Linux
Analysis Report
.5r3fqt67ew531has4231.arm6.elf
Overview
General Information
Sample name: | .5r3fqt67ew531has4231.arm6.elf |
Analysis ID: | 1644194 |
MD5: | 0a6816481665367226412568e3a74364 |
SHA1: | 4f88568c98df82482e4d3605f9dd6c5ed6b390a4 |
SHA256: | c24e8a9aeb41a70eed99e131197172097111d45aed7b3e240ea67bf576f55f3f |
Tags: | elfuser-abuse_ch |
Infos: |
Detection
Score: | 52 |
Range: | 0 - 100 |
Signatures
Multi AV Scanner detection for submitted file
Sample is packed with UPX
ELF contains segments with high entropy indicating compressed/encrypted content
Executes the "systemctl" command used for controlling the systemd system and service manager
Reads system version information
Sample contains only a LOAD segment without any section mappings
Uses the "uname" system call to query kernel version information (possible evasion)
Classification
Joe Sandbox version: | 42.0.0 Malachite |
Analysis ID: | 1644194 |
Start date and time: | 2025-03-20 12:49:25 +01:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 5m 15s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | defaultlinuxfilecookbook.jbs |
Analysis system description: | Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11) |
Analysis Mode: | default |
Sample name: | .5r3fqt67ew531has4231.arm6.elf |
Detection: | MAL |
Classification: | mal52.evad.linELF@0/0@2/0 |
Command: | /tmp/.5r3fqt67ew531has4231.arm6.elf |
PID: | 5722 |
Exit Code: | 139 |
Exit Code Info: | SIGSEGV (11) Segmentation fault invalid memory reference |
Killed: | False |
Standard Output: | |
Standard Error: | qemu: uncaught target signal 11 (Segmentation fault) - core dumped |
- system is lnxubuntu20
- systemd New Fork (PID: 5788, Parent: 1)
- snap-failure New Fork (PID: 5802, Parent: 5788)
- snap-failure New Fork (PID: 5803, Parent: 5788)
- cleanup
⊘No yara matches
⊘No Suricata rule has matched
- • AV Detection
- • Networking
- • System Summary
- • Data Obfuscation
- • Persistence and Installation Behavior
- • Hooking and other Techniques for Hiding and Protection
- • Malware Analysis System Evasion
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Virustotal: | Perma Link | ||
Source: | ReversingLabs: |
Source: | DNS traffic detected: |
Source: | String found in binary or memory: |
Source: | Program segment: |
Source: | Classification label: |
Data Obfuscation |
---|
Source: | String containing UPX found: | ||
Source: | String containing UPX found: | ||
Source: | String containing UPX found: |
Source: | Systemctl executable: | Jump to behavior |
Source: | Reads version info: | Jump to behavior |
Source: | Submission file: |
Source: | Queries kernel information via 'uname': | Jump to behavior |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 1 Systemd Service | 1 Systemd Service | 11 Obfuscated Files or Information | OS Credential Dumping | 11 Security Software Discovery | Remote Services | Data from Local System | 1 Non-Application Layer Protocol | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | Rootkit | LSASS Memory | 1 System Information Discovery | Remote Desktop Protocol | Data from Removable Media | 1 Application Layer Protocol | Exfiltration Over Bluetooth | Network Denial of Service |
⊘No configs have been found
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
21% | Virustotal | Browse | ||
31% | ReversingLabs | Linux.Backdoor.Mirai |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
Name | IP | Active | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|---|
daisy.ubuntu.com | 162.213.35.24 | true | false | high |
Name | Source | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|
false | high |
⊘No contacted IP infos
⊘No context
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
daisy.ubuntu.com | Get hash | malicious | Unknown | Browse |
| |
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Mirai, Gafgyt, Moobot, Okiru | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Unknown | Browse |
|
⊘No context
⊘No context
⊘No context
⊘No created / dropped files found
File type: | |
Entropy (8bit): | 7.982158041250768 |
TrID: |
|
File name: | .5r3fqt67ew531has4231.arm6.elf |
File size: | 60'976 bytes |
MD5: | 0a6816481665367226412568e3a74364 |
SHA1: | 4f88568c98df82482e4d3605f9dd6c5ed6b390a4 |
SHA256: | c24e8a9aeb41a70eed99e131197172097111d45aed7b3e240ea67bf576f55f3f |
SHA512: | 53735d4e55c789e4692591051a180a0171e8f8b39b54431531f79d5b1bb00161efc60f01b37db2efbdf67cec17717488786e33c9f93e5b1e4e37cf700a96bb9f |
