Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
arm5-20240504-1301.elf

Overview

General Information

Sample name:arm5-20240504-1301.elf
Analysis ID:1436348
MD5:497adc55737355f1450bb2c61e065a6f
SHA1:9cec574d83e70f0b501215d85cf4188d081fbc15
SHA256:c9259685bc8ceee829d42df79be5ab604d114f954724bd2152e57c938fd9243c
Infos:

Detection

Gafgyt
Score:68
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Yara detected Gafgyt
Deletes system log files
Manipulation of devices in /dev
Sample is packed with UPX
ELF contains segments with high entropy indicating compressed/encrypted content
Sample contains only a LOAD segment without any section mappings
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1436348
Start date and time:2024-05-04 15:02:05 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 6m 1s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:arm5-20240504-1301.elf
Detection:MAL
Classification:mal68.troj.evad.linELF@0/0@0/0

Warnings

  • Skipping network analysis since amount of network traffic is too extensive

Runtime Messages

Command:/tmp/arm5-20240504-1301.elf
PID:6243
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
guess what. you're retarded
Standard Error:

Process Tree

  • system is lnxubuntu20
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Bashlite, GafgytBashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
6350.1.00007f1e94017000.00007f1e94038000.r-x.sdmpJoeSecurity_GafgytYara detected GafgytJoe Security
    6243.1.00007f1e94017000.00007f1e94038000.r-x.sdmpJoeSecurity_GafgytYara detected GafgytJoe Security
      6352.1.00007f1e94017000.00007f1e94038000.r-x.sdmpJoeSecurity_GafgytYara detected GafgytJoe Security
        6292.1.00007f1e94017000.00007f1e94038000.r-x.sdmpJoeSecurity_GafgytYara detected GafgytJoe Security
          6295.1.00007f1e94017000.00007f1e94038000.r-x.sdmpJoeSecurity_GafgytYara detected GafgytJoe Security

            Snort Signatures

            ⊘No Snort rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Multi AV Scanner detection for submitted file
            Source: arm5-20240504-1301.elfReversingLabs: Detection: 23%
            Source: arm5-20240504-1301.elfVirustotal: Detection: 16%Perma Link
            Source: /tmp/arm5-20240504-1301.elf (PID: 6243)Socket: 127.0.0.1::46373Jump to behavior
            Source: arm5-20240504-1301.elfString found in binary or memory: http://upx.sf.net
            Source: LOAD without section mappingsProgram segment: 0x8000
            Source: /tmp/arm5-20240504-1301.elf (PID: 6295)SIGKILL sent: pid: 6292, result: successfulJump to behavior
            Source: /tmp/arm5-20240504-1301.elf (PID: 6352)SIGKILL sent: pid: 6350, result: successfulJump to behavior
            Source: classification engineClassification label: mal68.troj.evad.linELF@0/0@0/0

            Data Obfuscation

            barindex
            Manipulation of devices in /dev
            Source: /tmp/arm5-20240504-1301.elf (PID: 6251)Deleted: /dev/kmsgJump to behavior
            Sample is packed with UPX
            Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
            Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
            Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

