Create Interactive Tour

Linux Analysis Report
arm4.elf

Overview

General Information

Sample name:	arm4.elf
Analysis ID:	1653911
MD5:	c54cfbfc8cced6cf2e8385f4753a0833
SHA1:	71a88b66e7b0352d0a39e60c962f28303040c03b
SHA256:	603651e5c7fcc5af18e5304325ffa5b5f3ea1e91883180c039defb09321913f6
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	56
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

Sample has stripped symbol table

Sample listens on a socket

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1653911
Start date and time:	2025-04-01 17:57:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	arm4.elf
Detection:	MAL
Classification:	mal56.linELF@0/0@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/arm4.elf
PID:	5429
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	JEW was here lol
Standard Error:

Process Tree

system is lnxubuntu20

arm4.elf (PID: 5429, Parent: 5349, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm4.elf

arm4.elf New Fork (PID: 5431, Parent: 5429)

arm4.elf New Fork (PID: 5433, Parent: 5429)

arm4.elf New Fork (PID: 5435, Parent: 5433)

arm4.elf New Fork (PID: 5437, Parent: 5433)

dash New Fork (PID: 5483, Parent: 3580)

rm (PID: 5483, Parent: 3580, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.jgX3PWyVSo /tmp/tmp.XHpEnBrg1b /tmp/tmp.SjETxf9HWN

dash New Fork (PID: 5484, Parent: 3580)

cat (PID: 5484, Parent: 3580, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.jgX3PWyVSo

dash New Fork (PID: 5485, Parent: 3580)

head (PID: 5485, Parent: 3580, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 5486, Parent: 3580)

tr (PID: 5486, Parent: 3580, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 5487, Parent: 3580)

cut (PID: 5487, Parent: 3580, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 5488, Parent: 3580)

cat (PID: 5488, Parent: 3580, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.jgX3PWyVSo

dash New Fork (PID: 5489, Parent: 3580)

head (PID: 5489, Parent: 3580, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 5490, Parent: 3580)

tr (PID: 5490, Parent: 3580, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 5491, Parent: 3580)

cut (PID: 5491, Parent: 3580, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 5492, Parent: 3580)

rm (PID: 5492, Parent: 3580, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.jgX3PWyVSo /tmp/tmp.XHpEnBrg1b /tmp/tmp.SjETxf9HWN

cleanup

HTTP traffic detected: GET / HTTP/1.1User-Agent: wget/1.20.3-1ubuntu1 Ubuntu/20.04.2/LTS GNU/Linux/5.4.0-72-generic/x86_64 Intel(R)/Xeon(R)/Silver/4210/CPU/@/2.20GHz cloud_id/noneAccept: */*Accept-Encoding: identityHost: motd.ubuntu.comConnection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 57230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57230

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal56.linELF@0/0@0/0

Source: /usr/bin/dash (PID: 5483)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.jgX3PWyVSo /tmp/tmp.XHpEnBrg1b /tmp/tmp.SjETxf9HWN			Jump to behavior
Source: /usr/bin/dash (PID: 5492)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.jgX3PWyVSo /tmp/tmp.XHpEnBrg1b /tmp/tmp.SjETxf9HWN			Jump to behavior

Source: /tmp/arm4.elf (PID: 5429)

Queries kernel information via 'uname':

Jump to behavior

Source: arm4.elf, 5429.1.00007ffd8d2aa000.00007ffd8d2cb000.rw-.sdmp, arm4.elf, 5431.1.00007ffd8d2aa000.00007ffd8d2cb000.rw-.sdmp, arm4.elf, 5435.1.00007ffd8d2aa000.00007ffd8d2cb000.rw-.sdmp	Binary or memory string: yx86_64/usr/bin/qemu-arm/tmp/arm4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm4.elf
Source: arm4.elf, 5429.1.0000555ac3053000.0000555ac3181000.rw-.sdmp, arm4.elf, 5431.1.0000555ac3053000.0000555ac3181000.rw-.sdmp, arm4.elf, 5435.1.0000555ac3053000.0000555ac3181000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: arm4.elf, 5429.1.00007ffd8d2aa000.00007ffd8d2cb000.rw-.sdmp, arm4.elf, 5431.1.00007ffd8d2aa000.00007ffd8d2cb000.rw-.sdmp, arm4.elf, 5435.1.00007ffd8d2aa000.00007ffd8d2cb000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: arm4.elf, 5429.1.0000555ac3053000.0000555ac3181000.rw-.sdmp, arm4.elf, 5431.1.0000555ac3053000.0000555ac3181000.rw-.sdmp, arm4.elf, 5435.1.0000555ac3053000.0000555ac3181000.rw-.sdmp	Binary or memory string: ZU!/etc/qemu-binfmt/arm

