Loading ...

Play interactive tourEdit tour

Linux Analysis Report J26H423OMJ

Overview

General Information

Sample Name:J26H423OMJ
Analysis ID:553489
MD5:3414deab25b875eed0b15208810ed1ce
SHA1:80b311c6750599af1f89471ee858fbdbfd98d7d1
SHA256:95cd08fe8edd5ee21183808360baff9d3603fc7195dff78db1bf6b4e3085ca7a
Tags:32elfmiraipowerpc
Infos:

Detection

Score:52
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Sample is packed with UPX
Uses the "uname" system call to query kernel version information (possible evasion)
Sample contains only a LOAD segment without any section mappings
Enumerates processes within the "proc" file system
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine

General Information

Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:553489
Start date:15.01.2022
Start time:01:22:14
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 6m 12s
Hypervisor based Inspection enabled:false
Report type:light
Sample file name:J26H423OMJ
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal52.evad.lin@0/0@0/0

Process Tree

  • system is lnxubuntu20
  • cleanup

Yara Overview

No yara matches

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

barindex
Multi AV Scanner detection for submitted fileShow sources
Source: J26H423OMJVirustotal: Detection: 36%Perma Link
Source: J26H423OMJReversingLabs: Detection: 34%
Source: /tmp/J26H423OMJ (PID: 5226)Socket: 0.0.0.0::0
Source: /tmp/J26H423OMJ (PID: 5231)Socket: 0.0.0.0::0
Source: J26H423OMJString found in binary or memory: http://upx.sf.net
Source: LOAD without section mappingsProgram segment: 0x100000
Source: /tmp/J26H423OMJ (PID: 5226)SIGKILL sent: pid: 936, result: successful
Source: /tmp/J26H423OMJ (PID: 5231)SIGKILL sent: pid: 936, result: successful
Source: /tmp/J26H423OMJ (PID: 5242)SIGKILL sent: pid: 5240, result: successful
Source: classification engineClassification label: mal52.evad.lin@0/0@0/0

Data Obfuscation:

barindex
Sample is packed with UPXShow sources
Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/491/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/793/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/772/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/796/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/774/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/797/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/777/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/799/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/658/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/912/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/759/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/936/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/918/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/1/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/761/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/785/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/884/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/720/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/721/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/788/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/789/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/800/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/801/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/847/fd
Source: /tmp/J26H423OMJ (PID: 5231)File opened: /proc/904/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/491/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/793/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/772/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/796/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/774/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/797/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/777/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/799/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/658/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/912/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/759/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/936/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/918/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/1/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/761/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/785/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/884/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/720/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/721/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/788/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/789/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/800/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/801/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/847/fd
Source: /tmp/J26H423OMJ (PID: 5226)File opened: /proc/904/fd
Source: /tmp/J26H423OMJ (PID: 5224)Queries kernel information via 'uname':
Source: J26H423OMJ, 5224.1.00000000b7edd68d.00000000602b0247.rw-.sdmp, J26H423OMJ, 5240.1.00000000b7edd68d.00000000602b0247.rw-.sdmp, J26H423OMJ, 5242.1.00000000b7edd68d.00000000602b0247.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: J26H423OMJ, 5226.1.00000000b7edd68d.00000000602b0247.rw-.sdmp, J26H423OMJ, 5340.1.00000000b7edd68d.00000000602b0247.rw-.sdmp, J26H423OMJ, 5358.1.00000000b7edd68d.00000000602b0247.rw-.sdmp, J26H423OMJ, 5348.1.00000000b7edd68d.00000000602b0247.rw-.sdmp, J26H423OMJ, 5227.1.00000000b7edd68d.00000000602b0247.rw-.sdmp, J26H423OMJ, 5345.1.00000000b7edd68d.00000000602b0247.rw-.sdmp, J26H423OMJ, 5234.1.00000000b7edd68d.00000000602b0247.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc1
Source: J26H423OMJ, 5224.1.00000000b7edd68d.00000000602b0247.rw-.sdmp, J26H423OMJ, 5226.1.00000000b7edd68d.00000000602b0247.rw-.sdmp, J26H423OMJ, 5340.1.00000000b7edd68d.00000000602b0247.rw-.sdmp, J26H423OMJ, 5358.1.00000000b7edd68d.00000000602b0247.rw-.sdmp, J26H423OMJ, 5348.1.00000000b7edd68d.00000000602b0247.rw-.sdmp, J26H423OMJ, 5227.1.00000000b7edd68d.00000000602b0247.rw-.sdmp, J26H423OMJ, 5345.1.00000000b7edd68d.00000000602b0247.rw-.sdmp, J26H423OMJ, 5234.1.00000000b7edd68d.00000000602b0247.rw-.sdmp, J26H423OMJ, 5240.1.00000000b7edd68d.00000000602b0247.rw-.sdmp, J26H423OMJ, 5242.1.00000000b7edd68d.00000000602b0247.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/ppc
Source: J26H423OMJ, 5224.1.000000008c0f408b.00000000efb73240.rw-.sdmp, J26H423OMJ, 5226.1.000000008c0f408b.00000000efb73240.rw-.sdmp, J26H423OMJ, 5340.1.000000008c0f408b.00000000efb73240.rw-.sdmp, J26H423OMJ, 5358.1.000000008c0f408b.00000000efb73240.rw-.sdmp, J26H423OMJ, 5348.1.000000008c0f408b.00000000efb73240.rw-.sdmp, J26H423OMJ, 5227.1.000000008c0f408b.00000000efb73240.rw-.sdmp, J26H423OMJ, 5345.1.000000008c0f408b.00000000efb73240.rw-.sdmp, J26H423OMJ, 5234.1.000000008c0f408b.00000000efb73240.rw-.sdmp, J26H423OMJ, 5240.1.000000008c0f408b.00000000efb73240.rw-.sdmp, J26H423OMJ, 5242.1.000000008c0f408b.00000000efb73240.rw-.sdmpBinary or memory string: /usr/bin/qemu-ppc
Source: J26H423OMJ, 5224.1.000000008c0f408b.00000000efb73240.rw-.sdmp, J26H423OMJ, 5226.1.000000008c0f408b.00000000efb73240.rw-.sdmp, J26H423OMJ, 5340.1.000000008c0f408b.00000000efb73240.rw-.sdmp, J26H423OMJ, 5358.1.000000008c0f408b.00000000efb73240.rw-.sdmp, J26H423OMJ, 5348.1.000000008c0f408b.00000000efb73240.rw-.sdmp, J26H423OMJ, 5227.1.000000008c0f408b.00000000efb73240.rw-.sdmp, J26H423OMJ, 5345.1.000000008c0f408b.00000000efb73240.rw-.sdmp, J26H423OMJ, 5234.1.000000008c0f408b.00000000efb73240.rw-.sdmp, J26H423OMJ, 5240.1.000000008c0f408b.00000000efb73240.rw-.sdmp, J26H423OMJ, 5242.1.000000008c0f408b.00000000efb73240.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-ppc/tmp/J26H423OMJSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/J26H423OMJ

