Edit tour

Linux Analysis Report
efea6.elf

Overview

General Information

Sample name:efea6.elf
Analysis ID:1653947
MD5:1ab0d196bf57466769cff70e7f0a86fb
SHA1:f3fe74abf56449b0d6de554cfa220b285d4307e2
SHA256:4ea834e9a7f7f03b5e5b8413f8f9d588deb9b92b16fcdc3a0cee785a16e7368d
Tags:elfuser-abuse_ch
Infos:

Detection

Score:48
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Executes the "rm" command used to delete files or directories
Found strings indicative of a multi-platform dropper
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1653947
Start date and time:2025-04-01 18:37:19 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 32s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:efea6.elf
Detection:MAL
Classification:mal48.linELF@0/0@2/0
Command:/tmp/efea6.elf
PID:5516
Exit Code:139
Exit Code Info:SIGSEGV (11) Segmentation fault invalid memory reference
Killed:False
Standard Output:

Standard Error:qemu: uncaught target signal 11 (Segmentation fault) - core dumped
  • system is lnxubuntu20
  • efea6.elf (PID: 5516, Parent: 5442, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/efea6.elf
  • dash New Fork (PID: 5617, Parent: 3674)
  • rm (PID: 5617, Parent: 3674, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.vLU7744749 /tmp/tmp.hTqTAI7g1G /tmp/tmp.v80198zp3J
  • dash New Fork (PID: 5618, Parent: 3674)
  • rm (PID: 5618, Parent: 3674, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.vLU7744749 /tmp/tmp.hTqTAI7g1G /tmp/tmp.v80198zp3J
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: efea6.elfVirustotal: Detection: 25%Perma Link
Source: efea6.elfReversingLabs: Detection: 33%
Source: efea6.elfString: /lib/systemd//usr/lib/systemd/system/system/bin//gm/bin//home/process//home/helper/home/davinci/z/bin//mnt/mtd//tmp/sqfs//usr/libexec//usr/sbin//z/zbin//usr/bin/bin//tmp/var/mnt/root/boot/home/dev/media/opt/../(deleted)x86armmipsmpslsh4wgetcurllynxftpftpgettftpscpaflaaarsyncpfclamscanreadelfizsnapstracelsofgdbpmapltraceptracewiresharktsharktcpdumpnetstatssnmaphping3tracerouteiptablesnftfirewalldauditctlselinuxapparmoraptdnfyumzypperpacmanemergebrewportnanovimvinvimgeditkateemacspkillkillallkillsystemctlnohuppythonpython3perlrubyluanodebashshkshzshfishvolatilitychkrootkitrkhunterradare2binwalkdockerpodmanlxcqemuvirshvboxmanagemountumountdfdulsblkblkidmkfsfdiskpartedobjdumpstringsxxdhexdumpncnetcatsocatjournalctldmesglogcattaillessgrepawksedtmux[watcher] deleted file: %s%s/%s/data/local/tmp/sbin/dev/null/dev/console/var/lib/dockerkworker/u8:0raw.awaken-network.net/proc/self/cmdline/proc/%d/statusName:-
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49566 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 44530
Source: unknownNetwork traffic detected: HTTP traffic on port 44530 -> 443
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal48.linELF@0/0@2/0
Source: /usr/bin/dash (PID: 5617)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.vLU7744749 /tmp/tmp.hTqTAI7g1G /tmp/tmp.v80198zp3JJump to behavior
Source: /usr/bin/dash (PID: 5618)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.vLU7744749 /tmp/tmp.hTqTAI7g1G /tmp/tmp.v80198zp3JJump to behavior
Source: /tmp/efea6.elf (PID: 5516)Queries kernel information via 'uname': Jump to behavior
Source: efea6.elf, 5516.1.000055c187771000.000055c18789f000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
Source: efea6.elfBinary or memory string: /lib/systemd//usr/lib/systemd/system/system/bin//gm/bin//home/process//home/helper/home/davinci/z/bin//mnt/mtd//tmp/sqfs//usr/libexec//usr/sbin//z/zbin//usr/bin/bin//tmp/var/mnt/root/boot/home/dev/media/opt/../(deleted)x86armmipsmpslsh4wgetcurllynxftpftpgettftpscpaflaaarsyncpfclamscanreadelfizsnapstracelsofgdbpmapltraceptracewiresharktsharktcpdumpnetstatssnmaphping3tracerouteiptablesnftfirewalldauditctlselinuxapparmoraptdnfyumzypperpacmanemergebrewportnanovimvinvimgeditkateemacspkillkillallkillsystemctlnohuppythonpython3perlrubyluanodebashshkshzshfishvolatilitychkrootkitrkhunterradare2binwalkdockerpodmanlxcqemuvirshvboxmanagemountumountdfdulsblkblkidmkfsfdiskpartedobjdumpstringsxxdhexdumpncnetcatsocatjournalctldmesglogcattaillessgrepawksedtmux[watcher] deleted file: %s%s/%s/data/local/tmp/sbin/dev/null/dev/console/var/lib/dockerkworker/u8:0raw.awaken-network.net/proc/self/cmdline/proc/%d/statusName:-
Source: efea6.elf, 5516.1.00007ffd8da2f000.00007ffd8da50000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/efea6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/efea6.elf
Source: efea6.elf, 5516.1.000055c187771000.000055c18789f000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: efea6.elf, 5516.1.00007ffd8da2f000.00007ffd8da50000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
Source: efea6.elf, 5516.1.00007ffd8da2f000.00007ffd8da50000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting
Valid AccountsWindows Management Instrumentation1
Scripting
Path Interception1
File Deletion
OS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1653947 Sample: efea6.elf Startdate: 01/04/2025 Architecture: LINUX Score: 48 12 34.254.182.186, 443, 44530 AMAZON-02US United States 2->12 14 54.217.10.153, 443 AMAZON-02US United States 2->14 16 daisy.ubuntu.com 2->16 18 Multi AV Scanner detection for submitted file 2->18 6 dash rm 2->6         started        8 dash rm 2->8         started        10 efea6.elf 2->10         started        signatures3 process4

