Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
Aqua.arm4.elf

Overview

General Information

Sample name:Aqua.arm4.elf
Analysis ID:1675069
MD5:aa6d3819929a793b34413e998f0cd9c6
SHA1:c7cb5838c423d551f7124ae67f18df7358ad27ac
SHA256:23958aaed3d0dcb28a155d850a3225a8efcde34933b93ae0e6ca706563e26e8f
Tags:elfMiraiuser-abuse_ch
Infos:

Detection

Score:64
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sample deletes itself
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1675069
Start date and time:2025-04-26 21:18:46 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 31s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:Aqua.arm4.elf
Detection:MAL
Classification:mal64.troj.evad.linELF@0/1@6/0

Runtime Messages

Command:/tmp/Aqua.arm4.elf
PID:5472
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
about to cum inside a femboy btw
Standard Error:

Process Tree

  • system is lnxubuntu20
  • Aqua.arm4.elf (PID: 5472, Parent: 5394, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Aqua.arm4.elf
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

  • • AV Detection
  • • Networking
  • • System Summary
  • • Hooking and other Techniques for Hiding and Protection
  • • Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: Aqua.arm4.elfAvira: detected
Source: Aqua.arm4.elfVirustotal: Detection: 44%Perma Link
Source: Aqua.arm4.elfReversingLabs: Detection: 47%

Networking

barindex
Source: global trafficDNS traffic detected: malformed DNS query: raw.intenseproxy.zip. [malformed]
Source: global trafficTCP traffic: 192.168.2.13:37072 -> 193.200.78.28:33966
Source: global trafficDNS traffic detected: DNS query: raw.intenseproxy.zip
Source: global trafficDNS traffic detected: DNS query: raw.intenseproxy.zip. [malformed]
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal64.troj.evad.linELF@0/1@6/0

Hooking and other Techniques for Hiding and Protection

barindex
Source: /tmp/Aqua.arm4.elf (PID: 5475)File: /tmp/Aqua.arm4.elfJump to behavior
Source: /tmp/Aqua.arm4.elf (PID: 5472)Queries kernel information via 'uname': Jump to behavior
Source: Aqua.arm4.elf, 5472.1.00007ffd59385000.00007ffd593a6000.rw-.sdmpBinary or memory string: V/tmp/qemu-open.9eSwAY:
Source: Aqua.arm4.elf, 5472.1.00007ffd59385000.00007ffd593a6000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/Aqua.arm4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Aqua.arm4.elf
Source: Aqua.arm4.elf, 5472.1.0000561408c5b000.0000561408d89000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: Aqua.arm4.elf, 5472.1.00007ffd59385000.00007ffd593a6000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
Source: Aqua.arm4.elf, 5472.1.0000561408c5b000.0000561408d89000.rw-.sdmpBinary or memory string: V!/etc/qemu-binfmt/arm
Source: Aqua.arm4.elf, 5472.1.00007ffd59385000.00007ffd593a6000.rw-.sdmpBinary or memory string: /tmp/qemu-open.9eSwAY

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
File Deletion		OS Credential Dumping11
Security Software Discovery		Remote ServicesData from Local System1
Non-Standard Port		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1675069 Sample: Aqua.arm4.elf Startdate: 26/04/2025 Architecture: LINUX Score: 64 12 raw.intenseproxy.zip. [malformed] 2->12 14 raw.intenseproxy.zip 193.200.78.28, 33966, 37072 LINK-SERVICE-ASUA Switzerland 2->14 16 Antivirus / Scanner detection for submitted sample 2->16 18 Multi AV Scanner detection for submitted file 2->18 7 Aqua.arm4.elf 2->7         started        signatures3 20 Sends malformed DNS queries 12->20 process4 process5 9 Aqua.arm4.elf 7->9         started        signatures6 22 Sample deletes itself 9->22

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Aqua.arm4.elf44%VirustotalBrowse
Aqua.arm4.elf47%ReversingLabsLinux.Backdoor.Mirai
Aqua.arm4.elf100%AviraEXP/ELF.Mirai.W

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
raw.intenseproxy.zip
193.200.78.28
truefalse
    		high
    raw.intenseproxy.zip. [malformed]
    		unknown
    		unknownfalse
      		high

      World Map of Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public IPs

      IPDomainCountryFlagASNASN NameMalicious
      193.200.78.28
      		raw.intenseproxy.zipSwitzerland
      		29496LINK-SERVICE-ASUAfalse

