Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
arm5.elf

Overview

General Information

Sample name:arm5.elf
Analysis ID:1597848
MD5:cd8c0715d007854336cb6ec68b76d053
SHA1:0febdc45676c59855fbdbeba4c26e4b2a764c887
SHA256:1fab2bd1b8f808feede1ae67143f14766d15a514ce8598c699a8e7c78793b1f0
Tags:elfuser-abuse_ch
Infos:

Detection

Moobot
Score:64
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Moobot
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1597848
Start date and time:2025-01-23 18:24:37 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 10m 39s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:arm5.elf
Detection:MAL
Classification:mal64.troj.linELF@0/0@2/0
Cookbook Comments:
  • Analysis time extended to 480s due to sleep detection in submitted sample
  • Max analysis timeout: 600s exceeded, the analysis took too long

Runtime Messages

Command:/tmp/arm5.elf
PID:5494
Exit Code:255
Exit Code Info:
Killed:False
Standard Output:

Standard Error:/lib/ld-uClibc.so.0: No such file or directory

Process Tree

  • system is lnxubuntu20
  • arm5.elf (PID: 5494, Parent: 5418, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm5.elf
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MooBotNo Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
arm5.elfJoeSecurity_MoobotYara detected MoobotJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    5494.1.00007f8098029000.00007f809802a000.rw-.sdmpJoeSecurity_MoobotYara detected MoobotJoe Security
      5494.1.00007f8098017000.00007f8098022000.r-x.sdmpJoeSecurity_MoobotYara detected MoobotJoe Security
        Process Memory Space: arm5.elf PID: 5494JoeSecurity_MoobotYara detected MoobotJoe Security

          Suricata Signatures

          ⊘No Suricata rule has matched

          Joe Sandbox Signatures

          • • AV Detection
          • • Networking
          • • System Summary
          • • Malware Analysis System Evasion
          • • Stealing of Sensitive Information
          • • Remote Access Functionality

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Source: arm5.elfAvira: detected
          Source: arm5.elfVirustotal: Detection: 60%Perma Link
          Source: arm5.elfReversingLabs: Detection: 63%
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
          Source: ELF static info symbol of initial sample.symtab present: no
          Source: classification engineClassification label: mal64.troj.linELF@0/0@2/0
          Source: /tmp/arm5.elf (PID: 5494)Queries kernel information via 'uname': Jump to behavior
          Source: arm5.elf, 5494.1.00007ffee836d000.00007ffee838e000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm5.elf
          Source: arm5.elf, 5494.1.000055960ebcf000.000055960ecfd000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
          Source: arm5.elf, 5494.1.00007ffee836d000.00007ffee838e000.rw-.sdmpBinary or memory string: qemu: %s: %s
          Source: arm5.elf, 5494.1.00007ffee836d000.00007ffee838e000.rw-.sdmpBinary or memory string: leqemu: %s: %s
          Source: arm5.elf, 5494.1.000055960ebcf000.000055960ecfd000.rw-.sdmpBinary or memory string: Urg.qemu.gdb.arm.sys.regs">
          Source: arm5.elf, 5494.1.000055960ebcf000.000055960ecfd000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
          Source: arm5.elf, 5494.1.00007ffee836d000.00007ffee838e000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
          Source: arm5.elf, 5494.1.000055960ebcf000.000055960ecfd000.rw-.sdmpBinary or memory string: rg.qemu.gdb.arm.sys.regs">

          Stealing of Sensitive Information

          barindex
          Source: Yara matchFile source: arm5.elf, type: SAMPLE
          Source: Yara matchFile source: 5494.1.00007f8098029000.00007f809802a000.rw-.sdmp, type: MEMORY
          Source: Yara matchFile source: 5494.1.00007f8098017000.00007f8098022000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: arm5.elf PID: 5494, type: MEMORYSTR

