Edit tour

Linux Analysis Report
ppc.elf

Overview

General Information

Sample name:ppc.elf
Analysis ID:1646536
MD5:79f3da4f719218bbcbcd072858b0ae12
SHA1:3e3328051bbcd5263534bc17930b954dee17f90a
SHA256:bcbdbefaa9b5a475217697939d1ba63dcccc654627ae72711fd8dc24195c99ca
Tags:elfuser-abuse_ch
Infos:

Detection

Score:52
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Sample reads /proc/mounts (often used for finding a writable filesystem)
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1646536
Start date and time:2025-03-24 05:16:07 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 16s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:ppc.elf
Detection:MAL
Classification:mal52.troj.linELF@0/3@0/0
Command:/tmp/ppc.elf
PID:6272
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
For God so loved the world
Standard Error:
  • system is lnxubuntu20
  • ppc.elf (PID: 6272, Parent: 6196, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/ppc.elf
    • ppc.elf New Fork (PID: 6277, Parent: 6272)
  • dash New Fork (PID: 6327, Parent: 4332)
  • rm (PID: 6327, Parent: 4332, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.1FysiLhQ07 /tmp/tmp.juM21P70QU /tmp/tmp.15A5Mebi67
  • dash New Fork (PID: 6328, Parent: 4332)
  • rm (PID: 6328, Parent: 4332, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.1FysiLhQ07 /tmp/tmp.juM21P70QU /tmp/tmp.15A5Mebi67
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: ppc.elfReversingLabs: Detection: 22%
Source: /tmp/ppc.elf (PID: 6277)Socket: 127.0.0.1:22448Jump to behavior
Source: global trafficTCP traffic: 192.168.2.23:39256 -> 34.249.145.219:443
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: ppc.elf, 6272.1.00007fa20002c000.00007fa200032000.rw-.sdmp, ppc.elf, 6277.1.00007fa20002c000.00007fa200032000.rw-.sdmpString found in binary or memory: https://motd.ubuntu.com
Source: ppc.elf, 6272.1.00007fa20002c000.00007fa200032000.rw-.sdmp, ppc.elf, 6277.1.00007fa20002c000.00007fa200032000.rw-.sdmpString found in binary or memory: https://motd.ubuntu.comhe
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 39256 -> 443
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal52.troj.linELF@0/3@0/0

