Edit tour

Linux Analysis Report
arm5.fkunigr.elf

Overview

General Information

Sample name:arm5.fkunigr.elf
Analysis ID:1646742
MD5:17132228a3ee944ab5e4f8bd0d5028cb
SHA1:84889cced41a3065c93dd15dd780e39d4d6803c0
SHA256:65fc904026b789df31ba719dc90a5cf36103934d089518b39f35781d73e91609
Tags:Miraiuser-elfdigest
Infos:

Detection

Mirai
Score:64
Range:0 - 100

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1646742
Start date and time:2025-03-24 09:04:25 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 10m 25s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:arm5.fkunigr.elf
Detection:MAL
Classification:mal64.troj.linELF@0/0@2/0
Cookbook Comments:
  • Analysis time extended to 480s due to sleep detection in submitted sample
Command:/tmp/arm5.fkunigr.elf
PID:5435
Exit Code:255
Exit Code Info:
Killed:False
Standard Output:

Standard Error:/lib/ld-uClibc.so.0: No such file or directory
  • system is lnxubuntu20
  • arm5.fkunigr.elf (PID: 5435, Parent: 5357, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm5.fkunigr.elf
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
arm5.fkunigr.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    arm5.fkunigr.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
    • 0xb114:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xb128:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xb13c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xb150:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xb164:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xb178:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xb18c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xb1a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xb1b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xb1c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xb1dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xb1f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xb204:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xb218:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xb22c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xb240:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xb254:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xb268:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xb27c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xb290:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xb2a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    arm5.fkunigr.elfLinux_Trojan_Gafgyt_ea92cca8unknownunknown
    • 0xafd4:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
    SourceRuleDescriptionAuthorStrings
    5435.1.00007f66e8017000.00007f66e8023000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      5435.1.00007f66e8017000.00007f66e8023000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0xb114:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xb128:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xb13c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xb150:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xb164:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xb178:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xb18c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xb1a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xb1b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xb1c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xb1dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xb1f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xb204:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xb218:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xb22c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xb240:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xb254:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xb268:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xb27c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xb290:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xb2a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      5435.1.00007f66e8017000.00007f66e8023000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
      • 0xafd4:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
      Process Memory Space: arm5.fkunigr.elf PID: 5435Linux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0x18271:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x18285:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x18299:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x182ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x182c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x182d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x182e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x182fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x18311:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x18325:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x18339:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x1834d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x18361:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x18375:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x18389:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x1839d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x183b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x183c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x183d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x183ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x18401:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      Process Memory Space: arm5.fkunigr.elf PID: 5435Linux_Trojan_Gafgyt_ea92cca8unknownunknown
      • 0x18157:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
      No Suricata rule has matched

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Source: arm5.fkunigr.elfReversingLabs: Detection: 47%
      Source: arm5.fkunigr.elfVirustotal: Detection: 32%Perma Link
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
      Source: arm5.fkunigr.elfString found in binary or memory: http://213.209.129.92/lickmynutsnigah.sh;
      Source: arm5.fkunigr.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
      Source: arm5.fkunigr.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
      Source: arm5.fkunigr.elfString found in binary or memory: https://i.imgur.com/0r0MYas.gif

