Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
sUZF1NIN0R.elf

Overview

General Information

Sample name:sUZF1NIN0R.elf
renamed because original name is a hash value
Original sample name:a4f3b2ca8260c47880acb195596f528f.elf
Analysis ID:1432067
MD5:a4f3b2ca8260c47880acb195596f528f
SHA1:2c4d45bcb3ffa9be12fd7ea16f66297d92a12ad8
SHA256:bcb07d02845fcabb0a3b8e3f5173d361f90267ffff00fff62647c182b13a1025
Tags:32armelfmirai
Infos:

Detection

Okiru
Score:64
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Okiru
Reads CPU information from /proc indicative of miner or evasive malware
Reads system information from the proc file system
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample contains strings that are user agent strings indicative of HTTP manipulation
Sample has stripped symbol table
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1432067
Start date and time:2024-04-26 11:19:35 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 48s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:sUZF1NIN0R.elf
renamed because original name is a hash value
Original Sample Name:a4f3b2ca8260c47880acb195596f528f.elf
Detection:MAL
Classification:mal64.troj.linELF@0/0@0/0

Warnings

  • Skipping network analysis since amount of network traffic is too extensive

Runtime Messages

Command:/tmp/sUZF1NIN0R.elf
PID:5492
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:

Standard Error:

Process Tree

  • system is lnxubuntu20
  • cleanup

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
sUZF1NIN0R.elfJoeSecurity_OkiruYara detected OkiruJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    5550.1.00007f5550017000.00007f5550028000.r-x.sdmpJoeSecurity_OkiruYara detected OkiruJoe Security
      5496.1.00007f5550017000.00007f5550028000.r-x.sdmpJoeSecurity_OkiruYara detected OkiruJoe Security
        5492.1.00007f5550017000.00007f5550028000.r-x.sdmpJoeSecurity_OkiruYara detected OkiruJoe Security
          Process Memory Space: sUZF1NIN0R.elf PID: 5492JoeSecurity_OkiruYara detected OkiruJoe Security
            Process Memory Space: sUZF1NIN0R.elf PID: 5496JoeSecurity_OkiruYara detected OkiruJoe Security
              Click to see the 1 entries

              Snort Signatures

              ⊘No Snort rule has matched

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Antivirus / Scanner detection for submitted sample
              Source: sUZF1NIN0R.elfAvira: detected
              Multi AV Scanner detection for submitted file
              Source: sUZF1NIN0R.elfReversingLabs: Detection: 21%
              Source: sUZF1NIN0R.elfVirustotal: Detection: 23%Perma Link
              Source: /tmp/sUZF1NIN0R.elf (PID: 5498)Reads CPU info from proc file: /proc/cpuinfoJump to behavior
              Source: Initial sampleString containing 'busybox' found: /bin/busybox
              Source: Initial sampleString containing 'busybox' found: /proc/proc/%s/exe/var/Challenge/app/hi3511/gmDVR/ibox/usr/dvr_main _8182T_1108/mnt/mtd/app/gui/var/Kylin/l0 c/udevd/anko-app/ankosample _8182T_1104/var/tmp/sonia/hicore/stm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-server/usr//shell/mnt//sys//bin//boot//media//srv//var/run//sbin//lib//etc//dev//home/Davinci/telnet/ssh/var/spool/var/Sofia/sshd/usr/compress/bin//compress/bin/compress/usr//bash/httpd/telnetd/dropbear/ropbear/encoder/system/root/dvr_gui//root/dvr_app//anko-app//opt//softbot.arm/softbot.arm6/softbot.dbg/softbot.mpsl/softbot.x86/softbot.arm5/softbot.arm7/softbot.mips/softbot.sh4softbot.armsoftbot.arm6softbot.dbgsoftbot.mpslsoftbot.x86softbot.arm5softbot.arm7softbot.mipssoftbot.sh4/bin/sh
              Source: ELF static info symbol of initial sample.symtab present: no
              Source: /tmp/sUZF1NIN0R.elf (PID: 5550)SIGKILL sent: pid: 5550, result: unknownJump to behavior
              Source: classification engineClassification label: mal64.troj.linELF@0/0@0/0
              Source: /tmp/sUZF1NIN0R.elf (PID: 5498)Reads from proc file: /proc/cpuinfoJump to behavior
              Source: /tmp/sUZF1NIN0R.elf (PID: 5498)Reads from proc file: /proc/meminfoJump to behavior
              Source: /tmp/sUZF1NIN0R.elf (PID: 5498)Reads CPU info from proc file: /proc/cpuinfoJump to behavior
              Source: /tmp/sUZF1NIN0R.elf (PID: 5492)Queries kernel information via 'uname': Jump to behavior
              Source: sUZF1NIN0R.elf, 5492.1.00007ffd27fd6000.00007ffd27ff7000.rw-.sdmp, sUZF1NIN0R.elf, 5496.1.00007ffd27fd6000.00007ffd27ff7000.rw-.sdmp, sUZF1NIN0R.elf, 5550.1.00007ffd27fd6000.00007ffd27ff7000.rw-.sdmpBinary or memory string: \e_ x86_64/usr/bin/qemu-arm/tmp/sUZF1NIN0R.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sUZF1NIN0R.elf
              Source: sUZF1NIN0R.elf, 5492.1.00005602ad899000.00005602ad9c7000.rw-.sdmp, sUZF1NIN0R.elf, 5496.1.00005602ad899000.00005602ad9c7000.rw-.sdmp, sUZF1NIN0R.elf, 5550.1.00005602ad899000.00005602ad9c7000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
              Source: sUZF1NIN0R.elf, 5492.1.00005602ad899000.00005602ad9c7000.rw-.sdmp, sUZF1NIN0R.elf, 5496.1.00005602ad899000.00005602ad9c7000.rw-.sdmp, sUZF1NIN0R.elf, 5550.1.00005602ad899000.00005602ad9c7000.rw-.sdmpBinary or memory string: V!/etc/qemu-binfmt/arm
              Source: sUZF1NIN0R.elf, 5492.1.00007ffd27fd6000.00007ffd27ff7000.rw-.sdmp, sUZF1NIN0R.elf, 5496.1.00007ffd27fd6000.00007ffd27ff7000.rw-.sdmp, sUZF1NIN0R.elf, 5550.1.00007ffd27fd6000.00007ffd27ff7000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm

