Edit tour

Linux Analysis Report
arm6.elf

Overview

General Information

Sample name:arm6.elf
Analysis ID:1646574
MD5:968e40ea546134d178a2e9d9bcccbbcb
SHA1:ebeaab4b45e17e8e0a5b90986c6e9e8e09b36003
SHA256:288eeeb851738375bcbae267e2df9d513d96cdb7eca181162eb1ad48bf75a092
Tags:elfuser-abuse_ch
Infos:

Detection

Score:52
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Sample reads /proc/mounts (often used for finding a writable filesystem)
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Found strings indicative of a multi-platform dropper
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1646574
Start date and time:2025-03-24 06:08:20 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 45s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:arm6.elf
Detection:MAL
Classification:mal52.troj.linELF@0/4@0/0
Command:/tmp/arm6.elf
PID:6218
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
For God so loved the world
Standard Error:
  • system is lnxubuntu20
  • arm6.elf (PID: 6218, Parent: 6135, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm6.elf
    • arm6.elf New Fork (PID: 6224, Parent: 6218)
  • dash New Fork (PID: 6221, Parent: 4331)
  • rm (PID: 6221, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.5qDk0pc6ux /tmp/tmp.0wHhev3Skv /tmp/tmp.8bDRwkXCDQ
  • dash New Fork (PID: 6222, Parent: 4331)
  • rm (PID: 6222, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.5qDk0pc6ux /tmp/tmp.0wHhev3Skv /tmp/tmp.8bDRwkXCDQ
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: arm6.elfVirustotal: Detection: 20%Perma Link
Source: arm6.elfReversingLabs: Detection: 16%
Source: arm6.elfString: /proc/%s/exe/proc/%s/cmdline/proc/%d/exe/proc/%d/cmdlinewgettftpcurlftp/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/lib/snap/usr/lib/
Source: /tmp/arm6.elf (PID: 6224)Socket: 127.0.0.1:22448Jump to behavior
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: arm6.elf, 6218.1.00007f960403c000.00007f9604042000.rw-.sdmp, arm6.elf, 6224.1.00007f960403c000.00007f9604042000.rw-.sdmpString found in binary or memory: https://motd.ubuntu.com
Source: arm6.elf, 6218.1.00007f960403c000.00007f9604042000.rw-.sdmp, arm6.elf, 6224.1.00007f960403c000.00007f9604042000.rw-.sdmpString found in binary or memory: https://motd.ubuntu.comhe
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
Source: ELF static info symbol of initial sample.symtab present: no
Source: /tmp/arm6.elf (PID: 6218)SIGKILL sent: pid: 4439, result: successfulJump to behavior
Source: classification engineClassification label: mal52.troj.linELF@0/4@0/0

