Edit tour

Linux Analysis Report
arc.elf

Overview

General Information

Sample name:arc.elf
Analysis ID:1644004
MD5:121f20332ffe5e7bfbcc6a4b4635ac29
SHA1:9a92a7fe7fe575bc870080b67d3b2bea1abd8b0a
SHA256:9a599370312aa35364742155c32f13505ee0bf2b54f530114a751b2ced05a800
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:56
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Yara detected Mirai
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1644004
Start date and time:2025-03-20 10:16:51 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 19s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:arc.elf
Detection:MAL
Classification:mal56.troj.linELF@0/0@0/0
Command:/tmp/arc.elf
PID:5423
Exit Code:255
Exit Code Info:
Killed:False
Standard Output:

Standard Error:
  • system is lnxubuntu20
  • dash New Fork (PID: 5489, Parent: 3577)
  • rm (PID: 5489, Parent: 3577, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.wJBlXlCUB0 /tmp/tmp.939pskx3zr /tmp/tmp.LRm3U6260P
  • dash New Fork (PID: 5490, Parent: 3577)
  • rm (PID: 5490, Parent: 3577, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.wJBlXlCUB0 /tmp/tmp.939pskx3zr /tmp/tmp.LRm3U6260P
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
arc.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    No Suricata rule has matched

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Source: arc.elfVirustotal: Detection: 23%Perma Link
    Source: arc.elfReversingLabs: Detection: 19%
    Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
    Source: unknownTCP traffic detected without corresponding DNS query: 54.171.230.55
    Source: unknownTCP traffic detected without corresponding DNS query: 54.171.230.55
    Source: unknownTCP traffic detected without corresponding DNS query: 54.171.230.55
    Source: unknownTCP traffic detected without corresponding DNS query: 54.171.230.55
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58876
    Source: unknownNetwork traffic detected: HTTP traffic on port 57214 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 58876 -> 443
    Source: ELF static info symbol of initial sample.symtab present: no
    Source: classification engineClassification label: mal56.troj.linELF@0/0@0/0
    Source: /usr/bin/dash (PID: 5489)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.wJBlXlCUB0 /tmp/tmp.939pskx3zr /tmp/tmp.LRm3U6260PJump to behavior
    Source: /usr/bin/dash (PID: 5490)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.wJBlXlCUB0 /tmp/tmp.939pskx3zr /tmp/tmp.LRm3U6260PJump to behavior

    Stealing of Sensitive Information

    barindex
    Source: Yara matchFile source: arc.elf, type: SAMPLE

    Remote Access Functionality

    barindex
    Source: Yara matchFile source: arc.elf, type: SAMPLE
    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
    File Deletion
    OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
    Encrypted Channel
    Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
    Application Layer Protocol
    Exfiltration Over BluetoothNetwork Denial of Service
    No configs have been found
    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1644004 Sample: arc.elf Startdate: 20/03/2025 Architecture: LINUX Score: 56 10 54.171.230.55, 443, 58876 AMAZON-02US United States 2->10 12 54.247.62.1, 443 AMAZON-02US United States 2->12 14 Multi AV Scanner detection for submitted file 2->14 16 Yara detected Mirai 2->16 6 dash rm 2->6         started        8 dash rm 2->8         started        signatures3 process4
    SourceDetectionScannerLabelLink
    arc.elf24%VirustotalBrowse
    arc.elf19%ReversingLabsLinux.Backdoor.Mirai
    No Antivirus matches
    No Antivirus matches
    No Antivirus matches

