Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
ppc.elf

Overview

General Information

Sample name:ppc.elf
Analysis ID:1544028
MD5:fca3a13f964c784e1dd3535c18ba79fd
SHA1:d57cc0ad213106cf015bbd8211715cb6b859dc81
SHA256:501bf20705d8ca8c8fb9c1bfb648cbfb96a67bd775c8b97619752ddaef62f2f1
Tags:elfuser-abuse_ch
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Found strings indicative of a multi-platform dropper
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sleeps for long times indicative of sandbox evasion
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1544028
Start date and time:2024-10-28 18:18:09 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 3s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:ppc.elf
Detection:MAL
Classification:mal56.evad.linELF@0/0@0/0
  • Skipping network analysis since amount of network traffic is too extensive
  • VT rate limit hit for: ppc.elf

Runtime Messages

Command:/tmp/ppc.elf
PID:5549
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
thIs wEek on xLaB lEarNs nOthinG xd
Standard Error:

Process Tree

  • system is lnxubuntu20
  • dash New Fork (PID: 5507, Parent: 3671)
  • rm (PID: 5507, Parent: 3671, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.DM9Q5Mohm1 /tmp/tmp.VC2F28MSxW /tmp/tmp.mkdFGKy59o
  • dash New Fork (PID: 5508, Parent: 3671)
  • cat (PID: 5508, Parent: 3671, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.DM9Q5Mohm1
  • dash New Fork (PID: 5509, Parent: 3671)
  • head (PID: 5509, Parent: 3671, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5510, Parent: 3671)
  • tr (PID: 5510, Parent: 3671, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5511, Parent: 3671)
  • cut (PID: 5511, Parent: 3671, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5512, Parent: 3671)
  • cat (PID: 5512, Parent: 3671, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.DM9Q5Mohm1
  • dash New Fork (PID: 5513, Parent: 3671)
  • head (PID: 5513, Parent: 3671, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5514, Parent: 3671)
  • tr (PID: 5514, Parent: 3671, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5515, Parent: 3671)
  • cut (PID: 5515, Parent: 3671, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5516, Parent: 3671)
  • rm (PID: 5516, Parent: 3671, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.DM9Q5Mohm1 /tmp/tmp.VC2F28MSxW /tmp/tmp.mkdFGKy59o
  • ppc.elf (PID: 5549, Parent: 5440, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/ppc.elf
    • ppc.elf New Fork (PID: 5551, Parent: 5549)
    • ppc.elf New Fork (PID: 5553, Parent: 5549)
    • ppc.elf New Fork (PID: 5578, Parent: 5549)
      • ppc.elf New Fork (PID: 5636, Parent: 5578)
        • ppc.elf New Fork (PID: 5638, Parent: 5636)
      • ppc.elf New Fork (PID: 5644, Parent: 5578)
        • ppc.elf New Fork (PID: 5646, Parent: 5644)
      • ppc.elf New Fork (PID: 5674, Parent: 5578)
        • ppc.elf New Fork (PID: 5676, Parent: 5674)
      • ppc.elf New Fork (PID: 5706, Parent: 5578)
        • ppc.elf New Fork (PID: 5708, Parent: 5706)
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

  • • AV Detection
  • • Spreading
  • • Networking
  • • System Summary
  • • Data Obfuscation
  • • Persistence and Installation Behavior
  • • Hooking and other Techniques for Hiding and Protection
  • • Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: ppc.elfReversingLabs: Detection: 18%
Source: ppc.elfString: ash|login|wget|curl|tftp|ntpdate|ftp
Source: ppc.elfString: /proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/lib//lib64/
Source: /tmp/ppc.elf (PID: 5549)Socket: 127.0.0.1:1234Jump to behavior
Source: ELF static info symbol of initial sample.symtab present: no
Source: /tmp/ppc.elf (PID: 5551)SIGKILL sent: pid: 933, result: successfulJump to behavior
Source: /tmp/ppc.elf (PID: 5638)SIGKILL sent: pid: 5636, result: successfulJump to behavior
Source: /tmp/ppc.elf (PID: 5646)SIGKILL sent: pid: 5644, result: successfulJump to behavior
Source: /tmp/ppc.elf (PID: 5676)SIGKILL sent: pid: 5674, result: successfulJump to behavior
Source: /tmp/ppc.elf (PID: 5708)SIGKILL sent: pid: 5706, result: successfulJump to behavior
Source: classification engineClassification label: mal56.evad.linELF@0/0@0/0