Persistence and Installation Behavior

barindex
Source: /tmp/arm6.elf (PID: 6218)File: /proc/6218/mountsJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1582/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1582/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/3088/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/230/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/110/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/231/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/111/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/232/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1579/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1579/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/112/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/233/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1699/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1699/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/113/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/234/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1335/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1335/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1698/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1698/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/114/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/235/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1334/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1334/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1576/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1576/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/2302/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/2302/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/115/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/236/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/116/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/237/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/117/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/118/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/910/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/119/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/912/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/912/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/10/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/2307/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/2307/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/11/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/918/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/918/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/12/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/13/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/14/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/15/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/16/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/17/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/18/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1594/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1594/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/120/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/121/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1349/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1349/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1/mapsJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/122/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/243/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/123/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/2/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/124/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/3/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/4/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/125/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/126/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1344/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1344/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1465/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1465/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1586/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1586/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/127/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/6/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/248/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/128/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/249/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1463/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1463/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/800/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/800/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/9/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/801/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/801/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/20/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/21/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1900/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/1900/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/22/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/23/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/24/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/25/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/26/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/27/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/28/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/29/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/491/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/491/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/250/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/130/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/251/cmdlineJump to behavior
Source: /tmp/arm6.elf (PID: 6218)File opened: /proc/252/cmdlineJump to behavior
Source: /usr/bin/dash (PID: 6221)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.5qDk0pc6ux /tmp/tmp.0wHhev3Skv /tmp/tmp.8bDRwkXCDQJump to behavior
Source: /usr/bin/dash (PID: 6222)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.5qDk0pc6ux /tmp/tmp.0wHhev3Skv /tmp/tmp.8bDRwkXCDQJump to behavior
Source: /tmp/arm6.elf (PID: 6218)Queries kernel information via 'uname': Jump to behavior
Source: arm6.elf, 6218.1.00007f960403c000.00007f9604042000.rw-.sdmp, arm6.elf, 6224.1.00007f960403c000.00007f9604042000.rw-.sdmpBinary or memory string: !!a1gAWFxuAXsFWUgBRQAA!!a1gAWFxuAXsAWUgKRXgA!!a1gAWFxuAXsAWEgJR3IA!!a10CWFxuAHsGWVcWQHAA!!a10CWFxuAHsGWVcWQHUA!!aFwAWF9uA3sGW0gLRgAA!1aFwAWFlpG2QBW0gJTwAA1!qemu-arm2QBW0gJTwAA!