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	1 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
arm4.elf	59%	Virustotal		Browse
arm4.elf	67%	ReversingLabs	Linux.Trojan.Mirai
arm4.elf	100%	Avira	EXP/ELF.Mirai.Bootnet.o

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://motd.ubuntu.com/	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
190.110.208.76	unknown	Ecuador	22724	PUNTONETSAEC	false
58.9.180.211	unknown	Thailand	17552	TRUE-AS-APTrueInternetCoLtdTH	false
191.131.194.152	unknown	Brazil	26615	TIMSABR	false
160.229.97.125	unknown	United States	2269	FR-U-PARISSUD-ORSAYFREU	false
50.164.54.193	unknown	United States	7922	COMCAST-7922US	false
112.49.245.34	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
41.203.39.0	unknown	South Africa	36968	ECN-AS1ZA	false
146.132.148.42	unknown	United States	10695	WAL-MARTUS	false
117.178.194.1	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
166.17.44.249	unknown	United States	206	CSC-IGN-AMERUS	false
160.223.199.237	unknown	Canada	24771	FIAT-AS2IT	false
44.60.215.90	unknown	United States	7377	UCSDUS	false
177.72.44.24	unknown	Brazil	52813	MosaicoTelecomClinitecBR	false
132.66.138.252	unknown	Israel	378	MACHBA-ASILANIL	false
100.55.147.96	unknown	United States	701	UUNETUS	false
178.211.233.90	unknown	Switzerland	39544	VOECH	false
40.225.231.123	unknown	United States	4249	LILLY-ASUS	false
175.6.14.25	unknown	China	63835	CT-HUNAN-CHANGSHA-IDCNo293WanbaoAvenueCN	false
208.47.200.54	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
13.106.20.191	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
138.72.176.56	unknown	United States	30013	PIXAR-ASUS	false
171.146.18.178	unknown	United States	9874	STARHUB-MOBILEStarHubLtdSG	false
124.207.102.251	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
212.237.85.52	unknown	United Kingdom	16082	SPITFIREGB	false
164.88.136.164	unknown	South Africa	137951	CLAYERLIMITED-AS-APClayerLimitedHK	false
220.56.85.16	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
90.229.231.69	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
103.119.123.59	unknown	India	133278	ENETSOLS-AS-INDehradunEnetSolutionsPrivateLtdIN	false
31.112.34.50	unknown	United Kingdom	12576	EELtdGB	false
13.236.232.168	unknown	United States	16509	AMAZON-02US	false
131.53.93.123	unknown	United States	385	AFCONC-BLOCK1-ASUS	false
118.31.65.125	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
59.119.172.207	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
191.103.13.108	unknown	Argentina	28048	InternetParaTodos-GobiernodeLaRiojaAR	false
19.20.242.209	unknown	United States	3	MIT-GATEWAYSUS	false
183.47.151.217	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
53.251.116.223	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
150.176.128.194	unknown	United States	26438	MONROE-COMMUNITY-COLLEGEUS	false
192.147.201.71	unknown	United States	1313	ADOBE1-AS-ASUS	false
93.139.247.204	unknown	Croatia (LOCAL Name: Hrvatska)	5391	T-HTCroatianTelecomIncHR	false
161.93.220.128	unknown	Japan	14298	EPA-NETUS	false
40.203.127.127	unknown	United States	4249	LILLY-ASUS	false
70.107.151.211	unknown	United States	701	UUNETUS	false
