Edit tour

Linux Analysis Report
arm5.elf

Overview

General Information

Sample name:arm5.elf
Analysis ID:1650542
MD5:1cee70028aecd73152a2ab24760149d4
SHA1:116998b90a28924cba94b8f297c28c74a4117f79
SHA256:78e12f03efa6e83a62c44659be6c20d648911c6533539aeef901e9909ebb39c2
Tags:elfuser-abuse_ch
Infos:

Detection

Score:56
Range:0 - 100

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1650542
Start date and time:2025-03-27 19:58:26 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 10m 39s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:arm5.elf
Detection:MAL
Classification:mal56.linELF@0/0@2/0
Cookbook Comments:
  • Analysis time extended to 480s due to sleep detection in submitted sample
  • Max analysis timeout: 600s exceeded, the analysis took too long
Command:/tmp/arm5.elf
PID:5428
Exit Code:255
Exit Code Info:
Killed:False
Standard Output:

Standard Error:/lib/ld-uClibc.so.0: No such file or directory
  • system is lnxubuntu20
  • arm5.elf (PID: 5428, Parent: 5353, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm5.elf
  • cleanup
SourceRuleDescriptionAuthorStrings
arm5.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
  • 0x7dec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7e00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7e14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7e28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7e3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7e50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7e64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7e78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7e8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7ea0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7eb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7ec8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7edc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7ef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7f04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7f18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7f2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7f40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
SourceRuleDescriptionAuthorStrings
5428.1.00007f902c027000.00007f902c028000.rw-.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
  • 0x8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xe4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x10c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x120:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x134:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x148:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x15c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x170:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x184:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x198:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5428.1.00007f902c017000.00007f902c020000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
  • 0x7dec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7e00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7e14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7e28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7e3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7e50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7e64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7e78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7e8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7ea0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7eb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7ec8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7edc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7ef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7f04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7f18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7f2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7f40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x7f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: arm5.elf PID: 5428Linux_Trojan_Gafgyt_28a2fe0cunknownunknown
  • 0x11f63:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x11f77:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x11f8b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x11f9f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x11fb3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x11fc7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x11fdb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: arm5.elfReversingLabs: Detection: 41%
Source: arm5.elfVirustotal: Detection: 45%Perma Link
Source: global trafficTCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443
Source: unknownTCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknownTCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
Source: unknownNetwork traffic detected: HTTP traffic on port 48202 -> 443

System Summary

barindex
Source: arm5.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5428.1.00007f902c027000.00007f902c028000.rw-.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5428.1.00007f902c017000.00007f902c020000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: arm5.elf PID: 5428, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: ELF static info symbol of initial sample.symtab present: no
Source: arm5.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5428.1.00007f902c027000.00007f902c028000.rw-.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5428.1.00007f902c017000.00007f902c020000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: arm5.elf PID: 5428, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: classification engineClassification label: mal56.linELF@0/0@2/0
Source: /tmp/arm5.elf (PID: 5428)Queries kernel information via 'uname': Jump to behavior
Source: arm5.elf, 5428.1.00007ffc11acf000.00007ffc11af0000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm5.elf
Source: arm5.elf, 5428.1.000055a0ce1c4000.000055a0ce2f2000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
Source: arm5.elf, 5428.1.00007ffc11acf000.00007ffc11af0000.rw-.sdmpBinary or memory string: qemu: %s: %s
Source: arm5.elf, 5428.1.00007ffc11acf000.00007ffc11af0000.rw-.sdmpBinary or memory string: leqemu: %s: %s
Source: arm5.elf, 5428.1.000055a0ce1c4000.000055a0ce2f2000.rw-.sdmpBinary or memory string: Urg.qemu.gdb.arm.sys.regs">
Source: arm5.elf, 5428.1.000055a0ce1c4000.000055a0ce2f2000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: arm5.elf, 5428.1.00007ffc11acf000.00007ffc11af0000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
Source: arm5.elf, 5428.1.000055a0ce1c4000.000055a0ce2f2000.rw-.sdmpBinary or memory string: rg.qemu.gdb.arm.sys.regs">
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1650542 Sample: arm5.elf Startdate: 27/03/2025 Architecture: LINUX Score: 56 8 185.125.190.26, 443 CANONICAL-ASGB United Kingdom 2->8 10 daisy.ubuntu.com 2->10 12 Malicious sample detected (through community Yara rule) 2->12 14 Multi AV Scanner detection for submitted file 2->14 6 arm5.elf 2->6         started        signatures3 process4
SourceDetectionScannerLabelLink
arm5.elf42%ReversingLabsLinux.Trojan.Mirai
arm5.elf45%VirustotalBrowse
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

