Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
i486.elf

Overview

General Information

Sample name:i486.elf
Analysis ID:1646135
MD5:3f68612e145ef42a8fae216f1ded4e39
SHA1:b77d1ec443425df5e40e8c256e783d258115d676
SHA256:d91e6bbb3282f66f36a345fe9e1f4e1d6f295a1113fa81b457ab8a31ca3dc4f7
Tags:elfuser-abuse_ch
Infos:

Detection

Score:68
Range:0 - 100

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Sample deletes itself
Sample is packed with UPX
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Sample contains only a LOAD segment without any section mappings
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1646135
Start date and time:2025-03-23 12:16:22 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 29s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:i486.elf
Detection:MAL
Classification:mal68.troj.evad.linELF@0/0@0/0

Runtime Messages

Command:/tmp/i486.elf
PID:5553
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Obliterate You
Standard Error:

Process Tree

  • system is lnxubuntu20
  • i486.elf (PID: 5553, Parent: 5470, MD5: 3f68612e145ef42a8fae216f1ded4e39) Arguments: /tmp/i486.elf
    • i486.elf New Fork (PID: 5554, Parent: 5553)
      • i486.elf New Fork (PID: 5555, Parent: 5554)
        • i486.elf New Fork (PID: 5556, Parent: 5555)
  • cleanup

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
5553.1.0000000008048000.0000000008056000.r-x.sdmpLinux_Trojan_Mirai_3a56423bunknownunknown
  • 0x84ab:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
5553.1.0000000008048000.0000000008056000.r-x.sdmpLinux_Trojan_Mirai_6e8e9257unknownunknown
  • 0x632:$a: 53 83 EC 04 8B 5C 24 18 8B 7C 24 20 8A 44 24 14 8A 54 24 1C 88 54
  • 0x6a2:$a: 53 83 EC 04 8B 5C 24 18 8B 7C 24 20 8A 44 24 14 8A 54 24 1C 88 54
5553.1.0000000008048000.0000000008056000.r-x.sdmpLinux_Trojan_Mirai_dab39a25unknownunknown
  • 0x6c36:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

  • • AV Detection
  • • Networking
  • • System Summary
  • • Data Obfuscation
  • • Hooking and other Techniques for Hiding and Protection

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: i486.elfReversingLabs: Detection: 36%

Networking

barindex
Source: global trafficTCP traffic: 198.98.51.68 ports 1,2,3,4,5,23451
Source: global trafficTCP traffic: 192.168.2.15:38590 -> 198.98.51.68:23451
Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
Source: i486.elfString found in binary or memory: http://upx.sf.net

System Summary

barindex
Source: 5553.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 5553.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_6e8e9257 Author: unknown
Source: 5553.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: LOAD without section mappingsProgram segment: 0xc01000
Source: 5553.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 5553.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_6e8e9257 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4bad14aebb0b8c7aa414f38866baaf1f4b350b2026735de24bcf2014ff4b0a6a, id = 6e8e9257-a6d5-407a-a584-4656816a3ddc, last_modified = 2021-09-16
Source: 5553.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: classification engineClassification label: mal68.troj.evad.linELF@0/0@0/0

Data Obfuscation

barindex
Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Hooking and other Techniques for Hiding and Protection

barindex
Source: /tmp/i486.elf (PID: 5553)File: /tmp/i486.elfJump to behavior
Source: i486.elfSubmission file: segment LOAD with 7.8894 entropy (max. 8.0)

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception11
Obfuscated Files or Information		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Non-Standard Port		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
File Deletion		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1646135 Sample: i486.elf Startdate: 23/03/2025 Architecture: LINUX Score: 68 18 198.98.51.68, 23451, 38590 PONYNETUS United States 2->18 20 Malicious sample detected (through community Yara rule) 2->20 22 Multi AV Scanner detection for submitted file 2->22 24 Connects to many ports of the same IP (likely port scanning) 2->24 26 Sample is packed with UPX 2->26 9 i486.elf 2->9         started        signatures3 process4 signatures5 28 Sample deletes itself 9->28 12 i486.elf 9->12         started        process6 process7 14 i486.elf 12->14         started        process8 16 i486.elf 14->16         started       

