Edit tour

Linux Analysis Report
sh4.elf

Overview

General Information

Sample name:sh4.elf
Analysis ID:1647640
MD5:097d01ab25d5b41363e4ea8f79a6cbc7
SHA1:55ebb8825a5721f7e4cf14cc5ad82998c38a1c62
SHA256:3d5b4beaef358ee1de243bb0abc0a85ba9a5ee23478f3d3e27e1849a76d0ab9b
Tags:elfuser-abuse_ch
Infos:

Detection

Score:52
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Sample reads /proc/mounts (often used for finding a writable filesystem)
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1647640
Start date and time:2025-03-25 04:31:10 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 19s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:sh4.elf
Detection:MAL
Classification:mal52.troj.linELF@0/4@0/0
Command:/tmp/sh4.elf
PID:6265
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
For God so loved the world
Standard Error:
  • system is lnxubuntu20
  • sh4.elf (PID: 6265, Parent: 6190, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/sh4.elf
    • sh4.elf New Fork (PID: 6292, Parent: 6265)
  • dash New Fork (PID: 6270, Parent: 4331)
  • rm (PID: 6270, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.O8w13IpnD5 /tmp/tmp.cvuRfrGaCf /tmp/tmp.U2KbKcxjDU
  • dash New Fork (PID: 6271, Parent: 4331)
  • rm (PID: 6271, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.O8w13IpnD5 /tmp/tmp.cvuRfrGaCf /tmp/tmp.U2KbKcxjDU
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: sh4.elfReversingLabs: Detection: 22%
Source: /tmp/sh4.elf (PID: 6292)Socket: 127.0.0.1:22448Jump to behavior
Source: global trafficTCP traffic: 192.168.2.23:39256 -> 34.249.145.219:443
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: sh4.elf, 6265.1.00007f4790428000.00007f479042e000.rw-.sdmp, sh4.elf, 6292.1.00007f4790428000.00007f479042e000.rw-.sdmpString found in binary or memory: https://motd.ubuntu.com
Source: sh4.elf, 6265.1.00007f4790428000.00007f479042e000.rw-.sdmp, sh4.elf, 6292.1.00007f4790428000.00007f479042e000.rw-.sdmpString found in binary or memory: https://motd.ubuntu.comhe
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 39256 -> 443
Source: ELF static info symbol of initial sample.symtab present: no
Source: /tmp/sh4.elf (PID: 6265)SIGKILL sent: pid: 4438, result: successfulJump to behavior
Source: classification engineClassification label: mal52.troj.linELF@0/4@0/0

