Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
g4za.arm5.elf

Overview

General Information

Sample name:g4za.arm5.elf
Analysis ID:1646912
MD5:f5abfa9432605ac8e6771ee056b5a882
SHA1:adfc1e1658876704138a89be82804d666493e94b
SHA256:1d57e41b6ee2ff6607130ad6007fcd7b79be180e0ef7d545ec5f2f17eb0c0738
Tags:elfuser-rollcalcifer
Infos:

Detection

Mirai
Score:72
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Executes the "systemctl" command used for controlling the systemd system and service manager
Reads system version information
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1646912
Start date and time:2025-03-24 12:29:10 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 10m 38s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:g4za.arm5.elf
Detection:MAL
Classification:mal72.troj.linELF@0/0@2/0
Cookbook Comments:
  • Analysis time extended to 480s due to sleep detection in submitted sample
  • Max analysis timeout: 600s exceeded, the analysis took too long

Runtime Messages

Command:/tmp/g4za.arm5.elf
PID:5702
Exit Code:255
Exit Code Info:
Killed:False
Standard Output:

Standard Error:/lib/ld-uClibc.so.0: No such file or directory

Process Tree

  • system is lnxubuntu20
  • g4za.arm5.elf (PID: 5702, Parent: 5507, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/g4za.arm5.elf
  • systemd New Fork (PID: 5736, Parent: 1)
  • snap-failure (PID: 5736, Parent: 1, MD5: 69136a7d575731ce62349f2e4d3e5c36) Arguments: /usr/lib/snapd/snap-failure snapd
    • systemctl (PID: 5753, Parent: 5736, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl stop snapd.socket
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
g4za.arm5.elfJoeSecurity_Mirai_5Yara detected MiraiJoe Security
    g4za.arm5.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
    • 0xea84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xea98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xeaac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xeac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xead4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xeae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xeafc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xeb10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xeb24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xeb38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xeb4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xeb60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xeb74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xeb88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xeb9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xebb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xebc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xebd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xebec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xec00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xec14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    g4za.arm5.elfMAL_ELF_LNX_Mirai_Oct10_2Detects ELF malware Mirai relatedFlorian Roth
    • 0xea04:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    5702.1.00007efd3c017000.00007efd3c027000.r-x.sdmpJoeSecurity_Mirai_5Yara detected MiraiJoe Security
      5702.1.00007efd3c017000.00007efd3c027000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0xea84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xea98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xeaac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xeac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xead4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xeae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xeafc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xeb10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xeb24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xeb38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xeb4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xeb60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xeb74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xeb88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xeb9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xebb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xebc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xebd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xebec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xec00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xec14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      5702.1.00007efd3c017000.00007efd3c027000.r-x.sdmpMAL_ELF_LNX_Mirai_Oct10_2Detects ELF malware Mirai relatedFlorian Roth
      • 0xea04:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
      Process Memory Space: g4za.arm5.elf PID: 5702Linux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0x163ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x163c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x163d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x163e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x163fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16411:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16425:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16439:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x1644d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16461:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16475:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16489:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x1649d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x164b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x164c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x164d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x164ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16501:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16515:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16529:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x1653d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

      Suricata Signatures

      ⊘No Suricata rule has matched

      Joe Sandbox Signatures

      • • AV Detection
      • • Networking
      • • System Summary
      • • Persistence and Installation Behavior
      • • Malware Analysis System Evasion
      • • Stealing of Sensitive Information
      • • Remote Access Functionality

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Source: g4za.arm5.elfAvira: detected
      Source: g4za.arm5.elfVirustotal: Detection: 64%Perma Link
      Source: g4za.arm5.elfReversingLabs: Detection: 66%
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com