Source: arm6.elf, 6218.1.00007ffc105c8000.00007ffc105e9000.rw-.sdmpBinary or memory string: U/tmp/qemu-open.8UGhFm:
Source: arm6.elf, 6224.1.00007f960403c000.00007f9604042000.rw-.sdmpBinary or memory string: vmware
Source: arm6.elf, 6218.1.000055abd9fd4000.000055abda122000.rw-.sdmp, arm6.elf, 6224.1.000055abd9fd4000.000055abda122000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
Source: arm6.elf, 6218.1.00007f960403c000.00007f9604042000.rw-.sdmp, arm6.elf, 6224.1.00007f960403c000.00007f9604042000.rw-.sdmpBinary or memory string: qemu-arm
Source: arm6.elf, 6218.1.000055abd9fd4000.000055abda122000.rw-.sdmp, arm6.elf, 6224.1.000055abd9fd4000.000055abda122000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: arm6.elf, 6218.1.00007ffc105c8000.00007ffc105e9000.rw-.sdmp, arm6.elf, 6224.1.00007ffc105c8000.00007ffc105e9000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
Source: arm6.elf, 6218.1.00007ffc105c8000.00007ffc105e9000.rw-.sdmp, arm6.elf, 6224.1.00007ffc105c8000.00007ffc105e9000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm6.elf
Source: arm6.elf, 6224.1.00007ffc105c8000.00007ffc105e9000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Source: arm6.elf, 6218.1.00007ffc105c8000.00007ffc105e9000.rw-.sdmpBinary or memory string: /tmp/qemu-open.8UGhFm
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting
Valid AccountsWindows Management Instrumentation1
Scripting
Path Interception1
File Deletion
1
OS Credential Dumping
11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory1
File and Directory Discovery
Remote Desktop ProtocolData from Removable Media1
Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1646574 Sample: arm6.elf Startdate: 24/03/2025 Architecture: LINUX Score: 52 16 109.202.202.202, 80 INIT7CH Switzerland 2->16 18 91.189.91.42, 443 CANONICAL-ASGB United Kingdom 2->18 20 91.189.91.43, 443 CANONICAL-ASGB United Kingdom 2->20 22 Multi AV Scanner detection for submitted file 2->22 7 arm6.elf 2->7         started        10 dash rm 2->10         started        12 dash rm 2->12         started        signatures3 process4 signatures5 24 Sample reads /proc/mounts (often used for finding a writable filesystem) 7->24 14 arm6.elf 7->14         started        process6
SourceDetectionScannerLabelLink
arm6.elf20%VirustotalBrowse
arm6.elf17%ReversingLabsLinux.Trojan.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
https://motd.ubuntu.comarm6.elf, 6218.1.00007f960403c000.00007f9604042000.rw-.sdmp, arm6.elf, 6224.1.00007f960403c000.00007f9604042000.rw-.sdmpfalse
    high
    https://motd.ubuntu.comhearm6.elf, 6218.1.00007f960403c000.00007f9604042000.rw-.sdmp, arm6.elf, 6224.1.00007f960403c000.00007f9604042000.rw-.sdmpfalse
      high
      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs
      IPDomainCountryFlagASNASN NameMalicious
      109.202.202.202
      unknownSwitzerland
      13030INIT7CHfalse
      91.189.91.43
      unknownUnited Kingdom
      41231CANONICAL-ASGBfalse
      91.189.91.42
      unknownUnited Kingdom
      41231CANONICAL-ASGBfalse
      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
      • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
      91.189.91.43morte.spc.elfGet hashmaliciousOkiruBrowse
        arm7.elfGet hashmaliciousMiraiBrowse
          morte.sh4.elfGet hashmaliciousGafgyt, OkiruBrowse
            na.elfGet hashmaliciousPrometeiBrowse
              na.elfGet hashmaliciousPrometeiBrowse
                sh4.elfGet hashmaliciousUnknownBrowse
                  morte.arm5.elfGet hashmaliciousOkiruBrowse
                    arm6.elfGet hashmaliciousUnknownBrowse
                      morte.m68k.elfGet hashmaliciousGafgyt, OkiruBrowse
                        morte.arm.elfGet hashmaliciousGafgyt, OkiruBrowse
                          91.189.91.42morte.spc.elfGet hashmaliciousOkiruBrowse
                            arm7.elfGet hashmaliciousMiraiBrowse
                              morte.sh4.elfGet hashmaliciousGafgyt, OkiruBrowse
                                na.elfGet hashmaliciousPrometeiBrowse
                                  na.elfGet hashmaliciousPrometeiBrowse
                                    sh4.elfGet hashmaliciousUnknownBrowse
                                      ppc.elfGet hashmaliciousUnknownBrowse
                                        morte.arm5.elfGet hashmaliciousOkiruBrowse
                                          arm6.elfGet hashmaliciousUnknownBrowse
                                            morte.m68k.elfGet hashmaliciousGafgyt, OkiruBrowse
                                              No context
                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              CANONICAL-ASGBmorte.spc.elfGet hashmaliciousOkiruBrowse
                                              • 91.189.91.42
                                              arm7.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              morte.sh4.elfGet hashmaliciousGafgyt, OkiruBrowse
                                              • 91.189.91.42
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 91.189.91.42
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 91.189.91.42
                                              sh4.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              ppc.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 185.125.190.26
                                              morte.arm5.elfGet hashmaliciousOkiruBrowse
                                              • 91.189.91.42
                                              arm6.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              CANONICAL-ASGBmorte.spc.elfGet hashmaliciousOkiruBrowse
                                              • 91.189.91.42
                                              arm7.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              morte.sh4.elfGet hashmaliciousGafgyt, OkiruBrowse
                                              • 91.189.91.42
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 91.189.91.42
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 91.189.91.42
                                              sh4.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              ppc.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 185.125.190.26
                                              morte.arm5.elfGet hashmaliciousOkiruBrowse
                                              • 91.189.91.42
                                              arm6.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              INIT7CHmorte.spc.elfGet hashmaliciousOkiruBrowse
                                              • 109.202.202.202
                                              arm7.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              morte.sh4.elfGet hashmaliciousGafgyt, OkiruBrowse
