Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
yI52EULGv3.elf

Overview

General Information

Sample name:yI52EULGv3.elf
renamed because original name is a hash value
Original sample name:fff941174b72a89e35fe36d85ec4bb96.elf
Analysis ID:1431014
MD5:fff941174b72a89e35fe36d85ec4bb96
SHA1:3535d4a54bae39e4d3088d0d7b19ae7fc2b9c61a
SHA256:6a50f310a5ea0865540e663d7dcb638811866ee537bd60cfdc4a45afae9a998d
Tags:32elfmiraimotorola
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Detected TCP or UDP traffic on non-standard ports
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Sample has stripped symbol table
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Sets full permissions to files and/or directories
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
Non-zero exit code suggests an error during the execution. Lookup the error code for hints.

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1431014
Start date and time:2024-04-24 13:21:09 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 11s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:yI52EULGv3.elf
renamed because original name is a hash value
Original Sample Name:fff941174b72a89e35fe36d85ec4bb96.elf
Detection:MAL
Classification:mal48.linELF@0/0@0/0

Warnings

  • Connection to analysis system has been lost, crash info: Unknown

Runtime Messages

Command:/tmp/yI52EULGv3.elf
PID:5513
Exit Code:1
Exit Code Info:
Killed:False
Standard Output:
GOLDFISHGANG
Standard Error:

Process Tree

  • system is lnxubuntu20
  • yI52EULGv3.elf (PID: 5513, Parent: 5431, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/yI52EULGv3.elf
    • yI52EULGv3.elf New Fork (PID: 5515, Parent: 5513)
      • yI52EULGv3.elf New Fork (PID: 5517, Parent: 5515)
        • sh (PID: 5519, Parent: 5517, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mkdir /tuqrq95kgq/ && >/tuqrq95kgq/tuqrq95kgq && cd /tuqrq95kgq/ >/dev/null"
          • sh New Fork (PID: 5521, Parent: 5519)
          • mkdir (PID: 5521, Parent: 5519, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir /tuqrq95kgq/
        • sh (PID: 5522, Parent: 5517, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /tmp/yI52EULGv3.elf /tuqrq95kgq/tuqrq95kgq && chmod 777 /tuqrq95kgq/tuqrq95kgq >/dev/null"
          • sh New Fork (PID: 5524, Parent: 5522)
          • mv (PID: 5524, Parent: 5522, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /tmp/yI52EULGv3.elf /tuqrq95kgq/tuqrq95kgq
          • sh New Fork (PID: 5525, Parent: 5522)
          • chmod (PID: 5525, Parent: 5522, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 /tuqrq95kgq/tuqrq95kgq
  • cleanup