      System Summary

      barindex
      Source: g4za.arm5.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: g4za.arm5.elf, type: SAMPLEMatched rule: Detects ELF malware Mirai related Author: Florian Roth
      Source: 5702.1.00007efd3c017000.00007efd3c027000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 5702.1.00007efd3c017000.00007efd3c027000.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
      Source: Process Memory Space: g4za.arm5.elf PID: 5702, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: ELF static info symbol of initial sample.symtab present: no
      Source: g4za.arm5.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: g4za.arm5.elf, type: SAMPLEMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
      Source: 5702.1.00007efd3c017000.00007efd3c027000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 5702.1.00007efd3c017000.00007efd3c027000.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
      Source: Process Memory Space: g4za.arm5.elf PID: 5702, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: classification engineClassification label: mal72.troj.linELF@0/0@2/0
      Source: /usr/lib/snapd/snap-failure (PID: 5753)Systemctl executable: /usr/bin/systemctl -> systemctl stop snapd.socketJump to behavior
      Source: /usr/lib/snapd/snap-failure (PID: 5736)Reads version info: /proc/versionJump to behavior
      Source: /tmp/g4za.arm5.elf (PID: 5702)Queries kernel information via 'uname': Jump to behavior
      Source: g4za.arm5.elf, 5702.1.00007fff92c80000.00007fff92ca1000.rw-.sdmpBinary or memory string: qemu: %s: %s
      Source: g4za.arm5.elf, 5702.1.0000564d24080000.0000564d241ae000.rw-.sdmpBinary or memory string: s$MVPu$MVPr$MV!/etc/qemu-binfmt/arm
      Source: g4za.arm5.elf, 5702.1.00007fff92c80000.00007fff92ca1000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/g4za.arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/g4za.arm5.elf
      Source: g4za.arm5.elf, 5702.1.00007fff92c80000.00007fff92ca1000.rw-.sdmpBinary or memory string: ~leqemu: %s: %s
      Source: g4za.arm5.elf, 5702.1.0000564d24080000.0000564d241ae000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
      Source: g4za.arm5.elf, 5702.1.00007fff92c80000.00007fff92ca1000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
      Source: g4za.arm5.elf, 5702.1.0000564d24080000.0000564d241ae000.rw-.sdmpBinary or memory string: rg.qemu.gdb.arm.sys.regs">
      Source: g4za.arm5.elf, 5702.1.0000564d24080000.0000564d241ae000.rw-.sdmpBinary or memory string: $MVrg.qemu.gdb.arm.sys.regs">

      Stealing of Sensitive Information

      barindex
      Source: Yara matchFile source: g4za.arm5.elf, type: SAMPLE
      Source: Yara matchFile source: 5702.1.00007efd3c017000.00007efd3c027000.r-x.sdmp, type: MEMORY

      Remote Access Functionality

      barindex
      Source: Yara matchFile source: g4za.arm5.elf, type: SAMPLE
      Source: Yara matchFile source: 5702.1.00007efd3c017000.00007efd3c027000.r-x.sdmp, type: MEMORY

      Mitre Att&ck Matrix

      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
      Systemd Service      		1
      Systemd Service      		Direct Volume AccessOS Credential Dumping11
      Security Software Discovery      		Remote ServicesData from Local System1
      Non-Application Layer Protocol      		Exfiltration Over Other Network MediumAbuse Accessibility Features
      CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory1
      System Information Discovery      		Remote Desktop ProtocolData from Removable Media1
      Application Layer Protocol      		Exfiltration Over BluetoothNetwork Denial of Service

      Malware Configuration

      ⊘No configs have been found

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Number of created Files
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1646912 Sample: g4za.arm5.elf Startdate: 24/03/2025 Architecture: LINUX Score: 72 15 daisy.ubuntu.com 2->15 17 Malicious sample detected (through community Yara rule) 2->17 19 Antivirus / Scanner detection for submitted sample 2->19 21 Multi AV Scanner detection for submitted file 2->21 23 Yara detected Mirai 2->23 7 systemd snap-failure 2->7         started        9 g4za.arm5.elf 2->9         started        signatures3 process4 process5 11 snap-failure systemctl 7->11         started        13 snap-failure 7->13         started       

