Edit tour

Linux Analysis Report
m68k.elf

Overview

General Information

Sample name:m68k.elf
Analysis ID:1646214
MD5:e6162adecea289010f1a5d76561dda5f
SHA1:ac905b3238ef7033f1edcd0b9f4354563e763718
SHA256:c50ae8cce82d9e1eb9f5a0993f852915a489848d8529118c2b972fe9f55e58df
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:64
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Yara detected Mirai
Connects to many ports of the same IP (likely port scanning)
Sample deletes itself
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1646214
Start date and time:2025-03-23 17:07:15 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 36s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:m68k.elf
Detection:MAL
Classification:mal64.troj.evad.linELF@0/0@2/0
Command:/tmp/m68k.elf
PID:5505
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Obliterate You
Standard Error:
  • system is lnxubuntu20
  • m68k.elf (PID: 5505, Parent: 5428, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/m68k.elf
    • m68k.elf New Fork (PID: 5508, Parent: 5505)
      • m68k.elf New Fork (PID: 5510, Parent: 5508)
        • m68k.elf New Fork (PID: 5512, Parent: 5510)
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
m68k.elfJoeSecurity_Mirai_9Yara detected MiraiJoe Security
    SourceRuleDescriptionAuthorStrings
    5505.1.00007f624c001000.00007f624c011000.r-x.sdmpJoeSecurity_Mirai_9Yara detected MiraiJoe Security
      5512.1.00007f624c001000.00007f624c011000.r-x.sdmpJoeSecurity_Mirai_9Yara detected MiraiJoe Security
        5510.1.00007f624c001000.00007f624c011000.r-x.sdmpJoeSecurity_Mirai_9Yara detected MiraiJoe Security
          No Suricata rule has matched

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Source: m68k.elfVirustotal: Detection: 39%Perma Link
          Source: m68k.elfReversingLabs: Detection: 52%

          Networking

          barindex
          Source: global trafficTCP traffic: 198.98.51.68 ports 1,2,3,4,5,23451
          Source: global trafficTCP traffic: 192.168.2.14:60122 -> 198.98.51.68:23451
          Source: /tmp/m68k.elf (PID: 5505)Socket: 127.0.0.1:23451Jump to behavior
          Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
          Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
          Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
          Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
          Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
          Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
          Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
          Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
          Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
          Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
          Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
          Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
          Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
          Source: unknownTCP traffic detected without corresponding DNS query: 198.98.51.68
          Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
          Source: ELF static info symbol of initial sample.symtab present: no
          Source: classification engineClassification label: mal64.troj.evad.linELF@0/0@2/0

          Hooking and other Techniques for Hiding and Protection

          barindex
          Source: /tmp/m68k.elf (PID: 5505)File: /tmp/m68k.elfJump to behavior
          Source: /tmp/m68k.elf (PID: 5505)Queries kernel information via 'uname': Jump to behavior
          Source: m68k.elf, 5512.1.000055ac8bc5d000.000055ac8bcc1000.rw-.sdmpBinary or memory string: U!/sbin/mount.vmhgfs
          Source: m68k.elf, 5512.1.000055ac8bc5d000.000055ac8bcc1000.rw-.sdmpBinary or memory string: /sbin/mount.vmhgfs
          Source: m68k.elf, 5505.1.000055ac8bc5d000.000055ac8bce2000.rw-.sdmp, m68k.elf, 5510.1.000055ac8bc5d000.000055ac8bcc1000.rw-.sdmp, m68k.elf, 5512.1.000055ac8bc5d000.000055ac8bcc1000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/m68k
          Source: m68k.elf, 5505.1.00007ffed0c5f000.00007ffed0c80000.rw-.sdmp, m68k.elf, 5510.1.00007ffed0c5f000.00007ffed0c80000.rw-.sdmp, m68k.elf, 5512.1.00007ffed0c5f000.00007ffed0c80000.rw-.sdmpBinary or memory string: /usr/bin/qemu-m68k
          Source: m68k.elf, 5505.1.000055ac8bc5d000.000055ac8bce2000.rw-.sdmp, m68k.elf, 5510.1.000055ac8bc5d000.000055ac8bcc1000.rw-.sdmp, m68k.elf, 5512.1.000055ac8bc5d000.000055ac8bcc1000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/m68k
          Source: m68k.elf, 5510.1.00007ffed0c5f000.00007ffed0c80000.rw-.sdmp, m68k.elf, 5512.1.00007ffed0c5f000.00007ffed0c80000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
          Source: m68k.elf, 5505.1.00007ffed0c5f000.00007ffed0c80000.rw-.sdmp, m68k.elf, 5510.1.00007ffed0c5f000.00007ffed0c80000.rw-.sdmp, m68k.elf, 5512.1.00007ffed0c5f000.00007ffed0c80000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-m68k/tmp/m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/m68k.elf