Persistence and Installation Behavior

barindex
Source: /tmp/ppc.elf (PID: 6272)File: /proc/6272/mountsJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/1582/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/3088/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/230/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/110/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/231/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/111/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/232/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/1579/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/112/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/233/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/1699/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/113/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/234/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/1335/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/1698/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/114/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/235/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/1334/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/1576/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/2302/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/115/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/236/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/116/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/237/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/117/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/118/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/910/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/6227/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/119/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/912/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/6107/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/10/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/2307/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/11/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/918/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/12/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/13/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/14/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/15/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/6245/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/16/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/17/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/18/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/1594/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/120/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/121/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/1349/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/1/mapsJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/1/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/122/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/243/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/123/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/2/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/124/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/3/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/4/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/125/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/126/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/1344/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/1465/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/1586/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/127/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/6/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/248/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/128/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/249/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/1463/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/800/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/9/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/801/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/4735/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/20/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/21/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/1900/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/22/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/23/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/24/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/25/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/26/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/6256/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/27/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/28/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/6258/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/29/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/491/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/250/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/130/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/251/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/252/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/132/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/253/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/254/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/255/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/256/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/1599/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/257/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/1477/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/379/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/258/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/1476/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/259/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/1475/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/936/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/30/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 6272)File opened: /proc/2208/cmdlineJump to behavior
Source: /usr/bin/dash (PID: 6327)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.1FysiLhQ07 /tmp/tmp.juM21P70QU /tmp/tmp.15A5Mebi67Jump to behavior
Source: /usr/bin/dash (PID: 6328)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.1FysiLhQ07 /tmp/tmp.juM21P70QU /tmp/tmp.15A5Mebi67Jump to behavior
Source: /tmp/ppc.elf (PID: 6272)Queries kernel information via 'uname': Jump to behavior
Source: ppc.elf, 6272.1.00007fa20002c000.00007fa200032000.rw-.sdmp, ppc.elf, 6277.1.00007fa20002c000.00007fa200032000.rw-.sdmpBinary or memory string: !!a1gAWFxuAXsFWUgBRQAA!!a1gAWFxuAXsAWUgKRXgA!!a1gAWFxuAXsAWEgJR3IA!!a10CWFxuAHsGWVcWQHAA!!a10CWFxuAHsGWVcWQHUA!!aFwAWF9uA3sGW0gLRgAA!1aFwAWFlpG2QBW0gJTwAA1!qemu-arm2QBW0gJTwAA!
Source: ppc.elf, 6277.1.00007ffff130c000.00007ffff132d000.rw-.sdmpBinary or memory string: :DMPDIR%s/qemu-opSXPF
Source: ppc.elf, 6272.1.000055830e06a000.000055830e13b000.rw-.sdmp, ppc.elf, 6277.1.000055830e06a000.000055830e13b000.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc1
Source: ppc.elf, 6277.1.00007fa20002c000.00007fa200032000.rw-.sdmpBinary or memory string: vmware
Source: ppc.elf, 6272.1.00007ffff130c000.00007ffff132d000.rw-.sdmpBinary or memory string: /tmp/qemu-open.h4k3St
Source: ppc.elf, 6272.1.00007ffff130c000.00007ffff132d000.rw-.sdmp, ppc.elf, 6277.1.00007ffff130c000.00007ffff132d000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-ppc/tmp/ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ppc.elf
Source: ppc.elf, 6272.1.00007ffff130c000.00007ffff132d000.rw-.sdmpBinary or memory string: U/tmp/qemu-open.h4k3St\t
Source: ppc.elf, 6272.1.000055830e06a000.000055830e13b000.rw-.sdmp, ppc.elf, 6277.1.000055830e06a000.000055830e13b000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/ppc
Source: ppc.elf, 6272.1.00007ffff130c000.00007ffff132d000.rw-.sdmp, ppc.elf, 6277.1.00007ffff130c000.00007ffff132d000.rw-.sdmpBinary or memory string: /usr/bin/qemu-ppc
Source: ppc.elf, 6272.1.00007ffff130c000.00007ffff132d000.rw-.sdmp, ppc.elf, 6277.1.00007ffff130c000.00007ffff132d000.rw-.sdmpBinary or memory string: %s/qemu-op
Source: ppc.elf, 6272.1.00007ffff130c000.00007ffff132d000.rw-.sdmp, ppc.elf, 6277.1.00007ffff130c000.00007ffff132d000.rw-.sdmpBinary or memory string: MPDIR%s/qemu-op
Source: ppc.elf, 6277.1.00007ffff130c000.00007ffff132d000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Source: ppc.elf, 6277.1.00007fa20002c000.00007fa200032000.rw-.sdmpBinary or memory string: vmwareX
Source: ppc.elf, 6272.1.00007fa20002c000.00007fa200032000.rw-.sdmp, ppc.elf, 6277.1.00007fa20002c000.00007fa200032000.rw-.sdmpBinary or memory string: !qemu-arm
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
File Deletion
1
OS Credential Dumping
11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory1
File and Directory Discovery
Remote Desktop ProtocolData from Removable Media1
Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1646536 Sample: ppc.elf Startdate: 24/03/2025 Architecture: LINUX Score: 52 16 109.202.202.202, 80 INIT7CH Switzerland 2->16 18 91.189.91.42, 443 CANONICAL-ASGB United Kingdom 2->18 20 34.249.145.219, 443 AMAZON-02US United States 2->20 22 Multi AV Scanner detection for submitted file 2->22 7 ppc.elf 2->7         started        10 dash rm 2->10         started        12 dash rm 2->12         started        signatures3 process4 signatures5 24 Sample reads /proc/mounts (often used for finding a writable filesystem) 7->24 14 ppc.elf 7->14         started        process6

