Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
x86.elf

Overview

General Information

Sample name:x86.elf
Analysis ID:1436363
MD5:4b80c6c18aac27625434f6817fd951fd
SHA1:69cd4f920dec679fe6daef4d5f2939e74060a4d4
SHA256:25d8d5b4a3fdb428d08555641b9fd97b2b3294c17b5e11ecf22f1ecabb1a5a29
Tags:elf
Infos:

Detection

Score:68
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Machine Learning detection for sample
Found strings indicative of a multi-platform dropper
Sample contains strings that are user agent strings indicative of HTTP manipulation
Sample has stripped symbol table
Sample listens on a socket
Yara signature match

Classification

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1436363
Start date and time:2024-05-04 17:35:06 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 34s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:x86.elf
Detection:MAL
Classification:mal68.linELF@0/0@0/0

Warnings

  • Skipping network analysis since amount of network traffic is too extensive

Runtime Messages

Command:/tmp/x86.elf
PID:6248
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
your device just got infected to a bootnoot
Standard Error:

Process Tree

  • system is lnxubuntu20
  • x86.elf (PID: 6248, Parent: 6164, MD5: 4b80c6c18aac27625434f6817fd951fd) Arguments: /tmp/x86.elf
    • x86.elf New Fork (PID: 6249, Parent: 6248)
    • x86.elf New Fork (PID: 6250, Parent: 6248)
      • x86.elf New Fork (PID: 6251, Parent: 6250)
  • cleanup

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
x86.elfLinux_Trojan_Mirai_1cb033f3unknownunknown
  • 0x7c6a:$a: C3 EB 06 8A 46 FF 88 47 FF FF CA 48 FF C7 48 FF C6 83 FA FF

Memory Dumps

SourceRuleDescriptionAuthorStrings
6248.1.0000000000400000.000000000040d000.r-x.sdmpLinux_Trojan_Mirai_1cb033f3unknownunknown
  • 0x7c6a:$a: C3 EB 06 8A 46 FF 88 47 FF FF CA 48 FF C7 48 FF C6 83 FA FF

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: x86.elfAvira: detected
Multi AV Scanner detection for submitted file
Source: x86.elfVirustotal: Detection: 36%Perma Link
Source: x86.elfReversingLabs: Detection: 47%
Machine Learning detection for sample
Source: x86.elfJoe Sandbox ML: detected
Source: x86.elfString: /cmdlinewgettftpchmodcurl/root//tmp//dev//bin//etc//boot//usr//mnt//var//sbin//snap/
Source: /tmp/x86.elf (PID: 6248)Socket: 127.0.0.1::33337Jump to behavior

System Summary

barindex
Malicious sample detected (through community Yara rule)
Source: x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_1cb033f3 Author: unknown
Source: 6248.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_1cb033f3 Author: unknown
Source: ELF static info symbol of initial sample.symtab present: no
Source: x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_1cb033f3 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 49201ab37ff0b5cdfa9b0b34b6faa170bd25f04df51c24b0b558b7534fecc358, id = 1cb033f3-68c1-4fe5-9cd1-b5d066c1d86e, last_modified = 2021-09-16
Source: 6248.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_1cb033f3 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 49201ab37ff0b5cdfa9b0b34b6faa170bd25f04df51c24b0b558b7534fecc358, id = 1cb033f3-68c1-4fe5-9cd1-b5d066c1d86e, last_modified = 2021-09-16
Source: classification engineClassification label: mal68.linELF@0/0@0/0
Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting		Valid AccountsWindows Management Instrumentation1
Scripting		Path InterceptionDirect Volume AccessOS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Data Obfuscation		Exfiltration Over Other Network MediumAbuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1436363 Sample: x86.elf Startdate: 04/05/2024 Architecture: LINUX Score: 68 15 Malicious sample detected (through community Yara rule) 2->15 17 Antivirus / Scanner detection for submitted sample 2->17 19 Multi AV Scanner detection for submitted file 2->19 21 Machine Learning detection for sample 2->21 7 x86.elf 2->7         started        process3 process4 9 x86.elf 7->9         started        11 x86.elf 7->11         started        process5 13 x86.elf 9->13         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
x86.elf36%VirustotalBrowse
x86.elf47%ReversingLabsLinux.Trojan.Multiverze
x86.elf100%AviraEXP/ELF.Agent.J.12
x86.elf100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy (8bit):6.048884226868898
TrID:
  • ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:x86.elf
File size:53'128 bytes
MD5:4b80c6c18aac27625434f6817fd951fd
SHA1:69cd4f920dec679fe6daef4d5f2939e74060a4d4
SHA256:25d8d5b4a3fdb428d08555641b9fd97b2b3294c17b5e11ecf22f1ecabb1a5a29
SHA512:7f7537faafdd7cf941239a90ab0a37a2d99afa3146f1960c6c6ce567d5224a8a57c7719b97494bf44e370826a9839eb0ec703fde7cbd6820b47045230568b6e8
SSDEEP:768:O/4+VFnQBt9dv5Fjzr8GO1S5W46aN1RqSQdDqfopSF7koYZSt8hcw5gsQGIe33sA:mVFnQnQ74bCvdVEIDStI2sMeMA
TLSH:A0332A03A95140FDD886C1709B7FD527EA31F9BD12357F4E27887E212E32E21165EAC9
File Content Preview:.ELF..............>.......@.....@...................@.8...@.......................@.......@....................... .............p.......p.`.....p.`.....T................. .....Q.td....................................................P.b........X...........