          Stealing of Sensitive Information

          barindex
          Source: Yara matchFile source: m68k.elf, type: SAMPLE
          Source: Yara matchFile source: 5505.1.00007f624c001000.00007f624c011000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 5512.1.00007f624c001000.00007f624c011000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 5510.1.00007f624c001000.00007f624c011000.r-x.sdmp, type: MEMORY

          Remote Access Functionality

          barindex
          Source: Yara matchFile source: m68k.elf, type: SAMPLE
          Source: Yara matchFile source: 5505.1.00007f624c001000.00007f624c011000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 5512.1.00007f624c001000.00007f624c011000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 5510.1.00007f624c001000.00007f624c011000.r-x.sdmp, type: MEMORY
          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
          File Deletion
          OS Credential Dumping11
          Security Software Discovery
          Remote ServicesData from Local System1
          Non-Standard Port
          Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
          Non-Application Layer Protocol
          Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
          Application Layer Protocol
          Automated ExfiltrationData Encrypted for Impact
          No configs have been found
          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Number of created Files
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1646214 Sample: m68k.elf Startdate: 23/03/2025 Architecture: LINUX Score: 64 18 198.98.51.68, 23451, 60122 PONYNETUS United States 2->18 20 daisy.ubuntu.com 2->20 22 Multi AV Scanner detection for submitted file 2->22 24 Yara detected Mirai 2->24 26 Connects to many ports of the same IP (likely port scanning) 2->26 9 m68k.elf 2->9         started        signatures3 process4 signatures5 28 Sample deletes itself 9->28 12 m68k.elf 9->12         started        process6 process7 14 m68k.elf 12->14         started        process8 16 m68k.elf 14->16         started       

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand
          SourceDetectionScannerLabelLink
          m68k.elf39%VirustotalBrowse
          m68k.elf53%ReversingLabsLinux.Trojan.Mirai
          No Antivirus matches
          No Antivirus matches
          No Antivirus matches