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      g4za.arm5.elf64%VirustotalBrowse
      g4za.arm5.elf67%ReversingLabsLinux.Trojan.Mirai
      g4za.arm5.elf100%AviraEXP/ELF.Mirai.H

      Dropped Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      ⊘No Antivirus matches

      Domains and IPs

      Download Network PCAP: filtered – full

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      daisy.ubuntu.com
      		162.213.35.24
      		truefalse
        		high

        World Map of Contacted IPs

        ⊘No contacted IP infos

        Joe Sandbox View / Context

        IPs

        ⊘No context

        Domains

        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        daisy.ubuntu.comg4za.arm6.elfGet hashmaliciousMiraiBrowse
        • 162.213.35.25
        .i.elfGet hashmaliciousUnknownBrowse
        • 162.213.35.25
        arm5.fkunigr.elfGet hashmaliciousMiraiBrowse
        • 162.213.35.24
        arm6.fkunigr.elfGet hashmaliciousMiraiBrowse
        • 162.213.35.24
        ppc.elfGet hashmaliciousUnknownBrowse
        • 162.213.35.24
        arm7.fkunigr.elfGet hashmaliciousMiraiBrowse
        • 162.213.35.25
        mips.fkunigr.elfGet hashmaliciousMiraiBrowse
        • 162.213.35.24
        m68k.fkunigr.elfGet hashmaliciousMiraiBrowse
        • 162.213.35.24
        ppc.fkunigr.elfGet hashmaliciousMiraiBrowse
        • 162.213.35.24
        arm6.elfGet hashmaliciousMirai, MoobotBrowse
        • 162.213.35.24

        ASNs

        ⊘No context

        JA3 Fingerprints

        ⊘No context

        Dropped Files

        ⊘No context

        Created / dropped Files

        ⊘No created / dropped files found

        Static File Info

        General

        File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), dynamically linked, interpreter /lib/ld-uClibc.so.0, stripped
        Entropy (8bit):6.153851836674991
        TrID:
        • ELF Executable and Linkable format (generic) (4004/1) 100.00%
        File name:g4za.arm5.elf
        File size:64'832 bytes
        MD5:f5abfa9432605ac8e6771ee056b5a882
        SHA1:adfc1e1658876704138a89be82804d666493e94b
        SHA256:1d57e41b6ee2ff6607130ad6007fcd7b79be180e0ef7d545ec5f2f17eb0c0738
        SHA512:21c040b91f916d286748dc53c2743177e4f9a4c0f3e1f42f95710aed6cf6b20d2c39636ad6a7874fadbb51eee81b48ee2c21039f4f573372939f42ea41143b13
        SSDEEP:1536:jffgHhV2gKLExnNrnDKbO2l33eZto9aochK:jffgHhV2aGF3w9h
        TLSH:F753E7C1BC41A629C7E01777F99F559E3300A7C9E1DA72178C240BA47A8B94F0D67F8A
        File Content Preview:.ELF...a..........(.....D...4...p.......4. ...(.........4...4...4...................................................................\...\...............`...`...`.......................t...t...t...................Q.td............................/lib/ld-uCl

        Static ELF Info

        ELF header

        Class:ELF32
        Data:2's complement, little endian
        Version:1 (current)
        Machine:ARM
        Version Number:0x1
        Type:EXEC (Executable file)
        OS/ABI:ARM - ABI
        ABI Version:0
        Entry Point Address:0x8e44
        Flags:0x2
        ELF Header Size:52
        Program Header Offset:52
        Program Header Size:32
        Number of Program Headers:6
        Section Header Offset:64112
        Section Header Size:40
        Number of Section Headers:18
        Header String Table Index:17

