@...@....0...0...............0..E0..E0....T..k4........dt.Q............................<...'......!'.......................<...'......!... ....'9... ......................<...'..h...!........'9.

                      Static ELF Info

                      ELF header

                      Class:ELF32
                      Data:2's complement, big endian
                      Version:1 (current)
                      Machine:MIPS R3000
                      Version Number:0x1
                      Type:EXEC (Executable file)
                      OS/ABI:UNIX - System V
                      ABI Version:0
                      Entry Point Address:0x400260
                      Flags:0x1007
                      ELF Header Size:52
                      Program Header Offset:52
                      Program Header Size:32
                      Number of Program Headers:3
                      Section Header Offset:80316
                      Section Header Size:40
                      Number of Section Headers:14
                      Header String Table Index:13

                      Sections

                      NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                      NULL0x00x00x00x00x0000
                      .initPROGBITS0x4000940x940x8c0x00x6AX004
                      .textPROGBITS0x4001200x1200x113200x00x6AX0016
                      .finiPROGBITS0x4114400x114400x5c0x00x6AX004
                      .rodataPROGBITS0x4114a00x114a00x1b600x00x2A0016
                      .ctorsPROGBITS0x4530040x130040x80x00x3WA004
                      .dtorsPROGBITS0x45300c0x1300c0x80x00x3WA004
                      .data.rel.roPROGBITS0x4530180x130180x180x00x3WA004
                      .dataPROGBITS0x4530300x130300x4300x00x3WA0016
                      .gotPROGBITS0x4534600x134600x4f80x40x10000003WAp0016
                      .sbssNOBITS0x4539580x139580x300x00x10000003WAp004
                      .bssNOBITS0x4539900x139580x61a80x00x3WA0016
                      .mdebug.abi32PROGBITS0xb880x139580x00x00x0001
                      .shstrtabSTRTAB0x00x139580x640x00x0001

                      Program Segments

                      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                      LOAD0x00x4000000x4000000x130000x130005.50290x5R E0x10000.init .text .fini .rodata
                      LOAD0x130040x4530040x4530040x9540x6b344.15230x6RW 0x10000.ctors .dtors .data.rel.ro .data .got .sbss .bss
                      GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                      Network Behavior

                      Network Port Distribution

                      TCP Packets

                      TimestampSource PortDest PortSource IPDest IP
                      Jan 11, 2025 21:32:55.153104067 CET4653451320192.168.2.14154.213.187.125
                      Jan 11, 2025 21:32:55.158185005 CET5132046534154.213.187.125192.168.2.14
                      Jan 11, 2025 21:32:55.158257008 CET4653451320192.168.2.14154.213.187.125
                      Jan 11, 2025 21:32:55.205995083 CET4653451320192.168.2.14154.213.187.125
                      Jan 11, 2025 21:32:55.211112976 CET5132046534154.213.187.125192.168.2.14
                      Jan 11, 2025 21:32:55.211204052 CET4653451320192.168.2.14154.213.187.125
                      Jan 11, 2025 21:32:55.216103077 CET5132046534154.213.187.125192.168.2.14
                      Jan 11, 2025 21:32:56.026108980 CET5132046534154.213.187.125192.168.2.14
                      Jan 11, 2025 21:32:56.026438951 CET4653451320192.168.2.14154.213.187.125
                      Jan 11, 2025 21:32:56.031395912 CET5132046534154.213.187.125192.168.2.14
                      Jan 11, 2025 21:32:57.028583050 CET4653651320192.168.2.14154.213.187.125
                      Jan 11, 2025 21:32:57.033864975 CET5132046536154.213.187.125192.168.2.14
                      Jan 11, 2025 21:32:57.033981085 CET4653651320192.168.2.14154.213.187.125
                      Jan 11, 2025 21:32:57.034600019 CET4653651320192.168.2.14154.213.187.125
                      Jan 11, 2025 21:32:57.039433002 CET5132046536154.213.187.125192.168.2.14
                      Jan 11, 2025 21:32:57.039491892 CET4653651320192.168.2.14154.213.187.125
                      Jan 11, 2025 21:32:57.044318914 CET5132046536154.213.187.125192.168.2.14
                      Jan 11, 2025 21:32:57.763062954 CET5132046536154.213.187.125192.168.2.14
                      Jan 11, 2025 21:32:57.763219118 CET4653651320192.168.2.14154.213.187.125
                      Jan 11, 2025 21:32:57.768145084 CET5132046536154.213.187.125192.168.2.14
                      Jan 11, 2025 21:32:58.764703035 CET4653851320192.168.2.14154.213.187.125
                      Jan 11, 2025 21:32:58.769818068 CET5132046538154.213.187.125192.168.2.14
                      Jan 11, 2025 21:32:58.769912004 CET4653851320192.168.2.14154.213.187.125
                      Jan 11, 2025 21:32:58.770589113 CET4653851320192.168.2.14154.213.187.125
                      Jan 11, 2025 21:32:58.775485992 CET5132046538154.213.187.125192.168.2.14
                      Jan 11, 2025 21:32:58.775543928 CET4653851320192.168.2.14154.213.187.125
                      Jan 11, 2025 21:32:58.780440092 CET5132046538154.213.187.125192.168.2.14
                      Jan 11, 2025 21:33:08.775686026 CET4653851320192.168.2.14154.213.187.125
                      Jan 11, 2025 21:33:08.781037092 CET5132046538154.213.187.125192.168.2.14
                      Jan 11, 2025 21:33:09.216624975 CET5132046538154.213.187.125192.168.2.14
                      Jan 11, 2025 21:33:09.216795921 CET4653851320192.168.2.14154.213.187.125
                      Jan 11, 2025 21:34:09.264054060 CET4653851320192.168.2.14154.213.187.125
                      Jan 11, 2025 21:34:09.268915892 CET5132046538154.213.187.125192.168.2.14
                      Jan 11, 2025 21:34:09.436933994 CET5132046538154.213.187.125192.168.2.14
                      Jan 11, 2025 21:34:09.437024117 CET4653851320192.168.2.14154.213.187.125

                      System Behavior

                      General

                      Start time (UTC):20:32:54
                      Start date (UTC):11/01/2025
                      Path:/tmp/mips.elf
                      Arguments:/tmp/mips.elf
                      File size:5777432 bytes
                      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                      Chronological Activities


                      General

                      Start time (UTC):20:32:54
                      Start date (UTC):11/01/2025
                      Path:/tmp/mips.elf
                      Arguments:-
                      File size:5777432 bytes
                      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                      Chronological Activities


                      General

                      Start time (UTC):20:32:54
                      Start date (UTC):11/01/2025
                      Path:/tmp/mips.elf
                      Arguments:-
                      File size:5777432 bytes
                      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                      Chronological Activities