Edit tour

Linux Analysis Report
sync.arm5.elf

Overview

General Information

Sample name:sync.arm5.elf
Analysis ID:1650806
MD5:a0e9ebb4504dc1c5bae5e64584724232
SHA1:ff75706e4609415bbf38f60a556ed2d9d58faec9
SHA256:4ed9fc89df574f0eeeaa38c14fd92a11f5e9749b1482f6bdd027b72399e6e928
Tags:elfuser-abuse_ch
Infos:

Detection

Score:52
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Sample is packed with UPX
ELF contains segments with high entropy indicating compressed/encrypted content
Executes the "rm" command used to delete files or directories
Sample contains only a LOAD segment without any section mappings
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1650806
Start date and time:2025-03-28 04:12:21 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 56s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:sync.arm5.elf
Detection:MAL
Classification:mal52.evad.linELF@0/0@0/0
Command:/tmp/sync.arm5.elf
PID:6234
Exit Code:139
Exit Code Info:SIGSEGV (11) Segmentation fault invalid memory reference
Killed:False
Standard Output:

Standard Error:qemu: uncaught target signal 11 (Segmentation fault) - core dumped
  • system is lnxubuntu20
  • sync.arm5.elf (PID: 6234, Parent: 6155, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/sync.arm5.elf
  • dash New Fork (PID: 6317, Parent: 4352)
  • rm (PID: 6317, Parent: 4352, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.MOImxu5AWM /tmp/tmp.2EONbWtCXd /tmp/tmp.N60ErwQvdf
  • dash New Fork (PID: 6318, Parent: 4352)
  • rm (PID: 6318, Parent: 4352, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.MOImxu5AWM /tmp/tmp.2EONbWtCXd /tmp/tmp.N60ErwQvdf
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: sync.arm5.elfReversingLabs: Detection: 33%
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
Source: sync.arm5.elfString found in binary or memory: http://upx.sf.net
Source: unknownNetwork traffic detected: HTTP traffic on port 39246 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 39246
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
Source: LOAD without section mappingsProgram segment: 0x8000
Source: classification engineClassification label: mal52.evad.linELF@0/0@0/0

Data Obfuscation

barindex
Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sampleString containing UPX found: $Id: UPX 3.95 Copyright (C) 1996-2018 the UPX Team. All Rights Reserved. $
Source: /usr/bin/dash (PID: 6317)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.MOImxu5AWM /tmp/tmp.2EONbWtCXd /tmp/tmp.N60ErwQvdfJump to behavior
Source: /usr/bin/dash (PID: 6318)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.MOImxu5AWM /tmp/tmp.2EONbWtCXd /tmp/tmp.N60ErwQvdfJump to behavior
Source: sync.arm5.elfSubmission file: segment LOAD with 7.7444 entropy (max. 8.0)
Source: /tmp/sync.arm5.elf (PID: 6234)Queries kernel information via 'uname': Jump to behavior
Source: sync.arm5.elf, 6234.1.00005585860c6000.00005585861f4000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
Source: sync.arm5.elf, 6234.1.00007ffffe30f000.00007ffffe330000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/sync.arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sync.arm5.elf
Source: sync.arm5.elf, 6234.1.00005585860c6000.00005585861f4000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: sync.arm5.elf, 6234.1.00007ffffe30f000.00007ffffe330000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
Source: sync.arm5.elf, 6234.1.00007ffffe30f000.00007ffffe330000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception11
Obfuscated Files or Information
OS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
File Deletion
LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1650806 Sample: sync.arm5.elf Startdate: 28/03/2025 Architecture: LINUX Score: 52 12 109.202.202.202, 80 INIT7CH Switzerland 2->12 14 91.189.91.42, 443 CANONICAL-ASGB United Kingdom 2->14 16 2 other IPs or domains 2->16 18 Multi AV Scanner detection for submitted file 2->18 20 Sample is packed with UPX 2->20 6 dash rm 2->6         started        8 dash rm 2->8         started        10 sync.arm5.elf 2->10         started        signatures3 process4