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
efea6.elf25%VirustotalBrowse
efea6.elf33%ReversingLabsLinux.Backdoor.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

NameIPActiveMaliciousAntivirus DetectionReputation
daisy.ubuntu.com
162.213.35.25
truefalse
    high
    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs
    IPDomainCountryFlagASNASN NameMalicious
    54.217.10.153
    unknownUnited States
    16509AMAZON-02USfalse
    34.254.182.186
    unknownUnited States
    16509AMAZON-02USfalse
    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    54.217.10.153main_arm5.elfGet hashmaliciousMiraiBrowse
      socatGet hashmaliciousUnknownBrowse
        na.elfGet hashmaliciousPrometeiBrowse
          na.elfGet hashmaliciousPrometeiBrowse
            Execution.i586.elfGet hashmaliciousGafgyt, MiraiBrowse
              havoc.spc.elfGet hashmaliciousMirai, OkiruBrowse
                na.elfGet hashmaliciousPrometeiBrowse
                  na.elfGet hashmaliciousPrometeiBrowse
                    boatnet.arm.elfGet hashmaliciousMiraiBrowse
                      ppc.elfGet hashmaliciousUnknownBrowse
                        34.254.182.186na.elfGet hashmaliciousPrometeiBrowse
                          na.elfGet hashmaliciousPrometeiBrowse
                            ub8ehJSePAfc9FYqZIT6.arm.elfGet hashmaliciousMiraiBrowse
                              na.elfGet hashmaliciousPrometeiBrowse
                                na.elfGet hashmaliciousPrometeiBrowse
                                  na.elfGet hashmaliciousPrometeiBrowse
                                    mips.elfGet hashmaliciousUnknownBrowse
                                      na.elfGet hashmaliciousPrometeiBrowse
                                        bin.powerpc-440fp.elfGet hashmaliciousGafgyt, MiraiBrowse
                                          boatnet.x86.elfGet hashmaliciousMiraiBrowse
                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                            daisy.ubuntu.comFederalAgent.arm5.elfGet hashmaliciousUnknownBrowse
                                            • 162.213.35.25
                                            FederalAgent.mips.elfGet hashmaliciousMiraiBrowse
                                            • 162.213.35.25
                                            FederalAgent.i686.elfGet hashmaliciousMiraiBrowse
                                            • 162.213.35.25
                                            FederalAgent.arm.elfGet hashmaliciousMiraiBrowse
                                            • 162.213.35.25
                                            FederalAgent.arm7.elfGet hashmaliciousMiraiBrowse
                                            • 162.213.35.24
                                            FederalAgent.sh4.elfGet hashmaliciousMiraiBrowse
                                            • 162.213.35.24
                                            FederalAgent.m68k.elfGet hashmaliciousMiraiBrowse
                                            • 162.213.35.25
                                            FederalAgent.x86.elfGet hashmaliciousMiraiBrowse
                                            • 162.213.35.24
                                            most-mpsl.elfGet hashmaliciousMiraiBrowse
                                            • 162.213.35.25
                                            most-mips.elfGet hashmaliciousMiraiBrowse
                                            • 162.213.35.25
                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                            AMAZON-02UShttps://buildin.ai/share/5a345237-8f26-47b9-9ffb-209d1d646648?code=0GHW42&embed=trueGet hashmaliciousInvisible JS, Tycoon2FABrowse
                                            • 3.168.73.27
                                            Watchdog.exeGet hashmaliciousUnknownBrowse
                                            • 108.139.47.112
                                            Watchdog.exeGet hashmaliciousUnknownBrowse
                                            • 108.139.47.43
                                            epibrowser_installer_130.0.6723.144.exeGet hashmaliciousUnknownBrowse