              Stealing of Sensitive Information

              barindex
              Yara detected Okiru
              Source: Yara matchFile source: sUZF1NIN0R.elf, type: SAMPLE
              Source: Yara matchFile source: 5550.1.00007f5550017000.00007f5550028000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: 5496.1.00007f5550017000.00007f5550028000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: 5492.1.00007f5550017000.00007f5550028000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: sUZF1NIN0R.elf PID: 5492, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: sUZF1NIN0R.elf PID: 5496, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: sUZF1NIN0R.elf PID: 5550, type: MEMORYSTR
              Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36
              Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.67 Safari/537.36
              Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
              Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
              Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
              Source: Initial sampleUser agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:100.0) Gecko/20100101 Firefox/100.0
              Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
              Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
              Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
              Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:101.0) Gecko/20100101 Firefox/101.0

              Remote Access Functionality

              barindex
              Yara detected Okiru
              Source: Yara matchFile source: sUZF1NIN0R.elf, type: SAMPLE
              Source: Yara matchFile source: 5550.1.00007f5550017000.00007f5550028000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: 5496.1.00007f5550017000.00007f5550028000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: 5492.1.00007f5550017000.00007f5550028000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: sUZF1NIN0R.elf PID: 5492, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: sUZF1NIN0R.elf PID: 5496, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: sUZF1NIN0R.elf PID: 5550, type: MEMORYSTR

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
              Security Software Discovery              		Remote ServicesData from Local System1
              Data Obfuscation              		Exfiltration Over Other Network MediumAbuse Accessibility Features
              CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory2
              System Information Discovery              		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service

              Malware Configuration

              ⊘No configs have been found

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Number of created Files
              • Is malicious
              • Internet
              behaviorgraph top1 signatures2 2 Behavior Graph ID: 1432067 Sample: sUZF1NIN0R.elf Startdate: 26/04/2024 Architecture: LINUX Score: 64 18 Antivirus / Scanner detection for submitted sample 2->18 20 Multi AV Scanner detection for submitted file 2->20 22 Yara detected Okiru 2->22 8 sUZF1NIN0R.elf 2->8         started        process3 process4 10 sUZF1NIN0R.elf 8->10         started        12 sUZF1NIN0R.elf 8->12         started        process5 14 sUZF1NIN0R.elf 10->14         started        process6 16 sUZF1NIN0R.elf 14->16         started       

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              sUZF1NIN0R.elf21%ReversingLabsLinux.Trojan.Mirai
              sUZF1NIN0R.elf23%VirustotalBrowse
              sUZF1NIN0R.elf100%AviraEXP/ELF.Mirai.W

