Edit tour

Linux Analysis Report
arm6.elf

Overview

General Information

Sample name:arm6.elf
Analysis ID:1632719
MD5:682d70c35bacd66e2ef7cfb057d5b873
SHA1:a48c554b93a5a30e585dcff8adbdaf3f473d2d02
SHA256:01b9a782e417af3e7f4ec22874bb615fce27b1660e43a766ed03863aaf651bc6
Tags:elfuser-abuse_ch
Infos:

Detection

Score:52
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Sample reads /proc/mounts (often used for finding a writable filesystem)
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1632719
Start date and time:2025-03-09 00:50:14 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 10s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:arm6.elf
Detection:MAL
Classification:mal52.troj.linELF@0/1@0/0
Command:/tmp/arm6.elf
PID:6269
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
For God so loved the world
Standard Error:
  • system is lnxubuntu20
  • arm6.elf (PID: 6269, Parent: 6193, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm6.elf
    • arm6.elf New Fork (PID: 6272, Parent: 6269)
  • dash New Fork (PID: 6296, Parent: 4331)
  • rm (PID: 6296, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.Qej6uM723A /tmp/tmp.ll9twwAQtS /tmp/tmp.VQoU2BEGPh
  • dash New Fork (PID: 6297, Parent: 4331)
  • rm (PID: 6297, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.Qej6uM723A /tmp/tmp.ll9twwAQtS /tmp/tmp.VQoU2BEGPh
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: arm6.elfVirustotal: Detection: 20%Perma Link
Source: arm6.elfReversingLabs: Detection: 18%
Source: /tmp/arm6.elf (PID: 6272)Socket: 127.0.0.1:22448Jump to behavior
Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 39258
Source: unknownNetwork traffic detected: HTTP traffic on port 39258 -> 443
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal52.troj.linELF@0/1@0/0

Persistence and Installation Behavior

barindex
Source: /tmp/arm6.elf (PID: 6269)File: /proc/6269/mountsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/4331/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2033/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1582/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2275/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1612/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1579/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1699/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1335/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1698/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2028/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1334/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1576/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2302/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/3236/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2025/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2146/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/912/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/759/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2307/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/918/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1594/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2285/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2281/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1349/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1623/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/761/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1622/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/884/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1983/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2038/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1586/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1465/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1344/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1860/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1463/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2156/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/800/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/801/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1629/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1627/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1900/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/6251/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/6253/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/491/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2294/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2050/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1877/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/772/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1633/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1599/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1632/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1477/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/774/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1476/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1872/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2048/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1475/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2289/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/777/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/658/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/936/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1639/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1638/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2208/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2180/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1809/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1494/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1890/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2063/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2062/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1888/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1886/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1489/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/785/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1642/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/788/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/789/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1648/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2078/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2077/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2074/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2195/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/793/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1656/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1654/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2226/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1532/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/796/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/797/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2069/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2102/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2223/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/799/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2080/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2242/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2084/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2083/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1668/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1664/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/1389/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/720/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2114/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6269)File opened: /proc/2235/mapsJump to behavior
Source: /usr/bin/dash (PID: 6296)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.Qej6uM723A /tmp/tmp.ll9twwAQtS /tmp/tmp.VQoU2BEGPhJump to behavior
Source: /usr/bin/dash (PID: 6297)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.Qej6uM723A /tmp/tmp.ll9twwAQtS /tmp/tmp.VQoU2BEGPhJump to behavior
Source: /tmp/arm6.elf (PID: 6269)Queries kernel information via 'uname': Jump to behavior
Source: arm6.elf, 6269.1.000055c7b473a000.000055c7b4888000.rw-.sdmp, arm6.elf, 6272.1.000055c7b473a000.000055c7b4888000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
Source: arm6.elf, 6269.1.00007ffdcabdb000.00007ffdcabfc000.rw-.sdmpBinary or memory string: /tmp/qemu-open.viUZQe
Source: arm6.elf, 6272.1.00007ffdcabdb000.00007ffdcabfc000.rw-.sdmpBinary or memory string: Uqemu: uncaught target signal 11 (Segmentation fault) - core dumped
Source: arm6.elf, 6269.1.00007ffdcabdb000.00007ffdcabfc000.rw-.sdmpBinary or memory string: U/tmp/qemu-open.viUZQe:
Source: arm6.elf, 6269.1.000055c7b473a000.000055c7b4888000.rw-.sdmp, arm6.elf, 6272.1.000055c7b473a000.000055c7b4888000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: arm6.elf, 6269.1.00007ffdcabdb000.00007ffdcabfc000.rw-.sdmp, arm6.elf, 6272.1.00007ffdcabdb000.00007ffdcabfc000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
Source: arm6.elf, 6269.1.00007ffdcabdb000.00007ffdcabfc000.rw-.sdmp, arm6.elf, 6272.1.00007ffdcabdb000.00007ffdcabfc000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm6.elf
Source: arm6.elf, 6272.1.00007ffdcabdb000.00007ffdcabfc000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
File Deletion
1
OS Credential Dumping
11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory1
File and Directory Discovery
Remote Desktop ProtocolData from Removable Media1
Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1632719 Sample: arm6.elf Startdate: 09/03/2025 Architecture: LINUX Score: 52 16 109.202.202.202, 80 INIT7CH Switzerland 2->16 18 91.189.91.42, 443 CANONICAL-ASGB United Kingdom 2->18 20 34.249.145.219, 39258, 443 AMAZON-02US United States 2->20 22 Multi AV Scanner detection for submitted file 2->22 7 arm6.elf 2->7         started        10 dash rm 2->10         started        12 dash rm 2->12         started        signatures3 process4 signatures5 24 Sample reads /proc/mounts (often used for finding a writable filesystem) 7->24 14 arm6.elf 7->14         started        process6
SourceDetectionScannerLabelLink
arm6.elf21%VirustotalBrowse
arm6.elf18%ReversingLabsLinux.Trojan.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