106.57.220.200	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
181.101.151.154	unknown	Argentina	7303	TelecomArgentinaSAAR	false
103.78.119.48	unknown	Japan	58650	CATVWINKWarabiCableVisionCoLtdJP	false
82.148.116.223	unknown	Qatar	8781	QA-ISPQA	false
125.179.7.96	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
100.175.221.129	unknown	United States	21928	T-MOBILE-AS21928US	false
112.56.209.96	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
74.83.24.121	unknown	United States	6181	FUSE-NETUS	false
194.155.202.69	unknown	United Kingdom	5503	RMIFLGB	false
27.250.130.41	unknown	India	10201	DWL-AS-INDishnetWirelessLimitedBroadbandWirelessIN	false
218.251.63.77	unknown	Japan	17511	OPTAGEOPTAGEIncJP	false
200.25.167.187	unknown	Ecuador	14522	SatnetEC	false
125.56.19.43	unknown	Japan	7679	QTNETQTnetIncJP	false
70.0.41.119	unknown	United States	10507	SPCSUS	false
35.57.70.154	unknown	United States	36375	UMICH-AS-5US	false
14.128.230.30	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
217.85.175.217	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
17.112.122.111	unknown	United States	714	APPLE-ENGINEERINGUS	false
1.243.46.128	unknown	Korea Republic of	38415	GOEGN-AS-KRGuriNamyangjuOfficeOfEducationKR	false
23.44.132.48	unknown	United States	20940	AKAMAI-ASN1EU	false
73.167.101.177	unknown	United States	7922	COMCAST-7922US	false
99.130.173.204	unknown	United States	7018	ATT-INTERNET4US	false
71.6.170.30	unknown	United States	10439	CARINETUS	false
210.228.118.204	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
103.191.211.186	unknown	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
152.242.223.222	unknown	Brazil	26599	TELEFONICABRASILSABR	false
217.110.80.143	unknown	Germany	8220	COLTCOLTTechnologyServicesGroupLimitedGB	false
140.233.137.6	unknown	United States	14550	MIDDLEBURY-COLLEGEUS	false
74.122.132.2	unknown	Canada	20161	TRGOCA	false
135.123.1.243	unknown	United States	18676	AVAYAUS	false
71.251.192.70	unknown	United States	701	UUNETUS	false
108.34.146.60	unknown	United States	701	UUNETUS	false
182.163.41.236	unknown	Japan	10013	FBDCFreeBitCoLtdJP	false
144.111.213.194	unknown	United States	6262	CSIROCommonwealthScientificandIndustrialAU	false
119.242.33.27	unknown	Japan	2518	BIGLOBEBIGLOBEIncJP	false
73.198.70.223	unknown	United States	7922	COMCAST-7922US	false
175.248.36.216	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
98.57.93.174	unknown	United States	7922	COMCAST-7922US	false
67.1.99.194	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
218.49.51.72	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
192.233.100.176	unknown	United States	3356	LEVEL3US	false
177.224.246.19	unknown	Mexico	13999	MegaCableSAdeCVMX	false
80.213.114.186	unknown	Norway	2119	TELENOR-NEXTELTelenorNorgeASNO	false
198.222.52.25	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
196.186.144.46	unknown	Tunisia	5438	ATI-TN	false
87.117.138.151	unknown	Russian Federation	41691	SUMTEL-AS-RIPEMoscowRussiaRU	false
12.200.128.106	unknown	United States	7018	ATT-INTERNET4US	false
85.246.120.62	unknown	Portugal	3243	MEO-RESIDENCIALPT	false
112.102.255.127	unknown	China	17897	CHINATELECOM-HLJ-AS-APasnforHeilongjiangProvincialNeto	false
