Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
Aqua.mips.elf

Overview

General Information

Sample name:Aqua.mips.elf
Analysis ID:1674865
MD5:495d07031813eb14060634a51a536eb5
SHA1:e5b8b2a1cccfbac00a18c95e93a07d76b3b8b721
SHA256:39af9c82cff576189131478dc0270b42a80902862b1aed49c2b3c4f9ffe213d1
Tags:elfuser-abuse_ch
Infos:

Detection

Score:60
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sample deletes itself
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1674865
Start date and time:2025-04-26 17:34:11 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 28s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:Aqua.mips.elf
Detection:MAL
Classification:mal60.evad.linELF@0/1@2/0

Runtime Messages

Command:/tmp/Aqua.mips.elf
PID:5547
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
about to cum inside a femboy btw
Standard Error:

Process Tree

  • system is lnxubuntu20
  • Aqua.mips.elf (PID: 5547, Parent: 5466, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/Aqua.mips.elf
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

  • • AV Detection
  • • Networking
  • • System Summary
  • • Hooking and other Techniques for Hiding and Protection
  • • Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: Aqua.mips.elfAvira: detected
Source: Aqua.mips.elfVirustotal: Detection: 31%Perma Link
Source: Aqua.mips.elfReversingLabs: Detection: 25%
Source: global trafficTCP traffic: 192.168.2.15:42376 -> 193.200.78.28:33966
Source: global trafficDNS traffic detected: DNS query: raw.intenseproxy.zip
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal60.evad.linELF@0/1@2/0

Hooking and other Techniques for Hiding and Protection

barindex
Source: /tmp/Aqua.mips.elf (PID: 5549)File: /tmp/Aqua.mips.elfJump to behavior
Source: /tmp/Aqua.mips.elf (PID: 5547)Queries kernel information via 'uname': Jump to behavior
Source: Aqua.mips.elf, 5547.1.00007ffd070f1000.00007ffd07112000.rw-.sdmpBinary or memory string: ld_Ix86_64/usr/bin/qemu-mips/tmp/Aqua.mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Aqua.mips.elf
Source: Aqua.mips.elf, 5547.1.0000557a632b3000.0000557a6333a000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mips
Source: Aqua.mips.elf, 5547.1.00007ffd070f1000.00007ffd07112000.rw-.sdmpBinary or memory string: %s/qemu-op
Source: Aqua.mips.elf, 5547.1.00007ffd070f1000.00007ffd07112000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mips
Source: Aqua.mips.elf, 5547.1.00007ffd070f1000.00007ffd07112000.rw-.sdmpBinary or memory string: /tmp/qemu-open.6E6YTF
Source: Aqua.mips.elf, 5547.1.0000557a632b3000.0000557a6333a000.rw-.sdmpBinary or memory string: ,czU!/etc/qemu-binfmt/mips
Source: Aqua.mips.elf, 5547.1.00007ffd070f1000.00007ffd07112000.rw-.sdmpBinary or memory string: `zU/tmp/qemu-open.6E6YTF\
Source: Aqua.mips.elf, 5547.1.00007ffd070f1000.00007ffd07112000.rw-.sdmpBinary or memory string: MPDIR%s/qemu-op

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
File Deletion		OS Credential Dumping11
Security Software Discovery		Remote ServicesData from Local System1
Non-Standard Port		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1674865 Sample: Aqua.mips.elf Startdate: 26/04/2025 Architecture: LINUX Score: 60 12 raw.intenseproxy.zip 193.200.78.28, 33966, 42376 LINK-SERVICE-ASUA Switzerland 2->12 14 Antivirus / Scanner detection for submitted sample 2->14 16 Multi AV Scanner detection for submitted file 2->16 7 Aqua.mips.elf 2->7         started        signatures3 process4 process5 9 Aqua.mips.elf 7->9         started        signatures6 18 Sample deletes itself 9->18

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Aqua.mips.elf32%VirustotalBrowse
Aqua.mips.elf25%ReversingLabsLinux.Worm.Mirai
Aqua.mips.elf100%AviraEXP/ELF.Mirai.W