    Download Network PCAP: filteredfull

    No contacted domains info
    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs
    IPDomainCountryFlagASNASN NameMalicious
    54.171.230.55
    unknownUnited States
    16509AMAZON-02USfalse
    54.247.62.1
    unknownUnited States
    16509AMAZON-02USfalse
    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    54.171.230.55aarch64.elfGet hashmaliciousMiraiBrowse
      boatnet.m68k.elfGet hashmaliciousMiraiBrowse
        na.elfGet hashmaliciousPrometeiBrowse
          na.elfGet hashmaliciousPrometeiBrowse
            na.elfGet hashmaliciousPrometeiBrowse
              na.elfGet hashmaliciousPrometeiBrowse
                resgod.mpsl.elfGet hashmaliciousMiraiBrowse
                  na.elfGet hashmaliciousPrometeiBrowse
                    l7vmra.elfGet hashmaliciousUnknownBrowse
                      spim.elfGet hashmaliciousMiraiBrowse
                        54.247.62.1gigab.i686.elfGet hashmaliciousUnknownBrowse
                          jkse.arm7.elfGet hashmaliciousMiraiBrowse
                            na.elfGet hashmaliciousPrometeiBrowse
                              na.elfGet hashmaliciousPrometeiBrowse
                                apep.arm.elfGet hashmaliciousUnknownBrowse
                                  na.elfGet hashmaliciousPrometeiBrowse
                                    rrrdsl.elfGet hashmaliciousUnknownBrowse
                                      na.elfGet hashmaliciousPrometeiBrowse
                                        powerpc.nn.elfGet hashmaliciousMiraiBrowse
                                          na.elfGet hashmaliciousPrometeiBrowse
                                            No context
                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                            AMAZON-02USna.elfGet hashmaliciousPrometeiBrowse
                                            • 34.249.145.219
                                            https://scribehow.com/page/Adobe_PDF_Document__Heb44GIjSfq2CGzJcxhYmAGet hashmaliciousUnknownBrowse
                                            • 52.219.120.122
                                            na.elfGet hashmaliciousPrometeiBrowse
                                            • 34.249.145.219
                                            aarch64.elfGet hashmaliciousMiraiBrowse
                                            • 54.171.230.55
                                            na.elfGet hashmaliciousPrometeiBrowse
                                            • 34.249.145.219
                                            hiss.arm5.elfGet hashmaliciousUnknownBrowse
                                            • 34.249.145.219
                                            Cargo Arrival Notification BL -pdf.jsGet hashmaliciousFormBookBrowse
                                            • 13.248.169.48
                                            https://ver-5j.jimdofree.com/Get hashmaliciousUnknownBrowse
                                            • 3.255.10.234
                                            boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                                            • 34.249.145.219
                                            boatnet.arm7.elfGet hashmaliciousMiraiBrowse
                                            • 34.249.145.219
                                            AMAZON-02USna.elfGet hashmaliciousPrometeiBrowse
                                            • 34.249.145.219
                                            https://scribehow.com/page/Adobe_PDF_Document__Heb44GIjSfq2CGzJcxhYmAGet hashmaliciousUnknownBrowse
                                            • 52.219.120.122
                                            na.elfGet hashmaliciousPrometeiBrowse
                                            • 34.249.145.219
                                            aarch64.elfGet hashmaliciousMiraiBrowse
                                            • 54.171.230.55
                                            na.elfGet hashmaliciousPrometeiBrowse
                                            • 34.249.145.219
                                            hiss.arm5.elfGet hashmaliciousUnknownBrowse
                                            • 34.249.145.219
                                            Cargo Arrival Notification BL -pdf.jsGet hashmaliciousFormBookBrowse
                                            • 13.248.169.48
                                            https://ver-5j.jimdofree.com/Get hashmaliciousUnknownBrowse
                                            • 3.255.10.234
                                            boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                                            • 34.249.145.219
                                            boatnet.arm7.elfGet hashmaliciousMiraiBrowse
                                            • 34.249.145.219
                                            No context
                                            No context
                                            No created / dropped files found
                                            File type:ELF 32-bit LSB executable, Synopsys ARCompact ARC700 cores, version 1 (SYSV), dynamically linked, stripped
                                            Entropy (8bit):6.596744302490852
                                            TrID:
                                            • ELF Executable and Linkable format (generic) (4004/1) 98.45%
                                            • Lumena CEL bitmap (63/63) 1.55%
                                            File name:arc.elf
                                            File size:116'116 bytes
                                            MD5:121f20332ffe5e7bfbcc6a4b4635ac29
                                            SHA1:9a92a7fe7fe575bc870080b67d3b2bea1abd8b0a
                                            SHA256:9a599370312aa35364742155c32f13505ee0bf2b54f530114a751b2ced05a800
                                            SHA512:fd99ba7b677d6f42a53e377a5e2e551b4c70e972dfbdab75a50fa6379038c7b9dc7e3c532dbaf4c008a2ab9c94206cbae98087cf7ea9e2a6ecb3aaeb5f922a50
                                            SSDEEP:3072:+cGD4hIvgPvgQT8rUivg1njeUvjCBv5unGLq:tIOeghHS5Nq
                                            TLSH:7CB39D9BF24B6850C42247F80BC78F9D2FA361519F2BD8E66C1D953F28BD1DB4816782
                                            File Content Preview:.ELF..............].....<...4...d.......4. ...(.................................. .......................~....... .............................................................................................................................................