        Sections

        NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
        NULL0x00x00x00x00x0000
        .interpPROGBITS0x80f40xf40x140x00x2A001
        .hashHASH0x81080x1080x2200x40x2A304
        .dynsymDYNSYM0x83280x3280x4300x100x2A414
        .dynstrSTRTAB0x87580x7580x21f0x00x2A001
        .rel.pltREL0x89780x9780x1800x80x2A374
        .initPROGBITS0x8af80xaf80x180x00x6AX004
        .pltPROGBITS0x8b100xb100x2540x40x6AX004
        .textPROGBITS0x8d640xd640xdc880x00x6AX004
        .finiPROGBITS0x169ec0xe9ec0x140x00x6AX004
        .rodataPROGBITS0x16a000xea000xe5c0x00x2A004
        .ctorsPROGBITS0x1f8600xf8600x80x00x3WA004
        .dtorsPROGBITS0x1f8680xf8680x80x00x3WA004
        .dynamicDYNAMIC0x1f8740xf8740x980x80x3WA404
        .gotPROGBITS0x1f90c0xf90c0xcc0x40x3WA004
        .dataPROGBITS0x1f9d80xf9d80x240x00x3WA004
        .bssNOBITS0x1f9fc0xf9fc0x3440x00x3WA004
        .shstrtabSTRTAB0x00xf9fc0x730x00x0001

        Program Segments

        TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
        PHDR0x340x80340x80340xc00xc02.24600x5R E0x4
        INTERP0xf40x80f40x80f40x140x143.68420x4R 0x1/lib/ld-uClibc.so.0.interp
        LOAD0x00x80000x80000xf85c0xf85c6.18500x5R E0x8000.interp .hash .dynsym .dynstr .rel.plt .init .plt .text .fini .rodata
        LOAD0xf8600x1f8600x1f8600x19c0x4e02.28860x6RW 0x8000.ctors .dtors .dynamic .got .data .bss
        DYNAMIC0xf8740x1f8740x1f8740x980x981.91150x6RW 0x4.dynamic
        GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

        Dynamic Tags

        TypeMetaValueTag
        DT_NEEDEDsharedliblibc.so.00x1
        DT_INITvalue0x8af80xc
        DT_FINIvalue0x169ec0xd
        DT_HASHvalue0x81080x4
        DT_STRTABvalue0x87580x5
        DT_SYMTABvalue0x83280x6
        DT_STRSZbytes5430xa
        DT_SYMENTbytes160xb
        DT_DEBUGvalue0x00x15
        DT_PLTGOTvalue0x1f90c0x3
        DT_PLTRELSZbytes3840x2
        DT_PLTRELpltrelDT_REL0x14
        DT_JMPRELvalue0x89780x17
        DT_NULLvalue0x00x0

