Edit tour

Linux Analysis Report
demon.arm.elf

Overview

General Information

Sample name:demon.arm.elf
Analysis ID:1635857
MD5:7f33426c81282d96f9e892aa594f45c3
SHA1:d7bcb96db22e5d5e6a1fa89fe203b1f530dc393b
SHA256:fe3907124fa4a5af0e13784bf0871b44b24482798ac953ac8a838911904d15a3
Tags:elfuser-abuse_ch
Infos:

Detection

Score:56
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1635857
Start date and time:2025-03-12 03:07:15 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 55s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:demon.arm.elf
Detection:MAL
Classification:mal56.linELF@0/0@2/0
Command:/tmp/demon.arm.elf
PID:5429
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Dark infection successful!!
Standard Error:
  • system is lnxubuntu20
  • demon.arm.elf (PID: 5429, Parent: 5352, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/demon.arm.elf
  • cleanup
No yara matches
TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2025-03-12T03:08:03.097954+010028366151Malware Command and Control Activity Detected192.168.2.1341496196.251.81.24610019TCP
2025-03-12T03:10:37.763225+010028366151Malware Command and Control Activity Detected192.168.2.1341498196.251.81.24610019TCP
2025-03-12T03:10:39.415597+010028366151Malware Command and Control Activity Detected192.168.2.1341500196.251.81.24610019TCP
2025-03-12T03:10:41.057707+010028366151Malware Command and Control Activity Detected192.168.2.1341502196.251.81.24610019TCP

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: demon.arm.elfVirustotal: Detection: 43%Perma Link

Networking

barindex
Source: Network trafficSuricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.13:41498 -> 196.251.81.246:10019
Source: Network trafficSuricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.13:41496 -> 196.251.81.246:10019
Source: Network trafficSuricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.13:41502 -> 196.251.81.246:10019
Source: Network trafficSuricata IDS: 2836615 - Severity 1 - ETPRO MALWARE ELF/Miori Variant CnC Activity : 192.168.2.13:41500 -> 196.251.81.246:10019
Source: global trafficTCP traffic: 192.168.2.13:41496 -> 196.251.81.246:10019
Source: /tmp/demon.arm.elf (PID: 5429)Socket: 127.0.0.1:12121Jump to behavior
Source: unknownTCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknownTCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknownTCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknownTCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknownTCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknownTCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknownTCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknownTCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknownTCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknownTCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknownTCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknownTCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknownTCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknownTCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknownTCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknownTCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknownTCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknownTCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknownTCP traffic detected without corresponding DNS query: 196.251.81.246
Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal56.linELF@0/0@2/0
Source: /tmp/demon.arm.elf (PID: 5429)Queries kernel information via 'uname': Jump to behavior
Source: demon.arm.elf, 5429.1.00005567dd94c000.00005567dda7a000.rw-.sdmpBinary or memory string: gU!/etc/qemu-binfmt/arm
Source: demon.arm.elf, 5429.1.00005567dd94c000.00005567dda7a000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: demon.arm.elf, 5429.1.00007ffdfe542000.00007ffdfe563000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
Source: demon.arm.elf, 5429.1.00007ffdfe542000.00007ffdfe563000.rw-.sdmpBinary or memory string: 9x86_64/usr/bin/qemu-arm/tmp/demon.arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/demon.arm.elf
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local System1
Non-Standard Port
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1635857 Sample: demon.arm.elf Startdate: 12/03/2025 Architecture: LINUX Score: 56 11 196.251.81.246, 10019, 41496, 41498 SONIC-WirelessZA Seychelles 2->11 13 daisy.ubuntu.com 2->13 15 Suricata IDS alerts for network traffic 2->15 17 Multi AV Scanner detection for submitted file 2->17 7 demon.arm.elf 2->7         started        signatures3 process4 process5 9 demon.arm.elf 7->9         started       

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
demon.arm.elf44%VirustotalBrowse
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

