Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
tsh4.elf

Overview

General Information

Sample name:tsh4.elf
Analysis ID:1647999
MD5:cfe2c847ed68a6cd287afda760cd6cad
SHA1:ef51ab22a591add4054603ecfb58e5db585ed72a
SHA256:221d0fc70d25d7613fa4c3e552a258993124febbc2cba081c15154992cece280
Tags:elfuser-abuse_ch
Infos:

Detection

Score:48
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1647999
Start date and time:2025-03-25 13:31:29 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 27s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:tsh4.elf
Detection:MAL
Classification:mal48.linELF@0/0@0/0

Runtime Messages

Command:/tmp/tsh4.elf
PID:5416
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
a cat is fine too
Standard Error:

Process Tree

  • system is lnxubuntu20
  • tsh4.elf (PID: 5416, Parent: 5338, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/tsh4.elf
    • tsh4.elf New Fork (PID: 5418, Parent: 5416)
      • tsh4.elf New Fork (PID: 5420, Parent: 5418)
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

  • • AV Detection
  • • Networking
  • • System Summary
  • • Persistence and Installation Behavior
  • • Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: tsh4.elfVirustotal: Detection: 15%Perma Link
Source: tsh4.elfReversingLabs: Detection: 13%
Source: global trafficTCP traffic: 192.168.2.13:37916 -> 156.229.232.154:51325
Source: /tmp/tsh4.elf (PID: 5416)Socket: 127.0.0.1:51101Jump to behavior
Source: unknownTCP traffic detected without corresponding DNS query: 156.229.232.154
Source: unknownTCP traffic detected without corresponding DNS query: 156.229.232.154
Source: unknownTCP traffic detected without corresponding DNS query: 156.229.232.154
Source: unknownTCP traffic detected without corresponding DNS query: 156.229.232.154
Source: unknownTCP traffic detected without corresponding DNS query: 156.229.232.154
Source: unknownTCP traffic detected without corresponding DNS query: 156.229.232.154
Source: unknownTCP traffic detected without corresponding DNS query: 156.229.232.154
Source: unknownTCP traffic detected without corresponding DNS query: 156.229.232.154
Source: unknownTCP traffic detected without corresponding DNS query: 156.229.232.154
Source: unknownTCP traffic detected without corresponding DNS query: 156.229.232.154
Source: unknownTCP traffic detected without corresponding DNS query: 156.229.232.154
Source: unknownTCP traffic detected without corresponding DNS query: 156.229.232.154
Source: unknownTCP traffic detected without corresponding DNS query: 156.229.232.154
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal48.linELF@0/0@0/0
Source: /tmp/tsh4.elf (PID: 5420)File opened: /proc/5450/statusJump to behavior
Source: /tmp/tsh4.elf (PID: 5420)File opened: /proc/5440/statusJump to behavior
Source: /tmp/tsh4.elf (PID: 5420)File opened: /proc/5451/statusJump to behavior
Source: /tmp/tsh4.elf (PID: 5420)File opened: /proc/5441/statusJump to behavior
Source: /tmp/tsh4.elf (PID: 5420)File opened: /proc/5452/statusJump to behavior
Source: /tmp/tsh4.elf (PID: 5420)File opened: /proc/5255/cmdlineJump to behavior
Source: /tmp/tsh4.elf (PID: 5420)File opened: /proc/5442/statusJump to behavior
Source: /tmp/tsh4.elf (PID: 5420)File opened: /proc/5453/statusJump to behavior
Source: /tmp/tsh4.elf (PID: 5420)File opened: /proc/5443/statusJump to behavior
Source: /tmp/tsh4.elf (PID: 5420)File opened: /proc/5454/statusJump to behavior
Source: /tmp/tsh4.elf (PID: 5420)File opened: /proc/5444/statusJump to behavior
Source: /tmp/tsh4.elf (PID: 5420)File opened: /proc/5455/statusJump to behavior
Source: /tmp/tsh4.elf (PID: 5420)File opened: /proc/5445/statusJump to behavior
Source: /tmp/tsh4.elf (PID: 5420)File opened: /proc/5456/statusJump to behavior
Source: /tmp/tsh4.elf (PID: 5420)File opened: /proc/5446/statusJump to behavior
Source: /tmp/tsh4.elf (PID: 5420)File opened: /proc/5447/statusJump to behavior
Source: /tmp/tsh4.elf (PID: 5420)File opened: /proc/5448/statusJump to behavior
Source: /tmp/tsh4.elf (PID: 5420)File opened: /proc/5438/statusJump to behavior
Source: /tmp/tsh4.elf (PID: 5420)File opened: /proc/5449/statusJump to behavior
Source: /tmp/tsh4.elf (PID: 5420)File opened: /proc/5439/statusJump to behavior
Source: /tmp/tsh4.elf (PID: 5416)Queries kernel information via 'uname': Jump to behavior
Source: tsh4.elf, 5416.1.00007ffc1552e000.00007ffc1554f000.rw-.sdmpBinary or memory string: Bx86_64/usr/bin/qemu-sh4/tmp/tsh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/tsh4.elf
Source: tsh4.elf, 5416.1.00007ffc1552e000.00007ffc1554f000.rw-.sdmpBinary or memory string: /usr/bin/qemu-sh4
Source: tsh4.elf, 5416.1.000055cf69c4b000.000055cf69cce000.rw-.sdmpBinary or memory string: U5!/etc/qemu-binfmt/sh4
Source: tsh4.elf, 5416.1.000055cf69c4b000.000055cf69cce000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/sh4