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
raw.intenseproxy.zip
193.200.78.28
truefalse
    		high

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    193.200.78.28
    		raw.intenseproxy.zipSwitzerland
    		29496LINK-SERVICE-ASUAfalse

    Joe Sandbox View / Context

    IPs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    193.200.78.28Aqua.i686.elfGet hashmaliciousUnknownBrowse
      Aqua.arm7.elfGet hashmaliciousAquabot, MiraiBrowse
        Aqua.spc.elfGet hashmaliciousAquabotBrowse
          Aqua.m68k.elfGet hashmaliciousUnknownBrowse
            Aqua.m68k.elfGet hashmaliciousAquabotBrowse
              Aqua.x86_64.elfGet hashmaliciousUnknownBrowse
                Aqua.arm5.elfGet hashmaliciousAquabotBrowse
                  Aqua.mips.elfGet hashmaliciousAquabotBrowse
                    Aqua.spc.elfGet hashmaliciousAquabotBrowse
                      Aqua.mpsl.elfGet hashmaliciousAquabotBrowse

                        Domains

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        raw.intenseproxy.zipAqua.spc.elfGet hashmaliciousAquabotBrowse
                        • 193.200.78.28
                        Aqua.m68k.elfGet hashmaliciousUnknownBrowse
                        • 193.200.78.28
                        Aqua.m68k.elfGet hashmaliciousAquabotBrowse
                        • 193.200.78.28
                        Aqua.mips.elfGet hashmaliciousUnknownBrowse
                        • 193.200.78.43

                        ASNs

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        LINK-SERVICE-ASUAAqua.i686.elfGet hashmaliciousUnknownBrowse
                        • 193.200.78.28
                        Aqua.arm7.elfGet hashmaliciousAquabot, MiraiBrowse
                        • 193.200.78.28
                        Aqua.spc.elfGet hashmaliciousAquabotBrowse
                        • 193.200.78.28
                        Aqua.m68k.elfGet hashmaliciousUnknownBrowse
                        • 193.200.78.28
                        Aqua.m68k.elfGet hashmaliciousAquabotBrowse
                        • 193.200.78.28
                        Aqua.x86_64.elfGet hashmaliciousUnknownBrowse
                        • 193.200.78.28
                        Aqua.arm5.elfGet hashmaliciousAquabotBrowse
                        • 193.200.78.28
                        Aqua.mips.elfGet hashmaliciousAquabotBrowse
                        • 193.200.78.28
                        Aqua.spc.elfGet hashmaliciousAquabotBrowse
                        • 193.200.78.28
                        Aqua.mpsl.elfGet hashmaliciousAquabotBrowse
                        • 193.200.78.28

                        JA3 Fingerprints

                        ⊘No context

                        Dropped Files

                        ⊘No context

                        Created / dropped Files

                        Process:/tmp/Aqua.mips.elf
                        File Type:data
                        Category:dropped
                        Size (bytes):29
                        Entropy (8bit):4.1852301329094015
                        Encrypted:false
                        SSDEEP:3:TgHWCL8HJN:Tg2BJN
                        MD5:5DE8DFDDC7FAB7288CAFB40F58749EFE
                        SHA1:E57A6BA66AE8E362D2683846F616A6693D95A81D
                        SHA-256:E8AEB1E3E141F734EC9A546B30945CF93CBCB58DBCB931216DCE3C1F467035B2
                        SHA-512:37F922569AEAEEB3DF5DBB21F0C9E91C41575A5B2CCBFC188DA1562F62F6499A7699FB0BE5476D4FF43267D96983A45740FE7C931A8AE9ACE5600F5B1DFE0635
                        Malicious:false
                        Reputation:moderate, very likely benign file
                        Preview:/tmp/Aqua.mips.elf.nwlrbbmqbh