Yara Signatures

⊘No yara matches

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: yI52EULGv3.elfVirustotal: Detection: 43%Perma Link
Source: global trafficTCP traffic: 192.168.2.14:37030 -> 94.156.71.75:5683
Source: unknownTCP traffic detected without corresponding DNS query: 94.156.71.75
Source: unknownTCP traffic detected without corresponding DNS query: 94.156.71.75
Source: unknownTCP traffic detected without corresponding DNS query: 94.156.71.75
Source: unknownTCP traffic detected without corresponding DNS query: 94.156.71.75
Source: unknownTCP traffic detected without corresponding DNS query: 94.156.71.75
Source: ELF static info symbol of initial sample.symtab present: no
Source: /tmp/yI52EULGv3.elf (PID: 5517)SIGKILL sent: pid: 0 (kernel), result: unknownJump to behavior
Source: classification engineClassification label: mal48.linELF@0/0@0/0
Source: /tmp/yI52EULGv3.elf (PID: 5519)Shell command executed: sh -c "mkdir /tuqrq95kgq/ && >/tuqrq95kgq/tuqrq95kgq && cd /tuqrq95kgq/ >/dev/null"Jump to behavior
Source: /tmp/yI52EULGv3.elf (PID: 5522)Shell command executed: sh -c "mv /tmp/yI52EULGv3.elf /tuqrq95kgq/tuqrq95kgq && chmod 777 /tuqrq95kgq/tuqrq95kgq >/dev/null"Jump to behavior
Source: /bin/sh (PID: 5525)Chmod executable: /usr/bin/chmod -> chmod 777 /tuqrq95kgq/tuqrq95kgqJump to behavior
Source: /bin/sh (PID: 5521)Mkdir executable: /usr/bin/mkdir -> mkdir /tuqrq95kgq/Jump to behavior
Source: /usr/bin/chmod (PID: 5525)File: /tuqrq95kgq/tuqrq95kgq (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
Source: /bin/sh (PID: 5525)Chmod executable with 777: /usr/bin/chmod -> chmod 777 /tuqrq95kgq/tuqrq95kgqJump to behavior
Source: /tmp/yI52EULGv3.elf (PID: 5513)Queries kernel information via 'uname': Jump to behavior
Source: yI52EULGv3.elf, 5513.1.000055700709b000.0000557007120000.rw-.sdmp, yI52EULGv3.elf, 5515.1.000055700709b000.00005570070ff000.rw-.sdmp, yI52EULGv3.elf, 5517.1.000055700709b000.00005570070ff000.rw-.sdmpBinary or memory string: pU!/etc/qemu-binfmt/m68k
Source: yI52EULGv3.elf, 5513.1.00007ffca8860000.00007ffca8881000.rw-.sdmp, yI52EULGv3.elf, 5515.1.00007ffca8860000.00007ffca8881000.rw-.sdmp, yI52EULGv3.elf, 5517.1.00007ffca8860000.00007ffca8881000.rw-.sdmpBinary or memory string: /usr/bin/qemu-m68k
Source: yI52EULGv3.elf, 5513.1.000055700709b000.0000557007120000.rw-.sdmp, yI52EULGv3.elf, 5515.1.000055700709b000.00005570070ff000.rw-.sdmp, yI52EULGv3.elf, 5517.1.000055700709b000.00005570070ff000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/m68k
Source: yI52EULGv3.elf, 5513.1.00007ffca8860000.00007ffca8881000.rw-.sdmp, yI52EULGv3.elf, 5515.1.00007ffca8860000.00007ffca8881000.rw-.sdmp, yI52EULGv3.elf, 5517.1.00007ffca8860000.00007ffca8881000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-m68k/tmp/yI52EULGv3.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/yI52EULGv3.elf

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting		Valid AccountsWindows Management Instrumentation1
Scripting		Path Interception2
File and Directory Permissions Modification		OS Credential Dumping11
Security Software Discovery		Remote ServicesData from Local System1
Non-Standard Port		Exfiltration Over Other Network MediumAbuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1431014 Sample: yI52EULGv3.elf Startdate: 24/04/2024 Architecture: LINUX Score: 48 26 94.156.71.75, 37030, 5683 TERASYST-ASBG Bulgaria 2->26 28 Multi AV Scanner detection for submitted file 2->28 10 yI52EULGv3.elf 2->10         started        signatures3 process4 process5 12 yI52EULGv3.elf 10->12         started        process6 14 yI52EULGv3.elf 12->14         started        process7 16 yI52EULGv3.elf sh 14->16         started        18 yI52EULGv3.elf sh 14->18         started        process8 20 sh mv 16->20         started        22 sh chmod 16->22         started        24 sh mkdir 18->24         started       

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
yI52EULGv3.elf44%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
94.156.71.75
unknownBulgaria
31420TERASYST-ASBGfalse

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
TERASYST-ASBGReceipt_681002.exeGet hashmaliciousAgentTesla, AsyncRAT, PureLog StealerBrowse
  • 94.156.65.181
XCN5xgaiac.exeGet hashmaliciousLokibotBrowse
  • 94.156.65.182
34003198.pdf.jsGet hashmaliciousWSHRat, VjW0rmBrowse
  • 94.156.71.108
NDPS70IhR2.exeGet hashmaliciousZhark RATBrowse
  • 94.156.69.176
copy_106_10210_31.exeGet hashmaliciousAgentTesla, PureLog Stealer, XWormBrowse
  • 94.156.65.181
2023 Univ of St Augustine W-2.pdf.jsGet hashmaliciousAgentTesla, PureLog Stealer, zgRATBrowse
  • 94.156.65.234
nigalmuchmuchi.exeGet hashmaliciousXWormBrowse
  • 94.156.65.234
SecuriteInfo.com.FileRepMalware.5394.19333.elfGet hashmaliciousXmrigBrowse
  • 94.156.65.212
SecuriteInfo.com.FileRepMalware.29234.18634.elfGet hashmaliciousUnknownBrowse
  • 94.156.65.212
SecuriteInfo.com.Trojan.Linux.Agent.14727.28069.elfGet hashmaliciousUnknownBrowse
  • 94.156.65.212