8.159.126.32	unknown	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
64.172.167.233	unknown	United States	7132	SBIS-ASUS	false
155.92.185.239	unknown	United States	11500	MSOE-INTERNETUS	false
209.92.198.134	unknown	United States	7029	WINDSTREAMUS	false
178.218.158.77	unknown	Russian Federation	209759	ASMT6RU	false
190.70.3.176	unknown	Colombia	13489	EPMTelecomunicacionesSAESPCO	false
160.154.71.176	unknown	Cote D'ivoire	29571	ORANGE-COTE-IVOIRECI	false
8.116.5.128	unknown	United States	3356	LEVEL3US	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
146.132.148.42	h0r0zx00x.x86.elf	Get hash	malicious	Mirai	Browse
58.9.180.211	lvpoK7Ujup.elf	Get hash	malicious	Mirai	Browse
191.131.194.152	7OIYUbn30U	Get hash	malicious	Mirai	Browse
112.49.245.34	hz7NY6RFBX	Get hash	malicious	Mirai	Browse
41.203.39.0	boatnet.arm.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	94.156.8.9-skid.sh4-2024-07-23T17_40_06.elf	Get hash	malicious	Mirai, Moobot	Browse
	i586.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	n199svrcQC.elf	Get hash	malicious	Mirai	Browse
	log21.mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse
175.6.14.25	XzPa4QOz1i	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TRUE-AS-APTrueInternetCoLtdTH	k03ldc.spc.elf	Get hash	malicious	Unknown	Browse	115.87.226.51
	k03ldc.sh4.elf	Get hash	malicious	Unknown	Browse	124.121.111.73
	m68k.elf	Get hash	malicious	Unknown	Browse	61.90.87.95
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	61.90.87.78
	x86_64.elf	Get hash	malicious	Mirai	Browse	171.101.197.136
	hoho.i686.elf	Get hash	malicious	Unknown	Browse	171.96.124.142
	Nyx4r.mips.elf	Get hash	malicious	Okiru	Browse	171.99.205.149
	raw_cbot.exe	Get hash	malicious	Unknown	Browse	58.9.110.23
	raw_cbot.exe	Get hash	malicious	Unknown	Browse	58.9.110.23
	sshd	Get hash	malicious	Unknown	Browse	171.97.167.202
PUNTONETSAEC	vjwe68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	190.12.192.87
	ssh.mips.elf	Get hash	malicious	Mirai	Browse	190.12.192.78
	SecuriteInfo.com.Linux.Siggen.9999.31476.4146.elf	Get hash	malicious	Mirai	Browse	179.49.160.0
	sh4.elf	Get hash	malicious	Unknown	Browse	190.12.192.77
	ppc.elf	Get hash	malicious	Unknown	Browse	190.12.192.77
	res.mips.elf	Get hash	malicious	Unknown	Browse	190.12.133.124
	res.sh4.elf	Get hash	malicious	Unknown	Browse	179.49.183.144
	res.x86.elf	Get hash	malicious	Unknown	Browse	190.12.192.80
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	190.110.221.24
	sora.ppc.elf	Get hash	malicious	Mirai	Browse	190.12.192.98
TIMSABR	ppc.elf	Get hash	malicious	Mirai	Browse	191.160.73.71
	sh4.elf	Get hash	malicious	Unknown	Browse	179.200.97.118
	boatnet.x86_64.elf	Get hash	malicious	Mirai	Browse	179.73.88.73
	bimbo-m68k.elf	Get hash	malicious	Unknown	Browse	187.80.109.69
	k03ldc.m68k.elf	Get hash	malicious	Unknown	Browse	191.225.70.192
	k03ldc.arm7.elf	Get hash	malicious	Mirai	Browse	177.165.180.93
	k03ldc.sh4.elf	Get hash	malicious	Unknown	Browse	191.162.236.203
	k03ldc.mpsl.elf	Get hash	malicious	Unknown	Browse	189.67.161.196
	k03ldc.mips.elf	Get hash	malicious	Unknown	Browse	179.11.198.172
	vjwe68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	191.160.251.148