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
i486.elf36%ReversingLabsLinux.Backdoor.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
http://upx.sf.neti486.elffalse
    		high

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    198.98.51.68
    		unknownUnited States
    		53667PONYNETUStrue

    Joe Sandbox View / Context

    IPs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    198.98.51.68arm7.elfGet hashmaliciousMiraiBrowse
      x86_64.elfGet hashmaliciousMiraiBrowse

        Domains

        ⊘No context

        ASNs

        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        PONYNETUSarm7.elfGet hashmaliciousMiraiBrowse
        • 198.98.51.68
        x86_64.elfGet hashmaliciousMiraiBrowse
        • 198.98.51.68
        boatnet.ppc.elfGet hashmaliciousMiraiBrowse
        • 209.141.40.172
        boatnet.m68k.elfGet hashmaliciousMiraiBrowse
        • 209.141.40.172
        boatnet.arm7.elfGet hashmaliciousMiraiBrowse
        • 209.141.40.172
        boatnet.mips.elfGet hashmaliciousMiraiBrowse
        • 209.141.40.172
        boatnet.x86.elfGet hashmaliciousMiraiBrowse
        • 209.141.40.172
        boatnet.sh4.elfGet hashmaliciousMiraiBrowse
        • 209.141.40.172
        boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
        • 209.141.40.172
        boatnet.arm.elfGet hashmaliciousMiraiBrowse
        • 209.141.40.172

        JA3 Fingerprints

        ⊘No context

        Dropped Files

        ⊘No context

        Created / dropped Files

        ⊘No created / dropped files found

        Static File Info

        General

        File type:ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
        Entropy (8bit):7.884949616555641
        TrID:
        • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
        • ELF Executable and Linkable format (generic) (4004/1) 49.84%
        File name:i486.elf
        File size:29'384 bytes
        MD5:3f68612e145ef42a8fae216f1ded4e39
        SHA1:b77d1ec443425df5e40e8c256e783d258115d676
        SHA256:d91e6bbb3282f66f36a345fe9e1f4e1d6f295a1113fa81b457ab8a31ca3dc4f7
        SHA512:930a9b56dfa284908921a7496d9fb83c17ccccc250cf81a9ad05c35f61a5d11ef63ff605321666edae1147c06ef5a640010305ff11b2ea6f6ed60f55a08b16de
        SSDEEP:768:GAMkl2mywTPbo69Hq4x9u2yyIqSyyQbNO4KCXL:925wTPE4TyXryzlKC7
        TLSH:9CD2028B60CF42CADAD4C237D8CF15DE5BA27A70579C976367306453CA8F058E1ACD14
        File Content Preview:.ELF.....................y..4...........4. ...(......................q...q..............H...Hm..Hm..................Q.td...............................4UPX!...................._........?d..ELF.......d.......4....4. (.......k.-.#.8......sw....t..`..@....A.

        Static ELF Info

        ELF header

        Class:ELF32
        Data:2's complement, little endian
        Version:1 (current)
        Machine:Intel 80386
        Version Number:0x1
        Type:EXEC (Executable file)
        OS/ABI:UNIX - Linux
        ABI Version:0
        Entry Point Address:0xc079e0
        Flags:0x0
        ELF Header Size:52
        Program Header Offset:52
        Program Header Size:32
        Number of Program Headers:3
        Section Header Offset:0
        Section Header Size:40
        Number of Section Headers:0
        Header String Table Index:0

        Program Segments

        TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
        LOAD0x00xc010000xc010000x71c30x71c37.88940x5R E0x1000
        LOAD0xd480x8056d480x8056d480x00x00.00000x6RW 0x1000
        GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