Persistence and Installation Behavior

barindex
Source: /tmp/sh4.elf (PID: 6265)File: /proc/6265/mountsJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1582/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1582/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/3088/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/230/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/110/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/231/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/111/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/232/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1579/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1579/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/112/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/233/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1699/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1699/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/113/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/234/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1335/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1335/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1698/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1698/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/114/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/235/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1334/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1334/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1576/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1576/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/2302/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/2302/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/115/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/236/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/116/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/237/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/117/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/118/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/910/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/119/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/912/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/912/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/10/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/2307/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/2307/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/11/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/918/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/918/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/12/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/13/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/14/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/15/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/16/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/17/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/18/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1594/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1594/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/120/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/121/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1349/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1349/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1/mapsJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/122/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/243/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/123/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/2/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/124/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/3/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/4/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/125/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/126/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1344/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1344/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1465/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1465/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1586/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1586/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/127/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/6/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/248/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/128/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/249/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1463/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1463/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/800/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/800/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/9/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/801/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/801/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/20/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/21/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1900/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/1900/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/22/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/23/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/6251/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/6251/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/24/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/25/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/26/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/27/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/28/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/29/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/491/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/491/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/250/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6265)File opened: /proc/130/cmdlineJump to behavior
Source: /usr/bin/dash (PID: 6270)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.O8w13IpnD5 /tmp/tmp.cvuRfrGaCf /tmp/tmp.U2KbKcxjDUJump to behavior
Source: /usr/bin/dash (PID: 6271)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.O8w13IpnD5 /tmp/tmp.cvuRfrGaCf /tmp/tmp.U2KbKcxjDUJump to behavior
Source: /tmp/sh4.elf (PID: 6265)Queries kernel information via 'uname': Jump to behavior
Source: sh4.elf, 6265.1.00007f4790428000.00007f479042e000.rw-.sdmp, sh4.elf, 6292.1.00007f4790428000.00007f479042e000.rw-.sdmpBinary or memory string: B!!a1gAWFxuAXsFWUgBRQAA!!a1gAWFxuAXsAWUgKRXgA!!a1gAWFxuAXsAWEgJR3IA!!a10CWFxuAHsGWVcWQHAA!!a10CWFxuAHsGWVcWQHUA!!aFwAWF9uA3sGW0gLRgAA!!aFwAWFlpG2QBW0gJTwAA!!qemu-arm2QBW0gJTwAA!
Source: sh4.elf, 6265.1.00007ffed2d13000.00007ffed2d34000.rw-.sdmp, sh4.elf, 6292.1.00007ffed2d13000.00007ffed2d34000.rw-.sdmpBinary or memory string: {x86_64/usr/bin/qemu-sh4/tmp/sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sh4.elf
Source: sh4.elf, 6265.1.00007ffed2d13000.00007ffed2d34000.rw-.sdmpBinary or memory string: /tmp/qemu-open.PPd2CX
Source: sh4.elf, 6292.1.00007f4790428000.00007f479042e000.rw-.sdmpBinary or memory string: vmware
Source: sh4.elf, 6265.1.00007f4790428000.00007f479042e000.rw-.sdmp, sh4.elf, 6292.1.00007f4790428000.00007f479042e000.rw-.sdmpBinary or memory string: qemu-arm
Source: sh4.elf, 6265.1.00007ffed2d13000.00007ffed2d34000.rw-.sdmp, sh4.elf, 6292.1.00007ffed2d13000.00007ffed2d34000.rw-.sdmpBinary or memory string: /usr/bin/qemu-sh4
Source: sh4.elf, 6265.1.00007ffed2d13000.00007ffed2d34000.rw-.sdmpBinary or memory string: U/tmp/qemu-open.PPd2CX\
Source: sh4.elf, 6265.1.000055f12be72000.000055f12bf1a000.rw-.sdmp, sh4.elf, 6292.1.000055f12be72000.000055f12bf1a000.rw-.sdmpBinary or memory string: U5!/etc/qemu-binfmt/sh4
Source: sh4.elf, 6265.1.000055f12be72000.000055f12bf1a000.rw-.sdmp, sh4.elf, 6292.1.000055f12be72000.000055f12bf1a000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/sh4
Source: sh4.elf, 6292.1.00007ffed2d13000.00007ffed2d34000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
File Deletion
1
OS Credential Dumping
11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory1
File and Directory Discovery
Remote Desktop ProtocolData from Removable Media1
Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1647640 Sample: sh4.elf Startdate: 25/03/2025 Architecture: LINUX Score: 52 16 109.202.202.202, 80 INIT7CH Switzerland 2->16 18 91.189.91.42, 443 CANONICAL-ASGB United Kingdom 2->18 20 34.249.145.219, 443 AMAZON-02US United States 2->20 22 Multi AV Scanner detection for submitted file 2->22 7 sh4.elf 2->7         started        10 dash rm 2->10         started        12 dash rm 2->12         started        signatures3 process4 signatures5 24 Sample reads /proc/mounts (often used for finding a writable filesystem) 7->24 14 sh4.elf 7->14         started        process6