      Joe Sandbox View / Context

      IPs

      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      193.200.78.28Aqua.x86_64.elfGet hashmaliciousAquabotBrowse
        Aqua.mpsl.elfGet hashmaliciousUnknownBrowse
          Aqua.arm5.elfGet hashmaliciousUnknownBrowse
            Aqua.sh4.elfGet hashmaliciousAquabotBrowse
              Aqua.mips.elfGet hashmaliciousAquabotBrowse
                Aqua.sh4.elfGet hashmaliciousUnknownBrowse
                  Aqua.arm7.elfGet hashmaliciousMiraiBrowse
                    Aqua.ppc.elfGet hashmaliciousAquabotBrowse
                      Aqua.mpsl.elfGet hashmaliciousAquabotBrowse
                        Aqua.m68k.elfGet hashmaliciousUnknownBrowse

                          Domains

                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          raw.intenseproxy.zipAqua.x86_64.elfGet hashmaliciousAquabotBrowse
                          • 193.200.78.28
                          Aqua.mpsl.elfGet hashmaliciousUnknownBrowse
                          • 193.200.78.28
                          Aqua.mips.elfGet hashmaliciousAquabotBrowse
                          • 193.200.78.28
                          Aqua.ppc.elfGet hashmaliciousAquabotBrowse
                          • 193.200.78.28
                          Aqua.mpsl.elfGet hashmaliciousAquabotBrowse
                          • 193.200.78.28
                          Aqua.m68k.elfGet hashmaliciousUnknownBrowse
                          • 193.200.78.28

                          ASNs

                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          LINK-SERVICE-ASUAAqua.x86_64.elfGet hashmaliciousAquabotBrowse
                          • 193.200.78.28
                          Aqua.mpsl.elfGet hashmaliciousUnknownBrowse
                          • 193.200.78.28
                          Aqua.arm5.elfGet hashmaliciousUnknownBrowse
                          • 193.200.78.28
                          Aqua.sh4.elfGet hashmaliciousAquabotBrowse
                          • 193.200.78.28
                          Aqua.mips.elfGet hashmaliciousAquabotBrowse
                          • 193.200.78.28
                          Aqua.sh4.elfGet hashmaliciousUnknownBrowse
                          • 193.200.78.28
                          Aqua.arm7.elfGet hashmaliciousMiraiBrowse
                          • 193.200.78.28
                          Aqua.ppc.elfGet hashmaliciousAquabotBrowse
                          • 193.200.78.28
                          Aqua.mpsl.elfGet hashmaliciousAquabotBrowse
                          • 193.200.78.28
                          Aqua.m68k.elfGet hashmaliciousUnknownBrowse
                          • 193.200.78.28

                          JA3 Fingerprints

                          ⊘No context

                          Dropped Files

                          ⊘No context

                          Created / dropped Files

                          Process:/tmp/Aqua.arm4.elf
                          File Type:data
                          Category:dropped
                          Size (bytes):29
                          Entropy (8bit):4.1162646156680225
                          Encrypted:false
                          SSDEEP:3:Tg10J5oHJN:Tg10J5aJN
                          MD5:A112D952263191E835214AE26416ABBC
                          SHA1:349E32C34582E368CAC130154198CB6CD69DEBA8
                          SHA-256:2297F112B5819C8C8761662897BD7D67EA1C90C0B34719B1ACFC6338371CF666
                          SHA-512:907499D43E86878AE33DC88E09A22A69FE8E8487FCB31491D625C5BB5BE5E6444DA4FF33B3B2BB50C59A29E8DEB941BD54B13B8A34216AE9110CD7D1C7E43FDC
                          Malicious:false
                          Reputation:moderate, very likely benign file
                          Preview:/tmp/Aqua.arm4.elf.nwlrbbmqbh

                          Static File Info

                          General

                          File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
                          Entropy (8bit):6.052821383029686
                          TrID:
                          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                          File name:Aqua.arm4.elf
                          File size:54'896 bytes
                          MD5:aa6d3819929a793b34413e998f0cd9c6
                          SHA1:c7cb5838c423d551f7124ae67f18df7358ad27ac
                          SHA256:23958aaed3d0dcb28a155d850a3225a8efcde34933b93ae0e6ca706563e26e8f
                          SHA512:09a3782deb6e5007124138b9a5932ea3ae64f4743bd424f0391bda5ef808392d6719fcf88c535ea3cb97e8c81aae12aaecdd8f9c8141d11017dbba099e5f3417
                          SSDEEP:768:398SGDG3qh2rey4ICxld0m0eRwhc1CAZURczMMgvzcEYanMXPhHO9vjVmqI:mSqG3o2Ad0maq+Rc0vjmXk9LEq
                          TLSH:EC331981B9829613C6D412BBFB6E418D372617A8E2DF3307DD166F10379A92F0E77612
                          File Content Preview:.ELF...a..........(.........4...........4. ...(.........................................................x%..........Q.td..................................-...L."..../..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