Static ELF Info

ELF header

Class:ELF64
Data:2's complement, little endian
Version:1 (current)
Machine:Advanced Micro Devices X86-64
Version Number:0x1
Type:EXEC (Executable file)
OS/ABI:UNIX - System V
ABI Version:0
Entry Point Address:0x400194
Flags:0x0
ELF Header Size:64
Program Header Offset:64
Program Header Size:56
Number of Program Headers:3
Section Header Offset:52488
Section Header Size:64
Number of Section Headers:10
Header String Table Index:9

Sections

NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
NULL0x00x00x00x00x0000
.initPROGBITS0x4000e80xe80xd0x00x6AX001
.textPROGBITS0x4001000x1000xb5c20x00x6AX0016
.finiPROGBITS0x40b6c20xb6c20x80x00x6AX001
.rodataPROGBITS0x40b6e00xb6e00xac10x00x2A0032
.ctorsPROGBITS0x60cc700xcc700x100x00x3WA008
.dtorsPROGBITS0x60cc800xcc800x100x00x3WA008
.dataPROGBITS0x60cc980xcc980x2c0x00x3WA008
.bssNOBITS0x60cce00xccc40x1d800x00x3WA0032
.shstrtabSTRTAB0x00xccc40x3e0x00x0001

Program Segments

TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
LOAD0x00x4000000x4000000xc1a10xc1a16.30160x5R E0x200000.init .text .fini .rodata
LOAD0xcc700x60cc700x60cc700x540x1df01.86710x6RW 0x200000.ctors .dtors .data .bss
GNU_STACK0x00x00x00x00x00.00000x6RW 0x8

Network Behavior

⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

System Behavior

General

Start time (UTC):15:35:42
Start date (UTC):04/05/2024
Path:/tmp/x86.elf
Arguments:/tmp/x86.elf
File size:53128 bytes
MD5 hash:4b80c6c18aac27625434f6817fd951fd

Chronological Activities


General

Start time (UTC):15:35:42
Start date (UTC):04/05/2024
Path:/tmp/x86.elf
Arguments:-
File size:53128 bytes
MD5 hash:4b80c6c18aac27625434f6817fd951fd

Chronological Activities


General

Start time (UTC):15:35:42
Start date (UTC):04/05/2024
Path:/tmp/x86.elf
Arguments:-
File size:53128 bytes
MD5 hash:4b80c6c18aac27625434f6817fd951fd

Chronological Activities


General

Start time (UTC):15:35:42
Start date (UTC):04/05/2024
Path:/tmp/x86.elf
Arguments:-
File size:53128 bytes
MD5 hash:4b80c6c18aac27625434f6817fd951fd