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
sync.arm5.elf33%ReversingLabsLinux.Packed.Gafgyt
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
http://upx.sf.netsync.arm5.elffalse
    high
    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs
    IPDomainCountryFlagASNASN NameMalicious
    34.249.145.219
    unknownUnited States
    16509AMAZON-02USfalse
    109.202.202.202
    unknownSwitzerland
    13030INIT7CHfalse
    91.189.91.43
    unknownUnited Kingdom
    41231CANONICAL-ASGBfalse
    91.189.91.42
    unknownUnited Kingdom
    41231CANONICAL-ASGBfalse
    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    34.249.145.219na.elfGet hashmaliciousPrometeiBrowse
      na.elfGet hashmaliciousPrometeiBrowse
        na.elfGet hashmaliciousPrometeiBrowse
          na.elfGet hashmaliciousPrometeiBrowse
            na.elfGet hashmaliciousPrometeiBrowse
              Mozi.m.elfGet hashmaliciousUnknownBrowse
                na.elfGet hashmaliciousPrometeiBrowse
                  .gksed.arm.elfGet hashmaliciousUnknownBrowse
                    cron.elfGet hashmaliciousGafgyt, MiraiBrowse
                      ntpd.elfGet hashmaliciousGafgyt, MiraiBrowse
                        109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                        • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                        91.189.91.43mpsl.elfGet hashmaliciousUnknownBrowse
                          sync.x86.elfGet hashmaliciousUnknownBrowse
                            sync.mipsel.elfGet hashmaliciousUnknownBrowse
                              sync.arm4.elfGet hashmaliciousUnknownBrowse
                                bin.sh.elfGet hashmaliciousUnknownBrowse
                                  na.elfGet hashmaliciousPrometeiBrowse
                                    na.elfGet hashmaliciousPrometeiBrowse
                                      arm7.elfGet hashmaliciousMiraiBrowse
                                        na.elfGet hashmaliciousPrometeiBrowse
                                          na.elfGet hashmaliciousPrometeiBrowse
                                            91.189.91.42mpsl.elfGet hashmaliciousUnknownBrowse
                                              sync.x86.elfGet hashmaliciousUnknownBrowse
                                                sync.mipsel.elfGet hashmaliciousUnknownBrowse
                                                  sync.arm4.elfGet hashmaliciousUnknownBrowse
                                                    bin.sh.elfGet hashmaliciousUnknownBrowse
                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                        na.elfGet hashmaliciousPrometeiBrowse
                                                          arm7.elfGet hashmaliciousMiraiBrowse
                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                                No context
                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                CANONICAL-ASGBsync.powerpc.elfGet hashmaliciousUnknownBrowse
                                                                • 185.125.190.26
                                                                mpsl.elfGet hashmaliciousUnknownBrowse
                                                                • 91.189.91.42
                                                                sync.x86.elfGet hashmaliciousUnknownBrowse
                                                                • 91.189.91.42
                                                                sync.mipsel.elfGet hashmaliciousUnknownBrowse
                                                                • 91.189.91.42
                                                                sync.arm4.elfGet hashmaliciousUnknownBrowse
                                                                • 91.189.91.42
                                                                bin.sh.elfGet hashmaliciousUnknownBrowse
                                                                • 91.189.91.42
                                                                na.elfGet hashmaliciousPrometeiBrowse
                                                                • 91.189.91.42
                                                                na.elfGet hashmaliciousPrometeiBrowse
                                                                • 185.125.190.26
                                                                na.elfGet hashmaliciousPrometeiBrowse
                                                                • 91.189.91.42
                                                                arm7.elfGet hashmaliciousMiraiBrowse
                                                                • 91.189.91.42
                                                                CANONICAL-ASGBsync.powerpc.elfGet hashmaliciousUnknownBrowse
                                                                • 185.125.190.26
                                                                mpsl.elfGet hashmaliciousUnknownBrowse
                                                                • 91.189.91.42
                                                                sync.x86.elfGet hashmaliciousUnknownBrowse
                                                                • 91.189.91.42
                                                                sync.mipsel.elfGet hashmaliciousUnknownBrowse
                                                                • 91.189.91.42
                                                                sync.arm4.elfGet hashmaliciousUnknownBrowse
                                                                • 91.189.91.42
                                                                bin.sh.elfGet hashmaliciousUnknownBrowse
                                                                • 91.189.91.42
                                                                na.elfGet hashmaliciousPrometeiBrowse
                                                                • 91.189.91.42
                                                                na.elfGet hashmaliciousPrometeiBrowse