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):6.116356065026597
TrID:
  • ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:yI52EULGv3.elf
File size:71'572 bytes
MD5:fff941174b72a89e35fe36d85ec4bb96
SHA1:3535d4a54bae39e4d3088d0d7b19ae7fc2b9c61a
SHA256:6a50f310a5ea0865540e663d7dcb638811866ee537bd60cfdc4a45afae9a998d
SHA512:fc364536700e93ba8febf4da8e7c09ac870f4215660521715fa0554516c0c338650ec062f6587c68e4cd406a47141e6f58e58dfa0c631c3d110c88956b16896c
SSDEEP:1536:1S18tgi8IqsfLQekacWVcW0JcWcBbSSoGZeC/y3OO2Q1rEVgnKt:1SiDqsLQekacWVcW0JcWcBWSoGFqeFmo
TLSH:BD631AC7F410EABEF81CD73B4C6709157271F2A04D870E3667A7BB5AE92A198051AF81
File Content Preview:.ELF.......................D...4.........4. ...(.................................. ........4..34..34......'....... .dt.Q............................NV..a....da.....N^NuNV..J9..5.f>"y..3L QJ.g.X.#...3LN."y..3L QJ.f.A.....J.g.Hy..30N.X.......5.N^NuNV..N^NuN

Static ELF Info

ELF header

Class:ELF32
Data:2's complement, big endian
Version:1 (current)
Machine:MC68000
Version Number:0x1
Type:EXEC (Executable file)
OS/ABI:UNIX - System V
ABI Version:0
Entry Point Address:0x80000144
Flags:0x0
ELF Header Size:52
Program Header Offset:52
Program Header Size:32
Number of Program Headers:3
Section Header Offset:71172
Section Header Size:40
Number of Section Headers:10
Header String Table Index:9

Sections

NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
NULL0x00x00x00x00x0000
.initPROGBITS0x800000940x940x140x00x6AX002
.textPROGBITS0x800000a80xa80xfefe0x00x6AX004
.finiPROGBITS0x8000ffa60xffa60xe0x00x6AX002
.rodataPROGBITS0x8000ffb40xffb40x137a0x00x2A002
.ctorsPROGBITS0x800133340x113340x80x00x3WA004
.dtorsPROGBITS0x8001333c0x1133c0x80x00x3WA004
.dataPROGBITS0x800133480x113480x27c0x00x3WA004
.bssNOBITS0x800135c40x115c40x24780x00x3WA004
.shstrtabSTRTAB0x00x115c40x3e0x00x0001

Program Segments

TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
LOAD0x00x800000000x800000000x1132e0x1132e6.13430x5R E0x2000.init .text .fini .rodata
LOAD0x113340x800133340x800133340x2900x27083.92000x6RW 0x2000.ctors .dtors .data .bss
GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

Network Behavior

Network Port Distribution

TCP Packets

TimestampSource PortDest PortSource IPDest IP
Apr 24, 2024 13:22:01.817146063 CEST370305683192.168.2.1494.156.71.75
Apr 24, 2024 13:22:02.115353107 CEST56833703094.156.71.75192.168.2.14
Apr 24, 2024 13:22:02.115668058 CEST370305683192.168.2.1494.156.71.75
Apr 24, 2024 13:22:02.115935087 CEST370305683192.168.2.1494.156.71.75
Apr 24, 2024 13:22:02.413950920 CEST56833703094.156.71.75192.168.2.14
Apr 24, 2024 13:22:02.413978100 CEST56833703094.156.71.75192.168.2.14
Apr 24, 2024 13:22:02.414092064 CEST370305683192.168.2.1494.156.71.75
Apr 24, 2024 13:22:02.555752039 CEST370305683192.168.2.1494.156.71.75
Apr 24, 2024 13:22:02.897217035 CEST56833703094.156.71.75192.168.2.14

