Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
mips.elf

Overview

General Information

Sample name:mips.elf
Analysis ID:1541831
MD5:697f179d49ef3b5fe5c8a4f3df0d9592
SHA1:334fb962203b9819cc0303237b9d938a2f3e34cb
SHA256:bce751aa17d8e5cda2d82408d8c296f9de9e8ce9283c1bf0a7f777f34a33e0c5
Tags:elfuser-abuse_ch
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1541831
Start date and time:2024-10-25 08:18:08 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 24s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:mips.elf
Detection:MAL
Classification:mal56.linELF@0/0@0/0

Runtime Messages

Command:/tmp/mips.elf
PID:5451
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:

Standard Error:

Process Tree

  • system is lnxubuntu20
  • dash New Fork (PID: 5416, Parent: 3591)
  • rm (PID: 5416, Parent: 3591, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.WC8v2L67nm /tmp/tmp.okaodldQhL /tmp/tmp.qkDyzY2OYS
  • dash New Fork (PID: 5417, Parent: 3591)
  • cat (PID: 5417, Parent: 3591, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.WC8v2L67nm
  • dash New Fork (PID: 5418, Parent: 3591)
  • head (PID: 5418, Parent: 3591, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5419, Parent: 3591)
  • tr (PID: 5419, Parent: 3591, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5420, Parent: 3591)
  • cut (PID: 5420, Parent: 3591, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5421, Parent: 3591)
  • cat (PID: 5421, Parent: 3591, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.WC8v2L67nm
  • dash New Fork (PID: 5422, Parent: 3591)
  • head (PID: 5422, Parent: 3591, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5423, Parent: 3591)
  • tr (PID: 5423, Parent: 3591, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5424, Parent: 3591)
  • cut (PID: 5424, Parent: 3591, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5425, Parent: 3591)
  • rm (PID: 5425, Parent: 3591, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.WC8v2L67nm /tmp/tmp.okaodldQhL /tmp/tmp.qkDyzY2OYS
  • mips.elf (PID: 5451, Parent: 5346, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/mips.elf
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: mips.elfAvira: detected
Multi AV Scanner detection for submitted file
Source: mips.elfVirustotal: Detection: 7%Perma Link
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal56.linELF@0/0@0/0
Source: /usr/bin/dash (PID: 5416)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.WC8v2L67nm /tmp/tmp.okaodldQhL /tmp/tmp.qkDyzY2OYSJump to behavior
Source: /usr/bin/dash (PID: 5425)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.WC8v2L67nm /tmp/tmp.okaodldQhL /tmp/tmp.qkDyzY2OYSJump to behavior
Source: /tmp/mips.elf (PID: 5451)Queries kernel information via 'uname': Jump to behavior
Source: mips.elf, 5451.1.0000562faa289000.0000562faa310000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mips
Source: mips.elf, 5451.1.00007ffe4eac3000.00007ffe4eae4000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mips
Source: mips.elf, 5451.1.00007ffe4eac3000.00007ffe4eae4000.rw-.sdmpBinary or memory string: ,0+x86_64/usr/bin/qemu-mips/tmp/mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mips.elf
Source: mips.elf, 5451.1.0000562faa289000.0000562faa310000.rw-.sdmpBinary or memory string: /V!/etc/qemu-binfmt/mips

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
File Deletion		OS Credential Dumping11
Security Software Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1541831 Sample: mips.elf Startdate: 25/10/2024 Architecture: LINUX Score: 56 13 Antivirus / Scanner detection for submitted sample 2->13 15 Multi AV Scanner detection for submitted file 2->15 5 dash rm mips.elf 2->5         started        7 dash rm 2->7         started        9 dash head 2->9         started        11 7 other processes 2->11 process3

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
mips.elf8%ReversingLabsLinux.Exploit.Mirai
mips.elf8%VirustotalBrowse
mips.elf100%AviraEXP/ELF.Mirai.W

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):5.464679808498601
TrID:
  • ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:mips.elf
File size:69'528 bytes
MD5:697f179d49ef3b5fe5c8a4f3df0d9592
SHA1:334fb962203b9819cc0303237b9d938a2f3e34cb
SHA256:bce751aa17d8e5cda2d82408d8c296f9de9e8ce9283c1bf0a7f777f34a33e0c5
SHA512:06ab4e8cbc50ccaf824ad29b46486e12fb73e327c33d78fe0af1a6090daffcdb8321375074b99aa57c49c847e850dbc3bdef12937915f5a752288656e64047e9
SSDEEP:768:iPDbxU3BAeCpFyXFO+qy2wCcZNLf0tphaXEeDsh+PcRu4sz1WN70n8igIzyN:cxURaDyVgIThDshBrsZWNg8Ht
TLSH:1463F83A6A21CFA8F25DC23157B70B1197A922D523E1C584E29CCE042F6275E5C5FFE8
File Content Preview:.ELF.....................@.....4.........4. ...(.............@...@...........................A...A........6x.................A...A..................dt.Q............................<...'..|...!'.......................<...'..X...!........'9... .............

