Edit tour

Linux Analysis Report
arm7.elf

Overview

General Information

Sample name:arm7.elf
Analysis ID:1647832
MD5:761909a234ee4f1d856267abe30a3935
SHA1:2e95bbf3069f603ae7ff882770f49dc36223a626
SHA256:dd54e4a0220b6afbe0dbee66e32af3fe2012cc37023044a683e8e0c98579a059
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:60
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample reads /proc/mounts (often used for finding a writable filesystem)
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1647832
Start date and time:2025-03-25 10:17:25 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 38s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:arm7.elf
Detection:MAL
Classification:mal60.troj.linELF@0/4@2/0
Command:/tmp/arm7.elf
PID:5482
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
For God so loved the world
Standard Error:
  • system is lnxubuntu20
  • dash New Fork (PID: 5472, Parent: 3633)
  • rm (PID: 5472, Parent: 3633, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.9XW2VSGzhw /tmp/tmp.HyVVAIcBeG /tmp/tmp.mPhJ4zTeiq
  • dash New Fork (PID: 5473, Parent: 3633)
  • rm (PID: 5473, Parent: 3633, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.9XW2VSGzhw /tmp/tmp.HyVVAIcBeG /tmp/tmp.mPhJ4zTeiq
  • arm7.elf (PID: 5482, Parent: 5404, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm7.elf
    • arm7.elf New Fork (PID: 5485, Parent: 5482)
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
arm7.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    SourceRuleDescriptionAuthorStrings
    5485.1.00007f8dbc017000.00007f8dbc031000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      5482.1.00007f8dbc017000.00007f8dbc031000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        No Suricata rule has matched

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: arm7.elfVirustotal: Detection: 28%Perma Link
        Source: arm7.elfReversingLabs: Detection: 27%
        Source: /tmp/arm7.elf (PID: 5485)Socket: 127.0.0.1:22448Jump to behavior
        Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
        Source: arm7.elf, 5482.1.00007f8dbc03a000.00007f8dbc046000.rw-.sdmp, arm7.elf, 5485.1.00007f8dbc03a000.00007f8dbc046000.rw-.sdmpString found in binary or memory: http://17365637265742070617373776F7264206D656D6F721/t/wget.sh
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: classification engineClassification label: mal60.troj.linELF@0/4@2/0

        Persistence and Installation Behavior

        barindex
        Source: /tmp/arm7.elf (PID: 5482)File: /proc/5482/mountsJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/1583/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/2672/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/110/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/111/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/112/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/113/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/234/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/1577/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/1577/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/114/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/235/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/115/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/116/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/117/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/118/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/119/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/10/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/917/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/917/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/11/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/12/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/13/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/14/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/15/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/16/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/17/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/18/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/19/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/1593/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/1593/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/240/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/120/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/3094/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/3094/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/121/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/242/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/3406/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/3406/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/1/mapsJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/1/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/1/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/122/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/243/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/2/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/123/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/244/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/1589/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/1589/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/3/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/124/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/245/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/1588/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/1588/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/125/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/4/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/246/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/3402/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/3402/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/126/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/5/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/247/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/127/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/6/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/248/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/128/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/7/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/249/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/8/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/129/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/800/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/800/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/9/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/801/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/801/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/803/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/803/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/20/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/806/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/806/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/21/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/807/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/807/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/928/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/928/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/22/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/23/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/24/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/25/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/26/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/27/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/28/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/29/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/3420/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/3420/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/490/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/490/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/250/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/130/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/251/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/131/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/252/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/132/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/253/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/254/cmdlineJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)File opened: /proc/255/cmdlineJump to behavior
        Source: /usr/bin/dash (PID: 5472)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.9XW2VSGzhw /tmp/tmp.HyVVAIcBeG /tmp/tmp.mPhJ4zTeiqJump to behavior
        Source: /usr/bin/dash (PID: 5473)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.9XW2VSGzhw /tmp/tmp.HyVVAIcBeG /tmp/tmp.mPhJ4zTeiqJump to behavior
        Source: /tmp/arm7.elf (PID: 5482)Queries kernel information via 'uname': Jump to behavior
        Source: arm7.elf, 5485.1.00007f8dbc03a000.00007f8dbc046000.rw-.sdmpBinary or memory string: vmwarem
        Source: arm7.elf, 5482.1.00005571a8788000.00005571a88d7000.rw-.sdmp, arm7.elf, 5485.1.00005571a8788000.00005571a88d7000.rw-.sdmpBinary or memory string: qU!/etc/qemu-binfmt/arm
        Source: arm7.elf, 5485.1.00007f8dbc03a000.00007f8dbc046000.rw-.sdmpBinary or memory string: vmware
        Source: arm7.elf, 5482.1.00007f8dbc03a000.00007f8dbc046000.rw-.sdmp, arm7.elf, 5485.1.00007f8dbc03a000.00007f8dbc046000.rw-.sdmpBinary or memory string: qemu-arm
        Source: arm7.elf, 5482.1.00007ffe075fa000.00007ffe0761b000.rw-.sdmpBinary or memory string: /tmp/qemu-open.RV4ssK
        Source: arm7.elf, 5482.1.00007f8dbc03a000.00007f8dbc046000.rw-.sdmp, arm7.elf, 5485.1.00007f8dbc03a000.00007f8dbc046000.rw-.sdmpBinary or memory string: qemu-arm)Zm6vnZ5U4mf8vApyWcDwXR44ZAkzslsN)
        Source: arm7.elf, 5482.1.00005571a8788000.00005571a88d7000.rw-.sdmp, arm7.elf, 5485.1.00005571a8788000.00005571a88d7000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
        Source: arm7.elf, 5482.1.00007ffe075fa000.00007ffe0761b000.rw-.sdmp, arm7.elf, 5485.1.00007ffe075fa000.00007ffe0761b000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
        Source: arm7.elf, 5482.1.00007ffe075fa000.00007ffe0761b000.rw-.sdmp, arm7.elf, 5485.1.00007ffe075fa000.00007ffe0761b000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm7.elf
        Source: arm7.elf, 5485.1.00007ffe075fa000.00007ffe0761b000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
        Source: arm7.elf, 5482.1.00007ffe075fa000.00007ffe0761b000.rw-.sdmpBinary or memory string: qU/tmp/qemu-open.RV4ssK:

