Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
miner.elf

Overview

General Information

Sample name:miner.elf
Analysis ID:1642499
MD5:b48cc6096fe279d600ca7248e68172d1
SHA1:832d9425d52c18020efe517b7989e6c51e783743
SHA256:6dcc134336c951e4c13a375ca56cb5e51caf974a696a6bf4558b08c3733d1c18
Tags:elfuser-abuse_ch
Infos:

Detection

Score:48
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
ELF contains segments with high entropy indicating compressed/encrypted content
Executes the "systemctl" command used for controlling the systemd system and service manager
Reads system version information
Sample contains only a LOAD segment without any section mappings

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1642499
Start date and time:2025-03-19 04:26:38 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 8s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:miner.elf
Detection:MAL
Classification:mal48.linELF@0/0@2/0

Runtime Messages

Command:/tmp/miner.elf
PID:5721
Exit Code:135
Exit Code Info:
Killed:False
Standard Output:

Standard Error:

Process Tree

  • system is lnxubuntu20
  • miner.elf (PID: 5721, Parent: 5524, MD5: b48cc6096fe279d600ca7248e68172d1) Arguments: /tmp/miner.elf
  • systemd New Fork (PID: 5783, Parent: 1)
  • snap-failure (PID: 5783, Parent: 1, MD5: 69136a7d575731ce62349f2e4d3e5c36) Arguments: /usr/lib/snapd/snap-failure snapd
    • systemctl (PID: 5796, Parent: 5783, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl stop snapd.socket
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

  • • AV Detection
  • • Networking
  • • System Summary
  • • Persistence and Installation Behavior
  • • Hooking and other Techniques for Hiding and Protection

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: miner.elfVirustotal: Detection: 17%Perma Link
Source: miner.elfReversingLabs: Detection: 23%
Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
Source: LOAD without section mappingsProgram segment: 0x400000
Source: classification engineClassification label: mal48.linELF@0/0@2/0
Source: /usr/lib/snapd/snap-failure (PID: 5796)Systemctl executable: /usr/bin/systemctl -> systemctl stop snapd.socketJump to behavior
Source: /usr/lib/snapd/snap-failure (PID: 5783)Reads version info: /proc/versionJump to behavior
Source: miner.elfSubmission file: segment LOAD with 7.9995 entropy (max. 8.0)

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
Systemd Service		1
Systemd Service		1
Obfuscated Files or Information		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Non-Application Layer Protocol		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1642499 Sample: miner.elf Startdate: 19/03/2025 Architecture: LINUX Score: 48 15 daisy.ubuntu.com 2->15 17 Multi AV Scanner detection for submitted file 2->17 7 systemd snap-failure 2->7         started        9 miner.elf 2->9         started        signatures3 process4 process5 11 snap-failure systemctl 7->11         started        13 snap-failure 7->13         started       

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
miner.elf17%VirustotalBrowse
miner.elf24%ReversingLabsLinux.Trojan.Multiverze

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
daisy.ubuntu.com
162.213.35.24
truefalse
    		high

    World Map of Contacted IPs

    ⊘No contacted IP infos

    Joe Sandbox View / Context

    IPs

    ⊘No context

    Domains

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    daisy.ubuntu.comsh4.elfGet hashmaliciousUnknownBrowse
    • 162.213.35.25
    aarch64.elfGet hashmaliciousUnknownBrowse
    • 162.213.35.24
    Federalarm5Agent.elfGet hashmaliciousUnknownBrowse
    • 162.213.35.25
    arm.elfGet hashmaliciousUnknownBrowse
    • 162.213.35.24
    FederalarmAgent.elfGet hashmaliciousMiraiBrowse
    • 162.213.35.24
    arm5.elfGet hashmaliciousUnknownBrowse
    • 162.213.35.25
    arm6.elfGet hashmaliciousUnknownBrowse
    • 162.213.35.25
    sh4.elfGet hashmaliciousUnknownBrowse
    • 162.213.35.25

    ASNs

    ⊘No context

    JA3 Fingerprints

    ⊘No context

    Dropped Files

    ⊘No context

    Created / dropped Files

    ⊘No created / dropped files found

    Static File Info

    General

    File type:ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, no section header
    Entropy (8bit):7.999543560803114
    TrID:
    • ELF Executable and Linkable format (generic) (4004/1) 100.00%
    File name:miner.elf
    File size:456'727 bytes
    MD5:b48cc6096fe279d600ca7248e68172d1
    SHA1:832d9425d52c18020efe517b7989e6c51e783743
    SHA256:6dcc134336c951e4c13a375ca56cb5e51caf974a696a6bf4558b08c3733d1c18
    SHA512:7a4b4dab584feb892fd481054e22172021b17fa238a06a0e27523c232f030a03134ebd341b46b98b0206f37ea43b2ef8704570dab91f000829ff011bedf575ee
    SSDEEP:12288:PQesbwhx7kOQ4x1QJxhEol1X+QbchK0tvo:PvswhZT3/QJLfl1X+Q47tvo
    TLSH:2BA4235D5577A0F7DA386B7222ED0882598E286AD62C4F415EF4C428FDC1942B33B2DF
    File Content Preview:.ELF..............>.......[.....@...................@.8...@.......................@.......@....................... .............`.......`.......`......................... .....)]..UPX!L.........K...K.X...k..........?.E.h=.......N......e...U.....bo.G...y..

