Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
arm4.elf

Overview

General Information

Sample name:arm4.elf
Analysis ID:1527382
MD5:9ed946c62489e261cc2c8b0ffda9b7b0
SHA1:94411b69d65d5fa28c81497441aac6fe01d72adf
SHA256:e9cb9811bed65876bfbb617db1ebb4c19b711a05cbee6ec91587a9d38771aed7
Tags:user-elfdigest
Infos:

Detection

Mirai
Score:64
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1527382
Start date and time:2024-10-06 23:15:12 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 17s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:arm4.elf
Detection:MAL
Classification:mal64.troj.linELF@0/0@0/0

Warnings

  • Skipping network analysis since amount of network traffic is too extensive
  • VT rate limit hit for: arm4.elf

Runtime Messages

Command:/tmp/arm4.elf
PID:5824
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
you are now apart of hail cock botnet
Standard Error:

Process Tree

  • system is lnxubuntu20
  • arm4.elf (PID: 5824, Parent: 5748, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm4.elf
    • arm4.elf New Fork (PID: 5827, Parent: 5824)
      • arm4.elf New Fork (PID: 5889, Parent: 5827)
      • arm4.elf New Fork (PID: 5890, Parent: 5827)
        • arm4.elf New Fork (PID: 5911, Parent: 5890)
    • arm4.elf New Fork (PID: 5828, Parent: 5824)
    • arm4.elf New Fork (PID: 5830, Parent: 5824)
      • arm4.elf New Fork (PID: 5851, Parent: 5830)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
arm4.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    5824.1.00007ff814017000.00007ff81402c000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      5827.1.00007ff814017000.00007ff81402c000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        5890.1.00007ff814017000.00007ff81402c000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security

          Suricata Signatures

          ⊘No Suricata rule has matched

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Antivirus / Scanner detection for submitted sample
          Source: arm4.elfAvira: detected
          Multi AV Scanner detection for submitted file
          Source: arm4.elfReversingLabs: Detection: 44%
          Source: /tmp/arm4.elf (PID: 5824)Socket: 127.0.0.1:1172Jump to behavior
          Source: ELF static info symbol of initial sample.symtab present: no
          Source: classification engineClassification label: mal64.troj.linELF@0/0@0/0
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/6032/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/6031/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/6034/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/6033/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/5980/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/6036/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/5981/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/6035/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/5982/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/6016/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/6038/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/5983/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/6015/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/6037/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/6030/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/5918/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/5973/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/6029/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/5974/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/6028/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/5975/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/5976/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/5911/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/5977/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/5978/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/5979/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/6042/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/5890/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/6025/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/6024/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/6027/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/5972/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/6026/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/6041/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/6040/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/1/cmdlineJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/5984/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/5985/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/6017/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/6039/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/5667/cmdlineJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/5986/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/5987/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5828)File opened: /proc/5889/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/6032/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/6031/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/6034/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/6033/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/5980/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/6036/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/5981/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/6035/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/5982/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/6016/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/6038/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/5983/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/6015/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/6037/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/6030/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/5973/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/6029/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/5974/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/6028/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/5975/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/5976/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/5977/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/5978/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/5979/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/6042/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/6025/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/6024/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/5971/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/6027/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/5972/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/6026/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/6041/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/6040/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/1/cmdlineJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/2/cmdlineJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/5984/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/5985/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/6017/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/6039/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/5667/cmdlineJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/5986/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5889)File opened: /proc/5987/statusJump to behavior
          Source: /tmp/arm4.elf (PID: 5824)Queries kernel information via 'uname': Jump to behavior
          Source: arm4.elf, 5824.1.00007ffc75fc2000.00007ffc75fe3000.rw-.sdmp, arm4.elf, 5827.1.00007ffc75fc2000.00007ffc75fe3000.rw-.sdmp, arm4.elf, 5890.1.00007ffc75fc2000.00007ffc75fe3000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm4.elf
          Source: arm4.elf, 5824.1.000055da8beac000.000055da8c022000.rw-.sdmp, arm4.elf, 5827.1.000055da8beac000.000055da8c022000.rw-.sdmp, arm4.elf, 5890.1.000055da8beac000.000055da8c022000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
          Source: arm4.elf, 5824.1.000055da8beac000.000055da8c022000.rw-.sdmp, arm4.elf, 5827.1.000055da8beac000.000055da8c022000.rw-.sdmp, arm4.elf, 5890.1.000055da8beac000.000055da8c022000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
          Source: arm4.elf, 5824.1.00007ffc75fc2000.00007ffc75fe3000.rw-.sdmp, arm4.elf, 5827.1.00007ffc75fc2000.00007ffc75fe3000.rw-.sdmp, arm4.elf, 5890.1.00007ffc75fc2000.00007ffc75fe3000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
          Source: arm4.elf, 5890.1.00007ffc75fc2000.00007ffc75fe3000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