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
ppc.elf22%ReversingLabsLinux.Backdoor.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
https://motd.ubuntu.comppc.elf, 6272.1.00007fa20002c000.00007fa200032000.rw-.sdmp, ppc.elf, 6277.1.00007fa20002c000.00007fa200032000.rw-.sdmpfalse
    high
    https://motd.ubuntu.comheppc.elf, 6272.1.00007fa20002c000.00007fa200032000.rw-.sdmp, ppc.elf, 6277.1.00007fa20002c000.00007fa200032000.rw-.sdmpfalse
      high
      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs
      IPDomainCountryFlagASNASN NameMalicious
      34.249.145.219
      unknownUnited States
      16509AMAZON-02USfalse
      109.202.202.202
      unknownSwitzerland
      13030INIT7CHfalse
      91.189.91.42
      unknownUnited Kingdom
      41231CANONICAL-ASGBfalse
      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      34.249.145.219gigab.x86.elfGet hashmaliciousUnknownBrowse
        arm7.elfGet hashmaliciousUnknownBrowse
          aarch64.elfGet hashmaliciousMiraiBrowse
            na.elfGet hashmaliciousPrometeiBrowse
              na.elfGet hashmaliciousPrometeiBrowse
                arc.elfGet hashmaliciousMiraiBrowse
                  na.elfGet hashmaliciousPrometeiBrowse
                    na.elfGet hashmaliciousPrometeiBrowse
                      m68k.elfGet hashmaliciousMiraiBrowse
                        parm5.elfGet hashmaliciousUnknownBrowse
                          109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                          • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                          91.189.91.42morte.arm5.elfGet hashmaliciousOkiruBrowse
                            arm6.elfGet hashmaliciousUnknownBrowse
                              morte.m68k.elfGet hashmaliciousGafgyt, OkiruBrowse
                                morte.arm.elfGet hashmaliciousGafgyt, OkiruBrowse
                                  arm7.elfGet hashmaliciousMiraiBrowse
                                    gigab.x86.elfGet hashmaliciousUnknownBrowse
                                      morte.mips.elfGet hashmaliciousGafgyt, OkiruBrowse
                                        arm7.elfGet hashmaliciousUnknownBrowse
                                          morte.arm6.elfGet hashmaliciousGafgyt, OkiruBrowse
                                            aarch64.elfGet hashmaliciousMiraiBrowse
                                              No context
                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              CANONICAL-ASGBna.elfGet hashmaliciousPrometeiBrowse
                                              • 185.125.190.26
                                              morte.arm5.elfGet hashmaliciousOkiruBrowse
                                              • 91.189.91.42
                                              arm6.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              morte.m68k.elfGet hashmaliciousGafgyt, OkiruBrowse
                                              • 91.189.91.42
                                              morte.arm.elfGet hashmaliciousGafgyt, OkiruBrowse
                                              • 91.189.91.42
                                              arm7.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              gigab.x86.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              morte.x86.elfGet hashmaliciousOkiruBrowse
                                              • 185.125.190.26
                                              morte.mips.elfGet hashmaliciousGafgyt, OkiruBrowse
                                              • 91.189.91.42
                                              arm7.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              INIT7CHmorte.arm5.elfGet hashmaliciousOkiruBrowse
                                              • 109.202.202.202
                                              arm6.elfGet hashmaliciousUnknownBrowse
                                              • 109.202.202.202
                                              morte.m68k.elfGet hashmaliciousGafgyt, OkiruBrowse
                                              • 109.202.202.202
                                              morte.arm.elfGet hashmaliciousGafgyt, OkiruBrowse
                                              • 109.202.202.202
                                              arm7.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              gigab.x86.elfGet hashmaliciousUnknownBrowse
                                              • 109.202.202.202
                                              morte.mips.elfGet hashmaliciousGafgyt, OkiruBrowse
                                              • 109.202.202.202
                                              arm7.elfGet hashmaliciousUnknownBrowse
                                              • 109.202.202.202
                                              morte.arm6.elfGet hashmaliciousGafgyt, OkiruBrowse
                                              • 109.202.202.202
                                              aarch64.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              AMAZON-02UShttps://waimao-north-star-mail.qiye.163.com/api/j/html?c=https%3A%2F%2F1drv.ms%2Fo%2Fs!AjlMaeoI5pi7f_GXm50IY_RD-sw%3Fe%3DEsmwj4%3Fcid%3Dsite_nqmm3LQS7c9jn-2FWvVcVpMl0NsyUA8yUApYElnaeUm2Ly_xlUzBpbEuLGet hashmaliciousUnknownBrowse
                                              • 52.38.253.137
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 52.43.119.120
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 34.243.160.129
                                              arm5.elfGet hashmaliciousUnknownBrowse
                                              • 54.171.230.55
                                              arc.elfGet hashmaliciousMiraiBrowse
                                              • 34.254.182.186
                                              #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exeGet hashmaliciousNjratBrowse
