Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
8dhSBwxpzf.elf

Overview

General Information

Sample name:8dhSBwxpzf.elf
renamed because original name is a hash value
Original sample name:435524efacb1795b81089ee8f43472a1.elf
Analysis ID:1427869
MD5:435524efacb1795b81089ee8f43472a1
SHA1:67328f73218f033afed8f8cb8a6361154503f7b9
SHA256:96e842da98b7f1596bcc1fb59132173f8c0dde2f6413cc7393e535d84dd6e0f6
Tags:32elfmiraipowerpc
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1427869
Start date and time:2024-04-18 09:50:40 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 30s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:8dhSBwxpzf.elf
renamed because original name is a hash value
Original Sample Name:435524efacb1795b81089ee8f43472a1.elf
Detection:MAL
Classification:mal56.linELF@0/0@0/0

Warnings

  • VT rate limit hit for: 8dhSBwxpzf.elf

Runtime Messages

Command:/tmp/8dhSBwxpzf.elf
PID:5436
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
DaddyL33T Infected Your Shit
Standard Error:

Process Tree

  • system is lnxubuntu20
  • cleanup

Yara Signatures

⊘No yara matches

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: 8dhSBwxpzf.elfAvira: detected
Multi AV Scanner detection for submitted file
Source: 8dhSBwxpzf.elfReversingLabs: Detection: 65%
Source: global trafficTCP traffic: 192.168.2.13:45218 -> 92.249.48.17:666
Source: unknownTCP traffic detected without corresponding DNS query: 92.249.48.17
Source: unknownTCP traffic detected without corresponding DNS query: 92.249.48.17
Source: unknownTCP traffic detected without corresponding DNS query: 92.249.48.17
Source: unknownTCP traffic detected without corresponding DNS query: 92.249.48.17
Source: unknownTCP traffic detected without corresponding DNS query: 92.249.48.17
Source: unknownTCP traffic detected without corresponding DNS query: 92.249.48.17
Source: unknownTCP traffic detected without corresponding DNS query: 92.249.48.17
Source: unknownTCP traffic detected without corresponding DNS query: 92.249.48.17
Source: unknownTCP traffic detected without corresponding DNS query: 92.249.48.17
Source: unknownTCP traffic detected without corresponding DNS query: 92.249.48.17
Source: unknownTCP traffic detected without corresponding DNS query: 92.249.48.17
Source: unknownTCP traffic detected without corresponding DNS query: 92.249.48.17
Source: unknownTCP traffic detected without corresponding DNS query: 92.249.48.17
Source: unknownTCP traffic detected without corresponding DNS query: 92.249.48.17
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal56.linELF@0/0@0/0
Source: /tmp/8dhSBwxpzf.elf (PID: 5436)Queries kernel information via 'uname': Jump to behavior
Source: 8dhSBwxpzf.elf, 5436.1.000055cd2709c000.000055cd2714c000.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: 8dhSBwxpzf.elf, 5438.1.000055cd2709c000.000055cd2714c000.rw-.sdmp, 8dhSBwxpzf.elf, 5442.1.000055cd2709c000.000055cd2714c000.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc1
Source: 8dhSBwxpzf.elf, 5436.1.000055cd2709c000.000055cd2714c000.rw-.sdmp, 8dhSBwxpzf.elf, 5438.1.000055cd2709c000.000055cd2714c000.rw-.sdmp, 8dhSBwxpzf.elf, 5442.1.000055cd2709c000.000055cd2714c000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/ppc
Source: 8dhSBwxpzf.elf, 5436.1.00007ffed9c1a000.00007ffed9c3b000.rw-.sdmp, 8dhSBwxpzf.elf, 5438.1.00007ffed9c1a000.00007ffed9c3b000.rw-.sdmp, 8dhSBwxpzf.elf, 5442.1.00007ffed9c1a000.00007ffed9c3b000.rw-.sdmpBinary or memory string: /usr/bin/qemu-ppc
Source: 8dhSBwxpzf.elf, 5436.1.00007ffed9c1a000.00007ffed9c3b000.rw-.sdmp, 8dhSBwxpzf.elf, 5438.1.00007ffed9c1a000.00007ffed9c3b000.rw-.sdmp, 8dhSBwxpzf.elf, 5442.1.00007ffed9c1a000.00007ffed9c3b000.rw-.sdmpBinary or memory string: K<x86_64/usr/bin/qemu-ppc/tmp/8dhSBwxpzf.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/8dhSBwxpzf.elf