          Stealing of Sensitive Information

          barindex
          Yara detected Mirai
          Source: Yara matchFile source: arm4.elf, type: SAMPLE
          Source: Yara matchFile source: 5824.1.00007ff814017000.00007ff81402c000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 5827.1.00007ff814017000.00007ff81402c000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 5890.1.00007ff814017000.00007ff81402c000.r-x.sdmp, type: MEMORY

          Remote Access Functionality

          barindex
          Yara detected Mirai
          Source: Yara matchFile source: arm4.elf, type: SAMPLE
          Source: Yara matchFile source: 5824.1.00007ff814017000.00007ff81402c000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 5827.1.00007ff814017000.00007ff81402c000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 5890.1.00007ff814017000.00007ff81402c000.r-x.sdmp, type: MEMORY

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume Access1
          OS Credential Dumping          		11
          Security Software Discovery          		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features

          Malware Configuration

          ⊘No configs have been found

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Number of created Files
          • Is malicious
          • Internet
          behaviorgraph top1 signatures2 2 Behavior Graph ID: 1527382 Sample: arm4.elf Startdate: 06/10/2024 Architecture: LINUX Score: 64 24 Antivirus / Scanner detection for submitted sample 2->24 26 Multi AV Scanner detection for submitted file 2->26 28 Yara detected Mirai 2->28 8 arm4.elf 2->8         started        process3 process4 10 arm4.elf 8->10         started        12 arm4.elf 8->12         started        14 arm4.elf 8->14         started        process5 16 arm4.elf 10->16         started        18 arm4.elf 10->18         started        20 arm4.elf 12->20         started        process6 22 arm4.elf 16->22         started       

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          arm4.elf45%ReversingLabsLinux.Backdoor.Mirai
          arm4.elf100%AviraEXP/ELF.Mirai.W

          Dropped Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          ⊘No Antivirus matches