        Network Behavior

        Download Network PCAP: filtered – full

        TimestampSource PortDest PortSource IPDest IP
        Mar 23, 2025 12:17:16.882164955 CET3859023451192.168.2.15198.98.51.68
        Mar 23, 2025 12:17:16.972043037 CET2345138590198.98.51.68192.168.2.15
        Mar 23, 2025 12:17:16.972126007 CET3859023451192.168.2.15198.98.51.68
        Mar 23, 2025 12:17:16.972168922 CET3859023451192.168.2.15198.98.51.68
        Mar 23, 2025 12:17:17.064136028 CET2345138590198.98.51.68192.168.2.15
        Mar 23, 2025 12:17:17.064210892 CET3859023451192.168.2.15198.98.51.68
        Mar 23, 2025 12:17:17.154001951 CET2345138590198.98.51.68192.168.2.15
        Mar 23, 2025 12:17:26.978599072 CET3859023451192.168.2.15198.98.51.68
        Mar 23, 2025 12:17:27.068337917 CET2345138590198.98.51.68192.168.2.15
        Mar 23, 2025 12:17:27.068391085 CET2345138590198.98.51.68192.168.2.15
        Mar 23, 2025 12:17:27.068438053 CET3859023451192.168.2.15198.98.51.68
        Mar 23, 2025 12:17:42.193872929 CET2345138590198.98.51.68192.168.2.15
        Mar 23, 2025 12:17:42.193974018 CET3859023451192.168.2.15198.98.51.68
        Mar 23, 2025 12:17:57.283355951 CET2345138590198.98.51.68192.168.2.15
        Mar 23, 2025 12:17:57.283690929 CET3859023451192.168.2.15198.98.51.68
        Mar 23, 2025 12:18:12.373177052 CET2345138590198.98.51.68192.168.2.15
        Mar 23, 2025 12:18:12.373752117 CET3859023451192.168.2.15198.98.51.68
        Mar 23, 2025 12:18:27.117918015 CET3859023451192.168.2.15198.98.51.68
        Mar 23, 2025 12:18:27.208148003 CET2345138590198.98.51.68192.168.2.15
        Mar 23, 2025 12:18:27.208271027 CET3859023451192.168.2.15198.98.51.68
        Mar 23, 2025 12:18:42.353029966 CET2345138590198.98.51.68192.168.2.15
        Mar 23, 2025 12:18:42.353163004 CET3859023451192.168.2.15198.98.51.68
        Mar 23, 2025 12:18:57.442672968 CET2345138590198.98.51.68192.168.2.15
        Mar 23, 2025 12:18:57.443048000 CET3859023451192.168.2.15198.98.51.68
        Mar 23, 2025 12:19:12.533006907 CET2345138590198.98.51.68192.168.2.15
        Mar 23, 2025 12:19:12.533468008 CET3859023451192.168.2.15198.98.51.68

        System Behavior

        General

        Start time (UTC):11:17:15
        Start date (UTC):23/03/2025
        Path:/tmp/i486.elf
        Arguments:/tmp/i486.elf
        File size:29384 bytes
        MD5 hash:3f68612e145ef42a8fae216f1ded4e39

        File Activities

        Process Activities


        General

        Start time (UTC):11:17:15
        Start date (UTC):23/03/2025
        Path:/tmp/i486.elf
        Arguments:-
        File size:29384 bytes
        MD5 hash:3f68612e145ef42a8fae216f1ded4e39

        Process Activities


        General

        Start time (UTC):11:17:15
        Start date (UTC):23/03/2025
        Path:/tmp/i486.elf
        Arguments:-
        File size:29384 bytes
        MD5 hash:3f68612e145ef42a8fae216f1ded4e39

        File Activities

        Process Activities


        General

        Start time (UTC):11:17:15
        Start date (UTC):23/03/2025
        Path:/tmp/i486.elf
        Arguments:-
        File size:29384 bytes
        MD5 hash:3f68612e145ef42a8fae216f1ded4e39

        File Activities

        Process Activities