Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
miner.elf

Overview

General Information

Sample name:miner.elf
Analysis ID:1644315
MD5:72fe04a71bc2a1c7a7802a6555628aca
SHA1:029c01092e1fd3389fff69a181c2c1e4390c8849
SHA256:ba8200de3f3c001c4f00302adcbde152002e59a3cabb55c958955c6d14e16051
Tags:elfuser-abuse_ch
Infos:

Detection

Score:48
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
ELF contains segments with high entropy indicating compressed/encrypted content
Executes the "rm" command used to delete files or directories
Sample contains only a LOAD segment without any section mappings

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1644315
Start date and time:2025-03-20 14:26:48 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 16s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:miner.elf
Detection:MAL
Classification:mal48.linELF@0/0@2/0

Runtime Messages

Command:/tmp/miner.elf
PID:5521
Exit Code:135
Exit Code Info:
Killed:False
Standard Output:

Standard Error:

Process Tree

  • system is lnxubuntu20
  • miner.elf (PID: 5521, Parent: 5443, MD5: 72fe04a71bc2a1c7a7802a6555628aca) Arguments: /tmp/miner.elf
  • dash New Fork (PID: 5593, Parent: 3670)
  • rm (PID: 5593, Parent: 3670, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.kU5cCdfJTn /tmp/tmp.kjti3fnvm6 /tmp/tmp.atZnQgckWQ
  • dash New Fork (PID: 5594, Parent: 3670)
  • rm (PID: 5594, Parent: 3670, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.kU5cCdfJTn /tmp/tmp.kjti3fnvm6 /tmp/tmp.atZnQgckWQ
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

  • • AV Detection
  • • Networking
  • • System Summary
  • • Persistence and Installation Behavior
  • • Hooking and other Techniques for Hiding and Protection

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: miner.elfVirustotal: Detection: 15%Perma Link
Source: miner.elfReversingLabs: Detection: 19%
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
Source: unknownNetwork traffic detected: HTTP traffic on port 44522 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 44522
Source: LOAD without section mappingsProgram segment: 0x400000
Source: classification engineClassification label: mal48.linELF@0/0@2/0
Source: /usr/bin/dash (PID: 5593)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.kU5cCdfJTn /tmp/tmp.kjti3fnvm6 /tmp/tmp.atZnQgckWQJump to behavior
Source: /usr/bin/dash (PID: 5594)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.kU5cCdfJTn /tmp/tmp.kjti3fnvm6 /tmp/tmp.atZnQgckWQJump to behavior
Source: miner.elfSubmission file: segment LOAD with 7.9998 entropy (max. 8.0)

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
Obfuscated Files or Information		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
File Deletion		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1644315 Sample: miner.elf Startdate: 20/03/2025 Architecture: LINUX Score: 48 12 34.254.182.186, 443, 44522 AMAZON-02US United States 2->12 14 daisy.ubuntu.com 2->14 16 Multi AV Scanner detection for submitted file 2->16 6 dash rm 2->6         started        8 dash rm 2->8         started        10 miner.elf 2->10         started        signatures3 process4

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
miner.elf16%VirustotalBrowse
miner.elf19%ReversingLabsLinux.Trojan.Multiverze

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
daisy.ubuntu.com
162.213.35.25
truefalse
    		high

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    34.254.182.186
    		unknownUnited States
    		16509AMAZON-02USfalse

    Joe Sandbox View / Context

    IPs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    34.254.182.186na.elfGet hashmaliciousPrometeiBrowse
      Space.arm5.elfGet hashmaliciousUnknownBrowse
        arm.elfGet hashmaliciousUnknownBrowse
          bot.arm6.elfGet hashmaliciousUnknownBrowse
            hiss.arm7.elfGet hashmaliciousUnknownBrowse
              resgod.mpsl.elfGet hashmaliciousMiraiBrowse
                resgod.arm7.elfGet hashmaliciousMiraiBrowse
                  .i.elfGet hashmaliciousUnknownBrowse
                    x-8.6-.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                      8893Xmi39S.arm5.elfGet hashmaliciousUnknownBrowse

                        Domains

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        daisy.ubuntu.comarm5.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.24
                        hoho.m68k.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.24
                        hoho.mipsel.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.25
                        hoho.armv7l.elfGet hashmaliciousMiraiBrowse
                        • 162.213.35.24
                        miner.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.24
                        hoho.i586.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.24
                        hoho.i686.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.24
                        sshd.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.24
                        Space.spc.elfGet hashmaliciousMiraiBrowse
                        • 162.213.35.25
                        Nyx4r.arm6.elfGet hashmaliciousOkiruBrowse
                        • 162.213.35.24

                        ASNs

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        AMAZON-02UShttps://protect2.fireeye.com/v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdheb.htmlGet hashmaliciousHTMLPhisherBrowse
                        • 108.138.106.48
                        arm5.elfGet hashmaliciousUnknownBrowse
                        • 54.171.230.55
                        hoho.x86.elfGet hashmaliciousUnknownBrowse
                        • 54.119.141.49
                        na.elfGet hashmaliciousPrometeiBrowse
                        • 54.255.164.76
                        hoho.armv4l.elfGet hashmaliciousUnknownBrowse
                        • 35.157.3.245
                        hoho.armv6l.elfGet hashmaliciousUnknownBrowse
                        • 34.249.145.219
                        na.elfGet hashmaliciousPrometeiBrowse
                        • 34.243.160.129
                        miner.elfGet hashmaliciousUnknownBrowse
                        • 34.243.160.129
                        hoho.powerpc.elfGet hashmaliciousUnknownBrowse
                        • 54.171.230.55
                        hoho.sparc.elfGet hashmaliciousUnknownBrowse
                        • 52.35.74.180