          Download Network PCAP: filteredfull

          NameIPActiveMaliciousAntivirus DetectionReputation
          daisy.ubuntu.com
          162.213.35.25
          truefalse
            high
            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs
            IPDomainCountryFlagASNASN NameMalicious
            198.98.51.68
            unknownUnited States
            53667PONYNETUStrue
            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            198.98.51.68arm.elfGet hashmaliciousMiraiBrowse
              x86.elfGet hashmaliciousMiraiBrowse
                mpsl.elfGet hashmaliciousMiraiBrowse
                  mips.elfGet hashmaliciousMiraiBrowse
                    i486.elfGet hashmaliciousUnknownBrowse
                      arm7.elfGet hashmaliciousMiraiBrowse
                        x86_64.elfGet hashmaliciousMiraiBrowse
                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          daisy.ubuntu.comsshd.elfGet hashmaliciousUnknownBrowse
                          • 162.213.35.25
                          morte.arm7.elfGet hashmaliciousOkiruBrowse
                          • 162.213.35.25
                          morte.sh4.elfGet hashmaliciousGafgyt, OkiruBrowse
                          • 162.213.35.24
                          morte.arm.elfGet hashmaliciousGafgyt, OkiruBrowse
                          • 162.213.35.24
                          morte.arm6.elfGet hashmaliciousGafgyt, OkiruBrowse
                          • 162.213.35.24
                          morte.m68k.elfGet hashmaliciousGafgyt, OkiruBrowse
                          • 162.213.35.25
                          sshd.elfGet hashmaliciousUnknownBrowse
                          • 162.213.35.25
                          arm6.elfGet hashmaliciousMiraiBrowse
                          • 162.213.35.24
                          .i.elfGet hashmaliciousUnknownBrowse
                          • 162.213.35.25
                          drea4.elfGet hashmaliciousUnknownBrowse
                          • 162.213.35.25
                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          PONYNETUSarm.elfGet hashmaliciousMiraiBrowse
                          • 198.98.51.68
                          x86.elfGet hashmaliciousMiraiBrowse
                          • 198.98.51.68
                          mpsl.elfGet hashmaliciousMiraiBrowse
                          • 198.98.51.68
                          mips.elfGet hashmaliciousMiraiBrowse
                          • 198.98.51.68
                          i486.elfGet hashmaliciousUnknownBrowse
                          • 198.98.51.68
                          arm7.elfGet hashmaliciousMiraiBrowse
                          • 198.98.51.68
                          x86_64.elfGet hashmaliciousMiraiBrowse
                          • 198.98.51.68
                          boatnet.ppc.elfGet hashmaliciousMiraiBrowse
                          • 209.141.40.172
                          boatnet.m68k.elfGet hashmaliciousMiraiBrowse
                          • 209.141.40.172
                          boatnet.arm7.elfGet hashmaliciousMiraiBrowse
                          • 209.141.40.172
                          No context
                          No context
                          No created / dropped files found
                          File type:ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
                          Entropy (8bit):6.207696205357797
                          TrID:
                          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                          File name:m68k.elf
                          File size:64'204 bytes
                          MD5:e6162adecea289010f1a5d76561dda5f
                          SHA1:ac905b3238ef7033f1edcd0b9f4354563e763718
                          SHA256:c50ae8cce82d9e1eb9f5a0993f852915a489848d8529118c2b972fe9f55e58df
                          SHA512:3e2b096d267651a8ebfc533591e16dfc571f83c0a560a6df9b3cc89964045bb0c03c6d44972569e922771f8204be0beed367a1071d44ea9ea06a88b969072fe7
                          SSDEEP:1536:U/wpMbilONinIER8H6piOn7h56o0QC6bQoUXes:U/waiO0nIEiDO7h538lXes
                          TLSH:6C532BEAB901DD7CF81BD77B4853050AF171B35545830F36639BBE6BAC721A84823E86
                          File Content Preview:.ELF.......................D...4...<.....4. ...(.................................. ....................d..*(...... .dt.Q............................NV..a....da.....N^NuNV..J9....f>"y.... QJ.g.X.#.....N."y.... QJ.f.A.....J.g.Hy....N.X.........N^NuNV..N^NuN

                          ELF header

                          Class:ELF32
                          Data:2's complement, big endian
                          Version:1 (current)
                          Machine:MC68000
                          Version Number:0x1
                          Type:EXEC (Executable file)
                          OS/ABI:UNIX - System V
                          ABI Version:0
                          Entry Point Address:0x80000144
                          Flags:0x0
                          ELF Header Size:52
                          Program Header Offset:52
                          Program Header Size:32
                          Number of Program Headers:3
                          Section Header Offset:63804
                          Section Header Size:40
                          Number of Section Headers:10
                          Header String Table Index:9
                          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                          NULL0x00x00x00x00x0000
                          .initPROGBITS0x800000940x940x140x00x6AX002
                          .textPROGBITS0x800000a80xa80xe3aa0x00x6AX004
                          .finiPROGBITS0x8000e4520xe4520xe0x00x6AX002
                          .rodataPROGBITS0x8000e4600xe4600x11340x00x2A002
                          .ctorsPROGBITS0x800115980xf5980x80x00x3WA004
                          .dtorsPROGBITS0x800115a00xf5a00x80x00x3WA004
                          .dataPROGBITS0x800115ac0xf5ac0x3500x00x3WA004
                          .bssNOBITS0x800118fc0xf8fc0x26c40x00x3WA004
                          .shstrtabSTRTAB0x00xf8fc0x3e0x00x0001
                          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                          LOAD0x00x800000000x800000000xf5940xf5946.24580x5R E0x2000.init .text .fini .rodata
                          LOAD0xf5980x800115980x800115980x3640x2a282.80140x6RW 0x2000.ctors .dtors .data .bss
                          GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

