Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
fuckjewishpeople.ppc.elf

Overview

General Information

Sample name:fuckjewishpeople.ppc.elf
Analysis ID:1674781
MD5:6196bb1a4d17ace6ae1b213949e5747d
SHA1:0528fc7dc7e315799889c8afe67eaf57a20af94b
SHA256:1e0974f79a3c2faf8bb093c6465dc6dde0d2ffba0af3c7208485e8789a697fde
Tags:elfuser-abuse_ch
Infos:

Detection

Score:60
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sample is packed with UPX
ELF contains segments with high entropy indicating compressed/encrypted content
Sample contains only a LOAD segment without any section mappings
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1674781
Start date and time:2025-04-26 16:01:34 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 28s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:fuckjewishpeople.ppc.elf
Detection:MAL
Classification:mal60.evad.linELF@0/0@2/0

Runtime Messages

Command:/tmp/fuckjewishpeople.ppc.elf
PID:5546
Exit Code:134
Exit Code Info:SIGABRT (6) Abort signal from abort
Killed:False
Standard Output:

Standard Error:qemu: fatal: Tried to call a TRAP

NIP 10006dd0 LR 10006d44 CTR 00000000 XER 00000000 CPU#0
MSR 00006940 HID0 00000000 HF 00006000 iidx 2 didx 2
TB 00000085 367648793562
GPR00 000000000000005a 00000000ffffecd0 0000000000000000 0000000000000009
GPR04 0000000000007562 0000000000000003 0000000000000012 0000000000000003
GPR08 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR12 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR16 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR20 0000000000000000 0000000000001044 0000000010006e30 0000000000000000
GPR24 0000000000000000 0000000010000000 00000000ffffedac 0000000000000003
GPR28 0000000000007e74 00000000ff7f6000 00000000fffff000 000000001000618c
CR 50000002 [ GO - - - - - - E ] RES ffffffff
FPR00 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPR04 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPR08 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPR12 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPR16 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPR20 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPR24 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPR28 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPSCR 00000000

Process Tree

  • system is lnxubuntu20
  • fuckjewishpeople.ppc.elf (PID: 5546, Parent: 5465, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/fuckjewishpeople.ppc.elf
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

  • • AV Detection
  • • Networking
  • • System Summary
  • • Data Obfuscation
  • • Hooking and other Techniques for Hiding and Protection
  • • Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: fuckjewishpeople.ppc.elfAvira: detected
Source: fuckjewishpeople.ppc.elfReversingLabs: Detection: 44%
Source: fuckjewishpeople.ppc.elfVirustotal: Detection: 50%Perma Link
Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
Source: fuckjewishpeople.ppc.elfString found in binary or memory: http://upx.sf.net
Source: LOAD without section mappingsProgram segment: 0x10000000
Source: classification engineClassification label: mal60.evad.linELF@0/0@2/0

Data Obfuscation

barindex
Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sampleString containing UPX found: $Id: UPX 3.96 Copyright (C) 1996-2020 the UPX Team. All Rights Reserved. $
Source: fuckjewishpeople.ppc.elfSubmission file: segment LOAD with 7.9435 entropy (max. 8.0)
Source: /tmp/fuckjewishpeople.ppc.elf (PID: 5546)Queries kernel information via 'uname': Jump to behavior
Source: fuckjewishpeople.ppc.elf, 5546.1.00005599b5bbd000.00005599b5c4c000.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: fuckjewishpeople.ppc.elf, 5546.1.00005599b5bbd000.00005599b5c4c000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/ppc
Source: fuckjewishpeople.ppc.elf, 5546.1.00007ffd09722000.00007ffd09743000.rw-.sdmpBinary or memory string: /usr/bin/qemu-ppc
Source: fuckjewishpeople.ppc.elf, 5546.1.00007ffd09722000.00007ffd09743000.rw-.sdmpBinary or memory string: Ux86_64/usr/bin/qemu-ppc/tmp/fuckjewishpeople.ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/fuckjewishpeople.ppc.elf

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception11
Obfuscated Files or Information		OS Credential Dumping11
Security Software Discovery		Remote ServicesData from Local System1
Non-Application Layer Protocol		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1674781 Sample: fuckjewishpeople.ppc.elf Startdate: 26/04/2025 Architecture: LINUX Score: 60 8 daisy.ubuntu.com 2->8 10 Antivirus / Scanner detection for submitted sample 2->10 12 Multi AV Scanner detection for submitted file 2->12 14 Sample is packed with UPX 2->14 6 fuckjewishpeople.ppc.elf 2->6         started        signatures3 process4

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
fuckjewishpeople.ppc.elf44%ReversingLabsLinux.Network.LightAidra
fuckjewishpeople.ppc.elf50%VirustotalBrowse
fuckjewishpeople.ppc.elf100%AviraEXP/ELF.Agent.F.118

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
daisy.ubuntu.com
162.213.35.25
truefalse
    		high
    NameSourceMaliciousAntivirus DetectionReputation
    http://upx.sf.netfuckjewishpeople.ppc.elffalse
      		high