Data Obfuscation

barindex
Source: /tmp/ppc.elf (PID: 5553)File: /etc/configJump to behavior
Source: /tmp/ppc.elf (PID: 5553)Directory: /root/.cacheJump to behavior
Source: /tmp/ppc.elf (PID: 5553)Directory: /root/.sshJump to behavior
Source: /tmp/ppc.elf (PID: 5553)Directory: /root/.configJump to behavior
Source: /tmp/ppc.elf (PID: 5553)Directory: /root/.localJump to behavior
Source: /tmp/ppc.elf (PID: 5553)Directory: /tmp/.X11-unixJump to behavior
Source: /tmp/ppc.elf (PID: 5553)Directory: /tmp/.Test-unixJump to behavior
Source: /tmp/ppc.elf (PID: 5553)Directory: /tmp/.font-unixJump to behavior
Source: /tmp/ppc.elf (PID: 5553)Directory: /tmp/.ICE-unixJump to behavior
Source: /tmp/ppc.elf (PID: 5553)Directory: /tmp/.XIM-unixJump to behavior
Source: /tmp/ppc.elf (PID: 5553)Directory: /etc/.javaJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/110/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/231/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/111/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/112/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/233/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/113/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/114/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/235/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/115/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/116/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/117/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/118/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/119/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/911/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/914/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/10/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/917/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/11/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/12/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/13/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/14/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/15/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/16/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/17/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/18/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/19/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/120/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/121/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/1/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/122/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/243/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/2/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/123/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/3/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/124/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/125/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/4/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/246/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/126/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/5/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/127/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/6/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/128/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/7/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/129/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/8/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/800/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/9/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/802/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/803/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/804/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/20/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/21/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/22/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/23/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/24/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/25/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/26/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/27/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/28/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/29/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/490/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/250/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/130/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/251/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/131/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/132/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/133/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/378/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/258/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/259/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/931/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/812/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/933/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/30/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/35/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/260/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/261/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/262/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/142/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/263/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/264/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/265/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/145/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/266/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/267/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/268/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/269/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/270/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/271/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/272/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/273/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/274/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/275/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/276/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/277/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/278/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/279/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/158/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/280/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/281/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/282/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/283/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/284/fdJump to behavior
Source: /tmp/ppc.elf (PID: 5551)File opened: /proc/285/fdJump to behavior
Source: /usr/bin/dash (PID: 5507)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.DM9Q5Mohm1 /tmp/tmp.VC2F28MSxW /tmp/tmp.mkdFGKy59oJump to behavior
Source: /usr/bin/dash (PID: 5516)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.DM9Q5Mohm1 /tmp/tmp.VC2F28MSxW /tmp/tmp.mkdFGKy59oJump to behavior