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
sh4.elf22%ReversingLabsLinux.Backdoor.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
https://motd.ubuntu.comsh4.elf, 6265.1.00007f4790428000.00007f479042e000.rw-.sdmp, sh4.elf, 6292.1.00007f4790428000.00007f479042e000.rw-.sdmpfalse
    high
    https://motd.ubuntu.comhesh4.elf, 6265.1.00007f4790428000.00007f479042e000.rw-.sdmp, sh4.elf, 6292.1.00007f4790428000.00007f479042e000.rw-.sdmpfalse
      high
      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs
      IPDomainCountryFlagASNASN NameMalicious
      34.249.145.219
      unknownUnited States
      16509AMAZON-02USfalse
      109.202.202.202
      unknownSwitzerland
      13030INIT7CHfalse
      91.189.91.42
      unknownUnited Kingdom
      41231CANONICAL-ASGBfalse
      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      34.249.145.219na.elfGet hashmaliciousPrometeiBrowse
        na.elfGet hashmaliciousPrometeiBrowse
          na.elfGet hashmaliciousPrometeiBrowse
            i.elfGet hashmaliciousUnknownBrowse
              na.elfGet hashmaliciousPrometeiBrowse
                na.elfGet hashmaliciousPrometeiBrowse
                  na.elfGet hashmaliciousPrometeiBrowse
                    na.elfGet hashmaliciousPrometeiBrowse
                      na.elfGet hashmaliciousPrometeiBrowse
                        sshd.elfGet hashmaliciousUnknownBrowse
                          109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                          • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                          91.189.91.42main_arm.elfGet hashmaliciousMiraiBrowse
                            main_ppc.elfGet hashmaliciousMiraiBrowse
                              arm.elfGet hashmaliciousMiraiBrowse
                                na.elfGet hashmaliciousPrometeiBrowse
                                  na.elfGet hashmaliciousPrometeiBrowse
                                    na.elfGet hashmaliciousPrometeiBrowse
                                      na.elfGet hashmaliciousPrometeiBrowse
                                        na.elfGet hashmaliciousPrometeiBrowse
                                          i.elfGet hashmaliciousUnknownBrowse
                                            na.elfGet hashmaliciousPrometeiBrowse
                                              No context
                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              CANONICAL-ASGBmain_arm.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              main_ppc.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              main_x86.elfGet hashmaliciousMiraiBrowse
                                              • 185.125.190.26
                                              arm.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 91.189.91.42
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 91.189.91.42
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 91.189.91.42
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 91.189.91.42
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 91.189.91.42
                                              i.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              INIT7CHmain_arm.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              main_ppc.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              arm.elfGet hashmaliciousMiraiBrowse
                                              • 109.202.202.202
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 109.202.202.202
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 109.202.202.202
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 109.202.202.202
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 109.202.202.202
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 109.202.202.202
                                              i.elfGet hashmaliciousUnknownBrowse
                                              • 109.202.202.202
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 109.202.202.202
                                              AMAZON-02USarm.elfGet hashmaliciousMiraiBrowse
                                              • 54.171.230.55
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 52.212.150.54
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 52.212.150.54
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 34.249.145.219
                                              rShippingDocumentsCopies.exeGet hashmaliciousFormBookBrowse
                                              • 13.248.169.48
                                              SWIFT MT103.Pdf.exeGet hashmaliciousFormBookBrowse
                                              • 13.248.169.48
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 52.212.150.54
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 34.243.160.129
                                              i.elfGet hashmaliciousUnknownBrowse
                                              • 34.249.145.219
                                              P.O.exeGet hashmaliciousFormBookBrowse
                                              • 13.248.169.48
                                              No context
                                              No context
                                              Process:/tmp/sh4.elf
                                              File Type:ASCII text, with no line terminators
                                              Category:dropped
                                              Size (bytes):13
                                              Entropy (8bit):3.5465935642949384
                                              Encrypted:false
                                              SSDEEP:3:TgKYn:TgKYn