            Hooking and other Techniques for Hiding and Protection

            barindex
            Deletes system log files
            Source: /tmp/arm5-20240504-1301.elf (PID: 6251)Log files deleted: /var/log/kern.logJump to behavior
            Source: arm5-20240504-1301.elfSubmission file: segment LOAD with 7.7313 entropy (max. 8.0)
            Source: /tmp/arm5-20240504-1301.elf (PID: 6243)Queries kernel information via 'uname': Jump to behavior
            Source: arm5-20240504-1301.elf, 6243.1.0000557813189000.000055781339d000.rw-.sdmp, arm5-20240504-1301.elf, 6292.1.0000557813189000.000055781339d000.rw-.sdmp, arm5-20240504-1301.elf, 6295.1.0000557813189000.000055781339d000.rw-.sdmp, arm5-20240504-1301.elf, 6350.1.0000557813189000.000055781339d000.rw-.sdmp, arm5-20240504-1301.elf, 6352.1.0000557813189000.000055781339d000.rw-.sdmpBinary or memory string: xU!/etc/qemu-binfmt/arm
            Source: arm5-20240504-1301.elf, 6243.1.0000557813189000.000055781339d000.rw-.sdmp, arm5-20240504-1301.elf, 6292.1.0000557813189000.000055781339d000.rw-.sdmp, arm5-20240504-1301.elf, 6295.1.0000557813189000.000055781339d000.rw-.sdmp, arm5-20240504-1301.elf, 6350.1.0000557813189000.000055781339d000.rw-.sdmp, arm5-20240504-1301.elf, 6352.1.0000557813189000.000055781339d000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
            Source: arm5-20240504-1301.elf, 6243.1.00007fff7be7c000.00007fff7be9d000.rw-.sdmp, arm5-20240504-1301.elf, 6292.1.00007fff7be7c000.00007fff7be9d000.rw-.sdmp, arm5-20240504-1301.elf, 6295.1.00007fff7be7c000.00007fff7be9d000.rw-.sdmp, arm5-20240504-1301.elf, 6350.1.00007fff7be7c000.00007fff7be9d000.rw-.sdmp, arm5-20240504-1301.elf, 6352.1.00007fff7be7c000.00007fff7be9d000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
            Source: arm5-20240504-1301.elf, 6243.1.00007fff7be7c000.00007fff7be9d000.rw-.sdmp, arm5-20240504-1301.elf, 6292.1.00007fff7be7c000.00007fff7be9d000.rw-.sdmp, arm5-20240504-1301.elf, 6295.1.00007fff7be7c000.00007fff7be9d000.rw-.sdmp, arm5-20240504-1301.elf, 6350.1.00007fff7be7c000.00007fff7be9d000.rw-.sdmp, arm5-20240504-1301.elf, 6352.1.00007fff7be7c000.00007fff7be9d000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm5-20240504-1301.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm5-20240504-1301.elf

            Stealing of Sensitive Information

            barindex
            Yara detected Gafgyt
            Source: Yara matchFile source: 6350.1.00007f1e94017000.00007f1e94038000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6243.1.00007f1e94017000.00007f1e94038000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6352.1.00007f1e94017000.00007f1e94038000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6292.1.00007f1e94017000.00007f1e94038000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6295.1.00007f1e94017000.00007f1e94038000.r-x.sdmp, type: MEMORY

            Remote Access Functionality

            barindex
            Yara detected Gafgyt
            Source: Yara matchFile source: 6350.1.00007f1e94017000.00007f1e94038000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6243.1.00007f1e94017000.00007f1e94038000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6352.1.00007f1e94017000.00007f1e94038000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6292.1.00007f1e94017000.00007f1e94038000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6295.1.00007f1e94017000.00007f1e94038000.r-x.sdmp, type: MEMORY

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
            Indicator Removal            		OS Credential Dumping11
            Security Software Discovery            		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts11
            Obfuscated Files or Information            		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service

            Malware Configuration

            ⊘No configs have been found

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Number of created Files
            • Is malicious
            • Internet
            behaviorgraph top1 signatures2 2 Behavior Graph ID: 1436348 Sample: arm5-20240504-1301.elf Startdate: 04/05/2024 Architecture: LINUX Score: 68 27 Multi AV Scanner detection for submitted file 2->27 29 Yara detected Gafgyt 2->29 31 Sample is packed with UPX 2->31 8 arm5-20240504-1301.elf 2->8         started        process3 process4 10 arm5-20240504-1301.elf 8->10         started        process5 12 arm5-20240504-1301.elf 10->12         started        15 arm5-20240504-1301.elf 10->15         started        17 arm5-20240504-1301.elf 10->17         started        19 2 other processes 10->19 signatures6 33 Manipulation of devices in /dev 12->33 35 Deletes system log files 12->35 21 arm5-20240504-1301.elf 15->21         started        23 arm5-20240504-1301.elf 17->23         started        25 arm5-20240504-1301.elf 19->25         started        process7

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            arm5-20240504-1301.elf24%ReversingLabsLinux.Trojan.Aidra
            arm5-20240504-1301.elf16%VirustotalBrowse

            Dropped Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            ⊘No Antivirus matches