                                            • 13.225.63.87
                                            i486.elfGet hashmaliciousUnknownBrowse
                                            • 52.16.96.44
                                            arm4.elfGet hashmaliciousUnknownBrowse
                                            • 13.236.232.168
                                            x86_64.elfGet hashmaliciousUnknownBrowse
                                            • 108.151.82.213
                                            na.elfGet hashmaliciousPrometeiBrowse
                                            • 13.213.51.196
                                            FederalAgent.arm.elfGet hashmaliciousMiraiBrowse
                                            • 34.243.160.129
                                            FederalAgent.i486.elfGet hashmaliciousUnknownBrowse
                                            • 54.171.230.55
                                            AMAZON-02UShttps://buildin.ai/share/5a345237-8f26-47b9-9ffb-209d1d646648?code=0GHW42&embed=trueGet hashmaliciousInvisible JS, Tycoon2FABrowse
                                            • 3.168.73.27
                                            Watchdog.exeGet hashmaliciousUnknownBrowse
                                            • 108.139.47.112
                                            Watchdog.exeGet hashmaliciousUnknownBrowse
                                            • 108.139.47.43
                                            epibrowser_installer_130.0.6723.144.exeGet hashmaliciousUnknownBrowse
                                            • 13.225.63.87
                                            i486.elfGet hashmaliciousUnknownBrowse
                                            • 52.16.96.44
                                            arm4.elfGet hashmaliciousUnknownBrowse
                                            • 13.236.232.168
                                            x86_64.elfGet hashmaliciousUnknownBrowse
                                            • 108.151.82.213
                                            na.elfGet hashmaliciousPrometeiBrowse
                                            • 13.213.51.196
                                            FederalAgent.arm.elfGet hashmaliciousMiraiBrowse
                                            • 34.243.160.129
                                            FederalAgent.i486.elfGet hashmaliciousUnknownBrowse
                                            • 54.171.230.55
                                            No context
                                            No context
                                            No created / dropped files found
                                            File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
                                            Entropy (8bit):5.571960699480983
                                            TrID:
                                            • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                            File name:efea6.elf
                                            File size:168'636 bytes
                                            MD5:1ab0d196bf57466769cff70e7f0a86fb
                                            SHA1:f3fe74abf56449b0d6de554cfa220b285d4307e2
                                            SHA256:4ea834e9a7f7f03b5e5b8413f8f9d588deb9b92b16fcdc3a0cee785a16e7368d
                                            SHA512:f03a4b44e0572d7622a36f2c32cd006bb78773fffdec816b1dcb9f72756e94bdfe0f344639ea355bd5490b62e99aa7a2a5cdaca887ae5ca2d631bc255d858a72
                                            SSDEEP:3072:6URkx4W9X0LSqXjdjwcziagIIhUkmjouOzEVKHf:6URkp0DXZjwcuaY5mjkzEk/
                                            TLSH:09F30956B8819F11D1D112BAFE1E528E73131B78E3EE72139D246F207B8A87B0E3B515
                                            File Content Preview:.ELF..............(.....T...4...........4. ...(.....................PG..PG..............TG..TG..PG...H..............Q.td..................................-...L..................@-.,@...0....S..... 0....S.........../..0...0...@..../.8.......PG....-.@0....S