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: arm7.elf, type: SAMPLE
        Source: Yara matchFile source: 5485.1.00007f8dbc017000.00007f8dbc031000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5482.1.00007f8dbc017000.00007f8dbc031000.r-x.sdmp, type: MEMORY

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: arm7.elf, type: SAMPLE
        Source: Yara matchFile source: 5485.1.00007f8dbc017000.00007f8dbc031000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5482.1.00007f8dbc017000.00007f8dbc031000.r-x.sdmp, type: MEMORY
        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
        File Deletion
        1
        OS Credential Dumping
        11
        Security Software Discovery
        Remote ServicesData from Local System1
        Non-Application Layer Protocol
        Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory1
        File and Directory Discovery
        Remote Desktop ProtocolData from Removable Media1
        Application Layer Protocol
        Exfiltration Over BluetoothNetwork Denial of Service
        No configs have been found
        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1647832 Sample: arm7.elf Startdate: 25/03/2025 Architecture: LINUX Score: 60 14 daisy.ubuntu.com 2->14 16 Multi AV Scanner detection for submitted file 2->16 18 Yara detected Mirai 2->18 7 dash rm arm7.elf 2->7         started        10 dash rm 2->10         started        signatures3 process4 signatures5 20 Sample reads /proc/mounts (often used for finding a writable filesystem) 7->20 12 arm7.elf 7->12         started        process6
        SourceDetectionScannerLabelLink
        arm7.elf29%VirustotalBrowse
        arm7.elf28%ReversingLabsLinux.Backdoor.Mirai
        No Antivirus matches
        No Antivirus matches
        No Antivirus matches