      System Summary

      barindex
      Source: arm5.fkunigr.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: arm5.fkunigr.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: 5435.1.00007f66e8017000.00007f66e8023000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 5435.1.00007f66e8017000.00007f66e8023000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: Process Memory Space: arm5.fkunigr.elf PID: 5435, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: Process Memory Space: arm5.fkunigr.elf PID: 5435, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: ELF static info symbol of initial sample.symtab present: no
      Source: arm5.fkunigr.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: arm5.fkunigr.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: 5435.1.00007f66e8017000.00007f66e8023000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 5435.1.00007f66e8017000.00007f66e8023000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: Process Memory Space: arm5.fkunigr.elf PID: 5435, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: Process Memory Space: arm5.fkunigr.elf PID: 5435, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: classification engineClassification label: mal64.troj.linELF@0/0@2/0
      Source: /tmp/arm5.fkunigr.elf (PID: 5435)Queries kernel information via 'uname': Jump to behavior
      Source: arm5.fkunigr.elf, 5435.1.00007ffc03253000.00007ffc03274000.rw-.sdmpBinary or memory string: 32Ox86_64/usr/bin/qemu-arm/tmp/arm5.fkunigr.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm5.fkunigr.elf
      Source: arm5.fkunigr.elf, 5435.1.00007ffc03253000.00007ffc03274000.rw-.sdmpBinary or memory string: qemu: %s: %s
      Source: arm5.fkunigr.elf, 5435.1.00007ffc03253000.00007ffc03274000.rw-.sdmpBinary or memory string: leqemu: %s: %s
      Source: arm5.fkunigr.elf, 5435.1.0000557760191000.00005577602bf000.rw-.sdmpBinary or memory string: `wU!/etc/qemu-binfmt/arm
      Source: arm5.fkunigr.elf, 5435.1.0000557760191000.00005577602bf000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
      Source: arm5.fkunigr.elf, 5435.1.00007ffc03253000.00007ffc03274000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
      Source: arm5.fkunigr.elf, 5435.1.0000557760191000.00005577602bf000.rw-.sdmpBinary or memory string: `wUrg.qemu.gdb.arm.sys.regs">
      Source: arm5.fkunigr.elf, 5435.1.0000557760191000.00005577602bf000.rw-.sdmpBinary or memory string: rg.qemu.gdb.arm.sys.regs">

      Stealing of Sensitive Information

      barindex
      Source: Yara matchFile source: arm5.fkunigr.elf, type: SAMPLE
      Source: Yara matchFile source: 5435.1.00007f66e8017000.00007f66e8023000.r-x.sdmp, type: MEMORY

      Remote Access Functionality

      barindex
      Source: Yara matchFile source: arm5.fkunigr.elf, type: SAMPLE
      Source: Yara matchFile source: 5435.1.00007f66e8017000.00007f66e8023000.r-x.sdmp, type: MEMORY
      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
      Security Software Discovery
      Remote ServicesData from Local System1
      Non-Application Layer Protocol
      Exfiltration Over Other Network MediumAbuse Accessibility Features
      CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
      Application Layer Protocol
      Exfiltration Over BluetoothNetwork Denial of Service
      No configs have been found
      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Number of created Files
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1646742 Sample: arm5.fkunigr.elf Startdate: 24/03/2025 Architecture: LINUX Score: 64 8 daisy.ubuntu.com 2->8 10 Malicious sample detected (through community Yara rule) 2->10 12 Multi AV Scanner detection for submitted file 2->12 14 Yara detected Mirai 2->14 6 arm5.fkunigr.elf 2->6         started        signatures3 process4
      SourceDetectionScannerLabelLink
      arm5.fkunigr.elf47%ReversingLabsLinux.Backdoor.Mirai
      arm5.fkunigr.elf33%VirustotalBrowse
      No Antivirus matches
      No Antivirus matches
      No Antivirus matches

      Download Network PCAP: filteredfull

      NameIPActiveMaliciousAntivirus DetectionReputation
      daisy.ubuntu.com
      162.213.35.24
      truefalse
        high
        NameSourceMaliciousAntivirus DetectionReputation
        http://213.209.129.92/lickmynutsnigah.sh;arm5.fkunigr.elffalse
          high
          http://schemas.xmlsoap.org/soap/encoding/arm5.fkunigr.elffalse
            high
            https://i.imgur.com/0r0MYas.gifarm5.fkunigr.elffalse
              high
              http://schemas.xmlsoap.org/soap/envelope/arm5.fkunigr.elffalse
                high
                No contacted IP infos
                No context
                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                daisy.ubuntu.comarm6.fkunigr.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.24
                ppc.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.24
                arm7.fkunigr.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.25
                mips.fkunigr.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.24
                m68k.fkunigr.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.24
                ppc.fkunigr.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.24
                arm6.elfGet hashmaliciousMirai, MoobotBrowse
                • 162.213.35.24
                sh4.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.25
                aarch64.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.25
                arm7.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.24
                No context
                No context
                No context
                No created / dropped files found
                File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), dynamically linked, interpreter /lib/ld-uClibc.so.0, stripped
                Entropy (8bit):6.213754171191761
                TrID:
                • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                File name:arm5.fkunigr.elf
                File size:50'432 bytes
                MD5:17132228a3ee944ab5e4f8bd0d5028cb
                SHA1:84889cced41a3065c93dd15dd780e39d4d6803c0
                SHA256:65fc904026b789df31ba719dc90a5cf36103934d089518b39f35781d73e91609
                SHA512:2ff9c49aa22c266fab012b3bfed03da7ef522b52101e7ca68e660f5633251b6345c21d8fb2e7aa1178f17090c15f662ba241b690167e6ced5c96442ebf7520a6
                SSDEEP:768:otPNcOrqsn9kOShMXUYpef+UG5xgJLL6hwsWQPcq22sh5zbOWlBCh3rKE0N7yNXu:o7qsnEhEUY8G5xg1O9W4B220+uV23O
                TLSH:D2332B54F8915B26C1D12276BA6E9A8D372193E8C3CF73139C706B347A8651F1DA2F84
                File Content Preview:.ELF...a..........(.....0...4...0.......4. ...(.........4...4...4...................................................................@...@...............................T...........................................Q.td............................/lib/ld-uCl