                                            ELF header

                                            Class:ELF32
                                            Data:2's complement, little endian
                                            Version:1 (current)
                                            Machine:ARM
                                            Version Number:0x1
                                            Type:EXEC (Executable file)
                                            OS/ABI:UNIX - System V
                                            ABI Version:0
                                            Entry Point Address:0x8154
                                            Flags:0x4000002
                                            ELF Header Size:52
                                            Program Header Offset:52
                                            Program Header Size:32
                                            Number of Program Headers:3
                                            Section Header Offset:168116
                                            Section Header Size:40
                                            Number of Section Headers:13
                                            Header String Table Index:12
                                            NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                            NULL0x00x00x00x00x0000
                                            .initPROGBITS0x80940x940x100x00x6AX004
                                            .textPROGBITS0x80b00xb00x206cc0x00x6AX0016
                                            .finiPROGBITS0x2877c0x2077c0x100x00x6AX004
                                            .rodataPROGBITS0x287900x207900x3fc00x00x2A008
                                            .init_arrayINIT_ARRAY0x347540x247580x80x00x3WA004
                                            .fini_arrayFINI_ARRAY0x3475c0x247600x40x00x3WA004
                                            .data.rel.roPROGBITS0x347640x247680x780x00x3WA004
                                            .gotPROGBITS0x347dc0x247e00x11c0x40x3WA004
                                            .dataPROGBITS0x349000x249040x47340x00x3WA0032
                                            .bssNOBITS0x390380x290380xc9000x00x3WA008
                                            .ARM.attributesARM_ATTRIBUTES0x00x290380x100x00x0001
                                            .shstrtabSTRTAB0x00x290480x6a0x00x0001
                                            TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                            LOAD0x00x80000x80000x247500x247505.97300x5R E0x8000.init .text .fini .rodata
                                            LOAD0x247540x347540x347500x48e40x111e40.59310x6RW 0x8000.init_array .fini_array .data.rel.ro .got .data .bss
                                            GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                                            Download Network PCAP: filteredfull

                                            • Total Packets: 7
                                            • 443 (HTTPS)
                                            • 53 (DNS)
                                            TimestampSource PortDest PortSource IPDest IP
                                            Apr 1, 2025 18:38:02.260819912 CEST49566443192.168.2.1554.217.10.153
                                            Apr 1, 2025 18:38:30.747658014 CEST44530443192.168.2.1534.254.182.186
                                            Apr 1, 2025 18:38:30.747700930 CEST4434453034.254.182.186192.168.2.15
                                            Apr 1, 2025 18:38:30.747926950 CEST44530443192.168.2.1534.254.182.186
                                            Apr 1, 2025 18:38:30.749037981 CEST44530443192.168.2.1534.254.182.186
                                            Apr 1, 2025 18:38:30.749056101 CEST4434453034.254.182.186192.168.2.15
                                            Apr 1, 2025 18:39:30.746432066 CEST44530443192.168.2.1534.254.182.186
                                            Apr 1, 2025 18:39:30.788270950 CEST4434453034.254.182.186192.168.2.15
                                            Apr 1, 2025 18:40:05.473659992 CEST4434453034.254.182.186192.168.2.15
                                            TimestampSource PortDest PortSource IPDest IP
                                            Apr 1, 2025 18:38:01.952169895 CEST4458253192.168.2.151.1.1.1
                                            Apr 1, 2025 18:38:01.952271938 CEST4259253192.168.2.151.1.1.1
                                            Apr 1, 2025 18:38:02.057892084 CEST53425921.1.1.1192.168.2.15
                                            Apr 1, 2025 18:38:02.142097950 CEST53445821.1.1.1192.168.2.15
                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                            Apr 1, 2025 18:38:01.952169895 CEST192.168.2.151.1.1.10x3c1eStandard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                                            Apr 1, 2025 18:38:01.952271938 CEST192.168.2.151.1.1.10xcadcStandard query (0)daisy.ubuntu.com28IN (0x0001)false
                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                            Apr 1, 2025 18:38:02.142097950 CEST1.1.1.1192.168.2.150x3c1eNo error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
                                            Apr 1, 2025 18:38:02.142097950 CEST1.1.1.1192.168.2.150x3c1eNo error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

                                            System Behavior

                                            Start time (UTC):16:38:00
                                            Start date (UTC):01/04/2025
                                            Path:/tmp/efea6.elf
                                            Arguments:/tmp/efea6.elf
                                            File size:4956856 bytes
                                            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                            Start time (UTC):16:39:30
                                            Start date (UTC):01/04/2025
                                            Path:/usr/bin/dash
                                            Arguments:-
                                            File size:129816 bytes
                                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                            Start time (UTC):16:39:30
                                            Start date (UTC):01/04/2025
                                            Path:/usr/bin/rm
                                            Arguments:rm -f /tmp/tmp.vLU7744749 /tmp/tmp.hTqTAI7g1G /tmp/tmp.v80198zp3J
                                            File size:72056 bytes
                                            MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                            Start time (UTC):16:39:30
                                            Start date (UTC):01/04/2025
                                            Path:/usr/bin/dash
                                            Arguments:-
                                            File size:129816 bytes
                                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                            Start time (UTC):16:39:30
                                            Start date (UTC):01/04/2025
                                            Path:/usr/bin/rm
                                            Arguments:rm -f /tmp/tmp.vLU7744749 /tmp/tmp.hTqTAI7g1G /tmp/tmp.v80198zp3J
                                            File size:72056 bytes
                                            MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b