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume Access1
OS Credential Dumping		11
Security Software Discovery		Remote ServicesData from Local System1
Non-Standard Port		Exfiltration Over Other Network MediumAbuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1647999 Sample: tsh4.elf Startdate: 25/03/2025 Architecture: LINUX Score: 48 14 156.229.232.154, 37916, 51325 ONL-HKOCEANNETWORKLIMITEDHK Seychelles 2->14 16 Multi AV Scanner detection for submitted file 2->16 8 tsh4.elf 2->8         started        signatures3 process4 process5 10 tsh4.elf 8->10         started        process6 12 tsh4.elf 10->12         started       

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
tsh4.elf16%VirustotalBrowse
tsh4.elf14%ReversingLabsLinux.Backdoor.Gafgyt

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
156.229.232.154
unknownSeychelles
139086ONL-HKOCEANNETWORKLIMITEDHKfalse

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
156.229.232.154garm5.elfGet hashmaliciousUnknownBrowse
    arm5.elfGet hashmaliciousUnknownBrowse
      tmips.elfGet hashmaliciousUnknownBrowse
        gx86.elfGet hashmaliciousUnknownBrowse
          tarm.elfGet hashmaliciousUnknownBrowse
            tarm7.elfGet hashmaliciousMiraiBrowse
              arm.elfGet hashmaliciousUnknownBrowse
                gmips.elfGet hashmaliciousUnknownBrowse
                  arm5.elfGet hashmaliciousUnknownBrowse
                    garm5.elfGet hashmaliciousUnknownBrowse

                      Domains

                      ⊘No context

                      ASNs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      ONL-HKOCEANNETWORKLIMITEDHKgarm5.elfGet hashmaliciousUnknownBrowse
                      • 156.229.232.154
                      arm5.elfGet hashmaliciousUnknownBrowse
                      • 156.229.232.154
                      tmips.elfGet hashmaliciousUnknownBrowse
                      • 156.229.232.154
                      gx86.elfGet hashmaliciousUnknownBrowse
                      • 156.229.232.154
                      tarm.elfGet hashmaliciousUnknownBrowse
                      • 156.229.232.154
                      tarm7.elfGet hashmaliciousMiraiBrowse
                      • 156.229.232.154
                      arm.elfGet hashmaliciousUnknownBrowse
                      • 156.229.232.154
                      ppc.elfGet hashmaliciousMiraiBrowse
                      • 156.249.107.18
                      .5r3fqt67ew531has4231.dbg.elfGet hashmaliciousMirai, Gafgyt, Moobot, OkiruBrowse
                      • 156.229.233.104
                      .5r3fqt67ew531has4231.x86.elfGet hashmaliciousMirai, Gafgyt, Moobot, OkiruBrowse
                      • 156.229.233.104

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      ⊘No created / dropped files found

                      Static File Info

                      General

                      File type:ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
                      Entropy (8bit):6.801387321824759
                      TrID:
                      • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                      File name:tsh4.elf
                      File size:50'616 bytes
                      MD5:cfe2c847ed68a6cd287afda760cd6cad
                      SHA1:ef51ab22a591add4054603ecfb58e5db585ed72a
                      SHA256:221d0fc70d25d7613fa4c3e552a258993124febbc2cba081c15154992cece280
                      SHA512:89a08a6bb39430c059a9dc54dc2281ed99afa732e24360e2c5ff8e98cbe77e3a889d15a24886a29fab652f3bf68340cb36a34b4cf6619e2e4c84d9a081827528
                      SSDEEP:1536:CKgKkXjtvYOBJxKWI2y7QWIIbtACRBQpa:CKXkXjZYWuPIIbtAlpa
                      TLSH:D7337D63C8769E58E14986B4B4608FB51B23F984820B1FFB1566C7699083EDCF60E3F5
                      File Content Preview:.ELF..............*.......@.4...(.......4. ...(...............@...@.D...D.....................A...A......e..........Q.td............................././"O.n........#.*@........#.*@.....o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

                      Static ELF Info

                      ELF header

                      Class:ELF32
                      Data:2's complement, little endian
                      Version:1 (current)
                      Machine:<unknown>
                      Version Number:0x1
                      Type:EXEC (Executable file)
                      OS/ABI:UNIX - System V
                      ABI Version:0
                      Entry Point Address:0x4001a0
                      Flags:0x9
                      ELF Header Size:52
                      Program Header Offset:52
                      Program Header Size:32
                      Number of Program Headers:3
                      Section Header Offset:50216
                      Section Header Size:40
                      Number of Section Headers:10
                      Header String Table Index:9