                ELF header

                Class:ELF32
                Data:2's complement, little endian
                Version:1 (current)
                Machine:ARM
                Version Number:0x1
                Type:EXEC (Executable file)
                OS/ABI:ARM - ABI
                ABI Version:0
                Entry Point Address:0x9030
                Flags:0x2
                ELF Header Size:52
                Program Header Offset:52
                Program Header Size:32
                Number of Program Headers:6
                Section Header Offset:49712
                Section Header Size:40
                Number of Section Headers:18
                Header String Table Index:17
                NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                NULL0x00x00x00x00x0000
                .interpPROGBITS0x80f40xf40x140x00x2A001
                .hashHASH0x81080x1080x24c0x40x2A304
                .dynsymDYNSYM0x83540x3540x4e00x100x2A414
                .dynstrSTRTAB0x88340x8340x2b80x00x2A001
                .rel.pltREL0x8aec0xaec0x1b00x80x2A374
                .initPROGBITS0x8c9c0xc9c0x180x00x6AX004
                .pltPROGBITS0x8cb40xcb40x29c0x40x6AX004
                .textPROGBITS0x8f500xf500x96240x00x6AX004
                .finiPROGBITS0x125740xa5740x140x00x6AX004
                .rodataPROGBITS0x125880xa5880x17b80x00x2A004
                .ctorsPROGBITS0x1c0000xc0000x80x00x3WA004
                .dtorsPROGBITS0x1c0080xc0080x80x00x3WA004
                .dynamicDYNAMIC0x1c0140xc0140xa00x80x3WA404
                .gotPROGBITS0x1c0b40xc0b40xe40x40x3WA004
                .dataPROGBITS0x1c1980xc1980x240x00x3WA004
                .bssNOBITS0x1c1bc0xc1bc0x2980x00x3WA004
                .shstrtabSTRTAB0x00xc1bc0x730x00x0001
                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                PHDR0x340x80340x80340xc00xc02.13000x5R E0x4
                INTERP0xf40x80f40x80f40x140x143.68420x4R 0x1/lib/ld-uClibc.so.0.interp
                LOAD0x00x80000x80000xbd400xbd406.30720x5R E0x8000.interp .hash .dynsym .dynstr .rel.plt .init .plt .text .fini .rodata
                LOAD0xc0000x1c0000x1c0000x1bc0x4542.25620x6RW 0x8000.ctors .dtors .dynamic .got .data .bss
                DYNAMIC0xc0140x1c0140x1c0140xa00xa01.95420x6RW 0x4.dynamic
                GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
                TypeMetaValueTag
                DT_NEEDEDsharedliblibpthread.so.00x1
                DT_NEEDEDsharedliblibc.so.00x1
                DT_INITvalue0x8c9c0xc
                DT_FINIvalue0x125740xd
                DT_HASHvalue0x81080x4
                DT_STRTABvalue0x88340x5
                DT_SYMTABvalue0x83540x6
                DT_STRSZbytes6960xa
                DT_SYMENTbytes160xb
                DT_DEBUGvalue0x00x15
                DT_PLTGOTvalue0x1c0b40x3
                DT_PLTRELSZbytes4320x2
                DT_PLTRELpltrelDT_REL0x14
                DT_JMPRELvalue0x8aec0x17
                DT_NULLvalue0x00x0
                NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
                .dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                _Jv_RegisterClasses.dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                __aeabi_idiv0.dynsym0x124e44FUNC<unknown>DEFAULT8