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
Security Software Discovery		Remote ServicesData from Local System1
Non-Standard Port		Exfiltration Over Other Network MediumAbuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1427869 Sample: 8dhSBwxpzf.elf Startdate: 18/04/2024 Architecture: LINUX Score: 56 16 92.249.48.17, 45218, 666 M247GB Germany 2->16 18 Antivirus / Scanner detection for submitted sample 2->18 20 Multi AV Scanner detection for submitted file 2->20 8 8dhSBwxpzf.elf 2->8         started        signatures3 process4 process5 10 8dhSBwxpzf.elf 8->10         started        12 8dhSBwxpzf.elf 8->12         started        process6 14 8dhSBwxpzf.elf 10->14         started       

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
8dhSBwxpzf.elf66%ReversingLabsLinux.Trojan.Mirai
8dhSBwxpzf.elf100%AviraEXP/ELF.Mirai.T

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
92.249.48.17
unknownGermany
9009M247GBfalse

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
92.249.48.17ymzHFTCnUn.elfGet hashmaliciousUnknownBrowse
    kEwJ0hAwcD.elfGet hashmaliciousUnknownBrowse
      2NNsDEOsQD.elfGet hashmaliciousUnknownBrowse
        KXS94lE3oM.elfGet hashmaliciousUnknownBrowse

          Domains

          ⊘No context

          ASNs

          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          M247GBymzHFTCnUn.elfGet hashmaliciousUnknownBrowse
          • 92.249.48.17
          kEwJ0hAwcD.elfGet hashmaliciousUnknownBrowse
          • 92.249.48.17
          2NNsDEOsQD.elfGet hashmaliciousUnknownBrowse
          • 92.249.48.17
          KXS94lE3oM.elfGet hashmaliciousUnknownBrowse
          • 92.249.48.17
          jLntRRok3B.elfGet hashmaliciousMiraiBrowse
          • 161.123.252.205
          KFGhPSUn9z.elfGet hashmaliciousMiraiBrowse
          • 198.100.166.109
          DETAILS.docx.docGet hashmaliciousRemcosBrowse
          • 194.187.251.115
          LZazJikRId.exeGet hashmaliciousAsyncRATBrowse
          • 172.111.216.199
          bUAB.exeGet hashmaliciousAsyncRAT, DcRatBrowse
          • 172.94.39.213
          2jQHythw1E.elfGet hashmaliciousMiraiBrowse
          • 38.203.241.133

          JA3 Fingerprints

          ⊘No context

          Dropped Files

          ⊘No context

          Created / dropped Files

          ⊘No created / dropped files found

          Static File Info

          General

          File type:ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
          Entropy (8bit):6.143634035782867
          TrID:
          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
          File name:8dhSBwxpzf.elf
          File size:52'520 bytes
          MD5:435524efacb1795b81089ee8f43472a1
          SHA1:67328f73218f033afed8f8cb8a6361154503f7b9
          SHA256:96e842da98b7f1596bcc1fb59132173f8c0dde2f6413cc7393e535d84dd6e0f6
          SHA512:248134557ecc5971a520a66ee1d6c56a791fe72279989142edbc9a04950eb6942d7b6c723a58f760d30193d995c0f4f8aaff13b0f5ad93018a20bd3b5a4c3c6a
          SSDEEP:768:lMn8HKGGU7R5Y0SRRf/RH8T1vsmqzmiMhty0sG2usMmdTBof4X4/:L7mjaT1kmoY9pmdTwyU
          TLSH:C7332B42323C0E5FC5B35670253F96E083FBA96534E4BA88255F9B668A35D3B1089FCD
          File Content Preview:.ELF...........................4...H.....4. ...(.......................................................,...X........dt.Q.............................!..|......$H...H..-...$8!. |...N.. .!..|.......?..........D..../...@..\?........+../...A..$8...})......N..

          Static ELF Info

          ELF header

          Class:ELF32
          Data:2's complement, big endian
          Version:1 (current)
          Machine:PowerPC
          Version Number:0x1
          Type:EXEC (Executable file)
          OS/ABI:UNIX - System V
          ABI Version:0
          Entry Point Address:0x100001f0
          Flags:0x0
          ELF Header Size:52
          Program Header Offset:52
          Program Header Size:32
          Number of Program Headers:3
          Section Header Offset:52040
          Section Header Size:40
          Number of Section Headers:12
          Header String Table Index:11

          Sections

          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
          NULL0x00x00x00x00x0000
          .initPROGBITS0x100000940x940x240x00x6AX004
          .textPROGBITS0x100000b80xb80xb6840x00x6AX004
          .finiPROGBITS0x1000b73c0xb73c0x200x00x6AX004
          .rodataPROGBITS0x1000b75c0xb75c0x11700x00x2A004
          .ctorsPROGBITS0x1001c8d00xc8d00x80x00x3WA004
          .dtorsPROGBITS0x1001c8d80xc8d80x80x00x3WA004
          .dataPROGBITS0x1001c8e80xc8e80x1f40x00x3WA008
          .sdataPROGBITS0x1001cadc0xcadc0x200x00x3WA004
          .sbssNOBITS0x1001cafc0xcafc0x480x00x3WA004
          .bssNOBITS0x1001cb440xcafc0x1e40x00x3WA004
          .shstrtabSTRTAB0x00xcafc0x4b0x00x0001