            Domains and IPs

            Contacted Domains

            ⊘No contacted domains info

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            http://upx.sf.netarm5-20240504-1301.elffalse
              		high

              World Map of Contacted IPs

              ⊘No contacted IP infos

              Joe Sandbox View / Context

              IPs

              ⊘No context

              Domains

              ⊘No context

              ASNs

              ⊘No context

              JA3 Fingerprints

              ⊘No context

              Dropped Files

              ⊘No context

              Created / dropped Files

              ⊘No created / dropped files found

              Static File Info

              General

              File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, no section header
              Entropy (8bit):7.730014061623152
              TrID:
              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
              File name:arm5-20240504-1301.elf
              File size:68'316 bytes
              MD5:497adc55737355f1450bb2c61e065a6f
              SHA1:9cec574d83e70f0b501215d85cf4188d081fbc15
              SHA256:c9259685bc8ceee829d42df79be5ab604d114f954724bd2152e57c938fd9243c
              SHA512:d3a32048da27536423cfd0d64e893e14e2e7559a39e9f05ee2e87ddc5d20b00d617d305ec6c6eb07746f6f55e5acb386960069f0be6a58b850beb67b162b536d
              SSDEEP:1536:RHASKgN6DXqnWzbWQut6BTg0j+g03eFfRdHbxIsec3ENCwRtw:RgSKS6YWst6hg8+bONRYseciCCtw
              TLSH:4E6302A27A12260FF66C4673903FE39689E353C35F7BA14A4F2246CF02443525E9808A
              File Content Preview:.ELF...a..........(.....`...4...........4. ...(.....................................................................Q.td................................UPX!.........Z...Z......].........ELF.ra....(........4...Y..... ...}......,.g........,.n.5......H......

              Static ELF Info

              ELF header

              Class:ELF32
              Data:2's complement, little endian
              Version:1 (current)
              Machine:ARM
              Version Number:0x1
              Type:EXEC (Executable file)
              OS/ABI:ARM - ABI
              ABI Version:0
              Entry Point Address:0x18060
              Flags:0x2
              ELF Header Size:52
              Program Header Offset:52
              Program Header Size:32
              Number of Program Headers:3
              Section Header Offset:0
              Section Header Size:40
              Number of Section Headers:0
              Header String Table Index:0

              Program Segments

              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
              LOAD0x00x80000x80000x109c80x109c87.73130x5R E0x8000
              LOAD0x2e140x42e140x42e140x00x00.00000x6RW 0x8000
              GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

              Network Behavior

              ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

              System Behavior

              General

              Start time (UTC):13:02:43
              Start date (UTC):04/05/2024
              Path:/tmp/arm5-20240504-1301.elf
              Arguments:/tmp/arm5-20240504-1301.elf
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              Chronological Activities


              General

              Start time (UTC):13:02:43
              Start date (UTC):04/05/2024
              Path:/tmp/arm5-20240504-1301.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              Chronological Activities


              General

              Start time (UTC):13:02:43
              Start date (UTC):04/05/2024
              Path:/tmp/arm5-20240504-1301.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              Chronological Activities


              General

              Start time (UTC):13:02:43
              Start date (UTC):04/05/2024
              Path:/tmp/arm5-20240504-1301.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              Chronological Activities


              General

              Start time (UTC):13:03:08
              Start date (UTC):04/05/2024
              Path:/tmp/arm5-20240504-1301.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              Chronological Activities


              General

              Start time (UTC):13:03:08
              Start date (UTC):04/05/2024
              Path:/tmp/arm5-20240504-1301.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              Chronological Activities


              General

              Start time (UTC):13:04:29
              Start date (UTC):04/05/2024
              Path:/tmp/arm5-20240504-1301.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              Chronological Activities


              General

              Start time (UTC):13:04:29
              Start date (UTC):04/05/2024
              Path:/tmp/arm5-20240504-1301.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              Chronological Activities


              General

              Start time (UTC):13:06:10
              Start date (UTC):04/05/2024
              Path:/tmp/arm5-20240504-1301.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              Chronological Activities


              General

              Start time (UTC):13:06:10
              Start date (UTC):04/05/2024
              Path:/tmp/arm5-20240504-1301.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1