ICMP Packets

TimestampSource IPDest IPChecksumCodeType
Apr 24, 2024 13:22:09.098330021 CEST192.168.2.14192.168.2.1827a(Port unreachable)Destination Unreachable
Apr 24, 2024 13:23:29.113943100 CEST192.168.2.14192.168.2.1827a(Port unreachable)Destination Unreachable

System Behavior

General

Start time (UTC):11:22:00
Start date (UTC):24/04/2024
Path:/tmp/yI52EULGv3.elf
Arguments:/tmp/yI52EULGv3.elf
File size:4463432 bytes
MD5 hash:cd177594338c77b895ae27c33f8f86cc

Chronological Activities


General

Start time (UTC):11:22:00
Start date (UTC):24/04/2024
Path:/tmp/yI52EULGv3.elf
Arguments:-
File size:4463432 bytes
MD5 hash:cd177594338c77b895ae27c33f8f86cc

Chronological Activities


General

Start time (UTC):11:22:00
Start date (UTC):24/04/2024
Path:/tmp/yI52EULGv3.elf
Arguments:-
File size:4463432 bytes
MD5 hash:cd177594338c77b895ae27c33f8f86cc

Chronological Activities


General

Start time (UTC):11:22:00
Start date (UTC):24/04/2024
Path:/tmp/yI52EULGv3.elf
Arguments:-
File size:4463432 bytes
MD5 hash:cd177594338c77b895ae27c33f8f86cc

Chronological Activities


General

Start time (UTC):11:22:00
Start date (UTC):24/04/2024
Path:/bin/sh
Arguments:sh -c "mkdir /tuqrq95kgq/ && >/tuqrq95kgq/tuqrq95kgq && cd /tuqrq95kgq/ >/dev/null"
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities


General

Start time (UTC):11:22:00
Start date (UTC):24/04/2024
Path:/bin/sh
Arguments:-
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities


General

Start time (UTC):11:22:00
Start date (UTC):24/04/2024
Path:/usr/bin/mkdir
Arguments:mkdir /tuqrq95kgq/
File size:88408 bytes
MD5 hash:088c9d1df5a28ed16c726eca15964cb7

Chronological Activities


General

Start time (UTC):11:22:00
Start date (UTC):24/04/2024
Path:/tmp/yI52EULGv3.elf
Arguments:-
File size:4463432 bytes
MD5 hash:cd177594338c77b895ae27c33f8f86cc

Chronological Activities


General

Start time (UTC):11:22:00
Start date (UTC):24/04/2024
Path:/bin/sh
Arguments:sh -c "mv /tmp/yI52EULGv3.elf /tuqrq95kgq/tuqrq95kgq && chmod 777 /tuqrq95kgq/tuqrq95kgq >/dev/null"
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities


General

Start time (UTC):11:22:00
Start date (UTC):24/04/2024
Path:/bin/sh
Arguments:-
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities


General

Start time (UTC):11:22:00
Start date (UTC):24/04/2024
Path:/usr/bin/mv
Arguments:mv /tmp/yI52EULGv3.elf /tuqrq95kgq/tuqrq95kgq
File size:149888 bytes
MD5 hash:504f0590fa482d4da070a702260e3716

Chronological Activities


General

Start time (UTC):11:22:00
Start date (UTC):24/04/2024
Path:/bin/sh
Arguments:-
File size:129816 bytes
MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities


General

Start time (UTC):11:22:00
Start date (UTC):24/04/2024
Path:/usr/bin/chmod
Arguments:chmod 777 /tuqrq95kgq/tuqrq95kgq
File size:63864 bytes
MD5 hash:739483b900c045ae1374d6f53a86a279

Chronological Activities