Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
botnt.armv7v5.elf

Overview

General Information

Sample name:botnt.armv7v5.elf
Analysis ID:1502199
MD5:220d50d51a92a8fe2a109fc6a92de91b
SHA1:4168b3819ad07c57c6d74006e06a3808ed8b3aa7
SHA256:1e31df3c8fc2d8fe28fa013f1e69763de76d6792d89a2c75e557926a973659ac
Tags:botntelf
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false

Signatures

Sample has stripped symbol table
Sample listens on a socket
Sleeps for long times indicative of sandbox evasion
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1502199
Start date and time:2024-08-31 14:48:05 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 41s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:botnt.armv7v5.elf
Detection:CLEAN
Classification:clean2.linELF@0/0@0/0

Warnings

  • Skipping network analysis since amount of network traffic is too extensive

Runtime Messages

Command:/tmp/botnt.armv7v5.elf
PID:5493
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:

Standard Error:Segmentation fault

Process Tree

  • system is lnxubuntu20
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: /tmp/botnt.armv7v5.elf (PID: 5495)Socket: 127.0.0.1:2174Jump to behavior
Source: botnt.armv7v5.elfString found in binary or memory: https://www.gnu.org/software/libc/bugs.html
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: clean2.linELF@0/0@0/0
Source: submitted sampleStderr: Segmentation fault: exit code = 0
Source: /tmp/botnt.armv7v5.elf (PID: 5561)Sleeps longer then 60s: 60.0sJump to behavior
Source: /tmp/botnt.armv7v5.elf (PID: 5493)Queries kernel information via 'uname': Jump to behavior
Source: botnt.armv7v5.elf, 5493.1.00007fff1dff9000.00007fff1e01a000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/botnt.armv7v5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/botnt.armv7v5.elf
Source: botnt.armv7v5.elf, 5493.1.00005567f1d08000.00005567f1e58000.rw-.sdmpBinary or memory string: gU!/etc/qemu-binfmt/arm
Source: botnt.armv7v5.elf, 5493.1.00005567f1d08000.00005567f1e58000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: botnt.armv7v5.elf, 5493.1.00007fff1dff9000.00007fff1e01a000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
Virtualization/Sandbox Evasion		OS Credential Dumping11
Security Software Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory1
Virtualization/Sandbox Evasion		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1502199 Sample: botnt.armv7v5.elf Startdate: 31/08/2024 Architecture: LINUX Score: 2 7 botnt.armv7v5.elf 2->7         started        process3 9 botnt.armv7v5.elf 7->9         started        process4 11 botnt.armv7v5.elf 9->11         started        process5 13 botnt.armv7v5.elf 11->13         started       

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
botnt.armv7v5.elf3%ReversingLabsLinux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://www.gnu.org/software/libc/bugs.htmlbotnt.armv7v5.elffalse
    		unknown

    World Map of Contacted IPs

    ⊘No contacted IP infos

    Joe Sandbox View / Context

    IPs

    ⊘No context

    Domains

    ⊘No context

    ASNs

    ⊘No context

    JA3 Fingerprints

    ⊘No context

    Dropped Files

    ⊘No context

    Created / dropped Files

    ⊘No created / dropped files found

    Static File Info

    General

    File type:ELF 32-bit LSB executable, ARM, EABI5 version 1 (GNU/Linux), statically linked, stripped
    Entropy (8bit):5.964584674604982
    TrID:
    • ELF Executable and Linkable format (generic) (4004/1) 100.00%
    File name:botnt.armv7v5.elf
    File size:471'816 bytes
    MD5:220d50d51a92a8fe2a109fc6a92de91b
    SHA1:4168b3819ad07c57c6d74006e06a3808ed8b3aa7
    SHA256:1e31df3c8fc2d8fe28fa013f1e69763de76d6792d89a2c75e557926a973659ac
    SHA512:39474f22b2ebaeb9ea2cfeb13d42ad71af075c64129fbdb084b990f8f4a3e21c204e29ef2295b10bd3948d9443ca19b2629cb023f00efb45074e5f2c71a2d988
    SSDEEP:6144:bKtXtvNLljYtt+LMa27C1I4S7SWGpsGJvHK0H9rWgtgp8eXt:bEjLlkoC4AX4q0dXgp8eXt
    TLSH:80A45C59F8809FA1CAD425B6F74D925C331707B9C3DAB2079A245B343B978AB0F3B641
    File Content Preview:.ELF..............(.........4..../......4. ...(........pD...D...D... ... ...........................h...h...............$...$...$....3..|d..............................................$...$...$.......@...........Q.td.......................................