Hooking and other Techniques for Hiding and Protection

barindex
Source: /tmp/ppc.elf (PID: 5553)Log files deleted: /var/log/kern.logJump to behavior
Source: /tmp/ppc.elf (PID: 5638)Sleeps longer then 60s: 60.0sJump to behavior
Source: /tmp/ppc.elf (PID: 5676)Sleeps longer then 60s: 60.0sJump to behavior
Source: /tmp/ppc.elf (PID: 5708)Sleeps longer then 60s: 60.0sJump to behavior
Source: /tmp/ppc.elf (PID: 5549)Queries kernel information via 'uname': Jump to behavior
Source: ppc.elf, 5549.1.000055ffa092e000.000055ffa09de000.rw-.sdmp, ppc.elf, 5636.1.000055ffa092e000.000055ffa09de000.rw-.sdmp, ppc.elf, 5638.1.000055ffa092e000.000055ffa09de000.rw-.sdmp, ppc.elf, 5644.1.000055ffa092e000.000055ffa09de000.rw-.sdmp, ppc.elf, 5646.1.000055ffa092e000.000055ffa09de000.rw-.sdmp, ppc.elf, 5674.1.000055ffa092e000.000055ffa09de000.rw-.sdmp, ppc.elf, 5676.1.000055ffa092e000.000055ffa09de000.rw-.sdmp, ppc.elf, 5706.1.000055ffa092e000.000055ffa09de000.rw-.sdmp, ppc.elf, 5708.1.000055ffa092e000.000055ffa09de000.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc1
Source: ppc.elf, 5549.1.00007fffde895000.00007fffde8b6000.rw-.sdmp, ppc.elf, 5636.1.00007fffde895000.00007fffde8b6000.rw-.sdmp, ppc.elf, 5638.1.00007fffde895000.00007fffde8b6000.rw-.sdmp, ppc.elf, 5644.1.00007fffde895000.00007fffde8b6000.rw-.sdmp, ppc.elf, 5646.1.00007fffde895000.00007fffde8b6000.rw-.sdmp, ppc.elf, 5674.1.00007fffde895000.00007fffde8b6000.rw-.sdmp, ppc.elf, 5676.1.00007fffde895000.00007fffde8b6000.rw-.sdmp, ppc.elf, 5706.1.00007fffde895000.00007fffde8b6000.rw-.sdmp, ppc.elf, 5708.1.00007fffde895000.00007fffde8b6000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-ppc/tmp/ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ppc.elf
Source: ppc.elf, 5549.1.000055ffa092e000.000055ffa09de000.rw-.sdmp, ppc.elf, 5636.1.000055ffa092e000.000055ffa09de000.rw-.sdmp, ppc.elf, 5638.1.000055ffa092e000.000055ffa09de000.rw-.sdmp, ppc.elf, 5644.1.000055ffa092e000.000055ffa09de000.rw-.sdmp, ppc.elf, 5646.1.000055ffa092e000.000055ffa09de000.rw-.sdmp, ppc.elf, 5674.1.000055ffa092e000.000055ffa09de000.rw-.sdmp, ppc.elf, 5676.1.000055ffa092e000.000055ffa09de000.rw-.sdmp, ppc.elf, 5706.1.000055ffa092e000.000055ffa09de000.rw-.sdmp, ppc.elf, 5708.1.000055ffa092e000.000055ffa09de000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/ppc
Source: ppc.elf, 5549.1.00007fffde895000.00007fffde8b6000.rw-.sdmp, ppc.elf, 5636.1.00007fffde895000.00007fffde8b6000.rw-.sdmp, ppc.elf, 5638.1.00007fffde895000.00007fffde8b6000.rw-.sdmp, ppc.elf, 5644.1.00007fffde895000.00007fffde8b6000.rw-.sdmp, ppc.elf, 5646.1.00007fffde895000.00007fffde8b6000.rw-.sdmp, ppc.elf, 5674.1.00007fffde895000.00007fffde8b6000.rw-.sdmp, ppc.elf, 5676.1.00007fffde895000.00007fffde8b6000.rw-.sdmp, ppc.elf, 5706.1.00007fffde895000.00007fffde8b6000.rw-.sdmp, ppc.elf, 5708.1.00007fffde895000.00007fffde8b6000.rw-.sdmpBinary or memory string: /usr/bin/qemu-ppc

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting		Valid AccountsWindows Management Instrumentation1
Scripting		Path Interception1
Virtualization/Sandbox Evasion		1
OS Credential Dumping		11
Security Software Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Hidden Files and Directories		LSASS Memory1
Virtualization/Sandbox Evasion		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Indicator Removal		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
File Deletion		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1544028 Sample: ppc.elf Startdate: 28/10/2024 Architecture: LINUX Score: 56 43 Multi AV Scanner detection for submitted file 2->43 8 dash rm ppc.elf 2->8         started        10 dash rm 2->10         started        12 dash cat 2->12         started        14 7 other processes 2->14 process3 process4 16 ppc.elf 8->16         started        19 ppc.elf 8->19         started        21 ppc.elf 8->21         started        signatures5 39 Sample tries to access files in /etc/config/ (typical for OpenWRT routers) 16->39 41 Deletes system log files 16->41 23 ppc.elf 19->23         started        25 ppc.elf 19->25         started        27 ppc.elf 19->27         started        29 ppc.elf 19->29         started        process6 process7 31 ppc.elf 23->31         started        33 ppc.elf 25->33         started        35 ppc.elf 27->35         started        37 ppc.elf 29->37         started       

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
ppc.elf18%ReversingLabsLinux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
Entropy (8bit):6.067815872102156
TrID:
  • ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:ppc.elf
File size:59'788 bytes
MD5:fca3a13f964c784e1dd3535c18ba79fd
SHA1:d57cc0ad213106cf015bbd8211715cb6b859dc81
SHA256:501bf20705d8ca8c8fb9c1bfb648cbfb96a67bd775c8b97619752ddaef62f2f1
SHA512:737e539c223504876ecd93cc5bd9486ab2e28b7092a7d2d73c0f51fc7bc78760f89e3e4955d2c80b42aa043d8a68609b7a6ad87129e0fb8ffba115bb03607957
SSDEEP:1536:7xAQIVDLZOROw9U9mJQKa44N4qBBRGsg5L:GQiDLZ9Uir44vR/g5L
TLSH:C3431942721C0943C1661EF0363B17E0D3ABAAD222E4F388765F6B4AD1B1E376545EDE
File Content Preview:.ELF...........................4.........4. ...(.......................................................h..E.........dt.Q.............................!..|......$H...H..)...$8!. |...N.. .!..|.......?.............../...@..\?........+../...A..$8...})......N..