SSDEEP: | 1536:MAjZQzMl21+xQ3AgYVzHzQC0vckdwfFiuC:MekA++FVvy6fQ/ |
TLSH: | 2C53F2A20E0AF0BBE6D50AFCE4109340B1792D768FDF3013E51B1ADA6BB1B4575E149B |
File Content Preview: | .ELF..............(......Z..4...........4. ...(..........................................................[..........Q.td............................x.?.UPX!....................S..........?.E.h;....#..$..1).......*|i.V..i...im.}.2.....3X .p..9s.a.9d..+.BFa |
ELF header | |
---|---|
Class: | |
Data: | |
Version: | |
Machine: | |
Version Number: | |
Type: | |
OS/ABI: | |
ABI Version: | 0 |
Entry Point Address: | |
Flags: | |
ELF Header Size: | 52 |
Program Header Offset: | 52 |
Program Header Size: | 32 |
Number of Program Headers: | 3 |
Section Header Offset: | 0 |
Section Header Size: | 40 |
Number of Section Headers: | 0 |
Header String Table Index: | 0 |
Type | Offset | Virtual Address | Physical Address | File Size | Memory Size | Entropy | Flags | Flags Description | Align | Prog Interpreter | Section Mappings |
---|---|---|---|---|---|---|---|---|---|---|---|
LOAD | 0x0 | 0x8000 | 0x8000 | 0xecef | 0xecef | 7.9833 | 0x5 | R E | 0x8000 | ||
LOAD | 0x0 | 0x18000 | 0x18000 | 0x0 | 0x25be4 | 0.0000 | 0x6 | RW | 0x8000 | ||
GNU_STACK | 0x0 | 0x0 | 0x0 | 0x0 | 0x0 | 0.0000 | 0x7 | RWE | 0x4 |
Download Network PCAP: filtered – full
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Mar 20, 2025 12:51:04.057399988 CET | 34800 | 53 | 192.168.2.13 | 8.8.8.8 |
Mar 20, 2025 12:51:04.146599054 CET | 53 | 34800 | 8.8.8.8 | 192.168.2.13 |
Mar 20, 2025 12:51:04.146825075 CET | 34800 | 53 | 192.168.2.13 | 8.8.8.8 |
Mar 20, 2025 12:51:04.146826029 CET | 34800 | 53 | 192.168.2.13 | 8.8.8.8 |
Mar 20, 2025 12:51:04.146826029 CET | 34800 | 53 | 192.168.2.13 | 8.8.8.8 |
Mar 20, 2025 12:51:04.236100912 CET | 53 | 34800 | 8.8.8.8 | 192.168.2.13 |
Mar 20, 2025 12:51:04.236120939 CET | 53 | 34800 | 8.8.8.8 | 192.168.2.13 |
Mar 20, 2025 12:51:04.236131907 CET | 53 | 34800 | 8.8.8.8 | 192.168.2.13 |
Mar 20, 2025 12:51:04.236140966 CET | 53 | 34800 | 8.8.8.8 | 192.168.2.13 |
Mar 20, 2025 12:51:04.236304045 CET | 34800 | 53 | 192.168.2.13 | 8.8.8.8 |
Mar 20, 2025 12:51:04.236304045 CET | 34800 | 53 | 192.168.2.13 | 8.8.8.8 |
Mar 20, 2025 12:51:06.236530066 CET | 53 | 34800 | 8.8.8.8 | 192.168.2.13 |
Mar 20, 2025 12:51:06.236785889 CET | 34800 | 53 | 192.168.2.13 | 8.8.8.8 |
Mar 20, 2025 12:51:06.326262951 CET | 53 | 34800 | 8.8.8.8 | 192.168.2.13 |
Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
---|---|---|---|---|---|---|---|---|
Mar 20, 2025 12:51:04.146826029 CET | 192.168.2.13 | 8.8.8.8 | 0xd399 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Mar 20, 2025 12:51:04.146826029 CET | 192.168.2.13 | 8.8.8.8 | 0xbfdb | Standard query (0) | 28 | IN (0x0001) | false |
Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
---|---|---|---|---|---|---|---|---|---|---|
Mar 20, 2025 12:51:04.236131907 CET | 8.8.8.8 | 192.168.2.13 | 0xd399 | No error (0) | 162.213.35.24 | A (IP address) | IN (0x0001) | false | ||
Mar 20, 2025 12:51:04.236131907 CET | 8.8.8.8 | 192.168.2.13 | 0xd399 | No error (0) | 162.213.35.25 | A (IP address) | IN (0x0001) | false |
System Behavior
Start time (UTC): | 11:51:02 |
Start date (UTC): | 20/03/2025 |
Path: | /tmp/.5r3fqt67ew531has4231.arm6.elf |
Arguments: | /tmp/.5r3fqt67ew531has4231.arm6.elf |
File size: | 4956856 bytes |
MD5 hash: | 5ebfcae4fe2471fcc5695c2394773ff1 |
Start time (UTC): | 11:51:41 |
Start date (UTC): | 20/03/2025 |
Path: | /usr/lib/systemd/systemd |
Arguments: | - |
File size: | 1620224 bytes |
MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
Start time (UTC): | 11:51:41 |
Start date (UTC): | 20/03/2025 |
Path: | /usr/lib/snapd/snap-failure |
Arguments: | /usr/lib/snapd/snap-failure snapd |
File size: | 4764904 bytes |
MD5 hash: | 69136a7d575731ce62349f2e4d3e5c36 |
Start time (UTC): | 11:51:42 |
Start date (UTC): | 20/03/2025 |
Path: | /usr/lib/snapd/snap-failure |
Arguments: | - |
File size: | 4764904 bytes |
MD5 hash: | 69136a7d575731ce62349f2e4d3e5c36 |
Start time (UTC): | 11:51:42 |
Start date (UTC): | 20/03/2025 |
Path: | /usr/bin/systemctl |
Arguments: | systemctl stop snapd.socket |
File size: | 996584 bytes |
MD5 hash: | 4deddfb6741481f68aeac522cc26ff4b |
Start time (UTC): | 11:51:43 |
Start date (UTC): | 20/03/2025 |
Path: | /usr/lib/snapd/snap-failure |
Arguments: | - |
File size: | 4764904 bytes |
MD5 hash: | 69136a7d575731ce62349f2e4d3e5c36 |