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Source: arm4.elf	Virustotal: Detection: 59%			Perma Link
Source: arm4.elf	ReversingLabs: Detection: 66%

Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.84.207
Source: unknown	TCP traffic detected without corresponding DNS query: 37.221.139.6
Source: unknown	TCP traffic detected without corresponding DNS query: 25.190.251.132
Source: unknown	TCP traffic detected without corresponding DNS query: 196.13.214.95
Source: unknown	TCP traffic detected without corresponding DNS query: 124.128.146.99
Source: unknown	TCP traffic detected without corresponding DNS query: 171.47.191.119
Source: unknown	TCP traffic detected without corresponding DNS query: 34.90.27.183
Source: unknown	TCP traffic detected without corresponding DNS query: 31.22.76.36
Source: unknown	TCP traffic detected without corresponding DNS query: 37.190.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 68.120.135.247
Source: unknown	TCP traffic detected without corresponding DNS query: 168.91.64.196
Source: unknown	TCP traffic detected without corresponding DNS query: 96.179.37.246
Source: unknown	TCP traffic detected without corresponding DNS query: 47.114.39.63
Source: unknown	TCP traffic detected without corresponding DNS query: 195.112.248.187
Source: unknown	TCP traffic detected without corresponding DNS query: 167.85.29.206
Source: unknown	TCP traffic detected without corresponding DNS query: 165.245.235.42
Source: unknown	TCP traffic detected without corresponding DNS query: 66.187.207.175
Source: unknown	TCP traffic detected without corresponding DNS query: 25.192.185.182
Source: unknown	TCP traffic detected without corresponding DNS query: 192.252.124.177
Source: unknown	TCP traffic detected without corresponding DNS query: 160.73.13.70
Source: unknown	TCP traffic detected without corresponding DNS query: 211.118.126.196
Source: unknown	TCP traffic detected without corresponding DNS query: 180.169.4.46
Source: unknown	TCP traffic detected without corresponding DNS query: 155.143.91.192
Source: unknown	TCP traffic detected without corresponding DNS query: 180.141.181.94
Source: unknown	TCP traffic detected without corresponding DNS query: 65.184.224.226
Source: unknown	TCP traffic detected without corresponding DNS query: 152.13.148.80
Source: unknown	TCP traffic detected without corresponding DNS query: 197.239.21.142
Source: unknown	TCP traffic detected without corresponding DNS query: 202.169.35.73
Source: unknown	TCP traffic detected without corresponding DNS query: 92.29.5.213
Source: unknown	TCP traffic detected without corresponding DNS query: 145.50.76.145
Source: unknown	TCP traffic detected without corresponding DNS query: 167.147.117.171
Source: unknown	TCP traffic detected without corresponding DNS query: 72.168.81.62
Source: unknown	TCP traffic detected without corresponding DNS query: 130.127.34.114
Source: unknown	TCP traffic detected without corresponding DNS query: 158.71.222.221
Source: unknown	TCP traffic detected without corresponding DNS query: 119.36.243.198
Source: unknown	TCP traffic detected without corresponding DNS query: 99.68.209.172
Source: unknown	TCP traffic detected without corresponding DNS query: 85.124.67.5
Source: unknown	TCP traffic detected without corresponding DNS query: 222.29.223.46
Source: unknown	TCP traffic detected without corresponding DNS query: 12.165.12.229
Source: unknown	TCP traffic detected without corresponding DNS query: 121.14.88.45
Source: unknown	TCP traffic detected without corresponding DNS query: 83.177.223.86
Source: unknown	TCP traffic detected without corresponding DNS query: 68.118.232.205
Source: unknown	TCP traffic detected without corresponding DNS query: 37.8.97.239
Source: unknown	TCP traffic detected without corresponding DNS query: 218.170.108.120
Source: unknown	TCP traffic detected without corresponding DNS query: 84.166.153.35
Source: unknown	TCP traffic detected without corresponding DNS query: 23.181.41.210
Source: unknown	TCP traffic detected without corresponding DNS query: 194.216.245.13
Source: unknown	TCP traffic detected without corresponding DNS query: 175.5.60.245
Source: unknown	TCP traffic detected without corresponding DNS query: 187.79.236.54
Source: unknown	TCP traffic detected without corresponding DNS query: 156.83.103.27