          Program Segments

          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
          LOAD0x00x100000000x100000000xc8cc0xc8cc6.18470x5R E0x10000.init .text .fini .rodata
          LOAD0xc8d00x1001c8d00x1001c8d00x22c0x4583.03170x6RW 0x10000.ctors .dtors .data .sdata .sbss .bss
          GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

          Network Behavior

          Network Port Distribution

          TCP Packets

          TimestampSource PortDest PortSource IPDest IP
          Apr 18, 2024 09:51:21.130086899 CEST45218666192.168.2.1392.249.48.17
          Apr 18, 2024 09:51:21.338820934 CEST6664521892.249.48.17192.168.2.13
          Apr 18, 2024 09:51:21.338903904 CEST45218666192.168.2.1392.249.48.17
          Apr 18, 2024 09:51:21.339190960 CEST45218666192.168.2.1392.249.48.17
          Apr 18, 2024 09:51:21.547409058 CEST6664521892.249.48.17192.168.2.13
          Apr 18, 2024 09:51:21.547503948 CEST45218666192.168.2.1392.249.48.17
          Apr 18, 2024 09:51:21.755845070 CEST6664521892.249.48.17192.168.2.13
          Apr 18, 2024 09:51:31.347635031 CEST45218666192.168.2.1392.249.48.17
          Apr 18, 2024 09:51:31.556186914 CEST6664521892.249.48.17192.168.2.13
          Apr 18, 2024 09:51:31.556219101 CEST6664521892.249.48.17192.168.2.13
          Apr 18, 2024 09:51:31.556427002 CEST45218666192.168.2.1392.249.48.17
          Apr 18, 2024 09:51:46.780122042 CEST6664521892.249.48.17192.168.2.13
          Apr 18, 2024 09:51:46.780292034 CEST45218666192.168.2.1392.249.48.17
          Apr 18, 2024 09:51:58.425885916 CEST3721543008197.6.199.246192.168.2.13
          Apr 18, 2024 09:52:01.988059998 CEST6664521892.249.48.17192.168.2.13
          Apr 18, 2024 09:52:01.988614082 CEST45218666192.168.2.1392.249.48.17
          Apr 18, 2024 09:52:17.195946932 CEST6664521892.249.48.17192.168.2.13
          Apr 18, 2024 09:52:17.196074963 CEST45218666192.168.2.1392.249.48.17
          Apr 18, 2024 09:52:31.613521099 CEST45218666192.168.2.1392.249.48.17
          Apr 18, 2024 09:52:31.822217941 CEST6664521892.249.48.17192.168.2.13
          Apr 18, 2024 09:52:31.822385073 CEST45218666192.168.2.1392.249.48.17
          Apr 18, 2024 09:52:47.068758011 CEST6664521892.249.48.17192.168.2.13
          Apr 18, 2024 09:52:47.068922043 CEST45218666192.168.2.1392.249.48.17
          Apr 18, 2024 09:53:02.278841019 CEST6664521892.249.48.17192.168.2.13
          Apr 18, 2024 09:53:02.279017925 CEST45218666192.168.2.1392.249.48.17
          Apr 18, 2024 09:53:17.487061024 CEST6664521892.249.48.17192.168.2.13
          Apr 18, 2024 09:53:17.487224102 CEST45218666192.168.2.1392.249.48.17

          System Behavior

          General

          Start time (UTC):07:51:20
          Start date (UTC):18/04/2024
          Path:/tmp/8dhSBwxpzf.elf
          Arguments:/tmp/8dhSBwxpzf.elf
          File size:5388968 bytes
          MD5 hash:ae65271c943d3451b7f026d1fadccea6

          Chronological Activities


          General

          Start time (UTC):07:51:20
          Start date (UTC):18/04/2024
          Path:/tmp/8dhSBwxpzf.elf
          Arguments:-
          File size:5388968 bytes
          MD5 hash:ae65271c943d3451b7f026d1fadccea6

          Chronological Activities


          General

          Start time (UTC):07:51:20
          Start date (UTC):18/04/2024
          Path:/tmp/8dhSBwxpzf.elf
          Arguments:-
          File size:5388968 bytes
          MD5 hash:ae65271c943d3451b7f026d1fadccea6

          Chronological Activities


          General

          Start time (UTC):07:51:20
          Start date (UTC):18/04/2024
          Path:/tmp/8dhSBwxpzf.elf
          Arguments:-
          File size:5388968 bytes
          MD5 hash:ae65271c943d3451b7f026d1fadccea6

          Chronological Activities