Static ELF Info

ELF header

Class:ELF32
Data:2's complement, big endian
Version:1 (current)
Machine:PowerPC
Version Number:0x1
Type:EXEC (Executable file)
OS/ABI:UNIX - System V
ABI Version:0
Entry Point Address:0x100001f0
Flags:0x0
ELF Header Size:52
Program Header Offset:52
Program Header Size:32
Number of Program Headers:3
Section Header Offset:59308
Section Header Size:40
Number of Section Headers:12
Header String Table Index:11

Sections

NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
NULL0x00x00x00x00x0000
.initPROGBITS0x100000940x940x240x00x6AX004
.textPROGBITS0x100000b80xb80xd1800x00x6AX004
.finiPROGBITS0x1000d2380xd2380x200x00x6AX004
.rodataPROGBITS0x1000d2580xd2580x119c0x00x2A004
.ctorsPROGBITS0x1001e3f80xe3f80x80x00x3WA004
.dtorsPROGBITS0x1001e4000xe4000x80x00x3WA004
.dataPROGBITS0x1001e4100xe4100x3340x00x3WA008
.sdataPROGBITS0x1001e7440xe7440x1c0x00x3WA004
.sbssNOBITS0x1001e7600xe7600x800x00x3WA004
.bssNOBITS0x1001e7e00xe7600x41dc0x00x3WA004
.shstrtabSTRTAB0x00xe7600x4b0x00x0001

Program Segments

TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
LOAD0x00x100000000x100000000xe3f40xe3f46.10420x5R E0x10000.init .text .fini .rodata
LOAD0xe3f80x1001e3f80x1001e3f80x3680x45c43.84540x6RW 0x10000.ctors .dtors .data .sdata .sbss .bss
GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

Network Behavior

⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

System Behavior

General

Start time (UTC):17:18:52
Start date (UTC):28/10/2024
Path:/usr/bin/dash
Arguments:-
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Process Activities


General

Start time (UTC):17:18:52
Start date (UTC):28/10/2024
Path:/usr/bin/rm
Arguments:rm -f /tmp/tmp.DM9Q5Mohm1 /tmp/tmp.VC2F28MSxW /tmp/tmp.mkdFGKy59o
File size:72056 bytes
MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

File Activities


General

Start time (UTC):17:18:52
Start date (UTC):28/10/2024
Path:/usr/bin/dash
Arguments:-
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Process Activities


General

Start time (UTC):17:18:52
Start date (UTC):28/10/2024
Path:/usr/bin/cat
Arguments:cat /tmp/tmp.DM9Q5Mohm1
File size:43416 bytes
MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

File Activities


General

Start time (UTC):17:18:52
Start date (UTC):28/10/2024
Path:/usr/bin/dash
Arguments:-
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Process Activities


General

Start time (UTC):17:18:52
Start date (UTC):28/10/2024
Path:/usr/bin/head
Arguments:head -n 10
File size:47480 bytes
MD5 hash:fd96a67145172477dd57131396fc9608

File Activities


General

Start time (UTC):17:18:52
Start date (UTC):28/10/2024
Path:/usr/bin/dash
Arguments:-
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Process Activities


General

Start time (UTC):17:18:52
Start date (UTC):28/10/2024
Path:/usr/bin/tr
Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
File size:51544 bytes
MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

File Activities


General

Start time (UTC):17:18:52
Start date (UTC):28/10/2024
Path:/usr/bin/dash
Arguments:-
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Process Activities


General

Start time (UTC):17:18:52
Start date (UTC):28/10/2024
Path:/usr/bin/cut
Arguments:cut -c -80
File size:47480 bytes
MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

File Activities


General

Start time (UTC):17:18:52
Start date (UTC):28/10/2024
Path:/usr/bin/dash
Arguments:-
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Process Activities


General

Start time (UTC):17:18:52
Start date (UTC):28/10/2024
Path:/usr/bin/cat
Arguments:cat /tmp/tmp.DM9Q5Mohm1
File size:43416 bytes
MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

File Activities


General

Start time (UTC):17:18:52
Start date (UTC):28/10/2024
Path:/usr/bin/dash
Arguments:-
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Process Activities