                                              • 18.197.239.5
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 52.43.119.120
                                              gigab.x86.elfGet hashmaliciousUnknownBrowse
                                              • 34.249.145.219
                                              morte.mips.elfGet hashmaliciousGafgyt, OkiruBrowse
                                              • 54.171.230.55
                                              arm7.elfGet hashmaliciousUnknownBrowse
                                              • 34.249.145.219
                                              No context
                                              No context
                                              Process:/tmp/ppc.elf
                                              File Type:ASCII text, with no line terminators
                                              Category:dropped
                                              Size (bytes):13
                                              Entropy (8bit):3.1808329872054406
                                              Encrypted:false
                                              SSDEEP:3:Tg/cA3:TgkG
                                              MD5:B4B673815F84B3C325AF4B636EF3F7E8
                                              SHA1:0D795B3294AE13B67B5977896D2C28B777A2216A
                                              SHA-256:BA14832061879D30329B0378D53F56199440D741567578D0482343247629A00C
                                              SHA-512:DC4969EF1C3132480F4001EB78586B888D6E75CE84121CDF2B9679DA13062DC56604B4E7F1B1BBD205F9CC707B4BF311AAA9C19F0C67224026F270C18FDCD7EF
                                              Malicious:false
                                              Reputation:moderate, very likely benign file
                                              Preview:/tmp/ppc.elf.
                                              Process:/tmp/ppc.elf
                                              File Type:ASCII text, with no line terminators
                                              Category:dropped
                                              Size (bytes):13
                                              Entropy (8bit):3.1808329872054406
                                              Encrypted:false
                                              SSDEEP:3:Tg/cA3:TgkG
                                              MD5:B4B673815F84B3C325AF4B636EF3F7E8
                                              SHA1:0D795B3294AE13B67B5977896D2C28B777A2216A
                                              SHA-256:BA14832061879D30329B0378D53F56199440D741567578D0482343247629A00C
                                              SHA-512:DC4969EF1C3132480F4001EB78586B888D6E75CE84121CDF2B9679DA13062DC56604B4E7F1B1BBD205F9CC707B4BF311AAA9C19F0C67224026F270C18FDCD7EF
                                              Malicious:false
                                              Reputation:moderate, very likely benign file
                                              Preview:/tmp/ppc.elf.
                                              Process:/tmp/ppc.elf
                                              File Type:ASCII text, with no line terminators
                                              Category:dropped
                                              Size (bytes):13
                                              Entropy (8bit):3.1808329872054406
                                              Encrypted:false
                                              SSDEEP:3:Tg/cA3:TgkG
                                              MD5:B4B673815F84B3C325AF4B636EF3F7E8
                                              SHA1:0D795B3294AE13B67B5977896D2C28B777A2216A
                                              SHA-256:BA14832061879D30329B0378D53F56199440D741567578D0482343247629A00C
                                              SHA-512:DC4969EF1C3132480F4001EB78586B888D6E75CE84121CDF2B9679DA13062DC56604B4E7F1B1BBD205F9CC707B4BF311AAA9C19F0C67224026F270C18FDCD7EF
                                              Malicious:false
                                              Reputation:moderate, very likely benign file
                                              Preview:/tmp/ppc.elf.
                                              File type:ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
                                              Entropy (8bit):6.352115925059627
                                              TrID:
                                              • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
                                              • ELF Executable and Linkable format (generic) (4004/1) 49.84%
                                              File name:ppc.elf
                                              File size:107'332 bytes
                                              MD5:79f3da4f719218bbcbcd072858b0ae12
                                              SHA1:3e3328051bbcd5263534bc17930b954dee17f90a
                                              SHA256:bcbdbefaa9b5a475217697939d1ba63dcccc654627ae72711fd8dc24195c99ca
                                              SHA512:07e447d27426425814ab863fd4aecd02a4a89f1089ed86a2f73bdba233081d47a5b42e5336c47b1fd9790c25c86e95f675373682b9217ca11d9954b8b8c8667c
                                              SSDEEP:1536:AM0hcT9vaiW2TkaY6nXelr3NhQddHqTO4GmoqYSTQfY/LA90eSSM6ZVHxnor8t:1dBNEEv9kl6ZDnQ8t
                                              TLSH:06A35D81B7190583E2A35CF02A3F27E1C7EA8D8211B4A544791FFB5D96B2E332446EDD
                                              File Content Preview:.ELF...........................4...d.....4. ...(...........................................p...p...p......IX........dt.Q.............................!..|......$H...H......$8!. |...N.. .!..|.......?..........`..../...@..`= ..;........+../...A..$8...}).....