No contacted domains info
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs
IPDomainCountryFlagASNASN NameMalicious
34.249.145.219
unknownUnited States
16509AMAZON-02USfalse
109.202.202.202
unknownSwitzerland
13030INIT7CHfalse
91.189.91.42
unknownUnited Kingdom
41231CANONICAL-ASGBfalse
MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
34.249.145.219arm5.elfGet hashmaliciousUnknownBrowse
    m68k.elfGet hashmaliciousMiraiBrowse
      donk.ppc.elfGet hashmaliciousMiraiBrowse
        donk.sh4.elfGet hashmaliciousMiraiBrowse
          Okami.mpsl.elfGet hashmaliciousGafgyt, MiraiBrowse
            bejv86.elfGet hashmaliciousUnknownBrowse
              na.elfGet hashmaliciousPrometeiBrowse
                na.elfGet hashmaliciousPrometeiBrowse
                  na.elfGet hashmaliciousPrometeiBrowse
                    zermpsl.elfGet hashmaliciousUnknownBrowse
                      109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                      • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                      91.189.91.42mips.elfGet hashmaliciousMiraiBrowse
                        morte.arm-20250308-2315.elfGet hashmaliciousUnknownBrowse
                          morte.x64-20250308-2316.elfGet hashmaliciousUnknownBrowse
                            pty4.elfGet hashmaliciousMuhstik, TsunamiBrowse
                              arm-20250308-2052.elfGet hashmaliciousMiraiBrowse
                                na.elfGet hashmaliciousPrometeiBrowse
                                  na.elfGet hashmaliciousPrometeiBrowse
                                    na.elfGet hashmaliciousPrometeiBrowse
                                      na.elfGet hashmaliciousPrometeiBrowse
                                        na.elfGet hashmaliciousPrometeiBrowse
                                          No context
                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                          CANONICAL-ASGBmips.elfGet hashmaliciousMiraiBrowse
                                          • 91.189.91.42
                                          morte.arm-20250308-2315.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          morte.x64-20250308-2316.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          pty4.elfGet hashmaliciousMuhstik, TsunamiBrowse
                                          • 91.189.91.42
                                          arm-20250308-2052.elfGet hashmaliciousMiraiBrowse
                                          • 91.189.91.42
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 91.189.91.42
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 91.189.91.42
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 91.189.91.42
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 91.189.91.42
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 91.189.91.42
                                          INIT7CHmips.elfGet hashmaliciousMiraiBrowse
                                          • 109.202.202.202
                                          morte.arm-20250308-2315.elfGet hashmaliciousUnknownBrowse
                                          • 109.202.202.202
                                          morte.x64-20250308-2316.elfGet hashmaliciousUnknownBrowse
                                          • 109.202.202.202
                                          pty4.elfGet hashmaliciousMuhstik, TsunamiBrowse
                                          • 109.202.202.202
                                          arm-20250308-2052.elfGet hashmaliciousMiraiBrowse
                                          • 109.202.202.202
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 109.202.202.202
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 109.202.202.202
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 109.202.202.202
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 109.202.202.202
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 109.202.202.202
                                          AMAZON-02USSryxen-Built.exeGet hashmaliciousUnknownBrowse
                                          • 108.138.128.56
                                          SecuriteInfo.com.Variant.Fragtor.519143.11279.16206.exeGet hashmaliciousPoverty StealerBrowse
