Edit tour

Linux Analysis Report
ppc.elf

Overview

General Information

Sample name:ppc.elf
Analysis ID:1654440
MD5:858e620847a855232fffcb17c8057b4a
SHA1:275204e6316b32aa44e6e5a4298a90905c912ac1
SHA256:caa1621ea48e0134bd6edd637415138562b9ee4ac92e340c02838c26ef893b95
Tags:elfuser-abuse_ch
Infos:

Detection

Score:48
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Executes the "rm" command used to delete files or directories
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1654440
Start date and time:2025-04-02 11:19:19 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 40s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:ppc.elf
Detection:MAL
Classification:mal48.linELF@0/0@0/0
Command:/tmp/ppc.elf
PID:6223
Exit Code:132
Exit Code Info:SIGILL (4) Illegal Instruction
Killed:False
Standard Output:

Standard Error:qemu: uncaught target signal 4 (Illegal instruction) - core dumped
  • system is lnxubuntu20
  • ppc.elf (PID: 6223, Parent: 6145, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/ppc.elf
  • dash New Fork (PID: 6307, Parent: 4331)
  • rm (PID: 6307, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.wWI67oDWRT /tmp/tmp.4orplegfW4 /tmp/tmp.KkdVkZ7nzf
  • dash New Fork (PID: 6308, Parent: 4331)
  • rm (PID: 6308, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.wWI67oDWRT /tmp/tmp.4orplegfW4 /tmp/tmp.KkdVkZ7nzf
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: ppc.elfVirustotal: Detection: 12%Perma Link
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 39240
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 39240 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
Source: Initial sampleString containing 'busybox' found: /bin/busybox ech
Source: Initial sampleString containing 'busybox' found: /bin/busybox
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne "\x5b\
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -n
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne "\x6e\
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne "\x66\
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne "\
Source: Initial sampleString containing 'busybox' found: /busybox echo -ne "\x20\x5b\
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne "\x6b\
Source: classification engineClassification label: mal48.linELF@0/0@0/0
Source: /usr/bin/dash (PID: 6307)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.wWI67oDWRT /tmp/tmp.4orplegfW4 /tmp/tmp.KkdVkZ7nzfJump to behavior
Source: /usr/bin/dash (PID: 6308)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.wWI67oDWRT /tmp/tmp.4orplegfW4 /tmp/tmp.KkdVkZ7nzfJump to behavior
Source: /tmp/ppc.elf (PID: 6223)Queries kernel information via 'uname': Jump to behavior
Source: ppc.elf, 6223.1.0000564f2887d000.0000564f2890c000.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: ppc.elf, 6223.1.0000564f2887d000.0000564f2890c000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/ppc
Source: ppc.elf, 6223.1.00007ffe665f8000.00007ffe66619000.rw-.sdmpBinary or memory string: /usr/bin/qemu-ppc
Source: ppc.elf, 6223.1.00007ffe665f8000.00007ffe66619000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 4 (Illegal instruction) - core dumped
Source: ppc.elf, 6223.1.00007ffe665f8000.00007ffe66619000.rw-.sdmpBinary or memory string: SAx86_64/usr/bin/qemu-ppc/tmp/ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ppc.elf
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
File Deletion
OS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1654440 Sample: ppc.elf Startdate: 02/04/2025 Architecture: LINUX Score: 48 12 109.202.202.202, 80 INIT7CH Switzerland 2->12 14 91.189.91.42, 443 CANONICAL-ASGB United Kingdom 2->14 16 2 other IPs or domains 2->16 18 Multi AV Scanner detection for submitted file 2->18 6 dash rm 2->6         started        8 dash rm 2->8         started        10 ppc.elf 2->10         started        signatures3 process4
SourceDetectionScannerLabelLink
ppc.elf12%VirustotalBrowse
ppc.elf6%ReversingLabsLinux.Trojan.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