NameIPActiveMaliciousAntivirus DetectionReputation
daisy.ubuntu.com
162.213.35.25
truefalse
    high
    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs
    IPDomainCountryFlagASNASN NameMalicious
    185.125.190.26
    unknownUnited Kingdom
    41231CANONICAL-ASGBfalse
    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    185.125.190.26x86.elfGet hashmaliciousMiraiBrowse
      na.elfGet hashmaliciousPrometeiBrowse
        na.elfGet hashmaliciousPrometeiBrowse
          SecuriteInfo.com.ELF.Mirai-AXV.27459.929.elfGet hashmaliciousUnknownBrowse
            arm7.elfGet hashmaliciousUnknownBrowse
              arm5.elfGet hashmaliciousUnknownBrowse
                mips.elfGet hashmaliciousUnknownBrowse
                  arm.elfGet hashmaliciousUnknownBrowse
                    na.elfGet hashmaliciousPrometeiBrowse
                      SecuriteInfo.com.Linux.Mirai.4306.30063.19032.elfGet hashmaliciousUnknownBrowse
                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        daisy.ubuntu.comsshd.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.24
                        sshd.elfGet hashmaliciousGafgytBrowse
                        • 162.213.35.24
                        cron.elfGet hashmaliciousGafgytBrowse
                        • 162.213.35.25
                        SecuriteInfo.com.ELF.Mirai-AXV.27459.929.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.24
                        SecuriteInfo.com.Linux.Mirai.4306.7848.16619.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.24
                        SecuriteInfo.com.Linux.Mirai.2522.20371.24695.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.25
                        ntpd.elfGet hashmaliciousGafgytBrowse
                        • 162.213.35.24
                        pftp.elfGet hashmaliciousGafgytBrowse
                        • 162.213.35.24
                        apache2.elfGet hashmaliciousGafgytBrowse
                        • 162.213.35.25
                        ftp.elfGet hashmaliciousGafgytBrowse
                        • 162.213.35.25
                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        CANONICAL-ASGBna.elfGet hashmaliciousPrometeiBrowse
                        • 91.189.91.42
                        x86.elfGet hashmaliciousMiraiBrowse
                        • 185.125.190.26
                        debug.dbg.elfGet hashmaliciousMiraiBrowse
                        • 91.189.91.42
                        na.elfGet hashmaliciousPrometeiBrowse
                        • 185.125.190.26
                        na.elfGet hashmaliciousPrometeiBrowse
                        • 91.189.91.42
                        na.elfGet hashmaliciousPrometeiBrowse
                        • 185.125.190.26
                        SecuriteInfo.com.ELF.Mirai-AXV.27459.929.elfGet hashmaliciousUnknownBrowse
                        • 185.125.190.26
                        SecuriteInfo.com.Linux.Mirai.4306.4180.25704.elfGet hashmaliciousUnknownBrowse
                        • 91.189.91.42
                        SecuriteInfo.com.Linux.Mirai.2522.31389.24681.elfGet hashmaliciousUnknownBrowse
                        • 91.189.91.42
                        na.elfGet hashmaliciousPrometeiBrowse
                        • 91.189.91.42
                        No context
                        No context
                        No created / dropped files found
                        File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, stripped
                        Entropy (8bit):6.04117207399579
                        TrID:
                        • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                        File name:arm5.elf
                        File size:35'736 bytes
                        MD5:1cee70028aecd73152a2ab24760149d4
                        SHA1:116998b90a28924cba94b8f297c28c74a4117f79
                        SHA256:78e12f03efa6e83a62c44659be6c20d648911c6533539aeef901e9909ebb39c2
                        SHA512:ca28c9ea5b3e2c5402a1c333da42d473cb94fe0aa3a53224143be77217be74749be98f8f6a25546368577cff533394de237dfd9647272190f08b5d0c05904559
                        SSDEEP:768:O3HJACrU3F72vZLaQ3SR3m32ysclnldHtk9VHhvGcnYKl0+24HU+1EsJfwu:O3HJACrU3iaQ2RCP0ZZBnzdW
                        TLSH:31F2C694B8824A37C5D8037AB76E16CD336073EA92CBB307C9105B647E8591F0D63F99
                        File Content Preview:.ELF..............(.........4...........4. ...(.........4...4...4...................................................................H...H...............L...L...L.......<.......................X...................Q.td............................/lib/ld-uCl