          Domains and IPs

          Contacted Domains

          ⊘No contacted domains info

          World Map of Contacted IPs

          ⊘No contacted IP infos

          Joe Sandbox View / Context

          IPs

          ⊘No context

          Domains

          ⊘No context

          ASNs

          ⊘No context

          JA3 Fingerprints

          ⊘No context

          Dropped Files

          ⊘No context

          Created / dropped Files

          ⊘No created / dropped files found

          Static File Info

          General

          File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
          Entropy (8bit):6.1456347209933115
          TrID:
          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
          File name:arm4.elf
          File size:83'624 bytes
          MD5:9ed946c62489e261cc2c8b0ffda9b7b0
          SHA1:94411b69d65d5fa28c81497441aac6fe01d72adf
          SHA256:e9cb9811bed65876bfbb617db1ebb4c19b711a05cbee6ec91587a9d38771aed7
          SHA512:904fed7aa06c65ebfd534d895f1ce9715b07bd0880f8def37eed7dd107de132ff76614c3b910732e05aebcb9982b982d183a1ed81e96d65d09d441fc61720208
          SSDEEP:1536:S39V3xlXof0lWKRL0Bo/RAE5+6Gtgf+JFA0XuzREi3q80vNWmn:S39pPof0lxGo5AE5+7KEFA0XjnNWmn
          TLSH:ED834A45BD815B12C6D111BBFB2E428D372613E8D2EB7207C9256F21778B82B0E7B645
          File Content Preview:.ELF...a..........(.........4....E......4. ...(......................@...@...............@...@...@......4U..........Q.td..................................-...L."...3I..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

          Static ELF Info

          ELF header

          Class:ELF32
          Data:2's complement, little endian
          Version:1 (current)
          Machine:ARM
          Version Number:0x1
          Type:EXEC (Executable file)
          OS/ABI:ARM - ABI
          ABI Version:0
          Entry Point Address:0x8190
          Flags:0x202
          ELF Header Size:52
          Program Header Offset:52
          Program Header Size:32
          Number of Program Headers:3
          Section Header Offset:83224
          Section Header Size:40
          Number of Section Headers:10
          Header String Table Index:9

          Sections

          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
          NULL0x00x00x00x00x0000
          .initPROGBITS0x80940x940x180x00x6AX004
          .textPROGBITS0x80b00xb00x125040x00x6AX0016
          .finiPROGBITS0x1a5b40x125b40x140x00x6AX004
          .rodataPROGBITS0x1a5c80x125c80x1b240x00x2A004
          .ctorsPROGBITS0x240f00x140f00x80x00x3WA004
          .dtorsPROGBITS0x240f80x140f80x80x00x3WA004
          .dataPROGBITS0x241040x141040x3d40x00x3WA004
          .bssNOBITS0x244d80x144d80x514c0x00x3WA004
          .shstrtabSTRTAB0x00x144d80x3e0x00x0001

          Program Segments

          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
          LOAD0x00x80000x80000x140ec0x140ec6.17040x5R E0x8000.init .text .fini .rodata
          LOAD0x140f00x240f00x240f00x3e80x55343.45230x6RW 0x8000.ctors .dtors .data .bss
          GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

          Network Behavior

          ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

          System Behavior

          General

          Start time (UTC):21:16:22
          Start date (UTC):06/10/2024
          Path:/tmp/arm4.elf
          Arguments:/tmp/arm4.elf
          File size:4956856 bytes
          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

          Chronological Activities


          General

          Start time (UTC):21:16:22
          Start date (UTC):06/10/2024
          Path:/tmp/arm4.elf
          Arguments:-
          File size:4956856 bytes
          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

          Chronological Activities


          General

          Start time (UTC):21:16:22
          Start date (UTC):06/10/2024
          Path:/tmp/arm4.elf
          Arguments:-
          File size:4956856 bytes
          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

          Chronological Activities


          General

          Start time (UTC):21:16:22
          Start date (UTC):06/10/2024
          Path:/tmp/arm4.elf
          Arguments:-
          File size:4956856 bytes
          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

          Chronological Activities


          General

          Start time (UTC):21:16:22
          Start date (UTC):06/10/2024
          Path:/tmp/arm4.elf
          Arguments:-
          File size:4956856 bytes
          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

          Chronological Activities


          General

          Start time (UTC):21:16:22
          Start date (UTC):06/10/2024
          Path:/tmp/arm4.elf
          Arguments:-
          File size:4956856 bytes
          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

          Chronological Activities


          General

          Start time (UTC):21:16:22
          Start date (UTC):06/10/2024
          Path:/tmp/arm4.elf
          Arguments:-
          File size:4956856 bytes
          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

          Chronological Activities


          General

          Start time (UTC):21:16:22
          Start date (UTC):06/10/2024
          Path:/tmp/arm4.elf
          Arguments:-
          File size:4956856 bytes
          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

          Chronological Activities