                        Static File Info

                        General

                        File type:ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
                        Entropy (8bit):5.38616741105765
                        TrID:
                        • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                        File name:Aqua.mips.elf
                        File size:68'704 bytes
                        MD5:495d07031813eb14060634a51a536eb5
                        SHA1:e5b8b2a1cccfbac00a18c95e93a07d76b3b8b721
                        SHA256:39af9c82cff576189131478dc0270b42a80902862b1aed49c2b3c4f9ffe213d1
                        SHA512:c95c5ccd754a3150fd58330f2cbc8d6cf842105e0d1043b9a5b00af77e92fce2cd8e4a5449f39c549a14df0d122b86b0e7641748dc5c6432b296751ac9e31296
                        SSDEEP:768:qeXr/3SwGEbwC1DEsl0d5P6HVGt/reJLDhlol0ANCxa1M8kX0Hw94RyBFMPQ10yC:pls61Are5Dh6nkXg/ReTaewe5ND7I
                        TLSH:9363B61E6E118FEDFB68C73507F78921A398338A36A1D685D16CD7105E6028E641FFE8
                        File Content Preview:.ELF.....................@.`...4...X.....4. ...(.............@...@..... ... .................E...E........, ........dt.Q............................<...'..\...!'.......................<...'..8...!... ....'9... ......................<...'......!........'9.

                        Static ELF Info

                        ELF header

                        Class:ELF32
                        Data:2's complement, big endian
                        Version:1 (current)
                        Machine:MIPS R3000
                        Version Number:0x1
                        Type:EXEC (Executable file)
                        OS/ABI:UNIX - System V
                        ABI Version:0
                        Entry Point Address:0x400260
                        Flags:0x1007
                        ELF Header Size:52
                        Program Header Offset:52
                        Program Header Size:32
                        Number of Program Headers:3
                        Section Header Offset:68184
                        Section Header Size:40
                        Number of Section Headers:13
                        Header String Table Index:12

                        Sections

                        NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                        NULL0x00x00x00x00x0000
                        .initPROGBITS0x4000940x940x8c0x00x6AX004
                        .textPROGBITS0x4001200x1200xe7500x00x6AX0016
                        .finiPROGBITS0x40e8700xe8700x5c0x00x6AX004
                        .rodataPROGBITS0x40e8d00xe8d00x12500x00x2A0016
                        .ctorsPROGBITS0x4500000x100000x80x00x3WA004
                        .dtorsPROGBITS0x4500080x100080x80x00x3WA004
                        .dataPROGBITS0x4500200x100200x3e00x00x3WA0016
                        .gotPROGBITS0x4504000x104000x6000x40x10000003WAp0016
                        .sbssNOBITS0x450a000x10a000x140x00x10000003WAp004
                        .bssNOBITS0x450a200x10a000x22000x00x3WA0016
                        .mdebug.abi32PROGBITS0xbe20x10a000x00x00x0001
                        .shstrtabSTRTAB0x00x10a000x570x00x0001

                        Program Segments

                        TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                        LOAD0x00x4000000x4000000xfb200xfb205.51810x5R E0x10000.init .text .fini .rodata
                        LOAD0x100000x4500000x4500000xa000x2c203.16950x6RW 0x10000.ctors .dtors .data .got .sbss .bss
                        GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                        Network Behavior