                        ELF header

                        Class:ELF32
                        Data:2's complement, little endian
                        Version:1 (current)
                        Machine:ARM
                        Version Number:0x1
                        Type:EXEC (Executable file)
                        OS/ABI:UNIX - System V
                        ABI Version:0
                        Entry Point Address:0x8c94
                        Flags:0x4000002
                        ELF Header Size:52
                        Program Header Offset:52
                        Program Header Size:32
                        Number of Program Headers:6
                        Section Header Offset:34976
                        Section Header Size:40
                        Number of Section Headers:19
                        Header String Table Index:18
                        NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                        NULL0x00x00x00x00x0000
                        .interpPROGBITS0x80f40xf40x140x00x2A001
                        .hashHASH0x81080x1080x1900x40x2A304
                        .dynsymDYNSYM0x82980x2980x3d00x100x2A414
                        .dynstrSTRTAB0x86680x6680x1d90x00x2A001
                        .rel.pltREL0x88440x8440x1880x80x2A374
                        .initPROGBITS0x89cc0x9cc0x100x00x6AX004
                        .pltPROGBITS0x89dc0x9dc0x2600x40x6AX004
                        .textPROGBITS0x8c3c0xc3c0x70c40x00x6AX004
                        .finiPROGBITS0xfd000x7d000x100x00x6AX004
                        .rodataPROGBITS0xfd100x7d100x9380x00x2A004
                        .init_arrayINIT_ARRAY0x1864c0x864c0x40x00x3WA004
                        .fini_arrayFINI_ARRAY0x186500x86500x40x00x3WA004
                        .dynamicDYNAMIC0x186580x86580xb80x80x3WA404
                        .gotPROGBITS0x187100x87100xd00x40x3WA004
                        .dataPROGBITS0x187e00x87e00x1c0x00x3WA004
                        .bssNOBITS0x187fc0x87fc0x8c0x00x3WA004
                        .ARM.attributesARM_ATTRIBUTES0x00x87fc0x160x00x0001
                        .shstrtabSTRTAB0x00x88120x8d0x00x0001
                        TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                        PHDR0x340x80340x80340xc00xc02.06370x5R E0x4
                        INTERP0xf40x80f40x80f40x140x143.68420x4R 0x1/lib/ld-uClibc.so.0.interp
                        LOAD0x00x80000x80000x86480x86486.09250x5R E0x8000.interp .hash .dynsym .dynstr .rel.plt .init .plt .text .fini .rodata
                        LOAD0x864c0x1864c0x1864c0x1b00x23c2.37570x6RW 0x8000.init_array .fini_array .dynamic .got .data .bss
                        DYNAMIC0x00x00x186580x00x00.00000x6RW 0x4
                        GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
                        TypeMetaValueTag
                        DT_NEEDEDsharedliblibc.so.00x1
                        DT_INITvalue0x89cc0xc
                        DT_FINIvalue0xfd000xd
                        DT_INIT_ARRAYvalue0x1864c0x19
                        DT_INIT_ARRAYSZbytes40x1b
                        DT_FINI_ARRAYvalue0x186500x1a
                        DT_FINI_ARRAYSZbytes40x1c
                        DT_HASHvalue0x81080x4
                        DT_STRTABvalue0x86680x5
                        DT_SYMTABvalue0x82980x6
                        DT_STRSZbytes4730xa
                        DT_SYMENTbytes160xb
                        DT_DEBUGvalue0x00x15
                        DT_PLTGOTvalue0x187100x3
                        DT_PLTRELSZbytes3920x2
                        DT_PLTRELpltrelDT_REL0x14
                        DT_JMPRELvalue0x88440x17
                        DT_NULLvalue0x00x0
                        NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
                        .dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                        __bss_end__.dynsym0x188880NOTYPE<unknown>DEFAULTSHN_ABS
                        __bss_start.dynsym0x187fc0NOTYPE<unknown>DEFAULTSHN_ABS
                        __bss_start__.dynsym0x187fc0NOTYPE<unknown>DEFAULTSHN_ABS
                        __data_start.dynsym0x187e00NOTYPE<unknown>DEFAULT17