                                          • 185.166.143.50
                                          SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exeGet hashmaliciousPoverty StealerBrowse
                                          • 185.166.143.48
                                          sh4.elfGet hashmaliciousMiraiBrowse
                                          • 18.180.172.177
                                          arm.elfGet hashmaliciousMiraiBrowse
                                          • 18.182.140.102
                                          m68k.elfGet hashmaliciousMiraiBrowse
                                          • 18.227.209.61
                                          mpsl.elfGet hashmaliciousMiraiBrowse
                                          • 18.141.95.254
                                          spc.elfGet hashmaliciousMiraiBrowse
                                          • 18.190.141.61
                                          arm7.elfGet hashmaliciousMiraiBrowse
                                          • 13.53.253.2
                                          ppc.elfGet hashmaliciousMiraiBrowse
                                          • 13.127.50.187
                                          No context
                                          No context
                                          Process:/tmp/arm6.elf
                                          File Type:ASCII text
                                          Category:dropped
                                          Size (bytes):355
                                          Entropy (8bit):3.808693620130118
                                          Encrypted:false
                                          SSDEEP:6:0DF/LKyj/VUB4DF/+IXY/V/3VVyAb/rVmsVot/VOArB/VH:MpKfBwII+VIAbyl
                                          MD5:35ACE7EB60838D0E586D992405869244
                                          SHA1:5D32E9A95AB14160DA4E055CFF6C4AB183CB89F0
                                          SHA-256:407279EE26A46B68424D41414E9D0BC4DFB8D3AD7BEF297EA07ADD00116BA95C
                                          SHA-512:6FEFC82804E8FBE4A9C93B8C2E88F04C267B1EDE3922982917696CE9F45B0CA6253035FCDDA87E8E511950E358503D07B87DD572598AEB13E097F63AD5C73386
                                          Malicious:false
                                          Reputation:low
                                          Preview:8000-26000 r-xp 00000000 fd:00 531606 /tmp/arm6.elf.2d000-2e000 rw-p 0001d000 fd:00 531606 /tmp/arm6.elf.2e000-34000 rw-p 00000000 00:00 0 .ff7ee000-ff7ef000 r--p 00000000 fd:00 793309 /usr/lib/x86_64-linux-gnu/libm-2.31.so.ff7ef000-ff7f0000 ---p 00000000 00:00 0 .ff7f0000-ffff0000 rw-p 00000000 00:00 0 [stack].
                                          File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), dynamically linked, stripped
                                          Entropy (8bit):6.116600587426461
                                          TrID:
                                          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                          File name:arm6.elf
                                          File size:119'700 bytes
                                          MD5:682d70c35bacd66e2ef7cfb057d5b873
                                          SHA1:a48c554b93a5a30e585dcff8adbdaf3f473d2d02
                                          SHA256:01b9a782e417af3e7f4ec22874bb615fce27b1660e43a766ed03863aaf651bc6
                                          SHA512:404e3c413e966548189297e3ec7170f7843a721708c9374f7341195900563d2c1ead3d14c87e1f702d4e1e9dad1c697d320a4d910b8b66509ce77db512e8eefc
                                          SSDEEP:3072:A28m+VE6sjAtoFceeBU62MXPYG+zturwpQCinDJ:A28zu6ZtomeuUEXQG+Zur9v
                                          TLSH:5AC3189AB8819F66C5D116BEFE1E52CD33232FB8E3DA3103DD155B2077CA95A0A3B441
                                          File Content Preview:.ELF..............(.....l...4...........4. ...(..............O...O..................................T...T...............T...T...T........I...........................................@-..@............/..@-.,@...0....S..... 0....S.........../..0...0...@..../