        Symbols

        NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
        .dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
        __aeabi_idiv0.dynsym0x169ac4FUNC<unknown>DEFAULT8
        __aeabi_ldiv0.dynsym0x169ac4FUNC<unknown>DEFAULT8
        __aeabi_uidiv.dynsym0x166ec0FUNC<unknown>DEFAULT8
        __aeabi_uidivmod.dynsym0x167e424FUNC<unknown>DEFAULT8
        __bss_end__.dynsym0x1fd400NOTYPE<unknown>DEFAULTSHN_ABS
        __bss_start.dynsym0x1f9fc0NOTYPE<unknown>DEFAULTSHN_ABS
        __bss_start__.dynsym0x1f9fc0NOTYPE<unknown>DEFAULTSHN_ABS
        __data_start.dynsym0x1f9d80NOTYPE<unknown>DEFAULT17
        __div0.dynsym0x169ac4FUNC<unknown>DEFAULT8
        __end__.dynsym0x1fd400NOTYPE<unknown>DEFAULTSHN_ABS
        __errno_location.dynsym0x8ce032FUNC<unknown>DEFAULTSHN_UNDEF
        __modsi3.dynsym0x168c8228FUNC<unknown>DEFAULT8
        __uClibc_main.dynsym0x8c98488FUNC<unknown>DEFAULTSHN_UNDEF
        __udivsi3.dynsym0x166ec248FUNC<unknown>DEFAULT8
        __umodsi3.dynsym0x167fc204FUNC<unknown>DEFAULT8
        _bss_end__.dynsym0x1fd400NOTYPE<unknown>DEFAULTSHN_ABS
        _edata.dynsym0x1f9fc0NOTYPE<unknown>DEFAULTSHN_ABS
        _end.dynsym0x1fd400NOTYPE<unknown>DEFAULTSHN_ABS
        _start.dynsym0x8e4480FUNC<unknown>DEFAULT8
        abort.dynsym0x8c08352FUNC<unknown>DEFAULTSHN_UNDEF
        bind.dynsym0x8c2c44FUNC<unknown>DEFAULTSHN_UNDEF
        calloc.dynsym0x8c1488FUNC<unknown>DEFAULTSHN_UNDEF
        clock.dynsym0x8d0452FUNC<unknown>DEFAULTSHN_UNDEF
        close.dynsym0x8d3444FUNC<unknown>DEFAULTSHN_UNDEF
        closedir.dynsym0x8d1c196FUNC<unknown>DEFAULTSHN_UNDEF
        connect.dynsym0x8b4844FUNC<unknown>DEFAULTSHN_UNDEF
        exit.dynsym0x8cec172FUNC<unknown>DEFAULTSHN_UNDEF
        fcntl.dynsym0x8d28116FUNC<unknown>DEFAULTSHN_UNDEF
        fork.dynsym0x8c8c44FUNC<unknown>DEFAULTSHN_UNDEF
        free.dynsym0x8d40288FUNC<unknown>DEFAULTSHN_UNDEF
        getpid.dynsym0x8b7844FUNC<unknown>DEFAULTSHN_UNDEF
        getppid.dynsym0x8cb044FUNC<unknown>DEFAULTSHN_UNDEF
        getsockname.dynsym0x8d5844FUNC<unknown>DEFAULTSHN_UNDEF
        getsockopt.dynsym0x8cd448FUNC<unknown>DEFAULTSHN_UNDEF
        inet_addr.dynsym0x8c3836FUNC<unknown>DEFAULTSHN_UNDEF
        ioctl.dynsym0x8b2480FUNC<unknown>DEFAULTSHN_UNDEF
        kill.dynsym0x8c2044FUNC<unknown>DEFAULTSHN_UNDEF
        listen.dynsym0x8c8044FUNC<unknown>DEFAULTSHN_UNDEF
        malloc.dynsym0x8ba8400FUNC<unknown>DEFAULTSHN_UNDEF
        memcpy.dynsym0x8b904FUNC<unknown>DEFAULTSHN_UNDEF
        memmove.dynsym0x8b604FUNC<unknown>DEFAULTSHN_UNDEF
        memset.dynsym0x8ca4156FUNC<unknown>DEFAULTSHN_UNDEF
        open.dynsym0x8cf892FUNC<unknown>DEFAULTSHN_UNDEF
        opendir.dynsym0x8cc8264FUNC<unknown>DEFAULTSHN_UNDEF
        prctl.dynsym0x8b8448FUNC<unknown>DEFAULTSHN_UNDEF
        printf.dynsym0x8b3076FUNC<unknown>DEFAULTSHN_UNDEF
        rand.dynsym0x04FUNC<unknown>DEFAULTSHN_UNDEF
        read.dynsym0x8c5c44FUNC<unknown>DEFAULTSHN_UNDEF
        readdir.dynsym0x8be4224FUNC<unknown>DEFAULTSHN_UNDEF
        readlink.dynsym0x8b9c44FUNC<unknown>DEFAULTSHN_UNDEF
        realloc.dynsym0x8c74312FUNC<unknown>DEFAULTSHN_UNDEF
        recv.dynsym0x8b3c44FUNC<unknown>DEFAULTSHN_UNDEF
        recvfrom.dynsym0x8bc052FUNC<unknown>DEFAULTSHN_UNDEF
        select.dynsym0x8bd848FUNC<unknown>DEFAULTSHN_UNDEF
        send.dynsym0x8bfc44FUNC<unknown>DEFAULTSHN_UNDEF
        sendto.dynsym0x8c6852FUNC<unknown>DEFAULTSHN_UNDEF
        setsid.dynsym0x8d1044FUNC<unknown>DEFAULTSHN_UNDEF
        setsockopt.dynsym0x8c4448FUNC<unknown>DEFAULTSHN_UNDEF
        sigaddset.dynsym0x8bf048FUNC<unknown>DEFAULTSHN_UNDEF
        sigemptyset.dynsym0x8b5424FUNC<unknown>DEFAULTSHN_UNDEF
        signal.dynsym0x8c50200FUNC<unknown>DEFAULTSHN_UNDEF
        sigprocmask.dynsym0x8d4c84FUNC<unknown>DEFAULTSHN_UNDEF
        sleep.dynsym0x8bb4420FUNC<unknown>DEFAULTSHN_UNDEF
        socket.dynsym0x8bcc44FUNC<unknown>DEFAULTSHN_UNDEF
        time.dynsym0x8cbc44FUNC<unknown>DEFAULTSHN_UNDEF
        usleep.dynsym0x8b6c76FUNC<unknown>DEFAULTSHN_UNDEF

