Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
hanoi.mpsl.elf

Overview

General Information

Sample name:hanoi.mpsl.elf
Analysis ID:1674514
MD5:3ada550528ad4497de50fc73e4910bf6
SHA1:faecb1f6f023ff063057bed4cbfa9d1ee31560f1
SHA256:7d3108ea6af1ff146c3e40a5840443567452fc05e123a88cf91779b30d3ef45e
Tags:elfuser-abuse_ch

Detection

Score:52
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Sample is packed with UPX
ELF contains segments with high entropy indicating compressed/encrypted content
Sample contains only a LOAD segment without any section mappings
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1674514
Start date and time:2025-04-25 23:18:27 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 23s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:hanoi.mpsl.elf
Detection:MAL
Classification:mal52.evad.linELF@0/1@0/0

Runtime Messages

Command:/tmp/hanoi.mpsl.elf
PID:5492
Exit Code:127
Exit Code Info:
Killed:False
Standard Output:

Standard Error:

Process Tree

  • system is lnxubuntu20
  • hanoi.mpsl.elf (PID: 5492, Parent: 5415, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/hanoi.mpsl.elf
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

  • • AV Detection
  • • Networking
  • • System Summary
  • • Data Obfuscation
  • • Hooking and other Techniques for Hiding and Protection
  • • Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: hanoi.mpsl.elfReversingLabs: Detection: 13%
Source: hanoi.mpsl.elfString found in binary or memory: http://upx.sf.net
Source: LOAD without section mappingsProgram segment: 0x400000
Source: classification engineClassification label: mal52.evad.linELF@0/1@0/0

Data Obfuscation

barindex
Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sampleString containing UPX found: $Id: UPX 5.00 Copyright (C) 1996-2025 the UPX Team. All Rights Reserved. $
Source: hanoi.mpsl.elfSubmission file: segment LOAD with 7.8913 entropy (max. 8.0)
Source: hanoi.mpsl.elfSubmission file: segment LOAD with 7.9802 entropy (max. 8.0)
Source: /tmp/hanoi.mpsl.elf (PID: 5492)Queries kernel information via 'uname': Jump to behavior
Source: hanoi.mpsl.elf, 5492.1.0000564b3de2b000.0000564b3deb2000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mipsel
Source: hanoi.mpsl.elf, 5492.1.00007fffc4ad9000.00007fffc4afa000.rw-.sdmpBinary or memory string: [,x86_64/usr/bin/qemu-mipsel/tmp/hanoi.mpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/hanoi.mpsl.elf
Source: hanoi.mpsl.elf, 5492.1.0000564b3de2b000.0000564b3deb2000.rw-.sdmpBinary or memory string: =KV!/etc/qemu-binfmt/mipsel
Source: hanoi.mpsl.elf, 5492.1.00007fffc4ad9000.00007fffc4afa000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mipsel

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception11
Obfuscated Files or Information		OS Credential Dumping11
Security Software Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1674514 Sample: hanoi.mpsl.elf Startdate: 25/04/2025 Architecture: LINUX Score: 52 7 Multi AV Scanner detection for submitted file 2->7 9 Sample is packed with UPX 2->9 5 hanoi.mpsl.elf 2->5         started        process3

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
hanoi.mpsl.elf14%ReversingLabs

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
http://upx.sf.nethanoi.mpsl.elffalse
    		high