    Static ELF Info

    ELF header

    Class:ELF32
    Data:2's complement, little endian
    Version:1 (current)
    Machine:ARM
    Version Number:0x1
    Type:EXEC (Executable file)
    OS/ABI:UNIX - Linux
    ABI Version:0
    Entry Point Address:0x10a8c
    Flags:0x5000400
    ELF Header Size:52
    Program Header Offset:52
    Program Header Size:32
    Number of Program Headers:6
    Section Header Offset:471016
    Section Header Size:40
    Number of Section Headers:20
    Header String Table Index:19

    Sections

    NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
    NULL0x00x00x00x00x0000
    .rel.dynREL0x101340x1340x100x80x2A004
    .initPROGBITS0x101440x1440xc0x00x6AX004
    .ipltPROGBITS0x101500x1500x180x00x6AX004
    .textPROGBITS0x101800x1800x582980x00x6AX0064
    .finiPROGBITS0x684180x584180x80x00x6AX004
    .rodataPROGBITS0x684200x584200x169a80x00x2A004
    .ARM.extabPROGBITS0x7edc80x6edc80x1790x00x2A004
    .ARM.exidxARM_EXIDX0x7ef440x6ef440x6200x00x82AL404
    .eh_framePROGBITS0x7f5640x6f5640x40x00x2A004
    .tdataPROGBITS0x80b240x6fb240xc0x00x403WAT004
    .tbssNOBITS0x80b300x6fb300x340x00x403WAT004
    .init_arrayINIT_ARRAY0x80b300x6fb300x40x40x3WA004
    .fini_arrayFINI_ARRAY0x80b340x6fb340x40x40x3WA004
    .data.rel.roPROGBITS0x80b380x6fb380x22500x00x3WA008
    .gotPROGBITS0x82d880x71d880x2780x40x3WA004
    .dataPROGBITS0x830000x720000xf080x00x3WA008
    .bssNOBITS0x83f080x72f080x30980x00x3WA008
    .ARM.attributesARM_ATTRIBUTES0x00x72f080x390x00x0001
    .shstrtabSTRTAB0x00x72f410xa60x00x0001

    Program Segments

    TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
    EXIDX0x6ef440x7ef440x7ef440x6200x6205.34990x4R 0x4.ARM.exidx
    LOAD0x00x100000x100000x6f5680x6f5686.02060x5R E0x1000.rel.dyn .init .iplt .text .fini .rodata .ARM.extab .ARM.exidx .eh_frame
    LOAD0x6fb240x80b240x80b240x33e40x647c3.56100x6RW 0x1000.tdata .tbss .init_array .fini_array .data.rel.ro .got .data .bss
    NOTE0x00x101140x00x00x00.00000x4R 0x4
    TLS0x6fb240x80b240x80b240xc0x402.22960x4R 0x4.tdata .tbss
    GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

    Network Behavior

    ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

    System Behavior

    General

    Start time (UTC):12:49:12
    Start date (UTC):31/08/2024
    Path:/tmp/botnt.armv7v5.elf
    Arguments:/tmp/botnt.armv7v5.elf
    File size:4956856 bytes
    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

    Chronological Activities


    General

    Start time (UTC):12:49:12
    Start date (UTC):31/08/2024
    Path:/tmp/botnt.armv7v5.elf
    Arguments:-
    File size:4956856 bytes
    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

    Chronological Activities


    General

    Start time (UTC):12:51:01
    Start date (UTC):31/08/2024
    Path:/tmp/botnt.armv7v5.elf
    Arguments:-
    File size:4956856 bytes
    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

    Chronological Activities


    General

    Start time (UTC):12:51:01
    Start date (UTC):31/08/2024
    Path:/tmp/botnt.armv7v5.elf
    Arguments:-
    File size:4956856 bytes
    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

    Chronological Activities