    Static ELF Info

    ELF header

    Class:ELF64
    Data:2's complement, little endian
    Version:1 (current)
    Machine:Advanced Micro Devices X86-64
    Version Number:0x1
    Type:EXEC (Executable file)
    OS/ABI:UNIX - Linux
    ABI Version:0
    Entry Point Address:0x5bd090
    Flags:0x0
    ELF Header Size:64
    Program Header Offset:64
    Program Header Size:56
    Number of Program Headers:2
    Section Header Offset:0
    Section Header Size:64
    Number of Section Headers:0
    Header String Table Index:0

    Program Segments

    TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
    LOAD0x00x4000000x4000000x1be1cd0x1be1cd7.99950x5R E0x200000
    LOAD0xcfb600xacfb600xacfb600x00x00.00000x6RW 0x200000

    Network Behavior

    Download Network PCAP: filtered – full

    TimestampSource PortDest PortSource IPDest IP
    Mar 19, 2025 04:28:14.639575958 CET3480253192.168.2.138.8.8.8
    Mar 19, 2025 04:28:14.644665003 CET53348028.8.8.8192.168.2.13
    Mar 19, 2025 04:28:14.644781113 CET3480253192.168.2.138.8.8.8
    Mar 19, 2025 04:28:14.644846916 CET3480253192.168.2.138.8.8.8
    Mar 19, 2025 04:28:14.644871950 CET3480253192.168.2.138.8.8.8
    Mar 19, 2025 04:28:14.649609089 CET53348028.8.8.8192.168.2.13
    Mar 19, 2025 04:28:14.649638891 CET53348028.8.8.8192.168.2.13
    Mar 19, 2025 04:28:15.121753931 CET53348028.8.8.8192.168.2.13
    Mar 19, 2025 04:28:15.121906042 CET3480253192.168.2.138.8.8.8
    Mar 19, 2025 04:28:15.254762888 CET53348028.8.8.8192.168.2.13
    Mar 19, 2025 04:28:15.254935980 CET3480253192.168.2.138.8.8.8
    Mar 19, 2025 04:28:17.121684074 CET53348028.8.8.8192.168.2.13
    Mar 19, 2025 04:28:17.121923923 CET3480253192.168.2.138.8.8.8
    Mar 19, 2025 04:28:17.126836061 CET53348028.8.8.8192.168.2.13

    DNS Queries

    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
    Mar 19, 2025 04:28:14.644846916 CET192.168.2.138.8.8.80xb22dStandard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
    Mar 19, 2025 04:28:14.644871950 CET192.168.2.138.8.8.80x63cbStandard query (0)daisy.ubuntu.com28IN (0x0001)false

    DNS Answers

    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
    Mar 19, 2025 04:28:15.254762888 CET8.8.8.8192.168.2.130xb22dNo error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
    Mar 19, 2025 04:28:15.254762888 CET8.8.8.8192.168.2.130xb22dNo error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false

    System Behavior

    General

    Start time (UTC):03:28:12
    Start date (UTC):19/03/2025
    Path:/tmp/miner.elf
    Arguments:/tmp/miner.elf
    File size:456727 bytes
    MD5 hash:b48cc6096fe279d600ca7248e68172d1

    General

    Start time (UTC):03:28:52
    Start date (UTC):19/03/2025
    Path:/usr/lib/systemd/systemd
    Arguments:-
    File size:1620224 bytes
    MD5 hash:9b2bec7092a40488108543f9334aab75

    Process Activities


    General

    Start time (UTC):03:28:52
    Start date (UTC):19/03/2025
    Path:/usr/lib/snapd/snap-failure
    Arguments:/usr/lib/snapd/snap-failure snapd
    File size:4764904 bytes
    MD5 hash:69136a7d575731ce62349f2e4d3e5c36

    File Activities

    Process Activities


    General

    Start time (UTC):03:28:52
    Start date (UTC):19/03/2025
    Path:/usr/lib/snapd/snap-failure
    Arguments:-
    File size:4764904 bytes
    MD5 hash:69136a7d575731ce62349f2e4d3e5c36

    Process Activities


    General

    Start time (UTC):03:28:52
    Start date (UTC):19/03/2025
    Path:/usr/bin/systemctl
    Arguments:systemctl stop snapd.socket
    File size:996584 bytes
    MD5 hash:4deddfb6741481f68aeac522cc26ff4b

    File Activities

    Network Activities


    General

    Start time (UTC):03:28:52
    Start date (UTC):19/03/2025
    Path:/usr/lib/snapd/snap-failure
    Arguments:-
    File size:4764904 bytes
    MD5 hash:69136a7d575731ce62349f2e4d3e5c36

    Process Activities