        Network Behavior

        Download Network PCAP: filtered – full

        TimestampSource PortDest PortSource IPDest IP
        Mar 24, 2025 12:33:30.002816916 CET5878753192.168.2.131.1.1.1
        Mar 24, 2025 12:33:30.002883911 CET5291953192.168.2.131.1.1.1
        Mar 24, 2025 12:33:30.103692055 CET53587871.1.1.1192.168.2.13
        Mar 24, 2025 12:33:30.143904924 CET53529191.1.1.1192.168.2.13

        DNS Queries

        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
        Mar 24, 2025 12:33:30.002816916 CET192.168.2.131.1.1.10x95dbStandard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
        Mar 24, 2025 12:33:30.002883911 CET192.168.2.131.1.1.10x57bfStandard query (0)daisy.ubuntu.com28IN (0x0001)false

        DNS Answers

        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
        Mar 24, 2025 12:33:30.103692055 CET1.1.1.1192.168.2.130x95dbNo error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
        Mar 24, 2025 12:33:30.103692055 CET1.1.1.1192.168.2.130x95dbNo error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false

        System Behavior

        General

        Start time (UTC):11:30:44
        Start date (UTC):24/03/2025
        Path:/tmp/g4za.arm5.elf
        Arguments:/tmp/g4za.arm5.elf
        File size:4956856 bytes
        MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

        File Activities

        Process Activities

        System Activities


        General

        Start time (UTC):11:31:23
        Start date (UTC):24/03/2025
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Process Activities


        General

        Start time (UTC):11:31:23
        Start date (UTC):24/03/2025
        Path:/usr/lib/snapd/snap-failure
        Arguments:/usr/lib/snapd/snap-failure snapd
        File size:4764904 bytes
        MD5 hash:69136a7d575731ce62349f2e4d3e5c36

        File Activities

        Process Activities


        General

        Start time (UTC):11:31:23
        Start date (UTC):24/03/2025
        Path:/usr/lib/snapd/snap-failure
        Arguments:-
        File size:4764904 bytes
        MD5 hash:69136a7d575731ce62349f2e4d3e5c36

        Process Activities


        General

        Start time (UTC):11:31:23
        Start date (UTC):24/03/2025
        Path:/usr/bin/systemctl
        Arguments:systemctl stop snapd.socket
        File size:996584 bytes
        MD5 hash:4deddfb6741481f68aeac522cc26ff4b

        File Activities

        Network Activities


        General

        Start time (UTC):11:31:23
        Start date (UTC):24/03/2025
        Path:/usr/lib/snapd/snap-failure
        Arguments:-
        File size:4764904 bytes
        MD5 hash:69136a7d575731ce62349f2e4d3e5c36

        Process Activities