              Dropped Files

              ⊘No Antivirus matches

              Domains

              ⊘No Antivirus matches

              URLs

              ⊘No Antivirus matches

              Domains and IPs

              Contacted Domains

              ⊘No contacted domains info

              World Map of Contacted IPs

              ⊘No contacted IP infos

              Joe Sandbox View / Context

              IPs

              ⊘No context

              Domains

              ⊘No context

              ASNs

              ⊘No context

              JA3 Fingerprints

              ⊘No context

              Dropped Files

              ⊘No context

              Created / dropped Files

              ⊘No created / dropped files found

              Static File Info

              General

              File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
              Entropy (8bit):6.171248472026593
              TrID:
              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
              File name:sUZF1NIN0R.elf
              File size:73'336 bytes
              MD5:a4f3b2ca8260c47880acb195596f528f
              SHA1:2c4d45bcb3ffa9be12fd7ea16f66297d92a12ad8
              SHA256:bcb07d02845fcabb0a3b8e3f5173d361f90267ffff00fff62647c182b13a1025
              SHA512:e7161132ed9bf333abd7a0ce365d483c863a14a765985ef0e9b4741e77c3a9f02768a46c754c37b6a7d0ee0b16c64afdced392f289e86ccb509e18d8161a351b
              SSDEEP:1536:Us48kXuTRFpyHYlrnI4d+C5EvACVZteum+FjlFLpWOiLnrEE8vvX3T:Us48keTfpyp4d/5Ev7EuPFJFLpWtLnrm
              TLSH:E1632C42B9528A13C1C361B6F75FC19C3B266BE8D3F632069D399FA123874E61E77112
              File Content Preview:.ELF...a..........(.........4...........4. ...(..........................................................&..........Q.td..................................-...L."....<..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

              Static ELF Info

              ELF header

              Class:ELF32
              Data:2's complement, little endian
              Version:1 (current)
              Machine:ARM
              Version Number:0x1
              Type:EXEC (Executable file)
              OS/ABI:ARM - ABI
              ABI Version:0
              Entry Point Address:0x8190
              Flags:0x202
              ELF Header Size:52
              Program Header Offset:52
              Program Header Size:32
              Number of Program Headers:3
              Section Header Offset:72856
              Section Header Size:40
              Number of Section Headers:12
              Header String Table Index:11

              Sections

              NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
              NULL0x00x00x00x00x0000
              .initPROGBITS0x80940x940x180x00x6AX004
              .textPROGBITS0x80b00xb00xf2e80x00x6AX0016
              .finiPROGBITS0x173980xf3980x140x00x6AX004
              .rodataPROGBITS0x173ac0xf3ac0x1a340x00x2A004
              .ctorsPROGBITS0x210040x110040x80x00x3WA004
              .dtorsPROGBITS0x2100c0x1100c0x80x00x3WA004
              .dataPROGBITS0x210180x110180x1d00x00x3WA004
              .bssNOBITS0x211e80x111e80x24bc0x00x3WA004
              .commentPROGBITS0x00x111e80xa480x00x0001
              .ARM.attributesARM_ATTRIBUTES0x00x11c300x100x00x0001
              .shstrtabSTRTAB0x00x11c400x570x00x0001

              Program Segments

              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
              LOAD0x00x80000x80000x10de00x10de06.18040x5R E0x8000.init .text .fini .rodata
              LOAD0x110040x210040x210040x1e40x26a01.79410x6RW 0x8000.ctors .dtors .data .bss
              GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

              Network Behavior

              ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

              System Behavior

              General

              Start time (UTC):09:20:13
              Start date (UTC):26/04/2024
              Path:/tmp/sUZF1NIN0R.elf
              Arguments:/tmp/sUZF1NIN0R.elf
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              Chronological Activities


              General

              Start time (UTC):09:20:14
              Start date (UTC):26/04/2024
              Path:/tmp/sUZF1NIN0R.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              Chronological Activities


              General

              Start time (UTC):09:20:14
              Start date (UTC):26/04/2024
              Path:/tmp/sUZF1NIN0R.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              Chronological Activities


              General

              Start time (UTC):09:20:14
              Start date (UTC):26/04/2024
              Path:/tmp/sUZF1NIN0R.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              Chronological Activities


              General

              Start time (UTC):09:21:03
              Start date (UTC):26/04/2024
              Path:/tmp/sUZF1NIN0R.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              Chronological Activities