                        __end__.dynsym0x188880NOTYPE<unknown>DEFAULTSHN_ABS
                        __errno_location.dynsym0x8ba032FUNC<unknown>DEFAULTSHN_UNDEF
                        __exidx_end.dynsym0x106480NOTYPE<unknown>DEFAULTSHN_ABS
                        __exidx_start.dynsym0x106480NOTYPE<unknown>DEFAULTSHN_ABS
                        __uClibc_main.dynsym0x8b58848FUNC<unknown>DEFAULTSHN_UNDEF
                        _bss_end__.dynsym0x188880NOTYPE<unknown>DEFAULTSHN_ABS
                        _edata.dynsym0x187fc0NOTYPE<unknown>DEFAULTSHN_ABS
                        _end.dynsym0x188880NOTYPE<unknown>DEFAULTSHN_ABS
                        _start.dynsym0x8c9480FUNC<unknown>DEFAULT8
                        abort.dynsym0x8aa4296FUNC<unknown>DEFAULTSHN_UNDEF
                        accept.dynsym0x8ab0116FUNC<unknown>DEFAULTSHN_UNDEF
                        bind.dynsym0x8ae068FUNC<unknown>DEFAULTSHN_UNDEF
                        calloc.dynsym0x8abc320FUNC<unknown>DEFAULTSHN_UNDEF
                        clock.dynsym0x8bd052FUNC<unknown>DEFAULTSHN_UNDEF
                        close.dynsym0x8c00100FUNC<unknown>DEFAULTSHN_UNDEF
                        closedir.dynsym0x8be8272FUNC<unknown>DEFAULTSHN_UNDEF
                        connect.dynsym0x89fc116FUNC<unknown>DEFAULTSHN_UNDEF
                        exit.dynsym0x8bac196FUNC<unknown>DEFAULTSHN_UNDEF
                        fcntl.dynsym0x8bf4244FUNC<unknown>DEFAULTSHN_UNDEF
                        fork.dynsym0x8b4c972FUNC<unknown>DEFAULTSHN_UNDEF
                        free.dynsym0x8c18572FUNC<unknown>DEFAULTSHN_UNDEF
                        getpid.dynsym0x8a1472FUNC<unknown>DEFAULTSHN_UNDEF
                        getppid.dynsym0x8b7020FUNC<unknown>DEFAULTSHN_UNDEF
                        getsockname.dynsym0x8c3068FUNC<unknown>DEFAULTSHN_UNDEF
                        getsockopt.dynsym0x8b9472FUNC<unknown>DEFAULTSHN_UNDEF
                        inet_addr.dynsym0x8aec40FUNC<unknown>DEFAULTSHN_UNDEF
                        kill.dynsym0x8ad456FUNC<unknown>DEFAULTSHN_UNDEF
                        listen.dynsym0x8b4064FUNC<unknown>DEFAULTSHN_UNDEF
                        malloc.dynsym0x8a442360FUNC<unknown>DEFAULTSHN_UNDEF
                        memcpy.dynsym0x8a2c4FUNC<unknown>DEFAULTSHN_UNDEF
                        memset.dynsym0x8b64156FUNC<unknown>DEFAULTSHN_UNDEF
                        open.dynsym0x8bc4100FUNC<unknown>DEFAULTSHN_UNDEF
                        opendir.dynsym0x8b88196FUNC<unknown>DEFAULTSHN_UNDEF
                        prctl.dynsym0x8a2068FUNC<unknown>DEFAULTSHN_UNDEF
                        raise.dynsym0x8c0c240FUNC<unknown>DEFAULTSHN_UNDEF
                        rand.dynsym0x8b0424FUNC<unknown>DEFAULTSHN_UNDEF
                        read.dynsym0x8b1c100FUNC<unknown>DEFAULTSHN_UNDEF
                        readdir.dynsym0x8a80232FUNC<unknown>DEFAULTSHN_UNDEF
                        readlink.dynsym0x8a3864FUNC<unknown>DEFAULTSHN_UNDEF
                        realloc.dynsym0x8b34960FUNC<unknown>DEFAULTSHN_UNDEF
                        recv.dynsym0x89f0112FUNC<unknown>DEFAULTSHN_UNDEF
                        recvfrom.dynsym0x8a5c136FUNC<unknown>DEFAULTSHN_UNDEF
                        select.dynsym0x8a74132FUNC<unknown>DEFAULTSHN_UNDEF
                        send.dynsym0x8a98112FUNC<unknown>DEFAULTSHN_UNDEF
                        sendto.dynsym0x8b28136FUNC<unknown>DEFAULTSHN_UNDEF
                        setsid.dynsym0x8bdc64FUNC<unknown>DEFAULTSHN_UNDEF
                        setsockopt.dynsym0x8af872FUNC<unknown>DEFAULTSHN_UNDEF
                        sigaddset.dynsym0x8a8c80FUNC<unknown>DEFAULTSHN_UNDEF
                        sigemptyset.dynsym0x8a0820FUNC<unknown>DEFAULTSHN_UNDEF
                        signal.dynsym0x8b10196FUNC<unknown>DEFAULTSHN_UNDEF
                        sigprocmask.dynsym0x8c24140FUNC<unknown>DEFAULTSHN_UNDEF
                        sleep.dynsym0x8a50272FUNC<unknown>DEFAULTSHN_UNDEF
                        socket.dynsym0x8a6868FUNC<unknown>DEFAULTSHN_UNDEF
                        strlen.dynsym0x8bb896FUNC<unknown>DEFAULTSHN_UNDEF
                        time.dynsym0x8b7c48FUNC<unknown>DEFAULTSHN_UNDEF
                        write.dynsym0x8ac8100FUNC<unknown>DEFAULTSHN_UNDEF