          Remote Access Functionality

          barindex
          Source: Yara matchFile source: arm5.elf, type: SAMPLE
          Source: Yara matchFile source: 5494.1.00007f8098029000.00007f809802a000.rw-.sdmp, type: MEMORY
          Source: Yara matchFile source: 5494.1.00007f8098017000.00007f8098022000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: arm5.elf PID: 5494, type: MEMORYSTR

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
          Security Software Discovery          		Remote ServicesData from Local System1
          Non-Application Layer Protocol          		Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
          Application Layer Protocol          		Exfiltration Over BluetoothNetwork Denial of Service

          Malware Configuration

          ⊘No configs have been found

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Number of created Files
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1597848 Sample: arm5.elf Startdate: 23/01/2025 Architecture: LINUX Score: 64 8 daisy.ubuntu.com 2->8 10 Antivirus / Scanner detection for submitted sample 2->10 12 Multi AV Scanner detection for submitted file 2->12 14 Yara detected Moobot 2->14 6 arm5.elf 2->6         started        signatures3 process4

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          arm5.elf60%VirustotalBrowse
          arm5.elf63%ReversingLabsLinux.Trojan.Mirai
          arm5.elf100%AviraLINUX/Mirai.bonb

          Dropped Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          ⊘No Antivirus matches

          Domains and IPs

          Download Network PCAP: filtered – full

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          daisy.ubuntu.com
          		162.213.35.25
          		truefalse
            		high

            World Map of Contacted IPs

            ⊘No contacted IP infos

            Joe Sandbox View / Context

            IPs

            ⊘No context

            Domains

            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            daisy.ubuntu.comtelnet.mips.elfGet hashmaliciousUnknownBrowse
            • 162.213.35.25
            telnet.arm5.elfGet hashmaliciousUnknownBrowse
            • 162.213.35.24
            telnet.arm6.elfGet hashmaliciousUnknownBrowse
            • 162.213.35.25
            armv4l.elfGet hashmaliciousGafgyt, MiraiBrowse
            • 162.213.35.25
            telnet.arm7.elfGet hashmaliciousUnknownBrowse
            • 162.213.35.24
            m68k.elfGet hashmaliciousGafgyt, MiraiBrowse
            • 162.213.35.25
            powerpc.elfGet hashmaliciousGafgyt, MiraiBrowse
            • 162.213.35.24
            x86.elfGet hashmaliciousGafgyt, MiraiBrowse
            • 162.213.35.24
            Fantazy.ppc.elfGet hashmaliciousUnknownBrowse
            • 162.213.35.24
            sshd.elfGet hashmaliciousUnknownBrowse
            • 162.213.35.24

            ASNs

            ⊘No context

            JA3 Fingerprints

            ⊘No context

            Dropped Files

            ⊘No context

            Created / dropped Files

            ⊘No created / dropped files found

            Static File Info

            General

            File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), dynamically linked, interpreter /lib/ld-uClibc.so.0, stripped
            Entropy (8bit):6.075737415845693
            TrID:
            • ELF Executable and Linkable format (generic) (4004/1) 100.00%
            File name:arm5.elf
            File size:44'128 bytes
            MD5:cd8c0715d007854336cb6ec68b76d053
            SHA1:0febdc45676c59855fbdbeba4c26e4b2a764c887
            SHA256:1fab2bd1b8f808feede1ae67143f14766d15a514ce8598c699a8e7c78793b1f0
            SHA512:2a3e1664a55f9c8f6e520bcf0a44bca0960d76f843593587eb4496f79e0a46c21a80325c9ad9fba1de2d13c0ccd0d1b8191b619a6174373bb75196db06297ced
            SSDEEP:768:fh29cFj8mzXSDe4Qtv+1auihFKaVr8pgwoS3AXoz2oNyRVBNkZ:Z2uF4mzXA6iXihFKaO2woSIy
            TLSH:0B132986BC82996ACAD01776B62E108E3321B3E9D1CF3217CD245F1177C9A2F4D37A56
            File Content Preview:.ELF...a..........(.........4...........4. ...(.........4...4...4...................................................................p...p...............t...t...t...................................................Q.td............................/lib/ld-uCl