                                              • 109.202.202.202
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 109.202.202.202
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 109.202.202.202
                                              sh4.elfGet hashmaliciousUnknownBrowse
                                              • 109.202.202.202
                                              ppc.elfGet hashmaliciousUnknownBrowse
                                              • 109.202.202.202
                                              morte.arm5.elfGet hashmaliciousOkiruBrowse
                                              • 109.202.202.202
                                              arm6.elfGet hashmaliciousUnknownBrowse
                                              • 109.202.202.202
                                              morte.m68k.elfGet hashmaliciousGafgyt, OkiruBrowse
                                              • 109.202.202.202
                                              No context
                                              No context
                                              Process:/tmp/arm6.elf
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):14
                                              Entropy (8bit):3.521640636343319
                                              Encrypted:false
                                              SSDEEP:3:Tgj03:Tgw3
                                              MD5:3F57B2990E079DDED19A289B2C2D9845
                                              SHA1:EC529CD92FCD1419E74F69269A1FBDFB901F3360
                                              SHA-256:42BAD665C8A094C4820D587524D2B0F1E1AA45E1BA9BCE12E59A92CBA93B90BC
                                              SHA-512:B2E54540954546CA0BDC2B73923B545659131AB088282E7070B2A7C9FBA1D1C1D58CFE4094D1DAE38D578E2B4FD7CB2E3A7D25A06EE84546207EE6A3B19553A8
                                              Malicious:false
                                              Reputation:moderate, very likely benign file
                                              Preview:/tmp/arm6.elf.
                                              Process:/tmp/arm6.elf
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):14
                                              Entropy (8bit):3.521640636343319
                                              Encrypted:false
                                              SSDEEP:3:Tgj03:Tgw3
                                              MD5:3F57B2990E079DDED19A289B2C2D9845
                                              SHA1:EC529CD92FCD1419E74F69269A1FBDFB901F3360
                                              SHA-256:42BAD665C8A094C4820D587524D2B0F1E1AA45E1BA9BCE12E59A92CBA93B90BC
                                              SHA-512:B2E54540954546CA0BDC2B73923B545659131AB088282E7070B2A7C9FBA1D1C1D58CFE4094D1DAE38D578E2B4FD7CB2E3A7D25A06EE84546207EE6A3B19553A8
                                              Malicious:false
                                              Reputation:moderate, very likely benign file
                                              Preview:/tmp/arm6.elf.
                                              Process:/tmp/arm6.elf
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):14
                                              Entropy (8bit):3.521640636343319
                                              Encrypted:false
                                              SSDEEP:3:Tgj03:Tgw3
                                              MD5:3F57B2990E079DDED19A289B2C2D9845
                                              SHA1:EC529CD92FCD1419E74F69269A1FBDFB901F3360
                                              SHA-256:42BAD665C8A094C4820D587524D2B0F1E1AA45E1BA9BCE12E59A92CBA93B90BC
                                              SHA-512:B2E54540954546CA0BDC2B73923B545659131AB088282E7070B2A7C9FBA1D1C1D58CFE4094D1DAE38D578E2B4FD7CB2E3A7D25A06EE84546207EE6A3B19553A8
                                              Malicious:false
                                              Reputation:moderate, very likely benign file
                                              Preview:/tmp/arm6.elf.
                                              Process:/tmp/arm6.elf
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):14
                                              Entropy (8bit):3.521640636343319
                                              Encrypted:false
                                              SSDEEP:3:Tgj03:Tgw3
                                              MD5:3F57B2990E079DDED19A289B2C2D9845
                                              SHA1:EC529CD92FCD1419E74F69269A1FBDFB901F3360
                                              SHA-256:42BAD665C8A094C4820D587524D2B0F1E1AA45E1BA9BCE12E59A92CBA93B90BC
                                              SHA-512:B2E54540954546CA0BDC2B73923B545659131AB088282E7070B2A7C9FBA1D1C1D58CFE4094D1DAE38D578E2B4FD7CB2E3A7D25A06EE84546207EE6A3B19553A8
                                              Malicious:false
                                              Reputation:moderate, very likely benign file
                                              Preview:/tmp/arm6.elf.
                                              File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), dynamically linked, stripped
                                              Entropy (8bit):6.048869830134921
                                              TrID:
                                              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                              File name:arm6.elf
                                              File size:115'516 bytes
                                              MD5:968e40ea546134d178a2e9d9bcccbbcb
                                              SHA1:ebeaab4b45e17e8e0a5b90986c6e9e8e09b36003
                                              SHA256:288eeeb851738375bcbae267e2df9d513d96cdb7eca181162eb1ad48bf75a092
                                              SHA512:cc49c01d93a1ad503f053fdcf2a0ee2eff12b8be5e6ef85feae78ecc51116cae38d35a34ccafa260a12b8deb4982296a3407e575a02a80502757bed9906d58c3
                                              SSDEEP:3072:YClBCg+ozkXTsrGtfI4IJ6VRy71mnJzqqT1ctny:YCl5/IwrGtQl+61mJzr1D
                                              TLSH:2FB3089AB8519F66C5D116BEFE1E428D33232BB8E3DA3107DC156F2077CA95A0E3B441
                                              File Content Preview:.ELF..............(.....l...4...4.......4. ...(..............5...5......................................................................|I...........................................@-..@............/..@-.,@...0....S..... 0....S.........../..0...0...@..../