                        Download Network PCAP: filteredfull

                        • Total Packets: 4
                        • 443 (HTTPS)
                        • 53 (DNS)
                        TimestampSource PortDest PortSource IPDest IP
                        Mar 27, 2025 19:59:29.277097940 CET48202443192.168.2.13185.125.190.26
                        Mar 27, 2025 20:00:00.765182972 CET48202443192.168.2.13185.125.190.26
                        TimestampSource PortDest PortSource IPDest IP
                        Mar 27, 2025 20:02:03.186990976 CET4981053192.168.2.131.1.1.1
                        Mar 27, 2025 20:02:03.187051058 CET3464753192.168.2.131.1.1.1
                        Mar 27, 2025 20:02:03.270061016 CET53346471.1.1.1192.168.2.13
                        Mar 27, 2025 20:02:03.270088911 CET53498101.1.1.1192.168.2.13
                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                        Mar 27, 2025 20:02:03.186990976 CET192.168.2.131.1.1.10x7bc0Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                        Mar 27, 2025 20:02:03.187051058 CET192.168.2.131.1.1.10x2a0fStandard query (0)daisy.ubuntu.com28IN (0x0001)false
                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                        Mar 27, 2025 20:02:03.270088911 CET1.1.1.1192.168.2.130x7bc0No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
                        Mar 27, 2025 20:02:03.270088911 CET1.1.1.1192.168.2.130x7bc0No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

                        System Behavior

                        Start time (UTC):18:59:17
                        Start date (UTC):27/03/2025
                        Path:/tmp/arm5.elf
                        Arguments:/tmp/arm5.elf
                        File size:4956856 bytes
                        MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1