General

Start time (UTC):17:18:52
Start date (UTC):28/10/2024
Path:/usr/bin/head
Arguments:head -n 10
File size:47480 bytes
MD5 hash:fd96a67145172477dd57131396fc9608

File Activities


General

Start time (UTC):17:18:52
Start date (UTC):28/10/2024
Path:/usr/bin/dash
Arguments:-
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Process Activities


General

Start time (UTC):17:18:52
Start date (UTC):28/10/2024
Path:/usr/bin/tr
Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
File size:51544 bytes
MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

File Activities


General

Start time (UTC):17:18:52
Start date (UTC):28/10/2024
Path:/usr/bin/dash
Arguments:-
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Process Activities


General

Start time (UTC):17:18:52
Start date (UTC):28/10/2024
Path:/usr/bin/cut
Arguments:cut -c -80
File size:47480 bytes
MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

File Activities


General

Start time (UTC):17:18:52
Start date (UTC):28/10/2024
Path:/usr/bin/dash
Arguments:-
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Process Activities


General

Start time (UTC):17:18:52
Start date (UTC):28/10/2024
Path:/usr/bin/rm
Arguments:rm -f /tmp/tmp.DM9Q5Mohm1 /tmp/tmp.VC2F28MSxW /tmp/tmp.mkdFGKy59o
File size:72056 bytes
MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

File Activities


General

Start time (UTC):17:18:56
Start date (UTC):28/10/2024
Path:/tmp/ppc.elf
Arguments:/tmp/ppc.elf
File size:5388968 bytes
MD5 hash:ae65271c943d3451b7f026d1fadccea6

File Activities

Process Activities

System Activities

Network Activities


General

Start time (UTC):17:18:56
Start date (UTC):28/10/2024
Path:/tmp/ppc.elf
Arguments:-
File size:5388968 bytes
MD5 hash:ae65271c943d3451b7f026d1fadccea6

File Activities

Process Activities


General

Start time (UTC):17:18:56
Start date (UTC):28/10/2024
Path:/tmp/ppc.elf
Arguments:-
File size:5388968 bytes
MD5 hash:ae65271c943d3451b7f026d1fadccea6

File Activities

Process Activities


General

Start time (UTC):17:18:56
Start date (UTC):28/10/2024
Path:/tmp/ppc.elf
Arguments:-
File size:5388968 bytes
MD5 hash:ae65271c943d3451b7f026d1fadccea6

Process Activities

Network Activities


General

Start time (UTC):17:19:22
Start date (UTC):28/10/2024
Path:/tmp/ppc.elf
Arguments:-
File size:5388968 bytes
MD5 hash:ae65271c943d3451b7f026d1fadccea6

Process Activities


General

Start time (UTC):17:19:22
Start date (UTC):28/10/2024
Path:/tmp/ppc.elf
Arguments:-
File size:5388968 bytes
MD5 hash:ae65271c943d3451b7f026d1fadccea6

Process Activities


General

Start time (UTC):17:19:25
Start date (UTC):28/10/2024
Path:/tmp/ppc.elf
Arguments:-
File size:5388968 bytes
MD5 hash:ae65271c943d3451b7f026d1fadccea6

Process Activities

Network Activities


General

Start time (UTC):17:19:25
Start date (UTC):28/10/2024
Path:/tmp/ppc.elf
Arguments:-
File size:5388968 bytes
MD5 hash:ae65271c943d3451b7f026d1fadccea6

Process Activities


General

Start time (UTC):17:20:22
Start date (UTC):28/10/2024
Path:/tmp/ppc.elf
Arguments:-
File size:5388968 bytes
MD5 hash:ae65271c943d3451b7f026d1fadccea6

Process Activities

Network Activities


General

Start time (UTC):17:20:22
Start date (UTC):28/10/2024
Path:/tmp/ppc.elf
Arguments:-
File size:5388968 bytes
MD5 hash:ae65271c943d3451b7f026d1fadccea6

Process Activities


General

Start time (UTC):17:21:22
Start date (UTC):28/10/2024
Path:/tmp/ppc.elf
Arguments:-
File size:5388968 bytes
MD5 hash:ae65271c943d3451b7f026d1fadccea6

Process Activities

Network Activities


General

Start time (UTC):17:21:22
Start date (UTC):28/10/2024
Path:/tmp/ppc.elf
Arguments:-
File size:5388968 bytes
MD5 hash:ae65271c943d3451b7f026d1fadccea6

Process Activities