        Download Network PCAP: filteredfull

        NameIPActiveMaliciousAntivirus DetectionReputation
        daisy.ubuntu.com
        162.213.35.24
        truefalse
          high
          NameSourceMaliciousAntivirus DetectionReputation
          http://17365637265742070617373776F7264206D656D6F721/t/wget.sharm7.elf, 5482.1.00007f8dbc03a000.00007f8dbc046000.rw-.sdmp, arm7.elf, 5485.1.00007f8dbc03a000.00007f8dbc046000.rw-.sdmpfalse
            high
            No contacted IP infos
            No context
            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            daisy.ubuntu.comarm5.elfGet hashmaliciousUnknownBrowse
            • 162.213.35.24
            mips.elfGet hashmaliciousMiraiBrowse
            • 162.213.35.24
            arm5.elfGet hashmaliciousUnknownBrowse
            • 162.213.35.24
            arm7.elfGet hashmaliciousMiraiBrowse
            • 162.213.35.24
            arm.elfGet hashmaliciousMiraiBrowse
            • 162.213.35.25
            arm7.elfGet hashmaliciousMiraiBrowse
            • 162.213.35.25
            arm5.elfGet hashmaliciousUnknownBrowse
            • 162.213.35.25
            arm6.elfGet hashmaliciousUnknownBrowse
            • 162.213.35.24
            arm5.elfGet hashmaliciousUnknownBrowse
            • 162.213.35.25
            arm6.elfGet hashmaliciousUnknownBrowse
            • 162.213.35.24
            No context
            No context
            No context
            Process:/tmp/arm7.elf
            File Type:data
            Category:dropped
            Size (bytes):14
            Entropy (8bit):3.521640636343319
            Encrypted:false
            SSDEEP:3:TgiLG:TgiC
            MD5:451AC90F7FA61D0393D6A5A02158D369
            SHA1:5A7D458802462B80F94A9CDA24E2C877437A8E34
            SHA-256:E2D543300D643CEF7698E750F74E8499993E346EF765FA2061EB5DFAF8D77E48
            SHA-512:EF1D000F5B8BB5AFD4F6CB347FBE0FA0E97608B8C3839B6B44CB9828E5522396B334AE37148FCD2064A423B3DDD0C8874EF7019023A84B36E3893E50353F06FE
            Malicious:false
            Reputation:moderate, very likely benign file
            Preview:/tmp/arm7.elf.
            Process:/tmp/arm7.elf
            File Type:data
            Category:dropped
            Size (bytes):14
            Entropy (8bit):3.521640636343319
            Encrypted:false
            SSDEEP:3:TgiLG:TgiC
            MD5:451AC90F7FA61D0393D6A5A02158D369
            SHA1:5A7D458802462B80F94A9CDA24E2C877437A8E34
            SHA-256:E2D543300D643CEF7698E750F74E8499993E346EF765FA2061EB5DFAF8D77E48
            SHA-512:EF1D000F5B8BB5AFD4F6CB347FBE0FA0E97608B8C3839B6B44CB9828E5522396B334AE37148FCD2064A423B3DDD0C8874EF7019023A84B36E3893E50353F06FE
            Malicious:false
            Reputation:moderate, very likely benign file
            Preview:/tmp/arm7.elf.
            Process:/tmp/arm7.elf
            File Type:data
            Category:dropped
            Size (bytes):14
            Entropy (8bit):3.521640636343319
            Encrypted:false
            SSDEEP:3:TgiLG:TgiC
            MD5:451AC90F7FA61D0393D6A5A02158D369
            SHA1:5A7D458802462B80F94A9CDA24E2C877437A8E34
            SHA-256:E2D543300D643CEF7698E750F74E8499993E346EF765FA2061EB5DFAF8D77E48
            SHA-512:EF1D000F5B8BB5AFD4F6CB347FBE0FA0E97608B8C3839B6B44CB9828E5522396B334AE37148FCD2064A423B3DDD0C8874EF7019023A84B36E3893E50353F06FE
            Malicious:false
            Reputation:moderate, very likely benign file
            Preview:/tmp/arm7.elf.
            Process:/tmp/arm7.elf
            File Type:data
            Category:dropped
            Size (bytes):14
            Entropy (8bit):3.521640636343319
            Encrypted:false
            SSDEEP:3:TgiLG:TgiC
            MD5:451AC90F7FA61D0393D6A5A02158D369
            SHA1:5A7D458802462B80F94A9CDA24E2C877437A8E34
            SHA-256:E2D543300D643CEF7698E750F74E8499993E346EF765FA2061EB5DFAF8D77E48
            SHA-512:EF1D000F5B8BB5AFD4F6CB347FBE0FA0E97608B8C3839B6B44CB9828E5522396B334AE37148FCD2064A423B3DDD0C8874EF7019023A84B36E3893E50353F06FE
            Malicious:false
            Reputation:moderate, very likely benign file
            Preview:/tmp/arm7.elf.
            File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), dynamically linked, stripped
            Entropy (8bit):6.100816835815996
            TrID:
            • ELF Executable and Linkable format (generic) (4004/1) 100.00%
            File name:arm7.elf
            File size:108'040 bytes
            MD5:761909a234ee4f1d856267abe30a3935
            SHA1:2e95bbf3069f603ae7ff882770f49dc36223a626
            SHA256:dd54e4a0220b6afbe0dbee66e32af3fe2012cc37023044a683e8e0c98579a059
            SHA512:d562407d51d2267ba1b3f46a66c8f93f629ddc14304b5f4e4ef15a33d7f004a00e041cd129396d8890da352b4495155c530befa17c7c08a2c5bd42bb69d85ac7
            SSDEEP:3072:FJ8Gs/o4XPk9Hc28tsWxEw+h/9WXfxaqE9690r0wPOsz2dsTnY:FJ8Gsg4M9Hc28tsE2/MXpaqE9690XPi/
            TLSH:8BB3F659F9819F15D4D615BEFE4F828D332367A8E3EE7102D9245B2037CAA6B0E7B401
            File Content Preview:.ELF..............(.........4...........4. ...(.....................................................................................<....t................................................................................-...L..................@-.,@...0....S