                                                                • 185.125.190.26
                                                                na.elfGet hashmaliciousPrometeiBrowse
                                                                • 91.189.91.42
                                                                arm7.elfGet hashmaliciousMiraiBrowse
                                                                • 91.189.91.42
                                                                INIT7CHmpsl.elfGet hashmaliciousUnknownBrowse
                                                                • 109.202.202.202
                                                                sync.x86.elfGet hashmaliciousUnknownBrowse
                                                                • 109.202.202.202
                                                                sync.mipsel.elfGet hashmaliciousUnknownBrowse
                                                                • 109.202.202.202
                                                                sync.arm4.elfGet hashmaliciousUnknownBrowse
                                                                • 109.202.202.202
                                                                bin.sh.elfGet hashmaliciousUnknownBrowse
                                                                • 109.202.202.202
                                                                na.elfGet hashmaliciousPrometeiBrowse
                                                                • 109.202.202.202
                                                                na.elfGet hashmaliciousPrometeiBrowse
                                                                • 109.202.202.202
                                                                arm7.elfGet hashmaliciousMiraiBrowse
                                                                • 109.202.202.202
                                                                na.elfGet hashmaliciousPrometeiBrowse
                                                                • 109.202.202.202
                                                                na.elfGet hashmaliciousPrometeiBrowse
                                                                • 109.202.202.202
                                                                AMAZON-02USsync.mips.elfGet hashmaliciousUnknownBrowse
                                                                • 54.171.230.55
                                                                na.elfGet hashmaliciousPrometeiBrowse
                                                                • 34.249.145.219
                                                                na.elfGet hashmaliciousPrometeiBrowse
                                                                • 34.254.182.186
                                                                na.elfGet hashmaliciousPrometeiBrowse
                                                                • 34.249.145.219
                                                                na.elfGet hashmaliciousPrometeiBrowse
                                                                • 54.170.242.139
                                                                na.elfGet hashmaliciousPrometeiBrowse
                                                                • 34.249.145.219
                                                                na.elfGet hashmaliciousPrometeiBrowse
                                                                • 34.249.145.219
                                                                na.elfGet hashmaliciousPrometeiBrowse
                                                                • 34.249.145.219
                                                                bin.sh.elfGet hashmaliciousMiraiBrowse
                                                                • 54.217.10.153
                                                                na.elfGet hashmaliciousPrometeiBrowse
                                                                • 54.170.242.139
                                                                No context
                                                                No context
                                                                No created / dropped files found
                                                                File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, no section header
                                                                Entropy (8bit):7.741792246006307
                                                                TrID:
                                                                • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                                File name:sync.arm5.elf
                                                                File size:43'400 bytes
                                                                MD5:a0e9ebb4504dc1c5bae5e64584724232
                                                                SHA1:ff75706e4609415bbf38f60a556ed2d9d58faec9
                                                                SHA256:4ed9fc89df574f0eeeaa38c14fd92a11f5e9749b1482f6bdd027b72399e6e928
                                                                SHA512:94db1d74cf8dc44981505c0956126a8bee0837a93ad58139d2f5ad2757dedd02400aa7df952ff6c9545f04454956162bf7200fd1c1197e3067070dd2feb60370
                                                                SSDEEP:768:5Iy0HCUokwd7lrbUuG4mGdbkvtpcqKoFHr5K3jqqb:SvHdwUuG4mGbkv/cqlDKzqqb
                                                                TLSH:A213F17A31020806EEB436B91E4D9AC4F5446E93A348529185F7EFE263FC4B7778498A
                                                                File Content Preview:.ELF...a..........(.........4...........4. ...(..........................................................z..........Q.td.............................'..UPX!........`Y..`Y......].........ELF.ra....(........4...W..... ...}......,.g...S..../.......6.8..<....