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.0694196048165105
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	arm4.elf
File size:	64'396 bytes
MD5:	c54cfbfc8cced6cf2e8385f4753a0833
SHA1:	71a88b66e7b0352d0a39e60c962f28303040c03b
SHA256:	603651e5c7fcc5af18e5304325ffa5b5f3ea1e91883180c039defb09321913f6
SHA512:	4df6db5458326afedff942165debd11e2a41f02bf9a3f9cdc939cbf255c31697e222690cc3221316db103acf4a7588133765966aba60606976c2acf2e16bfa1a
SSDEEP:	1536:PjZTH0sjiwKJ0I0MNSksKYrbIlG9WQ5sAdKWd42+:Pj5PZnrb8G9n5JdKC
TLSH:	5B53E681B8819A17C5E412BBFA6E018D373563F8D1DF3216CD226F6476C982F0DA7792
File Content Preview:	.ELF...a..........(.........4...........4. ...(.....................................................,...@...........Q.td..................................-...L."...j:..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	63996
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0xe9e0	0x0	0x6	AX	16
.fini	PROGBITS	0x16a90	0xea90	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x16aa4	0xeaa4	0xce8	0x0	0x2	A	4
.ctors	PROGBITS	0x1f790	0xf790	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x1f798	0xf798	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x1f7a4	0xf7a4	0x218	0x0	0x3	WA	4
.bss	NOBITS	0x1f9bc	0xf9bc	0x314	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xf9bc	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0xf78c	0xf78c	6.0914	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0xf790	0x1f790	0x1f790	0x22c	0x540	2.9298	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Bytes transferred	Direction	Data
2025-04-01 15:58:22 UTC	249	OUT	GET / HTTP/1.1 User-Agent: wget/1.20.3-1ubuntu1 Ubuntu/20.04.2/LTS GNU/Linux/5.4.0-72-generic/x86_64 Intel(R)/Xeon(R)/Silver/4210/CPU/@/2.20GHz cloud_id/none Accept: / Accept-Encoding: identity Host: motd.ubuntu.com Connection: Keep-Alive
2025-04-01 15:58:23 UTC	271	IN	HTTP/1.1 200 OK Date: Tue, 01 Apr 2025 15:58:22 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Tue, 01 Apr 2025 15:46:01 GMT ETag: "d8-631b96eff48e4" Accept-Ranges: bytes Content-Length: 216 Vary: Accept-Encoding Connection: close Content-Type: text/plain
2025-04-01 15:58:23 UTC	216	IN	Data Raw: 20 2a 20 53 74 72 69 63 74 6c 79 20 63 6f 6e 66 69 6e 65 64 20 4b 75 62 65 72 6e 65 74 65 73 20 6d 61 6b 65 73 20 65 64 67 65 20 61 6e 64 20 49 6f 54 20 73 65 63 75 72 65 2e 20 4c 65 61 72 6e 20 68 6f 77 20 4d 69 63 72 6f 4b 38 73 0a 20 20 20 6a 75 73 74 20 72 61 69 73 65 64 20 74 68 65 20 62 61 72 20 66 6f 72 20 65 61 73 79 2c 20 72 65 73 69 6c 69 65 6e 74 20 61 6e 64 20 73 65 63 75 72 65 20 4b 38 73 20 63 6c 75 73 74 65 72 20 64 65 70 6c 6f 79 6d 65 6e 74 2e 0a 0a 20 20 20 68 74 74 70 73 3a 2f 2f 75 62 75 6e 74 75 2e 63 6f 6d 2f 65 6e 67 61 67 65 2f 73 65 63 75 72 65 2d 6b 75 62 65 72 6e 65 74 65 73 2d 61 74 2d 74 68 65 2d 65 64 67 65 0a Data Ascii: * Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s just raised the bar for easy, resilient and secure K8s cluster deployment. https://ubuntu.com/engage/secure-kubernetes-at-the-edge

Start time (UTC):	15:57:47
Start date (UTC):	01/04/2025
Path:	/tmp/arm4.elf
Arguments:	/tmp/arm4.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	15:58:22
Start date (UTC):	01/04/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source: global traffic	TCP traffic: 192.168.2.13:45844 -> 87.121.84.207:9931
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 37.221.139.6:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 168.91.64.196:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 145.50.76.145:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 83.177.223.86:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 58.80.175.11:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 74.94.214.18:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 118.211.30.149:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 176.118.93.92:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 89.207.46.106:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 157.8.218.9:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 51.251.113.147:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 67.55.206.160:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 32.177.220.122:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 177.18.221.92:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 209.226.61.48:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 23.217.98.224:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 51.69.210.116:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 186.145.170.168:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 25.71.68.253:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 41.168.154.162:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 213.219.112.233:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 42.20.115.177:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 221.118.153.111:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 2.4.21.53:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 61.7.243.209:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 50.68.255.108:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 169.167.40.210:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 181.224.82.140:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 39.71.177.29:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 130.150.135.90:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 86.229.166.46:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 54.207.114.84:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 70.255.177.170:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 139.139.168.39:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 17.153.182.139:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 61.41.99.74:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 98.181.71.153:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 196.224.137.154:2323
Source: global traffic	TCP traffic: 192.168.2.13:11103 -> 44.57.27.162:2323