                          Download Network PCAP: filteredfull

                          • Total Packets: 16
                          • 23451 undefined
                          • 53 (DNS)
                          TimestampSource PortDest PortSource IPDest IP
                          Mar 23, 2025 17:08:00.773855925 CET6012223451192.168.2.14198.98.51.68
                          Mar 23, 2025 17:08:00.864339113 CET2345160122198.98.51.68192.168.2.14
                          Mar 23, 2025 17:08:00.864471912 CET6012223451192.168.2.14198.98.51.68
                          Mar 23, 2025 17:08:00.926796913 CET6012223451192.168.2.14198.98.51.68
                          Mar 23, 2025 17:08:01.017771006 CET2345160122198.98.51.68192.168.2.14
                          Mar 23, 2025 17:08:01.017827034 CET6012223451192.168.2.14198.98.51.68
                          Mar 23, 2025 17:08:01.108042955 CET2345160122198.98.51.68192.168.2.14
                          Mar 23, 2025 17:08:10.936681986 CET6012223451192.168.2.14198.98.51.68
                          Mar 23, 2025 17:08:11.027235031 CET2345160122198.98.51.68192.168.2.14
                          Mar 23, 2025 17:08:11.027333975 CET2345160122198.98.51.68192.168.2.14
                          Mar 23, 2025 17:08:11.027415991 CET6012223451192.168.2.14198.98.51.68
                          Mar 23, 2025 17:08:26.128655910 CET2345160122198.98.51.68192.168.2.14
                          Mar 23, 2025 17:08:26.128845930 CET6012223451192.168.2.14198.98.51.68
                          Mar 23, 2025 17:08:41.222502947 CET2345160122198.98.51.68192.168.2.14
                          Mar 23, 2025 17:08:41.222841978 CET6012223451192.168.2.14198.98.51.68
                          Mar 23, 2025 17:08:56.312505960 CET2345160122198.98.51.68192.168.2.14
                          Mar 23, 2025 17:08:56.312855005 CET6012223451192.168.2.14198.98.51.68
                          Mar 23, 2025 17:09:11.068221092 CET6012223451192.168.2.14198.98.51.68
                          Mar 23, 2025 17:09:11.159650087 CET2345160122198.98.51.68192.168.2.14
                          Mar 23, 2025 17:09:11.159905910 CET6012223451192.168.2.14198.98.51.68
                          Mar 23, 2025 17:09:26.256617069 CET2345160122198.98.51.68192.168.2.14
                          Mar 23, 2025 17:09:26.256751060 CET6012223451192.168.2.14198.98.51.68
                          Mar 23, 2025 17:09:41.346930981 CET2345160122198.98.51.68192.168.2.14
                          Mar 23, 2025 17:09:41.347106934 CET6012223451192.168.2.14198.98.51.68
                          Mar 23, 2025 17:09:56.439147949 CET2345160122198.98.51.68192.168.2.14
                          Mar 23, 2025 17:09:56.439409018 CET6012223451192.168.2.14198.98.51.68
                          TimestampSource PortDest PortSource IPDest IP
                          Mar 23, 2025 17:08:01.988605022 CET5266153192.168.2.148.8.8.8
                          Mar 23, 2025 17:08:01.988605022 CET5038253192.168.2.148.8.8.8
                          Mar 23, 2025 17:08:02.079062939 CET53526618.8.8.8192.168.2.14
                          Mar 23, 2025 17:08:02.079818964 CET53503828.8.8.8192.168.2.14
                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                          Mar 23, 2025 17:08:01.988605022 CET192.168.2.148.8.8.80x5c4cStandard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                          Mar 23, 2025 17:08:01.988605022 CET192.168.2.148.8.8.80xb982Standard query (0)daisy.ubuntu.com28IN (0x0001)false
                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                          Mar 23, 2025 17:08:02.079062939 CET8.8.8.8192.168.2.140x5c4cNo error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
                          Mar 23, 2025 17:08:02.079062939 CET8.8.8.8192.168.2.140x5c4cNo error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

                          System Behavior

                          Start time (UTC):16:07:59
                          Start date (UTC):23/03/2025
                          Path:/tmp/m68k.elf
                          Arguments:/tmp/m68k.elf
                          File size:4463432 bytes
                          MD5 hash:cd177594338c77b895ae27c33f8f86cc

                          Start time (UTC):16:07:59
                          Start date (UTC):23/03/2025
                          Path:/tmp/m68k.elf
                          Arguments:-
                          File size:4463432 bytes
                          MD5 hash:cd177594338c77b895ae27c33f8f86cc

                          Start time (UTC):16:07:59
                          Start date (UTC):23/03/2025
                          Path:/tmp/m68k.elf
                          Arguments:-
                          File size:4463432 bytes
                          MD5 hash:cd177594338c77b895ae27c33f8f86cc

                          Start time (UTC):16:08:00
                          Start date (UTC):23/03/2025
                          Path:/tmp/m68k.elf
                          Arguments:-
                          File size:4463432 bytes
                          MD5 hash:cd177594338c77b895ae27c33f8f86cc