Edit tour

Linux Analysis Report
tftp.elf

Overview

General Information

Sample name:tftp.elf
Analysis ID:1644119
MD5:acedf944d0e8a5651b141bbfd1378b69
SHA1:84d6017e16ef34724067c4e4b4d9c6d7e43ddd04
SHA256:0e611b59976b9c50ef0e3ec6381624b139d367aad8c67ea117bd39f68dae430f
Tags:elfuser-abuse_ch
Infos:

Detection

Score:48
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Executes the "rm" command used to delete files or directories
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1644119
Start date and time:2025-03-20 11:38:26 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 33s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:tftp.elf
Detection:MAL
Classification:mal48.linELF@0/0@0/0
Command:/tmp/tftp.elf
PID:6232
Exit Code:135
Exit Code Info:
Killed:False
Standard Output:

Standard Error:
  • system is lnxubuntu20
  • tftp.elf (PID: 6232, Parent: 6154, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/tftp.elf
  • dash New Fork (PID: 6316, Parent: 4331)
  • rm (PID: 6316, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.ZJJXQx6pRL /tmp/tmp.4sz9aaeGLp /tmp/tmp.4hpUJs7kU9
  • dash New Fork (PID: 6317, Parent: 4331)
  • rm (PID: 6317, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.ZJJXQx6pRL /tmp/tmp.4sz9aaeGLp /tmp/tmp.4hpUJs7kU9
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: tftp.elfReversingLabs: Detection: 19%
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknownNetwork traffic detected: HTTP traffic on port 39246 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 39246
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
Source: classification engineClassification label: mal48.linELF@0/0@0/0
Source: /usr/bin/dash (PID: 6316)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.ZJJXQx6pRL /tmp/tmp.4sz9aaeGLp /tmp/tmp.4hpUJs7kU9Jump to behavior
Source: /usr/bin/dash (PID: 6317)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.ZJJXQx6pRL /tmp/tmp.4sz9aaeGLp /tmp/tmp.4hpUJs7kU9Jump to behavior
Source: /tmp/tftp.elf (PID: 6232)Queries kernel information via 'uname': Jump to behavior
Source: tftp.elf, 6232.1.00007ffdecd7f000.00007ffdecda0000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/tftp.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/tftp.elf
Source: tftp.elf, 6232.1.000056407aad1000.000056407abdd000.rw-.sdmpBinary or memory string: z@V!/etc/qemu-binfmt/arm
Source: tftp.elf, 6232.1.000056407aad1000.000056407abdd000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: tftp.elf, 6232.1.00007ffdecd7f000.00007ffdecda0000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
Source: tftp.elf, 6232.1.000056407aad1000.000056407abdd000.rw-.sdmpBinary or memory string: rg.qemu.gdb.arm.sys.regs">
Source: tftp.elf, 6232.1.000056407aad1000.000056407abdd000.rw-.sdmpBinary or memory string: z@Vrg.qemu.gdb.arm.sys.regs">
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
File Deletion
OS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1644119 Sample: tftp.elf Startdate: 20/03/2025 Architecture: LINUX Score: 48 12 109.202.202.202, 80 INIT7CH Switzerland 2->12 14 91.189.91.42, 443 CANONICAL-ASGB United Kingdom 2->14 16 2 other IPs or domains 2->16 18 Multi AV Scanner detection for submitted file 2->18 6 dash rm 2->6         started        8 dash rm 2->8         started        10 tftp.elf 2->10         started        signatures3 process4
SourceDetectionScannerLabelLink
tftp.elf19%ReversingLabsLinux.Trojan.Multiverze
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

