Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

Mozi.a

Status: finished
Submission Time: 2020-08-24 12:08:07 +02:00
Malicious
Spreader
Trojan
Evader

Comments

Tags

Details

  • Analysis ID:
    276062
  • API (Web) ID:
    447472
  • Analysis Started:
    2020-08-24 12:08:08 +02:00
  • Analysis Finished:
    2020-08-24 12:19:14 +02:00
  • MD5:
    9a111588a7db15b796421bd13a949cd4
  • SHA1:
    034c8c51a58be11ca620ce3eb0d43d5a59275d2f
  • SHA256:
    e15e93db3ce3a8a22adb4b18e0e37b93f39c495e4a97008f9b1a9a42e1fac2b0
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
Full Report Management Report IOC Report
malicious
Score: 84
System: Ubuntu Linux 16.04 x64 (Kernel 4.4.0-116, Firefox 88.0, Document Viewer 3.18.2, LibreOffice 5.1.6.2, OpenJDK 1.8.0_171)

Third Party Analysis Engines

Open Full Report
malicious
Score: 42/58
Open Full Report
malicious
Score: 17/40
malicious
Score: 18/31
malicious

URLs

Name Detection
http://pastebin.ca)
http://pastebin.ca/quiet-paste.php?api=$PASTEBINKEY&encrypt=t&encryptpw=blahblah
http://www.alsa-project.org.
Click to see the 8 hidden entries
http://upx.sf.net
http://www.pastebin.ca.
http://www.alsa-project.org
http://www.pastebin.ca/upload.php
http://www.pastebin.ca
http://www.alsa-project.org/cardinfo-db/
http://pastebin.ca/quiet-paste.php?api=$PASTEBINKEY
http://www.alsa-project.org/alsa-info.sh