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 1, 2025 17:57:48.666372061 CEST	45844	9931	192.168.2.13	87.121.84.207
Apr 1, 2025 17:57:48.700428963 CEST	11103	2323	192.168.2.13	37.221.139.6
Apr 1, 2025 17:57:48.700476885 CEST	11103	23	192.168.2.13	25.190.251.132
Apr 1, 2025 17:57:48.700490952 CEST	11103	23	192.168.2.13	196.13.214.95
Apr 1, 2025 17:57:48.700500011 CEST	11103	23	192.168.2.13	124.128.146.99
Apr 1, 2025 17:57:48.700524092 CEST	11103	23	192.168.2.13	188.100.110.125
Apr 1, 2025 17:57:48.700524092 CEST	11103	23	192.168.2.13	171.47.191.119
Apr 1, 2025 17:57:48.700529099 CEST	11103	23	192.168.2.13	34.90.27.183
Apr 1, 2025 17:57:48.700541973 CEST	11103	23	192.168.2.13	31.22.76.36
Apr 1, 2025 17:57:48.700548887 CEST	11103	23	192.168.2.13	37.190.41.4
Apr 1, 2025 17:57:48.700560093 CEST	11103	23	192.168.2.13	68.120.135.247
Apr 1, 2025 17:57:48.700583935 CEST	11103	2323	192.168.2.13	168.91.64.196
Apr 1, 2025 17:57:48.700651884 CEST	11103	23	192.168.2.13	96.179.37.246
Apr 1, 2025 17:57:48.700664043 CEST	11103	23	192.168.2.13	47.114.39.63
Apr 1, 2025 17:57:48.700664997 CEST	11103	23	192.168.2.13	195.112.248.187
Apr 1, 2025 17:57:48.700689077 CEST	11103	23	192.168.2.13	167.85.29.206
Apr 1, 2025 17:57:48.700692892 CEST	11103	23	192.168.2.13	165.245.235.42
Apr 1, 2025 17:57:48.700699091 CEST	11103	23	192.168.2.13	66.187.207.175
Apr 1, 2025 17:57:48.700705051 CEST	11103	23	192.168.2.13	25.192.185.182
Apr 1, 2025 17:57:48.700761080 CEST	11103	2323	192.168.2.13	192.252.124.177
Apr 1, 2025 17:57:48.700764894 CEST	11103	23	192.168.2.13	160.73.13.70
Apr 1, 2025 17:57:48.700767040 CEST	11103	23	192.168.2.13	211.118.126.196
Apr 1, 2025 17:57:48.700777054 CEST	11103	23	192.168.2.13	180.169.4.46
Apr 1, 2025 17:57:48.700777054 CEST	11103	23	192.168.2.13	155.143.91.192
Apr 1, 2025 17:57:48.700777054 CEST	11103	23	192.168.2.13	180.141.181.94
Apr 1, 2025 17:57:48.700792074 CEST	11103	23	192.168.2.13	65.184.224.226
Apr 1, 2025 17:57:48.700807095 CEST	11103	23	192.168.2.13	152.13.148.80
Apr 1, 2025 17:57:48.700835943 CEST	11103	23	192.168.2.13	197.239.21.142
Apr 1, 2025 17:57:48.700836897 CEST	11103	23	192.168.2.13	202.169.35.73
Apr 1, 2025 17:57:48.700840950 CEST	11103	23	192.168.2.13	92.29.5.213
Apr 1, 2025 17:57:48.700860023 CEST	11103	2323	192.168.2.13	145.50.76.145
Apr 1, 2025 17:57:48.700860023 CEST	11103	23	192.168.2.13	167.147.117.171
Apr 1, 2025 17:57:48.700864077 CEST	11103	23	192.168.2.13	72.168.81.62
Apr 1, 2025 17:57:48.700870991 CEST	11103	23	192.168.2.13	130.127.34.114
Apr 1, 2025 17:57:48.700875998 CEST	11103	23	192.168.2.13	158.71.222.221
Apr 1, 2025 17:57:48.700881004 CEST	11103	23	192.168.2.13	119.36.243.198
Apr 1, 2025 17:57:48.700887918 CEST	11103	23	192.168.2.13	99.68.209.172
Apr 1, 2025 17:57:48.700900078 CEST	11103	23	192.168.2.13	85.124.67.5
Apr 1, 2025 17:57:48.700917959 CEST	11103	23	192.168.2.13	222.29.223.46
Apr 1, 2025 17:57:48.700932980 CEST	11103	23	192.168.2.13	12.165.12.229

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report arm4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

HTTPS Proxied Packets

System Behavior

Analysis Process: arm4.elf PID: 5429, Parent PID: 5349

General

File Activities

File Opened

File Read

Process Activities

Process Forked

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Listening

Socket Connecting

Chronological Activities

Analysis Process: arm4.elf PID: 5431, Parent PID: 5429

General

File Activities

File Opened

Process Activities

Thread Sleep

Chronological Activities

Analysis Process: arm4.elf PID: 5433, Parent PID: 5429

General

Linux Analysis Report
arm4.elf