                      Sections

                      NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                      NULL0x00x00x00x00x0000
                      .initPROGBITS0x4000940x940x300x00x6AX004
                      .textPROGBITS0x4000e00xe00xac200x00x6AX0032
                      .finiPROGBITS0x40ad000xad000x240x00x6AX004
                      .rodataPROGBITS0x40ad240xad240x12200x00x2A004
                      .ctorsPROGBITS0x41c0000xc0000x80x00x3WA004
                      .dtorsPROGBITS0x41c0080xc0080x80x00x3WA004
                      .dataPROGBITS0x41c0140xc0140x3d40x00x3WA004
                      .bssNOBITS0x41c3e80xc3e80x61d80x00x3WA004
                      .shstrtabSTRTAB0x00xc3e80x3e0x00x0001

                      Program Segments

                      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                      LOAD0x00x4000000x4000000xbf440xbf446.87140x5R E0x10000.init .text .fini .rodata
                      LOAD0xc0000x41c0000x41c0000x3e80x65c03.59420x6RW 0x10000.ctors .dtors .data .bss
                      GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                      Network Behavior

                      Download Network PCAP: filtered – full

                      TimestampSource PortDest PortSource IPDest IP
                      Mar 25, 2025 13:32:16.688225031 CET3791651325192.168.2.13156.229.232.154
                      Mar 25, 2025 13:32:16.858222008 CET5132537916156.229.232.154192.168.2.13
                      Mar 25, 2025 13:32:16.858292103 CET3791651325192.168.2.13156.229.232.154
                      Mar 25, 2025 13:32:16.859338045 CET3791651325192.168.2.13156.229.232.154
                      Mar 25, 2025 13:32:17.028037071 CET5132537916156.229.232.154192.168.2.13
                      Mar 25, 2025 13:32:17.028120995 CET3791651325192.168.2.13156.229.232.154
                      Mar 25, 2025 13:32:17.195319891 CET5132537916156.229.232.154192.168.2.13
                      Mar 25, 2025 13:32:26.869570017 CET3791651325192.168.2.13156.229.232.154
                      Mar 25, 2025 13:32:27.037206888 CET5132537916156.229.232.154192.168.2.13
                      Mar 25, 2025 13:32:27.037257910 CET5132537916156.229.232.154192.168.2.13
                      Mar 25, 2025 13:32:27.037306070 CET3791651325192.168.2.13156.229.232.154
                      Mar 25, 2025 13:32:57.260891914 CET5132537916156.229.232.154192.168.2.13
                      Mar 25, 2025 13:32:57.260947943 CET3791651325192.168.2.13156.229.232.154
                      Mar 25, 2025 13:33:12.440170050 CET5132537916156.229.232.154192.168.2.13
                      Mar 25, 2025 13:33:12.440342903 CET3791651325192.168.2.13156.229.232.154
                      Mar 25, 2025 13:33:27.083755970 CET3791651325192.168.2.13156.229.232.154
                      Mar 25, 2025 13:33:27.251405001 CET5132537916156.229.232.154192.168.2.13
                      Mar 25, 2025 13:33:27.251597881 CET3791651325192.168.2.13156.229.232.154
                      Mar 25, 2025 13:33:42.444315910 CET5132537916156.229.232.154192.168.2.13
                      Mar 25, 2025 13:33:42.444559097 CET3791651325192.168.2.13156.229.232.154
                      Mar 25, 2025 13:33:57.616441011 CET5132537916156.229.232.154192.168.2.13
                      Mar 25, 2025 13:33:57.616825104 CET3791651325192.168.2.13156.229.232.154
                      Mar 25, 2025 13:34:12.783052921 CET5132537916156.229.232.154192.168.2.13
                      Mar 25, 2025 13:34:12.783216953 CET3791651325192.168.2.13156.229.232.154

                      System Behavior

                      General

                      Start time (UTC):12:32:15
                      Start date (UTC):25/03/2025
                      Path:/tmp/tsh4.elf
                      Arguments:/tmp/tsh4.elf
                      File size:4139976 bytes
                      MD5 hash:8943e5f8f8c280467b4472c15ae93ba9

                      File Activities

                      Process Activities

                      System Activities

                      Network Activities


                      General

                      Start time (UTC):12:32:15
                      Start date (UTC):25/03/2025
                      Path:/tmp/tsh4.elf
                      Arguments:-
                      File size:4139976 bytes
                      MD5 hash:8943e5f8f8c280467b4472c15ae93ba9

                      Process Activities

                      Network Activities


                      General

                      Start time (UTC):12:32:15
                      Start date (UTC):25/03/2025
                      Path:/tmp/tsh4.elf
                      Arguments:-
                      File size:4139976 bytes
                      MD5 hash:8943e5f8f8c280467b4472c15ae93ba9

                      File Activities

                      Process Activities