NameIPActiveMaliciousAntivirus DetectionReputation
daisy.ubuntu.com
162.213.35.24
truefalse
    high
    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs
    IPDomainCountryFlagASNASN NameMalicious
    196.251.81.246
    unknownSeychelles
    37417SONIC-WirelessZAtrue
    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    196.251.81.246demon.mpsl.elfGet hashmaliciousUnknownBrowse
      demon.x86.elfGet hashmaliciousUnknownBrowse
        demon.x86.elfGet hashmaliciousUnknownBrowse
          demon.mips.elfGet hashmaliciousUnknownBrowse
            demon.arm.elfGet hashmaliciousUnknownBrowse
              demon.mpsl.elfGet hashmaliciousUnknownBrowse
                demon.arm.elfGet hashmaliciousUnknownBrowse
                  demon.mpsl.elfGet hashmaliciousUnknownBrowse
                    demon.mips.elfGet hashmaliciousUnknownBrowse
                      demon.x86.elfGet hashmaliciousUnknownBrowse
                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        daisy.ubuntu.comdemon.arm5.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.25
                        demon.arm7.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.25
                        demon.mpsl.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.25
                        demon.arm6.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.24
                        demon.arm.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.24
                        demon.mpsl.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.25
                        morte.arm6.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.24
                        arm6.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.24
                        arm5-20250311-2220.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.25
                        mpsl.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.25
                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        SONIC-WirelessZAdemon.mpsl.elfGet hashmaliciousUnknownBrowse
                        • 196.251.81.246
                        demon.x86.elfGet hashmaliciousUnknownBrowse
                        • 196.251.81.246
                        demon.x86.elfGet hashmaliciousUnknownBrowse
                        • 196.251.81.246
                        demon.mips.elfGet hashmaliciousUnknownBrowse
                        • 196.251.81.246
                        demon.arm.elfGet hashmaliciousUnknownBrowse
                        • 196.251.81.246
                        demon.mpsl.elfGet hashmaliciousUnknownBrowse
                        • 196.251.81.246
                        demon.arm.elfGet hashmaliciousUnknownBrowse
                        • 196.251.81.246
                        demon.mpsl.elfGet hashmaliciousUnknownBrowse
                        • 196.251.81.246
                        demon.mips.elfGet hashmaliciousUnknownBrowse
                        • 196.251.81.246
                        demon.x86.elfGet hashmaliciousUnknownBrowse
                        • 196.251.81.246
                        No context
                        No context
                        No created / dropped files found
                        File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
                        Entropy (8bit):5.52413674452234
                        TrID:
                        • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                        File name:demon.arm.elf
                        File size:21'448 bytes
                        MD5:7f33426c81282d96f9e892aa594f45c3
                        SHA1:d7bcb96db22e5d5e6a1fa89fe203b1f530dc393b
                        SHA256:fe3907124fa4a5af0e13784bf0871b44b24482798ac953ac8a838911904d15a3
                        SHA512:a9a878946cb69ec27062422b8e90218682a0ce230a69626fda17b1dcf407e57de35fe209f5cf5f3d84ac627a6ef85926bb5faef2618e2f460538e03ec5b1eab6
                        SSDEEP:384:p+jYEv505hJOp+vJ66g6L69K6kXBJZH3HDkFx4eHF:pREv50PJOYvJKEJZH3Hh
                        TLSH:87A2C4E5F845DA07C9C50237BA0E878E7B216758B2DE3307AF273F50664B86B0A7E045
                        File Content Preview:.ELF...a..........(.........4...8R......4. ...(......................I...I...............P...P...P..................Q.td..................................-...L."...............0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

                        ELF header

                        Class:ELF32
                        Data:2's complement, little endian
                        Version:1 (current)
                        Machine:ARM
                        Version Number:0x1
                        Type:EXEC (Executable file)
                        OS/ABI:ARM - ABI
                        ABI Version:0
                        Entry Point Address:0x8190
                        Flags:0x202
                        ELF Header Size:52
                        Program Header Offset:52
                        Program Header Size:32
                        Number of Program Headers:3
                        Section Header Offset:21048
                        Section Header Size:40
                        Number of Section Headers:10
                        Header String Table Index:9
                        NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                        NULL0x00x00x00x00x0000
                        .initPROGBITS0x80940x940x180x00x6AX004
                        .textPROGBITS0x80b00xb00x43c80x00x6AX0016
                        .finiPROGBITS0xc4780x44780x140x00x6AX004
                        .rodataPROGBITS0xc48c0x448c0x55c0x00x2A004
                        .ctorsPROGBITS0x150000x50000x80x00x3WA004
                        .dtorsPROGBITS0x150080x50080x80x00x3WA004
                        .dataPROGBITS0x150140x50140x1e40x00x3WA004
                        .bssNOBITS0x151f80x51f80xd5180x00x3WA004
                        .shstrtabSTRTAB0x00x51f80x3e0x00x0001
                        TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                        LOAD0x00x80000x80000x49e80x49e85.85940x5R E0x8000.init .text .fini .rodata
                        LOAD0x50000x150000x150000x1f80xd7103.07420x6RW 0x8000.ctors .dtors .data .bss
                        GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                        Download Network PCAP: filteredfull