      World Map of Contacted IPs

      ⊘No contacted IP infos

      Joe Sandbox View / Context

      IPs

      ⊘No context

      Domains

      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      daisy.ubuntu.com8mips8.elfGet hashmaliciousMiraiBrowse
      • 162.213.35.25
      skid.mips.elfGet hashmaliciousGafgyt, MiraiBrowse
      • 162.213.35.24
      fuckjewishpeople.arm6.elfGet hashmaliciousUnknownBrowse
      • 162.213.35.24
      fuckjewishpeople.x86.elfGet hashmaliciousUnknownBrowse
      • 162.213.35.25
      fuckjewishpeople.arm7.elfGet hashmaliciousUnknownBrowse
      • 162.213.35.24
      fuckjewishpeople.mpsl.elfGet hashmaliciousUnknownBrowse
      • 162.213.35.25
      boatnet.arm.elfGet hashmaliciousMiraiBrowse
      • 162.213.35.25
      debug.dbg.elfGet hashmaliciousMiraiBrowse
      • 162.213.35.24
      boatnet.spc.elfGet hashmaliciousMiraiBrowse
      • 162.213.35.25
      boatnet.arm6.elfGet hashmaliciousMiraiBrowse
      • 162.213.35.25

      ASNs

      ⊘No context

      JA3 Fingerprints

      ⊘No context

      Dropped Files

      ⊘No context

      Created / dropped Files

      ⊘No created / dropped files found

      Static File Info

      General

      File type:ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (GNU/Linux), statically linked, no section header
      Entropy (8bit):7.953989813550454
      TrID:
      • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
      • ELF Executable and Linkable format (generic) (4004/1) 49.84%
      File name:fuckjewishpeople.ppc.elf
      File size:35'932 bytes
      MD5:6196bb1a4d17ace6ae1b213949e5747d
      SHA1:0528fc7dc7e315799889c8afe67eaf57a20af94b
      SHA256:1e0974f79a3c2faf8bb093c6465dc6dde0d2ffba0af3c7208485e8789a697fde
      SHA512:6486edcda44f7a5c438879951a7f8e5c3b338365ba75d384d562f608262da7cfc0968e03e2b0994506d32291d41f356dc2a565657902b9cdee928fa61c3ea359
      SSDEEP:768:qUlctgo3ekTdcFCcoeE9AoT3v5bBBqpRqAZH0R3plJEyYJ+1+4uVcqgw0X7JkmW3:YWo5TdmL2AonKlUR3plJEG+4u+qgw09C
      TLSH:73F2E19AE0905EE9EBBF2C3B1776FFC61BA105D637D647C27484AA200A54B3359006E9
      File Content Preview:.ELF......................a....4.........4. ...(......................ur..ur..............................w.........dt.Q................................UPX!..........j0..j0.......U.......?.E.h4...@b..............*{./...J.r......-....#....jxsE...^........]

      Static ELF Info

      ELF header

      Class:ELF32
      Data:2's complement, big endian
      Version:1 (current)
      Machine:PowerPC
      Version Number:0x1
      Type:EXEC (Executable file)
      OS/ABI:UNIX - Linux
      ABI Version:0
      Entry Point Address:0x10006188
      Flags:0x0
      ELF Header Size:52
      Program Header Offset:52
      Program Header Size:32
      Number of Program Headers:3
      Section Header Offset:0
      Section Header Size:40
      Number of Section Headers:0
      Header String Table Index:0

      Program Segments

      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
      LOAD0x00x100000000x100000000x75720x75727.94350x5R E0x10000
      LOAD0x00x100100000x100100000x00x177e40.00000x6RW 0x10000
      GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

      Network Behavior

      Download Network PCAP: filtered – full

      TimestampSource PortDest PortSource IPDest IP
      Apr 26, 2025 16:02:25.296828032 CEST5580553192.168.2.158.8.8.8
      Apr 26, 2025 16:02:25.296886921 CEST4588953192.168.2.158.8.8.8
      Apr 26, 2025 16:02:25.445564032 CEST53458898.8.8.8192.168.2.15
      Apr 26, 2025 16:02:25.454763889 CEST53558058.8.8.8192.168.2.15

      DNS Queries

      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
      Apr 26, 2025 16:02:25.296828032 CEST192.168.2.158.8.8.80xe767Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
      Apr 26, 2025 16:02:25.296886921 CEST192.168.2.158.8.8.80x2e6bStandard query (0)daisy.ubuntu.com28IN (0x0001)false

      DNS Answers

      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
      Apr 26, 2025 16:02:25.454763889 CEST8.8.8.8192.168.2.150xe767No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
      Apr 26, 2025 16:02:25.454763889 CEST8.8.8.8192.168.2.150xe767No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

      System Behavior

      General

      Start time (UTC):14:02:23
      Start date (UTC):26/04/2025
      Path:/tmp/fuckjewishpeople.ppc.elf
      Arguments:/tmp/fuckjewishpeople.ppc.elf
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      File Activities

      Process Activities

      System Activities