                                            ELF header

                                            Class:ELF32
                                            Data:2's complement, little endian
                                            Version:1 (current)
                                            Machine:<unknown>
                                            Version Number:0x1
                                            Type:EXEC (Executable file)
                                            OS/ABI:UNIX - System V
                                            ABI Version:0
                                            Entry Point Address:0x10b3c
                                            Flags:0x403
                                            ELF Header Size:52
                                            Program Header Offset:52
                                            Program Header Size:32
                                            Number of Program Headers:5
                                            Section Header Offset:115556
                                            Section Header Size:40
                                            Number of Section Headers:14
                                            Header String Table Index:13
                                            NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                            NULL0x00x00x00x00x0000
                                            .initPROGBITS0x101140x1140x220x00x6AX001
                                            .textPROGBITS0x101380x1380x130c00x00x6AX004
                                            .finiPROGBITS0x231f80x131f80x160x00x6AX001
                                            .rodataPROGBITS0x232100x132100x89ec0x00x2A004
                                            .tbssNOBITS0x2ffe00x1bfe00x80x00x403WAT004
                                            .fini_arrayFINI_ARRAY0x2ffe00x1bfe00x40x40x3WA004
                                            .ctorsPROGBITS0x2ffe40x1bfe40x80x00x3WA004
                                            .dtorsPROGBITS0x2ffec0x1bfec0x80x00x3WA004
                                            .gotPROGBITS0x2fff40x1bff40x80x00x3WA004
                                            .dataPROGBITS0x300080x1c0080x2c40x00x3WA004
                                            .bssNOBITS0x302cc0x1c2cc0x7bf00x00x3WA004
                                            .ARC.attributes<unknown>0x00x1c2cc0x320x00x0001
                                            .shstrtabSTRTAB0x00x1c2fe0x650x00x0001
                                            TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                            LOAD0x00x100000x100000x1bbfc0x1bbfc6.65600x5R E0x2000.init .text .fini .rodata
                                            LOAD0x1bfe00x2ffe00x2ffe00x2ec0x7edc3.99630x6RW 0x2000.tbss .fini_array .ctors .dtors .got .data .bss
                                            DYNAMIC0x00x00x00x00x00.00000x4R 0x4
                                            DYNAMIC0x1bfe00x2ffe00x2ffe00x00x80.00000x4R 0x4
                                            DYNAMIC0x00x00x00x00x00.00000x6RW 0x4

                                            Download Network PCAP: filteredfull

                                            TimestampSource PortDest PortSource IPDest IP
                                            Mar 20, 2025 10:17:35.237943888 CET57214443192.168.2.1354.247.62.1
                                            Mar 20, 2025 10:18:03.650144100 CET58876443192.168.2.1354.171.230.55
                                            Mar 20, 2025 10:18:03.650197029 CET4435887654.171.230.55192.168.2.13
                                            Mar 20, 2025 10:18:03.650255919 CET58876443192.168.2.1354.171.230.55
                                            Mar 20, 2025 10:18:03.675185919 CET58876443192.168.2.1354.171.230.55
                                            Mar 20, 2025 10:18:03.675221920 CET4435887654.171.230.55192.168.2.13
                                            Mar 20, 2025 10:19:03.650784969 CET58876443192.168.2.1354.171.230.55
                                            Mar 20, 2025 10:19:03.692323923 CET4435887654.171.230.55192.168.2.13
                                            Mar 20, 2025 10:19:36.590688944 CET4435887654.171.230.55192.168.2.13

                                            System Behavior

                                            Start time (UTC):09:19:03
                                            Start date (UTC):20/03/2025
                                            Path:/usr/bin/dash
                                            Arguments:-
                                            File size:129816 bytes
                                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                            Start time (UTC):09:19:03
                                            Start date (UTC):20/03/2025
                                            Path:/usr/bin/rm
                                            Arguments:rm -f /tmp/tmp.wJBlXlCUB0 /tmp/tmp.939pskx3zr /tmp/tmp.LRm3U6260P
                                            File size:72056 bytes
                                            MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                            Start time (UTC):09:19:03
                                            Start date (UTC):20/03/2025
                                            Path:/usr/bin/dash
                                            Arguments:-
                                            File size:129816 bytes
                                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                            Start time (UTC):09:19:03
                                            Start date (UTC):20/03/2025
                                            Path:/usr/bin/rm
                                            Arguments:rm -f /tmp/tmp.wJBlXlCUB0 /tmp/tmp.939pskx3zr /tmp/tmp.LRm3U6260P
                                            File size:72056 bytes
                                            MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b