No contacted domains info
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs
IPDomainCountryFlagASNASN NameMalicious
34.249.145.219
unknownUnited States
16509AMAZON-02USfalse
109.202.202.202
unknownSwitzerland
13030INIT7CHfalse
91.189.91.43
unknownUnited Kingdom
41231CANONICAL-ASGBfalse
91.189.91.42
unknownUnited Kingdom
41231CANONICAL-ASGBfalse
MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
34.249.145.219miner.elfGet hashmaliciousUnknownBrowse
    na.elfGet hashmaliciousPrometeiBrowse
      na.elfGet hashmaliciousPrometeiBrowse
        na.elfGet hashmaliciousPrometeiBrowse
          na.elfGet hashmaliciousPrometeiBrowse
            hiss.arm5.elfGet hashmaliciousUnknownBrowse
              boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                boatnet.arm7.elfGet hashmaliciousMiraiBrowse
                  boatnet.ppc.elfGet hashmaliciousMiraiBrowse
                    gigab.ppc.elfGet hashmaliciousUnknownBrowse
                      109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                      • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                      91.189.91.43miner.elfGet hashmaliciousUnknownBrowse
                        miner.elfGet hashmaliciousUnknownBrowse
                          na.elfGet hashmaliciousPrometeiBrowse
                            na.elfGet hashmaliciousPrometeiBrowse
                              na.elfGet hashmaliciousPrometeiBrowse
                                miner.elfGet hashmaliciousUnknownBrowse
                                  gigab.sh4.elfGet hashmaliciousUnknownBrowse
                                    gigab.ppc.elfGet hashmaliciousUnknownBrowse
                                      na.elfGet hashmaliciousPrometeiBrowse
                                        na.elfGet hashmaliciousPrometeiBrowse
                                          91.189.91.42miner.elfGet hashmaliciousUnknownBrowse
                                            miner.elfGet hashmaliciousUnknownBrowse
                                              na.elfGet hashmaliciousPrometeiBrowse
                                                na.elfGet hashmaliciousPrometeiBrowse
                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                    miner.elfGet hashmaliciousUnknownBrowse
                                                      gigab.sh4.elfGet hashmaliciousUnknownBrowse
                                                        gigab.ppc.elfGet hashmaliciousUnknownBrowse
                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                              No context
                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                              CANONICAL-ASGBminer.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              miner.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              miner.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              gigab.sh4.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              hiss.arm7.elfGet hashmaliciousUnknownBrowse
                                                              • 185.125.190.26
                                                              gigab.ppc.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              CANONICAL-ASGBminer.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              miner.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              miner.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              gigab.sh4.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              hiss.arm7.elfGet hashmaliciousUnknownBrowse
                                                              • 185.125.190.26
                                                              gigab.ppc.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              INIT7CHminer.elfGet hashmaliciousUnknownBrowse
                                                              • 109.202.202.202
                                                              miner.elfGet hashmaliciousUnknownBrowse
                                                              • 109.202.202.202
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 109.202.202.202
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 109.202.202.202
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 109.202.202.202
                                                              miner.elfGet hashmaliciousUnknownBrowse
                                                              • 109.202.202.202
                                                              gigab.sh4.elfGet hashmaliciousUnknownBrowse
                                                              • 109.202.202.202
                                                              gigab.ppc.elfGet hashmaliciousUnknownBrowse
                                                              • 109.202.202.202
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 109.202.202.202
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 109.202.202.202
                                                              AMAZON-02USna.elfGet hashmaliciousPrometeiBrowse
                                                              • 54.255.164.76
                                                              miner.elfGet hashmaliciousUnknownBrowse
                                                              • 34.249.145.219
                                                              microsftgoodforenoughtogetstory.htaGet hashmaliciousCobalt Strike, FormBookBrowse
                                                              • 13.248.243.5
                                                              nicenamewithgreatskillworkingon.htaGet hashmaliciousCobalt Strike, FormBookBrowse
                                                              • 13.248.243.5
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 54.255.164.76
                                                              sjjh.htaGet hashmaliciousCobalt Strike, FormBookBrowse
                                                              • 13.248.243.5
                                                              SecuriteInfo.com.Win64.MalwareX-gen.20059.3580.exeGet hashmaliciousUnknownBrowse
                                                              • 44.234.3.221
                                                              hiss.arm7.elfGet hashmaliciousUnknownBrowse
                                                              • 34.243.160.129
                                                              arc.elfGet hashmaliciousMiraiBrowse
                                                              • 54.247.62.1
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 34.249.145.219
                                                              No context
                                                              No context
                                                              No created / dropped files found
                                                              File type:ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.3, missing section headers at 381572
                                                              Entropy (8bit):6.009561679887215
                                                              TrID:
                                                              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                              File name:tftp.elf
                                                              File size:102'400 bytes
                                                              MD5:acedf944d0e8a5651b141bbfd1378b69
                                                              SHA1:84d6017e16ef34724067c4e4b4d9c6d7e43ddd04
                                                              SHA256:0e611b59976b9c50ef0e3ec6381624b139d367aad8c67ea117bd39f68dae430f
                                                              SHA512:cbb3c5b95023a01b366a6664afd6ce5c66cb81f0dfdbd157b7052e478adc87f90748cb8e73cfc3ffb2a12721b884d8822052c45f7fd2cb41fb57d3ee0a08f38a
                                                              SSDEEP:3072:9LOuh02xHCKQnqZ9YfMXKgyLlBZSyPjYTC:FOuhPHCKsqZ9YfM6g23ZJLYTC
                                                              TLSH:D2A30A96F8A28B56C4C55777FB4FC75637231795E3DF36038A184E34278B50A8E3AA01
                                                              File Content Preview:.ELF..............(.........4...........4. ...(........p.....+...+......................4...4...4...@...@...............t...t...t..............................................................................................................................