                __aeabi_ldiv0.dynsym0x124e44FUNC<unknown>DEFAULT8
                __aeabi_uidiv.dynsym0x122240FUNC<unknown>DEFAULT8
                __aeabi_uidivmod.dynsym0x1231c24FUNC<unknown>DEFAULT8
                __bss_end__.dynsym0x1c4540NOTYPE<unknown>DEFAULTSHN_ABS
                __bss_start.dynsym0x1c1bc0NOTYPE<unknown>DEFAULTSHN_ABS
                __bss_start__.dynsym0x1c1bc0NOTYPE<unknown>DEFAULTSHN_ABS
                __data_start.dynsym0x1c1980NOTYPE<unknown>DEFAULT17
                __deregister_frame_info.dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                __div0.dynsym0x124e44FUNC<unknown>DEFAULT8
                __end__.dynsym0x1c4540NOTYPE<unknown>DEFAULTSHN_ABS
                __errno_location.dynsym0x8eb416FUNC<unknown>DEFAULTSHN_UNDEF
                __modsi3.dynsym0x12400228FUNC<unknown>DEFAULT8
                __muldi3.dynsym0x124e880FUNC<unknown>DEFAULT8
                __register_frame_info.dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                __uClibc_main.dynsym0x8e60488FUNC<unknown>DEFAULTSHN_UNDEF
                __udivsi3.dynsym0x12224248FUNC<unknown>DEFAULT8
                __umodsi3.dynsym0x12334204FUNC<unknown>DEFAULT8
                _bss_end__.dynsym0x1c4540NOTYPE<unknown>DEFAULTSHN_ABS
                _edata.dynsym0x1c1bc0NOTYPE<unknown>DEFAULTSHN_ABS
                _end.dynsym0x1c4540NOTYPE<unknown>DEFAULTSHN_ABS
                _fini.dynsym0x125744FUNC<unknown>DEFAULT9
                _init.dynsym0x8c9c4FUNC<unknown>DEFAULT6
                _start.dynsym0x903080FUNC<unknown>DEFAULT8
                abort.dynsym0x8dac352FUNC<unknown>DEFAULTSHN_UNDEF
                accept.dynsym0x8db876FUNC<unknown>DEFAULTSHN_UNDEF
                bind.dynsym0x8de844FUNC<unknown>DEFAULTSHN_UNDEF
                calloc.dynsym0x8dc488FUNC<unknown>DEFAULTSHN_UNDEF
                clock.dynsym0x8ee452FUNC<unknown>DEFAULTSHN_UNDEF
                close.dynsym0x8f2060FUNC<unknown>DEFAULTSHN_UNDEF
                closedir.dynsym0x8efc196FUNC<unknown>DEFAULTSHN_UNDEF
                connect.dynsym0x8cf876FUNC<unknown>DEFAULTSHN_UNDEF
                exit.dynsym0x8ec0172FUNC<unknown>DEFAULTSHN_UNDEF
                fcntl.dynsym0x8f0888FUNC<unknown>DEFAULTSHN_UNDEF
                fork.dynsym0x8e54452FUNC<unknown>DEFAULTSHN_UNDEF
                free.dynsym0x8f2c288FUNC<unknown>DEFAULTSHN_UNDEF
                getpid.dynsym0x8d2844FUNC<unknown>DEFAULTSHN_UNDEF
                getppid.dynsym0x8e8444FUNC<unknown>DEFAULTSHN_UNDEF
                getsockname.dynsym0x8f4444FUNC<unknown>DEFAULTSHN_UNDEF
                getsockopt.dynsym0x8ea848FUNC<unknown>DEFAULTSHN_UNDEF
                inet_addr.dynsym0x8df436FUNC<unknown>DEFAULTSHN_UNDEF
                ioctl.dynsym0x8cd480FUNC<unknown>DEFAULTSHN_UNDEF
                kill.dynsym0x8ddc44FUNC<unknown>DEFAULTSHN_UNDEF
                listen.dynsym0x8e4844FUNC<unknown>DEFAULTSHN_UNDEF
                malloc.dynsym0x8d4c400FUNC<unknown>DEFAULTSHN_UNDEF
                memcpy.dynsym0x8d344FUNC<unknown>DEFAULTSHN_UNDEF
                memmove.dynsym0x8d1c4FUNC<unknown>DEFAULTSHN_UNDEF
                memset.dynsym0x8e6c156FUNC<unknown>DEFAULTSHN_UNDEF
                open.dynsym0x8ed888FUNC<unknown>DEFAULTSHN_UNDEF