            Static ELF Info

            ELF header

            Class:ELF32
            Data:2's complement, little endian
            Version:1 (current)
            Machine:ARM
            Version Number:0x1
            Type:EXEC (Executable file)
            OS/ABI:ARM - ABI
            ABI Version:0
            Entry Point Address:0x8eb4
            Flags:0x2
            ELF Header Size:52
            Program Header Offset:52
            Program Header Size:32
            Number of Program Headers:6
            Section Header Offset:43408
            Section Header Size:40
            Number of Section Headers:18
            Header String Table Index:17

            Sections

            NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
            NULL0x00x00x00x00x0000
            .interpPROGBITS0x80f40xf40x140x00x2A001
            .hashHASH0x81080x1080x2280x40x2A304
            .dynsymDYNSYM0x83300x3300x4500x100x2A414
            .dynstrSTRTAB0x87800x7800x22c0x00x2A001
            .rel.pltREL0x89ac0x9ac0x1980x80x2A374
            .initPROGBITS0x8b440xb440x180x00x6AX004
            .pltPROGBITS0x8b5c0xb5c0x2780x40x6AX004
            .textPROGBITS0x8dd40xdd40x93400x00x6AX004
            .finiPROGBITS0x121140xa1140x140x00x6AX004
            .rodataPROGBITS0x121280xa1280x6480x10x32AMS004
            .ctorsPROGBITS0x1a7740xa7740x80x00x3WA004
            .dtorsPROGBITS0x1a77c0xa77c0x80x00x3WA004
            .dynamicDYNAMIC0x1a7880xa7880x980x80x3WA404
            .gotPROGBITS0x1a8200xa8200xd80x40x3WA004
            .dataPROGBITS0x1a8f80xa8f80x240x00x3WA004
            .bssNOBITS0x1a91c0xa91c0x2240x00x3WA004
            .shstrtabSTRTAB0x00xa91c0x730x00x0001

            Program Segments

            TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
            PHDR0x340x80340x80340xc00xc02.25440x5R E0x4
            INTERP0xf40x80f40x80f40x140x143.68420x4R 0x1/lib/ld-uClibc.so.0.interp
            LOAD0x00x80000x80000xa7700xa7706.11630x5R E0x8000.interp .hash .dynsym .dynstr .rel.plt .init .plt .text .fini .rodata
            LOAD0xa7740x1a7740x1a7740x1a80x3cc2.27920x6RW 0x8000.ctors .dtors .dynamic .got .data .bss
            DYNAMIC0xa7880x1a7880x1a7880x980x981.91150x6RW 0x4.dynamic
            GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

            Dynamic Tags

            TypeMetaValueTag
            DT_NEEDEDsharedliblibc.so.00x1
            DT_INITvalue0x8b440xc
            DT_FINIvalue0x121140xd
            DT_HASHvalue0x81080x4
            DT_STRTABvalue0x87800x5
            DT_SYMTABvalue0x83300x6
            DT_STRSZbytes5560xa
            DT_SYMENTbytes160xb
            DT_DEBUGvalue0x00x15
            DT_PLTGOTvalue0x1a8200x3
            DT_PLTRELSZbytes4080x2
            DT_PLTRELpltrelDT_REL0x14
            DT_JMPRELvalue0x89ac0x17
            DT_NULLvalue0x00x0

