Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
mpsl.elf

Overview

General Information

Sample name:mpsl.elf
Analysis ID:1541790
MD5:4adc82f657ebca4d0a3ba87bd8e86734
SHA1:88dbc31fcf73cd58f013041d1cf8435347a33feb
SHA256:c3daeaa71accb615e86ed4c7332bbdd83eb4e6ffbfba259bcc5c35ca888ed2b9
Tags:elfuser-abuse_ch

Detection

Score:1
Range:0 - 100
Whitelisted:false

Signatures

Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1541790
Start date and time:2024-10-25 06:32:17 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 44s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:mpsl.elf
Detection:CLEAN
Classification:clean1.linELF@0/0@0/0
Command:/tmp/mpsl.elf
PID:5827
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:

Standard Error:
  • system is lnxubuntu20
  • mpsl.elf (PID: 5827, Parent: 5753, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/mpsl.elf
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: clean1.linELF@0/0@0/0
Source: /tmp/mpsl.elf (PID: 5827)Queries kernel information via 'uname': Jump to behavior
Source: mpsl.elf, 5827.1.0000558dd20f5000.0000558dd217c000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mipsel
Source: mpsl.elf, 5827.1.00007ffd94840000.00007ffd94861000.rw-.sdmpBinary or memory string: zx86_64/usr/bin/qemu-mipsel/tmp/mpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mpsl.elf
Source: mpsl.elf, 5827.1.0000558dd20f5000.0000558dd217c000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/mipsel
Source: mpsl.elf, 5827.1.00007ffd94840000.00007ffd94861000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mipsel
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1541790 Sample: mpsl.elf Startdate: 25/10/2024 Architecture: LINUX Score: 1 4 mpsl.elf 2->4         started       

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
mpsl.elf3%ReversingLabs
mpsl.elf3%VirustotalBrowse
No Antivirus matches
No Antivirus matches
No Antivirus matches
No contacted domains info
No contacted IP infos
No context
No context
No context
No context
No context
No created / dropped files found
File type:ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):5.46469854510127
TrID:
  • ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:mpsl.elf
File size:69'080 bytes
MD5:4adc82f657ebca4d0a3ba87bd8e86734
SHA1:88dbc31fcf73cd58f013041d1cf8435347a33feb
SHA256:c3daeaa71accb615e86ed4c7332bbdd83eb4e6ffbfba259bcc5c35ca888ed2b9
SHA512:addd8fc65afd89b537715de3049e05cf63df6e755ccfc6763e4459619cf5eea07b097bfd30a1dd5b1b49fe5a985b5c07567ca4e51c3482e46527e1368a07ca5d
SSDEEP:768:FqAOeJHLDZ8F2F/dgCnAgF+v5gjXif+uOVoH6XC7iv4rr+aYpTlklQH4IkT:7OeRQEgCAgF+J+uoVWCHY
TLSH:A663F90AAFA11EBFD82FDE3302A50B5621CC865662A57B7A3174C81CF64F5471BD3CA4
File Content Preview:.ELF......................@.4...X.......4. ...(...............@...@...........................A...A.....h6..............$...$.A.$.A.................Q.td...............................<...'!......'.......................<...'!.............9'.. ............

ELF header

Class:ELF32
Data:2's complement, little endian
Version:1 (current)
Machine:MIPS R3000
Version Number:0x1
Type:EXEC (Executable file)
OS/ABI:UNIX - System V
ABI Version:0
Entry Point Address:0x400290
Flags:0x1007
ELF Header Size:52
Program Header Offset:52
Program Header Size:32
Number of Program Headers:4
Section Header Offset:68440
Section Header Size:40
Number of Section Headers:16
Header String Table Index:15
NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
NULL0x00x00x00x00x0000
.initPROGBITS0x4000b40xb40x8c0x00x6AX004
.textPROGBITS0x4001400x1400xec100x00x6AX0016
.finiPROGBITS0x40ed500xed500x5c0x00x6AX004
.rodataPROGBITS0x40edb00xedb00x16300x00x2A0016
.eh_framePROGBITS0x4113e00x103e00x440x00x3WA004
.tbssNOBITS0x4114240x104240x80x00x403WAT004
.ctorsPROGBITS0x4114240x104240x80x00x3WA004
.dtorsPROGBITS0x41142c0x1042c0x80x00x3WA004
.jcrPROGBITS0x4114340x104340x40x00x3WA004
.dataPROGBITS0x4114400x104400x2440x00x3WA0016
.gotPROGBITS0x4116900x106900x45c0x40x10000003WAp0016
.sbssNOBITS0x411aec0x10aec0x300x00x10000003WAp004
.bssNOBITS0x411b200x10aec0x2f280x00x3WA0016
.mdebug.abi32PROGBITS0xa8c0x10aec0x00x00x0001
.shstrtabSTRTAB0x00x10aec0x6c0x00x0001
TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
LOAD0x00x4000000x4000000x103e00x103e05.48880x5R E0x1000.init .text .fini .rodata
LOAD0x103e00x4113e00x4113e00x70c0x36684.13380x6RW 0x1000.eh_frame .tbss .ctors .dtors .jcr .data .got .sbss .bss
TLS0x104240x4114240x4114240x00x80.00000x4R 0x4.tbss
GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
No network behavior found

System Behavior

Start time (UTC):04:33:25
Start date (UTC):25/10/2024
Path:/tmp/mpsl.elf
Arguments:/tmp/mpsl.elf
File size:5773336 bytes
MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9