No contacted domains info
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs
IPDomainCountryFlagASNASN NameMalicious
34.249.145.219
unknownUnited States
16509AMAZON-02USfalse
109.202.202.202
unknownSwitzerland
13030INIT7CHfalse
91.189.91.43
unknownUnited Kingdom
41231CANONICAL-ASGBfalse
91.189.91.42
unknownUnited Kingdom
41231CANONICAL-ASGBfalse
MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
34.249.145.219drea4.elfGet hashmaliciousUnknownBrowse
    825.elfGet hashmaliciousUnknownBrowse
      IdpLihor52.elfGet hashmaliciousUnknownBrowse
        Space.mips.elfGet hashmaliciousUnknownBrowse
          Space.spc.elfGet hashmaliciousMiraiBrowse
            Space.arc.elfGet hashmaliciousMiraiBrowse
              mips.elfGet hashmaliciousUnknownBrowse
                FBI.x86.elfGet hashmaliciousGafgyt, MiraiBrowse
                  FBI.arm5.elfGet hashmaliciousGafgyt, MiraiBrowse
                    na.elfGet hashmaliciousPrometeiBrowse
                      109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                      • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                      91.189.91.43drea4.elfGet hashmaliciousUnknownBrowse
                        825.elfGet hashmaliciousUnknownBrowse
                          IdpLihor52.elfGet hashmaliciousUnknownBrowse
                            Space.mips.elfGet hashmaliciousUnknownBrowse
                              rrrdsl.elfGet hashmaliciousUnknownBrowse
                                Space.spc.elfGet hashmaliciousMiraiBrowse
                                  Space.ppc.elfGet hashmaliciousUnknownBrowse
                                    Space.arc.elfGet hashmaliciousMiraiBrowse
                                      mips.elfGet hashmaliciousUnknownBrowse
                                        FBI.mpsl.elfGet hashmaliciousGafgyt, MiraiBrowse
                                          No context
                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                          CANONICAL-ASGBxd.arm6.elfGet hashmaliciousMiraiBrowse
                                          • 185.125.190.26
                                          drea4.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          825.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          IdpLihor52.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          Space.mips.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          rrrdsl.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          Space.spc.elfGet hashmaliciousMiraiBrowse
                                          • 91.189.91.42
                                          Space.ppc.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          Space.mpsl.elfGet hashmaliciousUnknownBrowse
                                          • 185.125.190.26
                                          Space.arc.elfGet hashmaliciousMiraiBrowse
                                          • 91.189.91.42
                                          CANONICAL-ASGBxd.arm6.elfGet hashmaliciousMiraiBrowse
                                          • 185.125.190.26
                                          drea4.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          825.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          IdpLihor52.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          Space.mips.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          rrrdsl.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          Space.spc.elfGet hashmaliciousMiraiBrowse
                                          • 91.189.91.42
                                          Space.ppc.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          Space.mpsl.elfGet hashmaliciousUnknownBrowse
                                          • 185.125.190.26
                                          Space.arc.elfGet hashmaliciousMiraiBrowse
                                          • 91.189.91.42
                                          INIT7CHxd.powerpc-440fp.elfGet hashmaliciousMiraiBrowse
                                          • 212.51.132.61
                                          drea4.elfGet hashmaliciousUnknownBrowse
                                          • 109.202.202.202
                                          825.elfGet hashmaliciousUnknownBrowse
                                          • 109.202.202.202
                                          IdpLihor52.elfGet hashmaliciousUnknownBrowse
                                          • 109.202.202.202
                                          Space.mips.elfGet hashmaliciousUnknownBrowse
                                          • 109.202.202.202
                                          rrrdsl.elfGet hashmaliciousUnknownBrowse
                                          • 109.202.202.202
                                          Space.spc.elfGet hashmaliciousMiraiBrowse
                                          • 109.202.202.202
                                          Space.ppc.elfGet hashmaliciousUnknownBrowse
                                          • 109.202.202.202
                                          Space.arc.elfGet hashmaliciousMiraiBrowse
                                          • 109.202.202.202
                                          mips.elfGet hashmaliciousUnknownBrowse
                                          • 109.202.202.202
                                          AMAZON-02USefea6.elfGet hashmaliciousUnknownBrowse
                                          • 54.171.230.55
                                          xd.powerpc-440fp.elfGet hashmaliciousMiraiBrowse
                                          • 44.239.245.251
                                          xd.m68k.elfGet hashmaliciousMiraiBrowse
                                          • 34.243.160.129
                                          xd.arm5.elfGet hashmaliciousMiraiBrowse
                                          • 34.254.182.186
                                          yuioiuy.txt.ps1Get hashmaliciousUnknownBrowse
                                          • 108.139.47.92
                                          xd.ppc.elfGet hashmaliciousMiraiBrowse
                                          • 18.138.41.48
                                          https://maxenerwellness.com/Get hashmaliciousUnknownBrowse
                                          • 13.127.204.192
                                          cfr4.txt.ps1Get hashmaliciousUnknownBrowse
                                          • 108.139.47.33
                                          xd.i686.elfGet hashmaliciousMiraiBrowse
                                          • 13.216.220.162
                                          xd.sh4.elfGet hashmaliciousMiraiBrowse
                                          • 18.148.60.32
                                          No context
                                          No context
                                          No created / dropped files found
                                          File type:ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, not stripped
                                          Entropy (8bit):5.983444560312372
                                          TrID:
                                          • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
                                          • ELF Executable and Linkable format (generic) (4004/1) 49.84%
                                          File name:ppc.elf
                                          File size:99'656 bytes
                                          MD5:858e620847a855232fffcb17c8057b4a
                                          SHA1:275204e6316b32aa44e6e5a4298a90905c912ac1
                                          SHA256:caa1621ea48e0134bd6edd637415138562b9ee4ac92e340c02838c26ef893b95
                                          SHA512:8bff07d15fca7800d0e770f6c9908e58b78924b702b1f97a8dd0f2cdb805cab22e43abc672b29ece7e0ff5807d5304ccfbc6c6ed53aefcf757c893314a48a16f
                                          SSDEEP:1536:myaTK7/r7WThaTNi2vPFM5pxeMinbXOfVj1ylnpqS2F9+cXoMhY3b3MXYJ:2wmSNbyZVByL2T/5Y9J
                                          TLSH:63A33902761C444BD6E75FF02BAF5BF0A7B70A112AB09243350AB7454972F729D0AEDE
                                          File Content Preview:.ELF...........................4...h.....4. ...(...........................................x...x...x......H4............................................|......$H...H.V....$8!. |........!..|.......?..........`........@..`= ..;........+../...A..$....}).....