                        Download Network PCAP: filtered – full

                        Network Port Distribution

                        • Total Packets: 16
                        • • 33966 undefined
                        • • 53 (DNS)
                        TimestampSource PortDest PortSource IPDest IP
                        Apr 26, 2025 17:35:01.696527958 CEST4237633966192.168.2.15193.200.78.28
                        Apr 26, 2025 17:35:01.968710899 CEST3396642376193.200.78.28192.168.2.15
                        Apr 26, 2025 17:35:01.968914032 CEST4237633966192.168.2.15193.200.78.28
                        Apr 26, 2025 17:35:01.970823050 CEST4237633966192.168.2.15193.200.78.28
                        Apr 26, 2025 17:35:02.242224932 CEST3396642376193.200.78.28192.168.2.15
                        Apr 26, 2025 17:35:02.242312908 CEST4237633966192.168.2.15193.200.78.28
                        Apr 26, 2025 17:35:02.516200066 CEST3396642376193.200.78.28192.168.2.15
                        Apr 26, 2025 17:35:17.516294003 CEST3396642376193.200.78.28192.168.2.15
                        Apr 26, 2025 17:35:17.516633987 CEST4237633966192.168.2.15193.200.78.28
                        Apr 26, 2025 17:35:32.791166067 CEST3396642376193.200.78.28192.168.2.15
                        Apr 26, 2025 17:35:32.791508913 CEST4237633966192.168.2.15193.200.78.28
                        Apr 26, 2025 17:35:48.069013119 CEST3396642376193.200.78.28192.168.2.15
                        Apr 26, 2025 17:35:48.069436073 CEST4237633966192.168.2.15193.200.78.28
                        Apr 26, 2025 17:36:03.343077898 CEST3396642376193.200.78.28192.168.2.15
                        Apr 26, 2025 17:36:03.343405008 CEST4237633966192.168.2.15193.200.78.28
                        Apr 26, 2025 17:36:12.029323101 CEST4237633966192.168.2.15193.200.78.28
                        Apr 26, 2025 17:36:12.303989887 CEST3396642376193.200.78.28192.168.2.15
                        Apr 26, 2025 17:36:12.304028988 CEST3396642376193.200.78.28192.168.2.15
                        Apr 26, 2025 17:36:12.304203033 CEST4237633966192.168.2.15193.200.78.28
                        Apr 26, 2025 17:36:22.314657927 CEST4237633966192.168.2.15193.200.78.28
                        Apr 26, 2025 17:36:22.586787939 CEST3396642376193.200.78.28192.168.2.15
                        Apr 26, 2025 17:36:22.591785908 CEST3396642376193.200.78.28192.168.2.15
                        Apr 26, 2025 17:36:22.591945887 CEST4237633966192.168.2.15193.200.78.28
                        Apr 26, 2025 17:36:38.115876913 CEST3396642376193.200.78.28192.168.2.15
                        Apr 26, 2025 17:36:38.116364956 CEST4237633966192.168.2.15193.200.78.28
                        Apr 26, 2025 17:36:53.393637896 CEST3396642376193.200.78.28192.168.2.15
                        Apr 26, 2025 17:36:53.393754005 CEST4237633966192.168.2.15193.200.78.28
                        TimestampSource PortDest PortSource IPDest IP
                        Apr 26, 2025 17:35:01.268493891 CEST6034153192.168.2.158.8.8.8
                        Apr 26, 2025 17:35:01.430879116 CEST53603418.8.8.8192.168.2.15
                        Apr 26, 2025 17:35:01.433556080 CEST4923553192.168.2.158.8.8.8
                        Apr 26, 2025 17:35:01.695431948 CEST53492358.8.8.8192.168.2.15

                        DNS Queries

                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                        Apr 26, 2025 17:35:01.268493891 CEST192.168.2.158.8.8.80x2f02Standard query (0)raw.intenseproxy.zipA (IP address)IN (0x0001)false
                        Apr 26, 2025 17:35:01.433556080 CEST192.168.2.158.8.8.80x1eaaStandard query (0)raw.intenseproxy.zipA (IP address)IN (0x0001)false

                        DNS Answers

                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                        Apr 26, 2025 17:35:01.430879116 CEST8.8.8.8192.168.2.150x2f02No error (0)raw.intenseproxy.zip193.200.78.28A (IP address)IN (0x0001)false
                        Apr 26, 2025 17:35:01.695431948 CEST8.8.8.8192.168.2.150x1eaaNo error (0)raw.intenseproxy.zip193.200.78.28A (IP address)IN (0x0001)false

                        System Behavior

                        General

                        Start time (UTC):15:35:00
                        Start date (UTC):26/04/2025
                        Path:/tmp/Aqua.mips.elf
                        Arguments:/tmp/Aqua.mips.elf
                        File size:5777432 bytes
                        MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                        File Activities

                        Process Activities

                        System Activities


                        General

                        Start time (UTC):15:35:00
                        Start date (UTC):26/04/2025
                        Path:/tmp/Aqua.mips.elf
                        Arguments:-
                        File size:5777432 bytes
                        MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                        File Activities

                        Process Activities

                        Network Activities