                        TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                        2025-03-12T03:08:03.097954+01002836615ETPRO MALWARE ELF/Miori Variant CnC Activity1192.168.2.1341496196.251.81.24610019TCP
                        2025-03-12T03:10:37.763225+01002836615ETPRO MALWARE ELF/Miori Variant CnC Activity1192.168.2.1341498196.251.81.24610019TCP
                        2025-03-12T03:10:39.415597+01002836615ETPRO MALWARE ELF/Miori Variant CnC Activity1192.168.2.1341500196.251.81.24610019TCP
                        2025-03-12T03:10:41.057707+01002836615ETPRO MALWARE ELF/Miori Variant CnC Activity1192.168.2.1341502196.251.81.24610019TCP
                        • Total Packets: 21
                        • 10019 undefined
                        • 53 (DNS)
                        TimestampSource PortDest PortSource IPDest IP
                        Mar 12, 2025 03:08:03.071851969 CET4149610019192.168.2.13196.251.81.246
                        Mar 12, 2025 03:08:03.076621056 CET1001941496196.251.81.246192.168.2.13
                        Mar 12, 2025 03:08:03.076769114 CET4149610019192.168.2.13196.251.81.246
                        Mar 12, 2025 03:08:03.097954035 CET4149610019192.168.2.13196.251.81.246
                        Mar 12, 2025 03:08:03.102658033 CET1001941496196.251.81.246192.168.2.13
                        Mar 12, 2025 03:08:03.102700949 CET4149610019192.168.2.13196.251.81.246
                        Mar 12, 2025 03:08:03.107377052 CET1001941496196.251.81.246192.168.2.13
                        Mar 12, 2025 03:10:37.755799055 CET1001941496196.251.81.246192.168.2.13
                        Mar 12, 2025 03:10:37.757118940 CET4149610019192.168.2.13196.251.81.246
                        Mar 12, 2025 03:10:37.757683039 CET4149810019192.168.2.13196.251.81.246
                        Mar 12, 2025 03:10:37.761929035 CET1001941496196.251.81.246192.168.2.13
                        Mar 12, 2025 03:10:37.762443066 CET1001941498196.251.81.246192.168.2.13
                        Mar 12, 2025 03:10:37.762501001 CET4149810019192.168.2.13196.251.81.246
                        Mar 12, 2025 03:10:37.763225079 CET4149810019192.168.2.13196.251.81.246
                        Mar 12, 2025 03:10:37.767929077 CET1001941498196.251.81.246192.168.2.13
                        Mar 12, 2025 03:10:37.767982006 CET4149810019192.168.2.13196.251.81.246
                        Mar 12, 2025 03:10:37.772694111 CET1001941498196.251.81.246192.168.2.13
                        Mar 12, 2025 03:10:39.407748938 CET1001941498196.251.81.246192.168.2.13
                        Mar 12, 2025 03:10:39.409240961 CET4149810019192.168.2.13196.251.81.246
                        Mar 12, 2025 03:10:39.409929991 CET4150010019192.168.2.13196.251.81.246
                        Mar 12, 2025 03:10:39.414056063 CET1001941498196.251.81.246192.168.2.13
                        Mar 12, 2025 03:10:39.414697886 CET1001941500196.251.81.246192.168.2.13
                        Mar 12, 2025 03:10:39.414784908 CET4150010019192.168.2.13196.251.81.246
                        Mar 12, 2025 03:10:39.415596962 CET4150010019192.168.2.13196.251.81.246
                        Mar 12, 2025 03:10:39.420301914 CET1001941500196.251.81.246192.168.2.13
                        Mar 12, 2025 03:10:39.420375109 CET4150010019192.168.2.13196.251.81.246
                        Mar 12, 2025 03:10:39.425353050 CET1001941500196.251.81.246192.168.2.13
                        Mar 12, 2025 03:10:41.049958944 CET1001941500196.251.81.246192.168.2.13
                        Mar 12, 2025 03:10:41.051204920 CET4150010019192.168.2.13196.251.81.246
                        Mar 12, 2025 03:10:41.052021980 CET4150210019192.168.2.13196.251.81.246
                        Mar 12, 2025 03:10:41.055948019 CET1001941500196.251.81.246192.168.2.13
                        Mar 12, 2025 03:10:41.056823969 CET1001941502196.251.81.246192.168.2.13
                        Mar 12, 2025 03:10:41.056907892 CET4150210019192.168.2.13196.251.81.246
                        Mar 12, 2025 03:10:41.057707071 CET4150210019192.168.2.13196.251.81.246
                        Mar 12, 2025 03:10:41.062897921 CET1001941502196.251.81.246192.168.2.13
                        Mar 12, 2025 03:10:41.062971115 CET4150210019192.168.2.13196.251.81.246
                        Mar 12, 2025 03:10:41.067745924 CET1001941502196.251.81.246192.168.2.13
                        TimestampSource PortDest PortSource IPDest IP
                        Mar 12, 2025 03:10:48.858741045 CET5817353192.168.2.138.8.8.8
                        Mar 12, 2025 03:10:48.858783960 CET4391053192.168.2.138.8.8.8
                        Mar 12, 2025 03:10:48.865289927 CET53439108.8.8.8192.168.2.13
                        Mar 12, 2025 03:10:48.865533113 CET53581738.8.8.8192.168.2.13
                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                        Mar 12, 2025 03:10:48.858741045 CET192.168.2.138.8.8.80x90f9Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                        Mar 12, 2025 03:10:48.858783960 CET192.168.2.138.8.8.80x7e6eStandard query (0)daisy.ubuntu.com28IN (0x0001)false
                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                        Mar 12, 2025 03:10:48.865533113 CET8.8.8.8192.168.2.130x90f9No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
                        Mar 12, 2025 03:10:48.865533113 CET8.8.8.8192.168.2.130x90f9No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false

                        System Behavior

                        Start time (UTC):02:08:02
                        Start date (UTC):12/03/2025
                        Path:/tmp/demon.arm.elf
                        Arguments:/tmp/demon.arm.elf
                        File size:4956856 bytes
                        MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                        Start time (UTC):02:08:02
                        Start date (UTC):12/03/2025
                        Path:/tmp/demon.arm.elf
                        Arguments:-
                        File size:4956856 bytes
                        MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1