                                                                ELF header

                                                                Class:ELF32
                                                                Data:2's complement, little endian
                                                                Version:1 (current)
                                                                Machine:ARM
                                                                Version Number:0x1
                                                                Type:EXEC (Executable file)
                                                                OS/ABI:ARM - ABI
                                                                ABI Version:0
                                                                Entry Point Address:0x11f04
                                                                Flags:0x2
                                                                ELF Header Size:52
                                                                Program Header Offset:52
                                                                Program Header Size:32
                                                                Number of Program Headers:3
                                                                Section Header Offset:0
                                                                Section Header Size:40
                                                                Number of Section Headers:0
                                                                Header String Table Index:0
                                                                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                                LOAD0x00x80000x80000xa8830xa8837.74440x5R E0x8000
                                                                LOAD0x00x180000x180000x00x17ad80.00000x6RW 0x8000
                                                                GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                                                                Download Network PCAP: filteredfull

                                                                • Total Packets: 11
                                                                • 443 (HTTPS)
                                                                • 80 (HTTP)
                                                                TimestampSource PortDest PortSource IPDest IP
                                                                Mar 28, 2025 04:13:28.485959053 CET43928443192.168.2.2391.189.91.42
                                                                Mar 28, 2025 04:13:31.301557064 CET4251680192.168.2.23109.202.202.202
                                                                Mar 28, 2025 04:13:33.861253023 CET42836443192.168.2.2391.189.91.43
                                                                Mar 28, 2025 04:13:44.337208986 CET39246443192.168.2.2334.249.145.219
                                                                Mar 28, 2025 04:13:44.337260962 CET4433924634.249.145.219192.168.2.23
                                                                Mar 28, 2025 04:13:44.337400913 CET39246443192.168.2.2334.249.145.219
                                                                Mar 28, 2025 04:13:44.338017941 CET39246443192.168.2.2334.249.145.219
                                                                Mar 28, 2025 04:13:44.338040113 CET4433924634.249.145.219192.168.2.23
                                                                Mar 28, 2025 04:13:48.963084936 CET43928443192.168.2.2391.189.91.42
                                                                Mar 28, 2025 04:14:01.249587059 CET4251680192.168.2.23109.202.202.202
                                                                Mar 28, 2025 04:14:01.249643087 CET42836443192.168.2.2391.189.91.43
                                                                Mar 28, 2025 04:14:29.917495012 CET43928443192.168.2.2391.189.91.42
                                                                Mar 28, 2025 04:14:44.329269886 CET39246443192.168.2.2334.249.145.219
                                                                Mar 28, 2025 04:14:44.372344971 CET4433924634.249.145.219192.168.2.23
                                                                Mar 28, 2025 04:15:32.363254070 CET4433924634.249.145.219192.168.2.23

                                                                System Behavior

                                                                Start time (UTC):03:13:27
                                                                Start date (UTC):28/03/2025
                                                                Path:/tmp/sync.arm5.elf
                                                                Arguments:/tmp/sync.arm5.elf
                                                                File size:4956856 bytes
                                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                                Start time (UTC):03:14:43
                                                                Start date (UTC):28/03/2025
                                                                Path:/usr/bin/dash
                                                                Arguments:-
                                                                File size:129816 bytes
                                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                Start time (UTC):03:14:43
                                                                Start date (UTC):28/03/2025
                                                                Path:/usr/bin/rm
                                                                Arguments:rm -f /tmp/tmp.MOImxu5AWM /tmp/tmp.2EONbWtCXd /tmp/tmp.N60ErwQvdf
                                                                File size:72056 bytes
                                                                MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                                Start time (UTC):03:14:43
                                                                Start date (UTC):28/03/2025
                                                                Path:/usr/bin/dash
                                                                Arguments:-
                                                                File size:129816 bytes
                                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                Start time (UTC):03:14:43
                                                                Start date (UTC):28/03/2025
                                                                Path:/usr/bin/rm
                                                                Arguments:rm -f /tmp/tmp.MOImxu5AWM /tmp/tmp.2EONbWtCXd /tmp/tmp.N60ErwQvdf
                                                                File size:72056 bytes
                                                                MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b