            Symbols

            NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
            .dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
            __aeabi_idiv0.dynsym0x120d44FUNC<unknown>DEFAULT8
            __aeabi_ldiv0.dynsym0x120d44FUNC<unknown>DEFAULT8
            __aeabi_uidiv.dynsym0x11e140FUNC<unknown>DEFAULT8
            __aeabi_uidivmod.dynsym0x11f0c24FUNC<unknown>DEFAULT8
            __bss_end__.dynsym0x1ab400NOTYPE<unknown>DEFAULTSHN_ABS
            __bss_start.dynsym0x1a91c0NOTYPE<unknown>DEFAULTSHN_ABS
            __bss_start__.dynsym0x1a91c0NOTYPE<unknown>DEFAULTSHN_ABS
            __data_start.dynsym0x1a8f80NOTYPE<unknown>DEFAULT17
            __div0.dynsym0x120d44FUNC<unknown>DEFAULT8
            __end__.dynsym0x1ab400NOTYPE<unknown>DEFAULTSHN_ABS
            __errno_location.dynsym0x8d5032FUNC<unknown>DEFAULTSHN_UNDEF
            __modsi3.dynsym0x11ff0228FUNC<unknown>DEFAULT8
            __uClibc_main.dynsym0x8d08488FUNC<unknown>DEFAULTSHN_UNDEF
            __udivsi3.dynsym0x11e14248FUNC<unknown>DEFAULT8
            __umodsi3.dynsym0x11f24204FUNC<unknown>DEFAULT8
            _bss_end__.dynsym0x1ab400NOTYPE<unknown>DEFAULTSHN_ABS
            _edata.dynsym0x1a91c0NOTYPE<unknown>DEFAULTSHN_ABS
            _end.dynsym0x1ab400NOTYPE<unknown>DEFAULTSHN_ABS
            _start.dynsym0x8eb480FUNC<unknown>DEFAULT8
            abort.dynsym0x8c48352FUNC<unknown>DEFAULTSHN_UNDEF
            accept.dynsym0x8c5444FUNC<unknown>DEFAULTSHN_UNDEF
            bind.dynsym0x8c8444FUNC<unknown>DEFAULTSHN_UNDEF
            calloc.dynsym0x8c6088FUNC<unknown>DEFAULTSHN_UNDEF
            clock.dynsym0x8d7452FUNC<unknown>DEFAULTSHN_UNDEF
            close.dynsym0x8da444FUNC<unknown>DEFAULTSHN_UNDEF
            closedir.dynsym0x8d8c196FUNC<unknown>DEFAULTSHN_UNDEF
            connect.dynsym0x8b8844FUNC<unknown>DEFAULTSHN_UNDEF
            exit.dynsym0x8d5c172FUNC<unknown>DEFAULTSHN_UNDEF
            fcntl.dynsym0x8d98116FUNC<unknown>DEFAULTSHN_UNDEF
            fork.dynsym0x8cfc44FUNC<unknown>DEFAULTSHN_UNDEF
            free.dynsym0x8db0288FUNC<unknown>DEFAULTSHN_UNDEF
            getpid.dynsym0x8bb844FUNC<unknown>DEFAULTSHN_UNDEF
            getppid.dynsym0x8d2044FUNC<unknown>DEFAULTSHN_UNDEF
            getsockname.dynsym0x8dc844FUNC<unknown>DEFAULTSHN_UNDEF
            getsockopt.dynsym0x8d4448FUNC<unknown>DEFAULTSHN_UNDEF
            inet_addr.dynsym0x8c9036FUNC<unknown>DEFAULTSHN_UNDEF
            ioctl.dynsym0x8b7080FUNC<unknown>DEFAULTSHN_UNDEF
            kill.dynsym0x8c7844FUNC<unknown>DEFAULTSHN_UNDEF
            listen.dynsym0x8cf044FUNC<unknown>DEFAULTSHN_UNDEF
            malloc.dynsym0x8be8400FUNC<unknown>DEFAULTSHN_UNDEF
            memcpy.dynsym0x8bd04FUNC<unknown>DEFAULTSHN_UNDEF
            memmove.dynsym0x8ba04FUNC<unknown>DEFAULTSHN_UNDEF
            memset.dynsym0x8d14156FUNC<unknown>DEFAULTSHN_UNDEF
            open.dynsym0x8d6892FUNC<unknown>DEFAULTSHN_UNDEF
            opendir.dynsym0x8d38264FUNC<unknown>DEFAULTSHN_UNDEF
            prctl.dynsym0x8bc448FUNC<unknown>DEFAULTSHN_UNDEF
            rand.dynsym0x8ca84FUNC<unknown>DEFAULTSHN_UNDEF
            read.dynsym0x8cc044FUNC<unknown>DEFAULTSHN_UNDEF
            readdir.dynsym0x8c24224FUNC<unknown>DEFAULTSHN_UNDEF
            readlink.dynsym0x8bdc44FUNC<unknown>DEFAULTSHN_UNDEF
            realloc.dynsym0x8ce4312FUNC<unknown>DEFAULTSHN_UNDEF
            recv.dynsym0x8b7c44FUNC<unknown>DEFAULTSHN_UNDEF
            recvfrom.dynsym0x8c0052FUNC<unknown>DEFAULTSHN_UNDEF
            select.dynsym0x8c1848FUNC<unknown>DEFAULTSHN_UNDEF
            send.dynsym0x8c3c44FUNC<unknown>DEFAULTSHN_UNDEF
            sendto.dynsym0x8cd852FUNC<unknown>DEFAULTSHN_UNDEF
            setsid.dynsym0x8d8044FUNC<unknown>DEFAULTSHN_UNDEF
            setsockopt.dynsym0x8c9c48FUNC<unknown>DEFAULTSHN_UNDEF
            sigaddset.dynsym0x8c3048FUNC<unknown>DEFAULTSHN_UNDEF
            sigemptyset.dynsym0x8b9424FUNC<unknown>DEFAULTSHN_UNDEF
            signal.dynsym0x8cb4200FUNC<unknown>DEFAULTSHN_UNDEF
            sigprocmask.dynsym0x8dbc84FUNC<unknown>DEFAULTSHN_UNDEF
            sleep.dynsym0x8bf4420FUNC<unknown>DEFAULTSHN_UNDEF
            socket.dynsym0x8c0c44FUNC<unknown>DEFAULTSHN_UNDEF
            time.dynsym0x8d2c44FUNC<unknown>DEFAULTSHN_UNDEF
            unlink.dynsym0x8ccc44FUNC<unknown>DEFAULTSHN_UNDEF
            usleep.dynsym0x8bac76FUNC<unknown>DEFAULTSHN_UNDEF
            write.dynsym0x8c6c44FUNC<unknown>DEFAULTSHN_UNDEF