                                              ELF header

                                              Class:ELF32
                                              Data:2's complement, big endian
                                              Version:1 (current)
                                              Machine:PowerPC
                                              Version Number:0x1
                                              Type:EXEC (Executable file)
                                              OS/ABI:UNIX - System V
                                              ABI Version:0
                                              Entry Point Address:0x100001f8
                                              Flags:0x0
                                              ELF Header Size:52
                                              Program Header Offset:52
                                              Program Header Size:32
                                              Number of Program Headers:3
                                              Section Header Offset:106852
                                              Section Header Size:40
                                              Number of Section Headers:12
                                              Header String Table Index:11
                                              NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                              NULL0x00x00x00x00x0000
                                              .initPROGBITS0x100000940x940x240x00x6AX004
                                              .textPROGBITS0x100000b80xb80x180640x00x6AX004
                                              .finiPROGBITS0x1001811c0x1811c0x200x00x6AX004
                                              .rodataPROGBITS0x100181400x181400x1eb80x00x2A008
                                              .ctorsPROGBITS0x1002a0700x1a0700x80x00x3WA004
                                              .dtorsPROGBITS0x1002a0780x1a0780x80x00x3WA004
                                              .dataPROGBITS0x1002a0840x1a0840x8c0x00x3WA004
                                              .sdataPROGBITS0x1002a1100x1a1100x90x00x3WA004
                                              .sbssNOBITS0x1002a11c0x1a1190x400x00x3WA004
                                              .bssNOBITS0x1002a1600x1a1190x48680x00x3WA008
                                              .shstrtabSTRTAB0x00x1a1190x4b0x00x0001
                                              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                              LOAD0x00x100000000x100000000x19ff80x19ff86.36890x5R E0x10000.init .text .fini .rodata
                                              LOAD0x1a0700x1002a0700x1002a0700xa90x49584.18950x6RW 0x10000.ctors .dtors .data .sdata .sbss .bss
                                              GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

                                              Download Network PCAP: filteredfull

                                              • Total Packets: 7
                                              • 443 (HTTPS)
                                              • 80 (HTTP)
                                              TimestampSource PortDest PortSource IPDest IP
                                              Mar 24, 2025 05:17:21.518932104 CET39256443192.168.2.2334.249.145.219
                                              Mar 24, 2025 05:17:23.314661026 CET43928443192.168.2.2391.189.91.42
                                              Mar 24, 2025 05:17:29.710021019 CET39256443192.168.2.2334.249.145.219
                                              Mar 24, 2025 05:17:39.692802906 CET4251680192.168.2.23109.202.202.202
                                              Mar 24, 2025 05:17:43.788147926 CET43928443192.168.2.2391.189.91.42
                                              Mar 24, 2025 05:17:45.835844994 CET39256443192.168.2.2334.249.145.219
                                              Mar 24, 2025 05:18:24.742849112 CET43928443192.168.2.2391.189.91.42

                                              System Behavior

                                              Start time (UTC):04:17:23
                                              Start date (UTC):24/03/2025
                                              Path:/tmp/ppc.elf
                                              Arguments:-
                                              File size:5388968 bytes
                                              MD5 hash:ae65271c943d3451b7f026d1fadccea6

                                              Start time (UTC):04:18:13
                                              Start date (UTC):24/03/2025
                                              Path:/usr/bin/dash
                                              Arguments:-
                                              File size:129816 bytes
                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                              Start time (UTC):04:18:13
                                              Start date (UTC):24/03/2025
                                              Path:/usr/bin/rm
                                              Arguments:rm -f /tmp/tmp.1FysiLhQ07 /tmp/tmp.juM21P70QU /tmp/tmp.15A5Mebi67
                                              File size:72056 bytes
                                              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                              Start time (UTC):04:18:13
                                              Start date (UTC):24/03/2025
                                              Path:/usr/bin/dash
                                              Arguments:-
                                              File size:129816 bytes
                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                              Start time (UTC):04:18:13
                                              Start date (UTC):24/03/2025
                                              Path:/usr/bin/rm
                                              Arguments:rm -f /tmp/tmp.1FysiLhQ07 /tmp/tmp.juM21P70QU /tmp/tmp.15A5Mebi67
                                              File size:72056 bytes
                                              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b