                                          ELF header

                                          Class:ELF32
                                          Data:2's complement, little endian
                                          Version:1 (current)
                                          Machine:ARM
                                          Version Number:0x1
                                          Type:EXEC (Executable file)
                                          OS/ABI:UNIX - System V
                                          ABI Version:0
                                          Entry Point Address:0x816c
                                          Flags:0x4000002
                                          ELF Header Size:52
                                          Program Header Offset:52
                                          Program Header Size:32
                                          Number of Program Headers:4
                                          Section Header Offset:119180
                                          Section Header Size:40
                                          Number of Section Headers:13
                                          Header String Table Index:12
                                          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                          NULL0x00x00x00x00x0000
                                          .initPROGBITS0x80b40xb40x140x00x6AX001
                                          .textPROGBITS0x80c80xc80x1b3e40x00x6AX004
                                          .finiPROGBITS0x234ac0x1b4ac0x140x00x6AX001
                                          .rodataPROGBITS0x234c00x1b4c00x1acc0x00x2A008
                                          .ARM.exidxARM_EXIDX0x24f8c0x1cf8c0xc80x00x82AL204
                                          .eh_framePROGBITS0x2d0540x1d0540x40x00x3WA004
                                          .init_arrayINIT_ARRAY0x2d0580x1d0580x40x00x3WA004
                                          .fini_arrayFINI_ARRAY0x2d05c0x1d05c0x40x00x3WA004
                                          .gotPROGBITS0x2d0640x1d0640x280x40x3WA004
                                          .dataPROGBITS0x2d08c0x1d08c0x9c0x00x3WA004
                                          .bssNOBITS0x2d1280x1d1280x48ac0x00x3WA008
                                          .shstrtabSTRTAB0x00x1d1280x620x00x0001
                                          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                          DYNAMIC0x1cf8c0x24f8c0x24f8c0xc80xc84.34580x4R 0x4.ARM.exidx
                                          LOAD0x00x80000x80000x1d0540x1d0546.12580x5R E0x8000.init .text .fini .rodata .ARM.exidx
                                          LOAD0x1d0540x2d0540x2d0540xd40x49803.56550x6RW 0x8000.eh_frame .init_array .fini_array .got .data .bss
                                          DYNAMIC0x00x00x00x00x00.00000x7RWE0x4

                                          Download Network PCAP: filteredfull

                                          • Total Packets: 4
                                          • 443 (HTTPS)
                                          • 80 (HTTP)
                                          TimestampSource PortDest PortSource IPDest IP
                                          Mar 9, 2025 00:51:42.847634077 CET4433925834.249.145.219192.168.2.23
                                          Mar 9, 2025 00:51:42.848167896 CET39258443192.168.2.2334.249.145.219
                                          Mar 9, 2025 00:51:42.853332996 CET4433925834.249.145.219192.168.2.23
                                          Mar 9, 2025 00:51:46.663420916 CET4251680192.168.2.23109.202.202.202
                                          Mar 9, 2025 00:51:46.663543940 CET43928443192.168.2.2391.189.91.42
                                          Mar 9, 2025 00:52:27.617844105 CET43928443192.168.2.2391.189.91.42

                                          System Behavior

                                          Start time (UTC):23:51:30
                                          Start date (UTC):08/03/2025
                                          Path:/tmp/arm6.elf
                                          Arguments:-
                                          File size:4956856 bytes
                                          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                          Start time (UTC):23:51:41
                                          Start date (UTC):08/03/2025
                                          Path:/usr/bin/dash
                                          Arguments:-
                                          File size:129816 bytes
                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                          Start time (UTC):23:51:41
                                          Start date (UTC):08/03/2025
                                          Path:/usr/bin/rm
                                          Arguments:rm -f /tmp/tmp.Qej6uM723A /tmp/tmp.ll9twwAQtS /tmp/tmp.VQoU2BEGPh
                                          File size:72056 bytes
                                          MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                          Start time (UTC):23:51:41
                                          Start date (UTC):08/03/2025
                                          Path:/usr/bin/dash
                                          Arguments:-
                                          File size:129816 bytes
                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                          Start time (UTC):23:51:41
                                          Start date (UTC):08/03/2025
                                          Path:/usr/bin/rm
                                          Arguments:rm -f /tmp/tmp.Qej6uM723A /tmp/tmp.ll9twwAQtS /tmp/tmp.VQoU2BEGPh
                                          File size:72056 bytes
                                          MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b