            ELF header

            Class:ELF32
            Data:2's complement, little endian
            Version:1 (current)
            Machine:ARM
            Version Number:0x1
            Type:EXEC (Executable file)
            OS/ABI:UNIX - System V
            ABI Version:0
            Entry Point Address:0x8194
            Flags:0x4000002
            ELF Header Size:52
            Program Header Offset:52
            Program Header Size:32
            Number of Program Headers:5
            Section Header Offset:107440
            Section Header Size:40
            Number of Section Headers:15
            Header String Table Index:14
            NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
            NULL0x00x00x00x00x0000
            .initPROGBITS0x80d40xd40x100x00x6AX004
            .textPROGBITS0x80f00xf00x17e4c0x00x6AX0016
            .finiPROGBITS0x1ff3c0x17f3c0x100x00x6AX004
            .rodataPROGBITS0x1ff500x17f500x1f300x00x2A008
            .ARM.extabPROGBITS0x21e800x19e800x180x00x2A004
            .ARM.exidxARM_EXIDX0x21e980x19e980x1180x00x82AL204
            .eh_framePROGBITS0x2a0000x1a0000x40x00x3WA004
            .tbssNOBITS0x2a0040x1a0040x80x00x403WAT004
            .init_arrayINIT_ARRAY0x2a0040x1a0040x40x00x3WA004
            .fini_arrayFINI_ARRAY0x2a0080x1a0080x40x00x3WA004
            .gotPROGBITS0x2a0100x1a0100xa80x40x3WA004
            .dataPROGBITS0x2a0b80x1a0b80x2840x00x3WA004
            .bssNOBITS0x2a33c0x1a33c0x70cc0x00x3WA004
            .shstrtabSTRTAB0x00x1a33c0x730x00x0001
            TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
            DYNAMIC0x19e980x21e980x21e980x1180x1184.46360x4R 0x4.ARM.exidx
            LOAD0x00x80000x80000x19fb00x19fb06.11930x5R E0x8000.init .text .fini .rodata .ARM.extab .ARM.exidx
            LOAD0x1a0000x2a0000x2a0000x33c0x74084.19640x6RW 0x8000.eh_frame .tbss .init_array .fini_array .got .data .bss
            DYNAMIC0x1a0040x2a0040x2a0040x00x80.00000x4R 0x4
            DYNAMIC0x00x00x00x00x00.00000x7RWE0x4

            Download Network PCAP: filteredfull

            TimestampSource PortDest PortSource IPDest IP
            Mar 25, 2025 10:18:17.705666065 CET5937753192.168.2.148.8.8.8
            Mar 25, 2025 10:18:17.705724001 CET5178653192.168.2.148.8.8.8
            Mar 25, 2025 10:18:17.713635921 CET53593778.8.8.8192.168.2.14
            Mar 25, 2025 10:18:17.713660955 CET53517868.8.8.8192.168.2.14
            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
            Mar 25, 2025 10:18:17.705666065 CET192.168.2.148.8.8.80x30a8Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
            Mar 25, 2025 10:18:17.705724001 CET192.168.2.148.8.8.80x6633Standard query (0)daisy.ubuntu.com28IN (0x0001)false
            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
            Mar 25, 2025 10:18:17.713635921 CET8.8.8.8192.168.2.140x30a8No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
            Mar 25, 2025 10:18:17.713635921 CET8.8.8.8192.168.2.140x30a8No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false

            System Behavior

            Start time (UTC):09:18:05
            Start date (UTC):25/03/2025
            Path:/usr/bin/dash
            Arguments:-
            File size:129816 bytes
            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

            Start time (UTC):09:18:05
            Start date (UTC):25/03/2025
            Path:/usr/bin/rm
            Arguments:rm -f /tmp/tmp.9XW2VSGzhw /tmp/tmp.HyVVAIcBeG /tmp/tmp.mPhJ4zTeiq
            File size:72056 bytes
            MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

            Start time (UTC):09:18:05
            Start date (UTC):25/03/2025
            Path:/usr/bin/dash
            Arguments:-
            File size:129816 bytes
            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

            Start time (UTC):09:18:05
            Start date (UTC):25/03/2025
            Path:/usr/bin/rm
            Arguments:rm -f /tmp/tmp.9XW2VSGzhw /tmp/tmp.HyVVAIcBeG /tmp/tmp.mPhJ4zTeiq
            File size:72056 bytes
            MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

            Start time (UTC):09:18:14
            Start date (UTC):25/03/2025
            Path:/tmp/arm7.elf
            Arguments:-
            File size:4956856 bytes
            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1