                                              ELF header

                                              Class:ELF32
                                              Data:2's complement, little endian
                                              Version:1 (current)
                                              Machine:ARM
                                              Version Number:0x1
                                              Type:EXEC (Executable file)
                                              OS/ABI:UNIX - System V
                                              ABI Version:0
                                              Entry Point Address:0x816c
                                              Flags:0x4000002
                                              ELF Header Size:52
                                              Program Header Offset:52
                                              Program Header Size:32
                                              Number of Program Headers:4
                                              Section Header Offset:114996
                                              Section Header Size:40
                                              Number of Section Headers:13
                                              Header String Table Index:12
                                              NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                              NULL0x00x00x00x00x0000
                                              .initPROGBITS0x80b40xb40x140x00x6AX001
                                              .textPROGBITS0x80c80xc80x1989c0x00x6AX004
                                              .finiPROGBITS0x219640x199640x140x00x6AX001
                                              .rodataPROGBITS0x219780x199780x1c600x00x2A004
                                              .ARM.exidxARM_EXIDX0x235d80x1b5d80xc80x00x82AL204
                                              .eh_framePROGBITS0x2c0000x1c0000x40x00x3WA004
                                              .init_arrayINIT_ARRAY0x2c0040x1c0040x40x00x3WA004
                                              .fini_arrayFINI_ARRAY0x2c0080x1c0080x40x00x3WA004
                                              .gotPROGBITS0x2c0100x1c0100x280x40x3WA004
                                              .dataPROGBITS0x2c0380x1c0380x980x00x3WA004
                                              .bssNOBITS0x2c0d00x1c0d00x48ac0x00x3WA008
                                              .shstrtabSTRTAB0x00x1c0d00x620x00x0001
                                              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                              DYNAMIC0x1b5d80x235d80x235d80xc80xc84.30230x4R 0x4.ARM.exidx
                                              LOAD0x00x80000x80000x1b6a00x1b6a06.13170x5R E0x8000.init .text .fini .rodata .ARM.exidx
                                              LOAD0x1c0000x2c0000x2c0000xd00x497c3.58960x6RW 0x8000.eh_frame .init_array .fini_array .got .data .bss
                                              DYNAMIC0x00x00x00x00x00.00000x7RWE0x4

                                              Download Network PCAP: filteredfull

                                              • Total Packets: 8
                                              • 443 (HTTPS)
                                              • 80 (HTTP)
                                              TimestampSource PortDest PortSource IPDest IP
                                              Mar 24, 2025 06:09:03.101283073 CET43928443192.168.2.2391.189.91.42
                                              Mar 24, 2025 06:09:08.732794046 CET42836443192.168.2.2391.189.91.43
                                              Mar 24, 2025 06:09:10.268347025 CET4251680192.168.2.23109.202.202.202
                                              Mar 24, 2025 06:09:24.346434116 CET43928443192.168.2.2391.189.91.42
                                              Mar 24, 2025 06:09:34.585048914 CET42836443192.168.2.2391.189.91.43
                                              Mar 24, 2025 06:09:40.728250027 CET4251680192.168.2.23109.202.202.202
                                              Mar 24, 2025 06:10:05.300776958 CET43928443192.168.2.2391.189.91.42
                                              Mar 24, 2025 06:10:25.778031111 CET42836443192.168.2.2391.189.91.43

                                              System Behavior

                                              Start time (UTC):05:09:04
                                              Start date (UTC):24/03/2025
                                              Path:/tmp/arm6.elf
                                              Arguments:-
                                              File size:4956856 bytes
                                              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                              Start time (UTC):05:09:04
                                              Start date (UTC):24/03/2025
                                              Path:/usr/bin/dash
                                              Arguments:-
                                              File size:129816 bytes
                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                              Start time (UTC):05:09:04
                                              Start date (UTC):24/03/2025
                                              Path:/usr/bin/rm
                                              Arguments:rm -f /tmp/tmp.5qDk0pc6ux /tmp/tmp.0wHhev3Skv /tmp/tmp.8bDRwkXCDQ
                                              File size:72056 bytes
                                              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                              Start time (UTC):05:09:04
                                              Start date (UTC):24/03/2025
                                              Path:/usr/bin/dash
                                              Arguments:-
                                              File size:129816 bytes
                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                              Start time (UTC):05:09:04
                                              Start date (UTC):24/03/2025
                                              Path:/usr/bin/rm
                                              Arguments:rm -f /tmp/tmp.5qDk0pc6ux /tmp/tmp.0wHhev3Skv /tmp/tmp.8bDRwkXCDQ
                                              File size:72056 bytes
                                              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b