                                          Download Network PCAP: filteredfull

                                          • Total Packets: 12
                                          • 443 (HTTPS)
                                          • 80 (HTTP)
                                          TimestampSource PortDest PortSource IPDest IP
                                          Apr 2, 2025 11:20:07.016316891 CEST43928443192.168.2.2391.189.91.42
                                          Apr 2, 2025 11:20:12.391575098 CEST42836443192.168.2.2391.189.91.43
                                          Apr 2, 2025 11:20:13.159805059 CEST4251680192.168.2.23109.202.202.202
                                          Apr 2, 2025 11:20:27.462658882 CEST39240443192.168.2.2334.249.145.219
                                          Apr 2, 2025 11:20:27.462713003 CEST4433924034.249.145.219192.168.2.23
                                          Apr 2, 2025 11:20:27.462815046 CEST39240443192.168.2.2334.249.145.219
                                          Apr 2, 2025 11:20:27.463386059 CEST39240443192.168.2.2334.249.145.219
                                          Apr 2, 2025 11:20:27.463407040 CEST4433924034.249.145.219192.168.2.23
                                          Apr 2, 2025 11:20:28.261506081 CEST43928443192.168.2.2391.189.91.42
                                          Apr 2, 2025 11:20:38.500320911 CEST42836443192.168.2.2391.189.91.43
                                          Apr 2, 2025 11:20:42.595606089 CEST4251680192.168.2.23109.202.202.202
                                          Apr 2, 2025 11:21:09.216048002 CEST43928443192.168.2.2391.189.91.42
                                          Apr 2, 2025 11:21:27.455003977 CEST39240443192.168.2.2334.249.145.219
                                          Apr 2, 2025 11:21:27.496313095 CEST4433924034.249.145.219192.168.2.23
                                          Apr 2, 2025 11:21:29.693001032 CEST42836443192.168.2.2391.189.91.43
                                          Apr 2, 2025 11:22:11.661891937 CEST4433924034.249.145.219192.168.2.23

                                          System Behavior

                                          Start time (UTC):09:20:06
                                          Start date (UTC):02/04/2025
                                          Path:/tmp/ppc.elf
                                          Arguments:/tmp/ppc.elf
                                          File size:5388968 bytes
                                          MD5 hash:ae65271c943d3451b7f026d1fadccea6

                                          Start time (UTC):09:21:26
                                          Start date (UTC):02/04/2025
                                          Path:/usr/bin/dash
                                          Arguments:-
                                          File size:129816 bytes
                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                          Start time (UTC):09:21:26
                                          Start date (UTC):02/04/2025
                                          Path:/usr/bin/rm
                                          Arguments:rm -f /tmp/tmp.wWI67oDWRT /tmp/tmp.4orplegfW4 /tmp/tmp.KkdVkZ7nzf
                                          File size:72056 bytes
                                          MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                          Start time (UTC):09:21:26
                                          Start date (UTC):02/04/2025
                                          Path:/usr/bin/dash
                                          Arguments:-
                                          File size:129816 bytes
                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                          Start time (UTC):09:21:26
                                          Start date (UTC):02/04/2025
                                          Path:/usr/bin/rm
                                          Arguments:rm -f /tmp/tmp.wWI67oDWRT /tmp/tmp.4orplegfW4 /tmp/tmp.KkdVkZ7nzf
                                          File size:72056 bytes
                                          MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b