            Network Behavior

            Download Network PCAP: filtered – full

            TimestampSource PortDest PortSource IPDest IP
            Jan 23, 2025 18:28:28.704493046 CET5546453192.168.2.131.1.1.1
            Jan 23, 2025 18:28:28.704545021 CET4573453192.168.2.131.1.1.1
            Jan 23, 2025 18:28:28.711622000 CET53554641.1.1.1192.168.2.13
            Jan 23, 2025 18:28:28.711714983 CET53457341.1.1.1192.168.2.13

            DNS Queries

            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
            Jan 23, 2025 18:28:28.704493046 CET192.168.2.131.1.1.10xdd1eStandard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
            Jan 23, 2025 18:28:28.704545021 CET192.168.2.131.1.1.10x5cfbStandard query (0)daisy.ubuntu.com28IN (0x0001)false

            DNS Answers

            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
            Jan 23, 2025 18:28:28.711622000 CET1.1.1.1192.168.2.130xdd1eNo error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
            Jan 23, 2025 18:28:28.711622000 CET1.1.1.1192.168.2.130xdd1eNo error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

            System Behavior

            General

            Start time (UTC):17:25:43
            Start date (UTC):23/01/2025
            Path:/tmp/arm5.elf
            Arguments:/tmp/arm5.elf
            File size:4956856 bytes
            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

            File Activities

            Process Activities

            System Activities