    World Map of Contacted IPs

    ⊘No contacted IP infos

    Joe Sandbox View / Context

    IPs

    ⊘No context

    Domains

    ⊘No context

    ASNs

    ⊘No context

    JA3 Fingerprints

    ⊘No context

    Dropped Files

    ⊘No context

    Created / dropped Files

    Process:/tmp/hanoi.mpsl.elf
    File Type:data
    Category:dropped
    Size (bytes):7348
    Entropy (8bit):5.335446825916104
    Encrypted:false
    SSDEEP:96:cUl2lSpOOjDcRkd+GgsOVd+a9TvNh55MH55okN/KzwRncxdRb3/CV7Bctv/qlVS1:cKpOHRkgvJdtlvIYQy0RWL3KV7atvUb4
    MD5:3236D6F77B7C0E42E57137B100E816F2
    SHA1:4B62485FA53EF994A249FDC5D36900200A4A75A8
    SHA-256:104A3AD29E4E24F121A5254B5D0FBD0439F6D8B70585D58A71686ED57688A56B
    SHA-512:AF8AD995D7E9956633A1332EA3051286BAABE9E9EF81317B85A3142BCAA29948D39519340A4CF40FF1A6A1BCD5EE3EEAAD58A04F95747758F04E666E341DE91F
    Malicious:false
    Reputation:low
    Preview:..................................................a2.. .!.....'!.....Y...B$..y...c$..V...a24. ...i$..`...c$!.`...Y...H...B$..y...h...c$.. .!.`...a23. . ..$..#...y...y...y.=..$..y...w$......../proc/self/exe..!..........$.......!._...`...B.!..................!.?...".......@.!.A...`...B$..`.!..........$...$! .....$.......$!(.............$........!.... ....'!@..!8..!0..!( .{...! .....'!.@.h...! .....$.......$..........a2.. .....!H.................$...$"(..! .....$...........$............ ..'!.....'...'.................. ....... ....$...........'...........0..@.!P..!@.....$..........e.!..............%..i.......B.......@...............@.......E.......F.e......$!P.........$...............'...'................+.F...@.....................P......$!...!8....b...........c$.......$........!.F.............#.F....................'...'............!...........L.@.!...! ....'.......$............X!.<....UPB4..b.......".......@.....:.................`.+..........$..@.............+.D...@.+.d...@.....

    Static File Info

    General

    File type:ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, no section header
    Entropy (8bit):7.978458990337606
    TrID:
    • ELF Executable and Linkable format (generic) (4004/1) 100.00%
    File name:hanoi.mpsl.elf
    File size:40'396 bytes
    MD5:3ada550528ad4497de50fc73e4910bf6
    SHA1:faecb1f6f023ff063057bed4cbfa9d1ee31560f1
    SHA256:7d3108ea6af1ff146c3e40a5840443567452fc05e123a88cf91779b30d3ef45e
    SHA512:40a8a8f3b4365fe0d33c1637a9d0a9d9d3f8b825ef09915338decfd2f41fcea767a5450e43cc2ce71edeb32bf1e4552a97354a7b085f0253b321e8855df2ce60
    SSDEEP:768:JNaiW/NBOPF2qo50OlMybVD5Lqe35Q+PSgfGh2gJKbss6yMCgpO3tx086F7p:kFSILZl5me35Q+PSgfSJKIsPMFpO96Fl
    TLSH:D703F1ACA47ACF59D03FCB3D1474BAE6D45B764581EB4D58B09C5E84F2BCE90089344D
    File Content Preview:.ELF......................C.4...........4. ...................@...@...........................C...C.................Q.td............................*[FyUPX!........x...........V..........?.E.h;....#......b.L#4.p.8d$.......w...y.<yO.<..y...Hj*.............

    Static ELF Info

    ELF header

    Class:ELF32
    Data:2's complement, little endian
    Version:1 (current)
    Machine:MIPS R3000
    Version Number:0x1
    Type:EXEC (Executable file)
    OS/ABI:UNIX - System V
    ABI Version:0
    Entry Point Address:0x4389f0
    Flags:0x1007
    ELF Header Size:52
    Program Header Offset:52
    Program Header Size:32
    Number of Program Headers:3
    Section Header Offset:0
    Section Header Size:0
    Number of Section Headers:0
    Header String Table Index:0

    Program Segments

    TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
    LOAD0x00x4000000x4000000x10000x20fec7.89130x6RW 0x10000
    LOAD0x00x4300000x4300000x9c8a0x9c8a7.98020x5R E0x10000
    GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

    Network Behavior

    ⊘No network behavior found

    System Behavior

    General

    Start time (UTC):21:19:16
    Start date (UTC):25/04/2025
    Path:/tmp/hanoi.mpsl.elf
    Arguments:/tmp/hanoi.mpsl.elf
    File size:5773336 bytes
    MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

    File Activities

    Process Activities

    System Activities