                                                              Download Network PCAP: filteredfull

                                                              • Total Packets: 11
                                                              • 443 (HTTPS)
                                                              • 80 (HTTP)
                                                              TimestampSource PortDest PortSource IPDest IP
                                                              Mar 20, 2025 11:39:11.151941061 CET43928443192.168.2.2391.189.91.42
                                                              Mar 20, 2025 11:39:16.783255100 CET42836443192.168.2.2391.189.91.43
                                                              Mar 20, 2025 11:39:18.062923908 CET4251680192.168.2.23109.202.202.202
                                                              Mar 20, 2025 11:39:31.373137951 CET43928443192.168.2.2391.189.91.42
                                                              Mar 20, 2025 11:39:32.446974993 CET39246443192.168.2.2334.249.145.219
                                                              Mar 20, 2025 11:39:32.447079897 CET4433924634.249.145.219192.168.2.23
                                                              Mar 20, 2025 11:39:32.447374105 CET39246443192.168.2.2334.249.145.219
                                                              Mar 20, 2025 11:39:32.447596073 CET39246443192.168.2.2334.249.145.219
                                                              Mar 20, 2025 11:39:32.447622061 CET4433924634.249.145.219192.168.2.23
                                                              Mar 20, 2025 11:39:43.659352064 CET42836443192.168.2.2391.189.91.43
                                                              Mar 20, 2025 11:39:47.754787922 CET4251680192.168.2.23109.202.202.202
                                                              Mar 20, 2025 11:40:12.327356100 CET43928443192.168.2.2391.189.91.42
                                                              Mar 20, 2025 11:40:32.439630985 CET39246443192.168.2.2334.249.145.219
                                                              Mar 20, 2025 11:40:32.484324932 CET4433924634.249.145.219192.168.2.23
                                                              Mar 20, 2025 11:41:15.934746027 CET4433924634.249.145.219192.168.2.23

                                                              System Behavior

                                                              Start time (UTC):10:39:10
                                                              Start date (UTC):20/03/2025
                                                              Path:/tmp/tftp.elf
                                                              Arguments:/tmp/tftp.elf
                                                              File size:4956856 bytes
                                                              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                              Start time (UTC):10:40:31
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/dash
                                                              Arguments:-
                                                              File size:129816 bytes
                                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                              Start time (UTC):10:40:31
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/rm
                                                              Arguments:rm -f /tmp/tmp.ZJJXQx6pRL /tmp/tmp.4sz9aaeGLp /tmp/tmp.4hpUJs7kU9
                                                              File size:72056 bytes
                                                              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                              Start time (UTC):10:40:31
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/dash
                                                              Arguments:-
                                                              File size:129816 bytes
                                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                              Start time (UTC):10:40:31
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/rm
                                                              Arguments:rm -f /tmp/tmp.ZJJXQx6pRL /tmp/tmp.4sz9aaeGLp /tmp/tmp.4hpUJs7kU9
                                                              File size:72056 bytes
                                                              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b