                                              MD5:AEF4020327A62D78F5A8202D453B0A74
                                              SHA1:84FC7A7CBE0B4EF5BDB927B95EA1BD01665BE8B1
                                              SHA-256:1878DDF74B755A998CBFD2140779771966ADF507D2B95CA86906476BFD80575B
                                              SHA-512:0E1BF58363F746F19B92730E15E2091F05A2C87B120B004F3819735F4D60268E66711EBEB06E3B771B2DE327FCBB3DDD368241E7A6E1A1B759384F6D70A2C528
                                              Malicious:false
                                              Reputation:moderate, very likely benign file
                                              Preview:/tmp/sh4.elf.
                                              Process:/tmp/sh4.elf
                                              File Type:ASCII text, with no line terminators
                                              Category:dropped
                                              Size (bytes):13
                                              Entropy (8bit):3.5465935642949384
                                              Encrypted:false
                                              SSDEEP:3:TgKYn:TgKYn
                                              MD5:AEF4020327A62D78F5A8202D453B0A74
                                              SHA1:84FC7A7CBE0B4EF5BDB927B95EA1BD01665BE8B1
                                              SHA-256:1878DDF74B755A998CBFD2140779771966ADF507D2B95CA86906476BFD80575B
                                              SHA-512:0E1BF58363F746F19B92730E15E2091F05A2C87B120B004F3819735F4D60268E66711EBEB06E3B771B2DE327FCBB3DDD368241E7A6E1A1B759384F6D70A2C528
                                              Malicious:false
                                              Reputation:moderate, very likely benign file
                                              Preview:/tmp/sh4.elf.
                                              Process:/tmp/sh4.elf
                                              File Type:ASCII text, with no line terminators
                                              Category:dropped
                                              Size (bytes):13
                                              Entropy (8bit):3.5465935642949384
                                              Encrypted:false
                                              SSDEEP:3:TgKYn:TgKYn
                                              MD5:AEF4020327A62D78F5A8202D453B0A74
                                              SHA1:84FC7A7CBE0B4EF5BDB927B95EA1BD01665BE8B1
                                              SHA-256:1878DDF74B755A998CBFD2140779771966ADF507D2B95CA86906476BFD80575B
                                              SHA-512:0E1BF58363F746F19B92730E15E2091F05A2C87B120B004F3819735F4D60268E66711EBEB06E3B771B2DE327FCBB3DDD368241E7A6E1A1B759384F6D70A2C528
                                              Malicious:false
                                              Reputation:moderate, very likely benign file
                                              Preview:/tmp/sh4.elf.
                                              Process:/tmp/sh4.elf
                                              File Type:ASCII text, with no line terminators
                                              Category:dropped
                                              Size (bytes):13
                                              Entropy (8bit):3.5465935642949384
                                              Encrypted:false
                                              SSDEEP:3:TgKYn:TgKYn
                                              MD5:AEF4020327A62D78F5A8202D453B0A74
                                              SHA1:84FC7A7CBE0B4EF5BDB927B95EA1BD01665BE8B1
                                              SHA-256:1878DDF74B755A998CBFD2140779771966ADF507D2B95CA86906476BFD80575B
                                              SHA-512:0E1BF58363F746F19B92730E15E2091F05A2C87B120B004F3819735F4D60268E66711EBEB06E3B771B2DE327FCBB3DDD368241E7A6E1A1B759384F6D70A2C528
                                              Malicious:false
                                              Reputation:moderate, very likely benign file
                                              Preview:/tmp/sh4.elf.
                                              File type:ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), dynamically linked, stripped
                                              Entropy (8bit):6.821251786309552
                                              TrID:
                                              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                              File name:sh4.elf
                                              File size:95'064 bytes
                                              MD5:097d01ab25d5b41363e4ea8f79a6cbc7
                                              SHA1:55ebb8825a5721f7e4cf14cc5ad82998c38a1c62
                                              SHA256:3d5b4beaef358ee1de243bb0abc0a85ba9a5ee23478f3d3e27e1849a76d0ab9b
                                              SHA512:e00073c3999236e84b16b67f0ce53c97950b6f54910bebd8cf99be4618ae4130ba950390bf236516a9e1bbad8ef7f63ee8ecab61bcc0ac6549fd7bcc4b5995c4
                                              SSDEEP:1536:QKvEmzwkMSkbC2LZ7ByfAqrRHWKQnOIGjrWUNYWhnxr:QshskkbC2vQlWH6lbhnl
                                              TLSH:B593AF32F8202D90CC266AF4F0B4CB79874259A184D21DB59DAED27044A7EDDF58EF68
                                              File Content Preview:.ELF..............*.......@.4....q......4. ...(...............@...@..f...f...............p...pB..pB.....PI............................................././"O.n......#.*@........#.*@.I..&O.n.l..................................././.../.a"O.!...n...a.b("...q.