Static ELF Info

ELF header

Class:ELF32
Data:2's complement, big endian
Version:1 (current)
Machine:MIPS R3000
Version Number:0x1
Type:EXEC (Executable file)
OS/ABI:UNIX - System V
ABI Version:0
Entry Point Address:0x400290
Flags:0x1007
ELF Header Size:52
Program Header Offset:52
Program Header Size:32
Number of Program Headers:4
Section Header Offset:68888
Section Header Size:40
Number of Section Headers:16
Header String Table Index:15

Sections

NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
NULL0x00x00x00x00x0000
.initPROGBITS0x4000b40xb40x8c0x00x6AX004
.textPROGBITS0x4001400x1400xed800x00x6AX0016
.finiPROGBITS0x40eec00xeec00x5c0x00x6AX004
.rodataPROGBITS0x40ef200xef200x16700x00x2A0016
.eh_framePROGBITS0x4115900x105900x440x00x3WA004
.tbssNOBITS0x4115d40x105d40x80x00x403WAT004
.ctorsPROGBITS0x4115d40x105d40x80x00x3WA004
.dtorsPROGBITS0x4115dc0x105dc0x80x00x3WA004
.jcrPROGBITS0x4115e40x105e40x40x00x3WA004
.dataPROGBITS0x4115f00x105f00x2440x00x3WA0016
.gotPROGBITS0x4118400x108400x46c0x40x10000003WAp0016
.sbssNOBITS0x411cac0x10cac0x300x00x10000003WAp004
.bssNOBITS0x411ce00x10cac0x2f280x00x3WA0016
.mdebug.abi32PROGBITS0xa9e0x10cac0x00x00x0001
.shstrtabSTRTAB0x00x10cac0x6c0x00x0001

Program Segments

TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
LOAD0x00x4000000x4000000x105900x105905.48870x5R E0x1000.init .text .fini .rodata
LOAD0x105900x4115900x4115900x71c0x36784.16860x6RW 0x1000.eh_frame .tbss .ctors .dtors .jcr .data .got .sbss .bss
TLS0x105d40x4115d40x4115d40x00x80.00000x4R 0x4.tbss
GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

Network Behavior

⊘No network behavior found

System Behavior

General

Start time (UTC):06:18:50
Start date (UTC):25/10/2024
Path:/usr/bin/dash
Arguments:-
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities


General

Start time (UTC):06:18:50
Start date (UTC):25/10/2024
Path:/usr/bin/rm
Arguments:rm -f /tmp/tmp.WC8v2L67nm /tmp/tmp.okaodldQhL /tmp/tmp.qkDyzY2OYS
File size:72056 bytes
MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities


General

Start time (UTC):06:18:50
Start date (UTC):25/10/2024
Path:/usr/bin/dash
Arguments:-
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities


General

Start time (UTC):06:18:50
Start date (UTC):25/10/2024
Path:/usr/bin/cat
Arguments:cat /tmp/tmp.WC8v2L67nm
File size:43416 bytes
MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities


General

Start time (UTC):06:18:50
Start date (UTC):25/10/2024
Path:/usr/bin/dash
Arguments:-
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities


General

Start time (UTC):06:18:50
Start date (UTC):25/10/2024
Path:/usr/bin/head
Arguments:head -n 10
File size:47480 bytes
MD5 hash:fd96a67145172477dd57131396fc9608

Chronological Activities


General

Start time (UTC):06:18:50
Start date (UTC):25/10/2024
Path:/usr/bin/dash
Arguments:-
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities


General

Start time (UTC):06:18:50
Start date (UTC):25/10/2024
Path:/usr/bin/tr
Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
File size:51544 bytes
MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

Chronological Activities


General

Start time (UTC):06:18:50
Start date (UTC):25/10/2024
Path:/usr/bin/dash
Arguments:-
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities


General

Start time (UTC):06:18:50
Start date (UTC):25/10/2024
Path:/usr/bin/cut
Arguments:cut -c -80
File size:47480 bytes
MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

Chronological Activities


General

Start time (UTC):06:18:50
Start date (UTC):25/10/2024
Path:/usr/bin/dash
Arguments:-
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities


General

Start time (UTC):06:18:50
Start date (UTC):25/10/2024
Path:/usr/bin/cat
Arguments:cat /tmp/tmp.WC8v2L67nm
File size:43416 bytes
MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities


General

Start time (UTC):06:18:50
Start date (UTC):25/10/2024
Path:/usr/bin/dash
Arguments:-
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities


General

Start time (UTC):06:18:50
Start date (UTC):25/10/2024
Path:/usr/bin/head
Arguments:head -n 10
File size:47480 bytes
MD5 hash:fd96a67145172477dd57131396fc9608

Chronological Activities


General

Start time (UTC):06:18:50
Start date (UTC):25/10/2024
Path:/usr/bin/dash
Arguments:-
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities


General

Start time (UTC):06:18:50
Start date (UTC):25/10/2024
Path:/usr/bin/tr
Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
File size:51544 bytes
MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

Chronological Activities


General

Start time (UTC):06:18:50
Start date (UTC):25/10/2024
Path:/usr/bin/dash
Arguments:-
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities


General

Start time (UTC):06:18:50
Start date (UTC):25/10/2024
Path:/usr/bin/cut
Arguments:cut -c -80
File size:47480 bytes
MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

Chronological Activities


General

Start time (UTC):06:18:50
Start date (UTC):25/10/2024
Path:/usr/bin/dash
Arguments:-
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities


General

Start time (UTC):06:18:50
Start date (UTC):25/10/2024
Path:/usr/bin/rm
Arguments:rm -f /tmp/tmp.WC8v2L67nm /tmp/tmp.okaodldQhL /tmp/tmp.qkDyzY2OYS
File size:72056 bytes
MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities


General

Start time (UTC):06:18:54
Start date (UTC):25/10/2024
Path:/tmp/mips.elf
Arguments:/tmp/mips.elf
File size:5777432 bytes
MD5 hash:0083f1f0e77be34ad27f849842bbb00c

Chronological Activities