                          Static ELF Info

                          ELF header

                          Class:ELF32
                          Data:2's complement, little endian
                          Version:1 (current)
                          Machine:ARM
                          Version Number:0x1
                          Type:EXEC (Executable file)
                          OS/ABI:ARM - ABI
                          ABI Version:0
                          Entry Point Address:0x8190
                          Flags:0x202
                          ELF Header Size:52
                          Program Header Offset:52
                          Program Header Size:32
                          Number of Program Headers:3
                          Section Header Offset:54496
                          Section Header Size:40
                          Number of Section Headers:10
                          Header String Table Index:9

                          Sections

                          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                          NULL0x00x00x00x00x0000
                          .initPROGBITS0x80940x940x180x00x6AX004
                          .textPROGBITS0x80b00xb00xbf0c0x00x6AX0016
                          .finiPROGBITS0x13fbc0xbfbc0x140x00x6AX004
                          .rodataPROGBITS0x13fd00xbfd00x111c0x00x2A004
                          .ctorsPROGBITS0x1d0f00xd0f00x80x00x3WA004
                          .dtorsPROGBITS0x1d0f80xd0f80x80x00x3WA004
                          .dataPROGBITS0x1d1040xd1040x39c0x00x3WA004
                          .bssNOBITS0x1d4a00xd4a00x21c80x00x3WA004
                          .shstrtabSTRTAB0x00xd4a00x3e0x00x0001

                          Program Segments

                          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                          LOAD0x00x80000x80000xd0ec0xd0ec6.08860x5R E0x8000.init .text .fini .rodata
                          LOAD0xd0f00x1d0f00x1d0f00x3b00x25783.19510x6RW 0x8000.ctors .dtors .data .bss
                          GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                          Network Behavior