                opendir.dynsym0x8e9c264FUNC<unknown>DEFAULTSHN_UNDEF
                pthread_create.dynsym0x8d04208FUNC<unknown>DEFAULTSHN_UNDEF
                pthread_join.dynsym0x8f14508FUNC<unknown>DEFAULTSHN_UNDEF
                rand.dynsym0x8e0c4FUNC<unknown>DEFAULTSHN_UNDEF
                read.dynsym0x8e2476FUNC<unknown>DEFAULTSHN_UNDEF
                readdir.dynsym0x8d88224FUNC<unknown>DEFAULTSHN_UNDEF
                readlink.dynsym0x8d4044FUNC<unknown>DEFAULTSHN_UNDEF
                realloc.dynsym0x8e3c312FUNC<unknown>DEFAULTSHN_UNDEF
                recv.dynsym0x8cec84FUNC<unknown>DEFAULTSHN_UNDEF
                recvfrom.dynsym0x8d64100FUNC<unknown>DEFAULTSHN_UNDEF
                select.dynsym0x8d7c48FUNC<unknown>DEFAULTSHN_UNDEF
                send.dynsym0x8da084FUNC<unknown>DEFAULTSHN_UNDEF
                sendto.dynsym0x8e30100FUNC<unknown>DEFAULTSHN_UNDEF
                setsid.dynsym0x8ef044FUNC<unknown>DEFAULTSHN_UNDEF
                setsockopt.dynsym0x8e0048FUNC<unknown>DEFAULTSHN_UNDEF
                sigaddset.dynsym0x8d9448FUNC<unknown>DEFAULTSHN_UNDEF
                sigemptyset.dynsym0x8d1024FUNC<unknown>DEFAULTSHN_UNDEF
                signal.dynsym0x8e18200FUNC<unknown>DEFAULTSHN_UNDEF
                sigprocmask.dynsym0x8f3884FUNC<unknown>DEFAULTSHN_UNDEF
                sleep.dynsym0x8d58420FUNC<unknown>DEFAULTSHN_UNDEF
                socket.dynsym0x8d7044FUNC<unknown>DEFAULTSHN_UNDEF
                srand.dynsym0x8e78148FUNC<unknown>DEFAULTSHN_UNDEF
                strcpy.dynsym0x8cc828FUNC<unknown>DEFAULTSHN_UNDEF
                strlen.dynsym0x8ecc96FUNC<unknown>DEFAULTSHN_UNDEF
                sysconf.dynsym0x8ce0944FUNC<unknown>DEFAULTSHN_UNDEF
                time.dynsym0x8e9044FUNC<unknown>DEFAULTSHN_UNDEF
                write.dynsym0x8dd076FUNC<unknown>DEFAULTSHN_UNDEF

                Download Network PCAP: filteredfull

                TimestampSource PortDest PortSource IPDest IP
                Mar 24, 2025 09:07:55.772934914 CET4110053192.168.2.131.1.1.1
                Mar 24, 2025 09:07:55.772996902 CET3470353192.168.2.131.1.1.1
                Mar 24, 2025 09:07:55.872415066 CET53411001.1.1.1192.168.2.13
                Mar 24, 2025 09:07:55.873590946 CET53347031.1.1.1192.168.2.13
                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                Mar 24, 2025 09:07:55.772934914 CET192.168.2.131.1.1.10x1846Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                Mar 24, 2025 09:07:55.772996902 CET192.168.2.131.1.1.10x6e87Standard query (0)daisy.ubuntu.com28IN (0x0001)false
                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                Mar 24, 2025 09:07:55.872415066 CET1.1.1.1192.168.2.130x1846No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
                Mar 24, 2025 09:07:55.872415066 CET1.1.1.1192.168.2.130x1846No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false

                System Behavior

                Start time (UTC):08:05:10
                Start date (UTC):24/03/2025
                Path:/tmp/arm5.fkunigr.elf
                Arguments:/tmp/arm5.fkunigr.elf
                File size:4956856 bytes
                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1