Linux Analysis Report rijsTqU0If

Overview

General Information

Sample Name:	rijsTqU0If
Analysis ID:	511555
MD5:	8c305137c8b025af33ac608a9b5465b9
SHA1:	4dc66a698ddbfbb1bf77a67af5c85b997b99a17e
SHA256:	93ca4f85d13c01834ae5b36d93cca17bd924dcbb9b238c7a3e2d51646d0c636a
Tags:	32elfmipsmirai
Infos:
Most interesting Screenshot:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample tries to kill a process (SIGKILL)

Classification

Signatures

AV Detection:

Multi AV Scanner detection for submitted file

Source: rijsTqU0If	Virustotal: Detection: 21%			Perma Link
Source: rijsTqU0If	ReversingLabs: Detection: 15%

Networking:

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.23:56596 -> 45.95.169.120:455

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 14.245.169.210
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

System Summary:

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Sample tries to kill a process (SIGKILL)

Source: /tmp/rijsTqU0If (PID: 5261)	SIGKILL sent: pid: 2256, result: successful	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	SIGKILL sent: pid: 2258, result: no such process	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	SIGKILL sent: pid: 5216, result: successful	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	SIGKILL sent: pid: 5217, result: successful	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	SIGKILL sent: pid: 5332, result: successful	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	SIGKILL sent: pid: 5339, result: successful	Jump to behavior

Source: classification engine

Classification label: mal48.lin@0/4@0/0

Source: rijsTqU0If

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Persistence and Installation Behavior:

Enumerates processes within the "proc" file system

Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/5261/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/5261/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1582/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1582/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/3088/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/3088/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1579/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1579/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1699/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1699/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1335/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1335/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1698/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1698/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1334/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1334/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1576/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/1576/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/2302/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/2302/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/rijsTqU0If (PID: 5261)	File opened: /proc/118/status	Jump to behavior

Malware Analysis System Evasion:

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/rijsTqU0If (PID: 5257)

Queries kernel information via 'uname':

Jump to behavior

Source: rijsTqU0If, 5257.1.000000002e1e1e19.000000007037b6cf.rw-.sdmp	Binary or memory string: 'x86_64/usr/bin/qemu-mips/tmp/rijsTqU0IfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/rijsTqU0If
Source: rijsTqU0If, 5257.1.00000000ea33cb04.0000000086a4c822.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mips
Source: rijsTqU0If, 5257.1.00000000ea33cb04.0000000086a4c822.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: rijsTqU0If, 5257.1.000000002e1e1e19.000000007037b6cf.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
14.245.169.210	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
45.95.169.120	unknown	Croatia (LOCAL Name: Hrvatska)	42864	GIGANET-HUGigaNetInternetServiceProviderCoHU	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

ID:	511555
Product:	CloudBasic
Start time:	09:42:04
Start date:	29.10.2021
Sample:	rijsTqU0If
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	8c305137c8b025af33ac608a9b5465b9
SHA1:	4dc66a698ddbfbb1bf77a67af5c85b997b99a17e
SHA256:	93ca4f85d13c01834ae5b36d93cca17bd924dcbb9b238c7a3e2d51646d0c636a
Filetype:	ELF Executable and Linkable format (generic) (4004/1) 100.00%

Name	Type	MD5	SHA1	SHA256
/tmp/qemu-open.FkwII2 (deleted)	ASCII text, with no line terminators	F74579562F35CBFB0F4F4CDB336291CC	832C3E5265179CEE8D7209B6AA96F037415D564A	D6A6D223938608296B875F461E30143D0860BBDD07D17AF915F5D4EEB51D4A51
/tmp/qemu-open.l72D7Z (deleted)	ASCII text, with no line terminators	F74579562F35CBFB0F4F4CDB336291CC	832C3E5265179CEE8D7209B6AA96F037415D564A	D6A6D223938608296B875F461E30143D0860BBDD07D17AF915F5D4EEB51D4A51
/tmp/qemu-open.mWC470 (deleted)	ASCII text, with no line terminators	F74579562F35CBFB0F4F4CDB336291CC	832C3E5265179CEE8D7209B6AA96F037415D564A	D6A6D223938608296B875F461E30143D0860BBDD07D17AF915F5D4EEB51D4A51
/tmp/qemu-open.zQV7X2 (deleted)	ASCII text, with no line terminators	F74579562F35CBFB0F4F4CDB336291CC	832C3E5265179CEE8D7209B6AA96F037415D564A	D6A6D223938608296B875F461E30143D0860BBDD07D17AF915F5D4EEB51D4A51

Linux Analysis Report rijsTqU0If

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Networking:

System Summary:

Persistence and Installation Behavior:

Malware Analysis System Evasion:

Screenshots

Network Map

Contacted Public IPs