Dropped files

Name File Type Hashes Detection
/usr/networks
 ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
 #
/etc/rcS.d/S95baby.sh
 POSIX shell script, ASCII text executable
 #
/etc/rc.local
 ASCII text
 #
Click to see the 97 hidden entries
/etc/profile.d/vte-2.91.sh
 ASCII text
 #
/etc/profile.d/cedilla-portuguese.sh
 ASCII text
 #
/etc/profile.d/bash_completion.sh
 ASCII text
 #
/etc/profile.d/apps-bin-path.sh
 ASCII text
 #
/etc/profile.d/Z97-byobu.sh
 ASCII text
 #
/etc/init.d/umountnfs.sh
 ASCII text
 #
/etc/init.d/mountnfs.sh
 ASCII text
 #
/etc/init.d/mountnfs-bootclean.sh
 ASCII text
 #
/etc/init.d/mountkernfs.sh
 ASCII text
 #
/etc/init.d/mountdevsubfs.sh
 ASCII text
 #
/etc/init.d/mountall.sh
 ASCII text
 #
/etc/init.d/hwclock.sh
 ASCII text
 #
/etc/init.d/hostname.sh
 ASCII text
 #
/etc/init.d/checkroot.sh
 ASCII text
 #
/etc/init.d/checkroot-bootclean.sh
 ASCII text
 #
/etc/init.d/checkfs.sh
 ASCII text
 #
/etc/init.d/bootmisc.sh
 ASCII text
 #
/etc/init.d/mountall-bootclean.sh
 ASCII text
 #
/etc/init.d/S95baby.sh
 POSIX shell script, ASCII text executable
 #
/usr/share/doc/git/contrib/examples/git-notes.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-pull.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-repack.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-log.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-whatchanged.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-verify-tag.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-tag.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-revert.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-resolve.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-reset.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-merge.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-merge-ours.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-ls-remote.sh
 ASCII text
 #
/usr/share/doc/ifupdown/examples/check-mac-address.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-gc.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-fetch.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-commit.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-clone.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-clean.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-checkout.sh
 ASCII text
 #
/usr/share/doc/hddtemp/contribs/hddtemp-all.sh
 ASCII text
 #
/usr/share/doc/mdadm/examples/mdadd.sh
 ASCII text
 #
/usr/share/doc/lm-sensors/examples/tellerstats/tellerstats.sh
 ASCII text
 #
/usr/share/doc/lm-sensors/examples/tellerstats/gather.sh
 ASCII text
 #
/usr/share/doc/lm-sensors/examples/daemon/healthd.sh
 ASCII text
 #
/usr/share/doc/libsane/plustek/MakeModule.sh
 ASCII text
 #
/usr/share/doc/ifupdown/examples/ping-places.sh
 ASCII text
 #
/usr/share/doc/ifupdown/examples/pcmcia-compat.sh
 ASCII text
 #
/usr/share/doc/ifupdown/examples/get-mac-address.sh
 ASCII text
 #
/usr/share/doc/acpid/examples/ac.sh
 ASCII text
 #
/usr/share/doc/git/contrib/fast-import/git-import.sh
 ASCII text
 #
/usr/share/doc/hddtemp/contribs/analyze/hddtemp_monitor.sh
 ASCII text
 #
/usr/share/doc/hddtemp/contribs/analyze/graph-field.sh
 ASCII text
 #
/usr/share/doc/git/contrib/thunderbird-patch-inline/appp.sh
 ASCII text
 #
/usr/share/doc/git/contrib/subtree/t/t7900-subtree.sh
 ASCII text
 #
/usr/share/doc/git/contrib/subtree/git-subtree.sh
 ASCII text
 #
/usr/share/doc/git/contrib/rerere-train.sh
 ASCII text
 #
/usr/share/doc/git/contrib/remotes2config.sh
 ASCII text
 #
/usr/share/doc/git/contrib/git-resurrect.sh
 ASCII text
 #
/etc/wpa_supplicant/ifupdown.sh
 ASCII text
 #
/tmp/tmp.QTRzgnebJm
 ASCII text
 #
/home/user/.cache/upstart/upstart-event-bridge.log.1.gz
 Mon Jul 27 09:05:22 2020, from Unix
 #
/home/user/.cache/upstart/update-notifier-release.log.1.gz
 Mon Jul 27 09:05:22 2020, from Unix
 #
/home/user/.cache/upstart/startxfce4.log.1.gz
 Mon Aug 24 12:08:37 2020, from Unix
 #
/home/user/.cache/upstart/ssh-agent.log.1.gz
 Mon Jul 27 09:05:22 2020, from Unix
 #
/home/user/.cache/upstart/gpg-agent.log.1.gz
 Mon Jul 27 09:05:26 2020, from Unix
 #
/home/user/.cache/upstart/gnome-keyring-ssh.log.1.gz
 Mon Jul 27 09:05:22 2020, from Unix
 #
/home/user/.cache/upstart/dbus.log.1.gz
 Mon Aug 24 10:08:13 2020, from Unix
 #
/home/user/.cache/logrotate/status.tmp
 ASCII text
 #
/usr/share/alsa-base/alsa-info.sh
 ASCII text, with very long lines
 #
/etc/wpa_supplicant/functions.sh
 ASCII text
 #
/etc/wpa_supplicant/action_wpa.sh
 ASCII text
 #
/etc/libreoffice/soffice.sh
 ASCII text
 #
/etc/bash_completion.d/libreoffice.sh
 ASCII text
 #
/etc/acpi/undock.sh
 ASCII text
 #
/etc/acpi/tosh-wireless.sh
 ASCII text
 #
/etc/acpi/powerbtn.sh
 ASCII text
 #
/etc/acpi/ibm-wireless.sh
 ASCII text
 #
/etc/acpi/asus-wireless.sh
 ASCII text
 #
/usr/share/doc/acpid/examples/default.sh
 ASCII text
 #
/usr/share/doc/git/contrib/convert-grafts-to-replace-refs.sh
 ASCII text
 #
/usr/share/doc/gdb/contrib/gdb-add-index.sh
 ASCII text
 #
/usr/share/doc/gdb/contrib/expect-read1.sh
 ASCII text
 #
/usr/share/doc/gdb/contrib/ari/gdb_find.sh
 ASCII text
 #
/usr/share/doc/gdb/contrib/ari/create-web-ari-in-src.sh
 ASCII text
 #
/usr/share/doc/gawk/examples/prog/igawk.sh
 awk or perl script, ASCII text
 #
/usr/share/doc/gawk/examples/network/PostAgent.sh
 ASCII text
 #
/usr/share/doc/cron/examples/cron-tasks-review.sh
 ASCII text
 #
/usr/share/doc/busybox-static/examples/mdev.conf.change_blockdev.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-am.sh
 OS/2 REXX batch file, ASCII text
 #
/etc/acpi/asus-keyboard-backlight.sh
 ASCII text
 #
/usr/share/debconf/confmodule.sh
 ASCII text
 #
/usr/share/cups/braille/indexv4.sh
 ASCII text
 #
/usr/share/cups/braille/indexv3.sh
 ASCII text
 #
/usr/share/cups/braille/index.sh
 ASCII text
 #
/usr/share/cups/braille/cups-braille.sh
 UTF-8 Unicode text
 #
/usr/share/brltty/initramfs/brltty.sh
 ASCII text
 #
/usr/share/alsa/utils.sh
 ASCII text
 #