                                              ELF header

                                              Class:ELF32
                                              Data:2's complement, little endian
                                              Version:1 (current)
                                              Machine:<unknown>
                                              Version Number:0x1
                                              Type:EXEC (Executable file)
                                              OS/ABI:UNIX - System V
                                              ABI Version:0
                                              Entry Point Address:0x4001a0
                                              Flags:0xc
                                              ELF Header Size:52
                                              Program Header Offset:52
                                              Program Header Size:32
                                              Number of Program Headers:3
                                              Section Header Offset:94664
                                              Section Header Size:40
                                              Number of Section Headers:10
                                              Header String Table Index:9
                                              NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                              NULL0x00x00x00x00x0000
                                              .initPROGBITS0x4000940x940x2e0x00x6AX004
                                              .textPROGBITS0x4000e00xe00x14a000x00x6AX0032
                                              .finiPROGBITS0x414ae00x14ae00x220x00x6AX004
                                              .rodataPROGBITS0x414b040x14b040x1bcc0x00x2A004
                                              .ctorsPROGBITS0x4270dc0x170dc0x80x00x3WA004
                                              .dtorsPROGBITS0x4270e40x170e40x80x00x3WA004
                                              .dataPROGBITS0x4270f00x170f00x980x00x3WA004
                                              .bssNOBITS0x4271880x171880x48a40x00x3WA004
                                              .shstrtabSTRTAB0x00x171880x3e0x00x0001
                                              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                              LOAD0x00x4000000x4000000x166d00x166d06.94160x5R E0x10000.init .text .fini .rodata
                                              LOAD0x170dc0x4270dc0x4270dc0xac0x49504.04200x6RW 0x10000.ctors .dtors .data .bss
                                              DYNAMIC0x00x00x00x00x00.00000x7RWE0x4

                                              Download Network PCAP: filteredfull

                                              • Total Packets: 5
                                              • 443 (HTTPS)
                                              • 80 (HTTP)
                                              TimestampSource PortDest PortSource IPDest IP
                                              Mar 25, 2025 04:32:23.964601040 CET39256443192.168.2.2334.249.145.219
                                              Mar 25, 2025 04:32:25.756361008 CET43928443192.168.2.2391.189.91.42
                                              Mar 25, 2025 04:32:42.394206047 CET4251680192.168.2.23109.202.202.202
                                              Mar 25, 2025 04:32:46.489602089 CET43928443192.168.2.2391.189.91.42
                                              Mar 25, 2025 04:33:27.444048882 CET43928443192.168.2.2391.189.91.42

                                              System Behavior

                                              Start time (UTC):03:32:26
                                              Start date (UTC):25/03/2025
                                              Path:/tmp/sh4.elf
                                              Arguments:-
                                              File size:4139976 bytes
                                              MD5 hash:8943e5f8f8c280467b4472c15ae93ba9

                                              Start time (UTC):03:32:25
                                              Start date (UTC):25/03/2025
                                              Path:/usr/bin/dash
                                              Arguments:-
                                              File size:129816 bytes
                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                              Start time (UTC):03:32:25
                                              Start date (UTC):25/03/2025
                                              Path:/usr/bin/rm
                                              Arguments:rm -f /tmp/tmp.O8w13IpnD5 /tmp/tmp.cvuRfrGaCf /tmp/tmp.U2KbKcxjDU
                                              File size:72056 bytes
                                              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                              Start time (UTC):03:32:26
                                              Start date (UTC):25/03/2025
                                              Path:/usr/bin/dash
                                              Arguments:-
                                              File size:129816 bytes
                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                              Start time (UTC):03:32:26
                                              Start date (UTC):25/03/2025
                                              Path:/usr/bin/rm
                                              Arguments:rm -f /tmp/tmp.O8w13IpnD5 /tmp/tmp.cvuRfrGaCf /tmp/tmp.U2KbKcxjDU
                                              File size:72056 bytes
                                              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b