                        JA3 Fingerprints

                        ⊘No context

                        Dropped Files

                        ⊘No context

                        Created / dropped Files

                        ⊘No created / dropped files found

                        Static File Info

                        General

                        File type:ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, no section header
                        Entropy (8bit):7.999767598908993
                        TrID:
                        • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                        File name:miner.elf
                        File size:849'467 bytes
                        MD5:72fe04a71bc2a1c7a7802a6555628aca
                        SHA1:029c01092e1fd3389fff69a181c2c1e4390c8849
                        SHA256:ba8200de3f3c001c4f00302adcbde152002e59a3cabb55c958955c6d14e16051
                        SHA512:706923b8c4380e3c9b453226f7ae92370990621e269831ac31be1ee24479794900912cdf8ce76e4cb3a9549c391f062032ac544898bed6830fed337877e236c7
                        SSDEEP:24576:PvswhZT3/QJLfl1X+Q47tv7T6inGEDOdiru3eSlP:njEflQ/573nydbeOP
                        TLSH:3A05339E20F724BBD5700B746AFD4843D69E2074CE2E1F459C75E81CBD82B46A3298DE
                        File Content Preview:.ELF..............>.......[.....@...................@.8...@.......................@.......@....................... .............`.......`.......`......................... .....)]..UPX!L.........K...K.X...k..........?.E.h=.......N......e...U.....bo.G...y..

                        Static ELF Info

                        ELF header

                        Class:ELF64
                        Data:2's complement, little endian
                        Version:1 (current)
                        Machine:Advanced Micro Devices X86-64
                        Version Number:0x1
                        Type:EXEC (Executable file)
                        OS/ABI:UNIX - Linux
                        ABI Version:0
                        Entry Point Address:0x5bd090
                        Flags:0x0
                        ELF Header Size:64
                        Program Header Offset:64
                        Program Header Size:56
                        Number of Program Headers:2
                        Section Header Offset:0
                        Section Header Size:64
                        Number of Section Headers:0
                        Header String Table Index:0

                        Program Segments

                        TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                        LOAD0x00x4000000x4000000x1be1cd0x1be1cd7.99980x5R E0x200000
                        LOAD0xcfb600xacfb600xacfb600x00x00.00000x6RW 0x200000

                        Network Behavior

                        Download Network PCAP: filtered – full

                        Network Port Distribution

                        • Total Packets: 4
                        • • 443 (HTTPS)
                        • • 53 (DNS)
                        TimestampSource PortDest PortSource IPDest IP
                        Mar 20, 2025 14:27:40.939459085 CET44522443192.168.2.1534.254.182.186
                        Mar 20, 2025 14:28:02.724086046 CET44522443192.168.2.1534.254.182.186
                        Mar 20, 2025 14:28:02.905014992 CET4434452234.254.182.186192.168.2.15
                        TimestampSource PortDest PortSource IPDest IP
                        Mar 20, 2025 14:27:28.509907961 CET4954253192.168.2.151.1.1.1
                        Mar 20, 2025 14:27:28.510040045 CET5753553192.168.2.151.1.1.1
                        Mar 20, 2025 14:27:28.609333038 CET53575351.1.1.1192.168.2.15
                        Mar 20, 2025 14:27:28.609385014 CET53495421.1.1.1192.168.2.15

                        DNS Queries

                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                        Mar 20, 2025 14:27:28.509907961 CET192.168.2.151.1.1.10x8262Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                        Mar 20, 2025 14:27:28.510040045 CET192.168.2.151.1.1.10xf1ccStandard query (0)daisy.ubuntu.com28IN (0x0001)false

                        DNS Answers

                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                        Mar 20, 2025 14:27:28.609385014 CET1.1.1.1192.168.2.150x8262No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
                        Mar 20, 2025 14:27:28.609385014 CET1.1.1.1192.168.2.150x8262No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

                        System Behavior

                        General

                        Start time (UTC):13:27:27
                        Start date (UTC):20/03/2025
                        Path:/tmp/miner.elf
                        Arguments:/tmp/miner.elf
                        File size:849467 bytes
                        MD5 hash:72fe04a71bc2a1c7a7802a6555628aca

                        General

                        Start time (UTC):13:28:01
                        Start date (UTC):20/03/2025
                        Path:/usr/bin/dash
                        Arguments:-
                        File size:129816 bytes
                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                        Process Activities


                        General

                        Start time (UTC):13:28:01
                        Start date (UTC):20/03/2025
                        Path:/usr/bin/rm
                        Arguments:rm -f /tmp/tmp.kU5cCdfJTn /tmp/tmp.kjti3fnvm6 /tmp/tmp.atZnQgckWQ
                        File size:72056 bytes
                        MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                        File Activities


                        General

                        Start time (UTC):13:28:01
                        Start date (UTC):20/03/2025
                        Path:/usr/bin/dash
                        Arguments:-
                        File size:129816 bytes
                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                        Process Activities


                        General

                        Start time (UTC):13:28:01
                        Start date (UTC):20/03/2025
                        Path:/usr/bin/rm
                        Arguments:rm -f /tmp/tmp.kU5cCdfJTn /tmp/tmp.kjti3fnvm6 /tmp/tmp.atZnQgckWQ
                        File size:72056 bytes
                        MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                        File Activities