                          Download Network PCAP: filtered – full

                          Network Port Distribution

                          • Total Packets: 20
                          • • 33966 undefined
                          • • 53 (DNS)
                          TimestampSource PortDest PortSource IPDest IP
                          Apr 26, 2025 21:19:35.785778046 CEST3707233966192.168.2.13193.200.78.28
                          Apr 26, 2025 21:19:36.057107925 CEST3396637072193.200.78.28192.168.2.13
                          Apr 26, 2025 21:19:36.057240009 CEST3707233966192.168.2.13193.200.78.28
                          Apr 26, 2025 21:19:36.058463097 CEST3707233966192.168.2.13193.200.78.28
                          Apr 26, 2025 21:19:36.330153942 CEST3396637072193.200.78.28192.168.2.13
                          Apr 26, 2025 21:19:36.330296040 CEST3707233966192.168.2.13193.200.78.28
                          Apr 26, 2025 21:19:36.603040934 CEST3396637072193.200.78.28192.168.2.13
                          Apr 26, 2025 21:19:51.603739023 CEST3396637072193.200.78.28192.168.2.13
                          Apr 26, 2025 21:19:51.603879929 CEST3707233966192.168.2.13193.200.78.28
                          Apr 26, 2025 21:20:06.875720978 CEST3396637072193.200.78.28192.168.2.13
                          Apr 26, 2025 21:20:06.875834942 CEST3707233966192.168.2.13193.200.78.28
                          Apr 26, 2025 21:20:22.147713900 CEST3396637072193.200.78.28192.168.2.13
                          Apr 26, 2025 21:20:22.147902012 CEST3707233966192.168.2.13193.200.78.28
                          Apr 26, 2025 21:20:37.419851065 CEST3396637072193.200.78.28192.168.2.13
                          Apr 26, 2025 21:20:37.420018911 CEST3707233966192.168.2.13193.200.78.28
                          Apr 26, 2025 21:20:46.105555058 CEST3707233966192.168.2.13193.200.78.28
                          Apr 26, 2025 21:20:46.377132893 CEST3396637072193.200.78.28192.168.2.13
                          Apr 26, 2025 21:20:46.377160072 CEST3396637072193.200.78.28192.168.2.13
                          Apr 26, 2025 21:20:46.377317905 CEST3707233966192.168.2.13193.200.78.28
                          Apr 26, 2025 21:20:56.386743069 CEST3707233966192.168.2.13193.200.78.28
                          Apr 26, 2025 21:20:56.658181906 CEST3396637072193.200.78.28192.168.2.13
                          Apr 26, 2025 21:20:56.658205032 CEST3396637072193.200.78.28192.168.2.13
                          Apr 26, 2025 21:20:56.658319950 CEST3707233966192.168.2.13193.200.78.28
                          Apr 26, 2025 21:21:12.160152912 CEST3396637072193.200.78.28192.168.2.13
                          Apr 26, 2025 21:21:12.160387993 CEST3707233966192.168.2.13193.200.78.28
                          Apr 26, 2025 21:21:27.435780048 CEST3396637072193.200.78.28192.168.2.13
                          Apr 26, 2025 21:21:27.435906887 CEST3707233966192.168.2.13193.200.78.28
                          TimestampSource PortDest PortSource IPDest IP
                          Apr 26, 2025 21:19:34.827577114 CEST5907253192.168.2.138.8.8.8
                          Apr 26, 2025 21:19:35.029728889 CEST53590728.8.8.8192.168.2.13
                          Apr 26, 2025 21:19:35.030977011 CEST5933953192.168.2.138.8.8.8
                          Apr 26, 2025 21:19:35.178872108 CEST53593398.8.8.8192.168.2.13
                          Apr 26, 2025 21:19:35.180088997 CEST4204153192.168.2.138.8.8.8
                          Apr 26, 2025 21:19:35.337167978 CEST53420418.8.8.8192.168.2.13
                          Apr 26, 2025 21:19:35.338102102 CEST3791053192.168.2.138.8.8.8
                          Apr 26, 2025 21:19:35.486244917 CEST53379108.8.8.8192.168.2.13
                          Apr 26, 2025 21:19:35.487282991 CEST5462253192.168.2.138.8.8.8
                          Apr 26, 2025 21:19:35.635984898 CEST53546228.8.8.8192.168.2.13
                          Apr 26, 2025 21:19:35.636837959 CEST4682853192.168.2.138.8.8.8
                          Apr 26, 2025 21:19:35.784966946 CEST53468288.8.8.8192.168.2.13

                          DNS Queries

                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                          Apr 26, 2025 21:19:34.827577114 CEST192.168.2.138.8.8.80x17ceStandard query (0)raw.intenseproxy.zipA (IP address)IN (0x0001)false
                          Apr 26, 2025 21:19:35.030977011 CEST192.168.2.138.8.8.80xb64Standard query (0)raw.intenseproxy.zip. [malformed]256455false
                          Apr 26, 2025 21:19:35.180088997 CEST192.168.2.138.8.8.80xb64Standard query (0)raw.intenseproxy.zip. [malformed]256455false
                          Apr 26, 2025 21:19:35.338102102 CEST192.168.2.138.8.8.80xb64Standard query (0)raw.intenseproxy.zip. [malformed]256455false
                          Apr 26, 2025 21:19:35.487282991 CEST192.168.2.138.8.8.80xb64Standard query (0)raw.intenseproxy.zip. [malformed]256455false
                          Apr 26, 2025 21:19:35.636837959 CEST192.168.2.138.8.8.80xb64Standard query (0)raw.intenseproxy.zip. [malformed]256455false

                          DNS Answers

                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                          Apr 26, 2025 21:19:35.029728889 CEST8.8.8.8192.168.2.130x17ceNo error (0)raw.intenseproxy.zip193.200.78.28A (IP address)IN (0x0001)false

                          System Behavior

                          General

                          Start time (UTC):19:19:33
                          Start date (UTC):26/04/2025
                          Path:/tmp/Aqua.arm4.elf
                          Arguments:/tmp/Aqua.arm4.elf
                          File size:4956856 bytes
                          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                          File Activities

                          Process Activities

                          System Activities


                          General

                          Start time (UTC):19:19:34
                          Start date (UTC):26/04/2025
                          Path:/tmp/Aqua.arm4.elf
                          Arguments:-
                          File size:4956856 bytes
                          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                          File Activities

                          Process Activities

                          Network Activities