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionObfuscated Files or Information1OS Credential Dumping1Security Software Discovery11Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition

Malware Configuration

No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 553489 Sample: J26H423OMJ Startdate: 15/01/2022 Architecture: LINUX Score: 52 47 Multi AV Scanner detection for submitted file 2->47 49 Sample is packed with UPX 2->49 9 J26H423OMJ 2->9         started        process3 process4 11 J26H423OMJ 9->11         started        13 J26H423OMJ 9->13         started        15 J26H423OMJ 9->15         started        process5 17 J26H423OMJ 11->17         started        19 J26H423OMJ 11->19         started        21 J26H423OMJ 11->21         started        27 2 other processes 11->27 23 J26H423OMJ 13->23         started        25 J26H423OMJ 13->25         started        process6 29 J26H423OMJ 17->29         started        31 J26H423OMJ 17->31         started        33 J26H423OMJ 19->33         started        35 J26H423OMJ 21->35         started        37 J26H423OMJ 23->37         started        39 J26H423OMJ 23->39         started        41 J26H423OMJ 23->41         started        process7 43 J26H423OMJ 37->43         started        45 J26H423OMJ 37->45         started       

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
J26H423OMJ37%VirustotalBrowse
J26H423OMJ35%ReversingLabsLinux.Trojan.Mirai

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://upx.sf.netJ26H423OMJfalse
    high

    Contacted IPs

    No contacted IP infos


    Runtime Messages

    Command:/tmp/J26H423OMJ
    Exit Code:0
    Exit Code Info:
    Killed:False
    Standard Output:
    Connected To CNC
    Standard Error:

    Joe Sandbox View / Context

    IPs

    No context

    Domains

    No context

    ASN

    No context

    JA3 Fingerprints

    No context

    Dropped Files

    No context

    Created / dropped Files

    No created / dropped files found

    Static File Info

    General

    File type:ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (GNU/Linux), statically linked, stripped
    Entropy (8bit):7.916994486922002
    TrID:
    • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
    • ELF Executable and Linkable format (generic) (4004/1) 49.84%
    File name:J26H423OMJ
    File size:23936
    MD5:3414deab25b875eed0b15208810ed1ce
    SHA1:80b311c6750599af1f89471ee858fbdbfd98d7d1
    SHA256:95cd08fe8edd5ee21183808360baff9d3603fc7195dff78db1bf6b4e3085ca7a
    SHA512:2484ec2ea5e9ddf6aa9d9500d17e0b14e9e45894013d1bed3d18b3f197e5ce42e683f6f91162bdb71a3130bfc94375c276927f8f8a03dbac3b65e32469cbb366
    SSDEEP:384:eA0AeimAzNCdvw1PwIW2MnY5uETrcGdLXM5w1ol8z3hTbt49X5fyDUKsUYM4uVcR:QApCdvwJoOL3v31oOLNbopfNOn4uVcq2
    File Content Preview:.ELF......................J....4.........4. ...(......................\...\.........................................dt.Q................................UPX!.......................S.......?.E.h4...@b....................D*aN.........]&a.r...K{.LS....9.5o..V

    Static ELF Info

    ELF header

    Class:ELF32
    Data:2's complement, big endian
    Version:1 (current)
    Machine:PowerPC
    Version Number:0x1
    Type:EXEC (Executable file)
    OS/ABI:UNIX - Linux
    ABI Version:0
    Entry Point Address:0x104aa0
    Flags:0x0
    ELF Header Size:52
    Program Header Offset:52
    Program Header Size:32
    Number of Program Headers:3
    Section Header Offset:0
    Section Header Size:40
    Number of Section Headers:0
    Header String Table Index:0

    Program Segments

    TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
    LOAD0x00x1000000x1000000x5c880x5c884.25300x5R E0x10000
    LOAD0xc9e80x1001c9e80x1001c9e80x00x00.00000x6RW 0x10000
    GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

    Network Behavior

    No network behavior found

    System Behavior

    General

    Start time:01:22:54
    Start date:15/01/2022
    Path:/tmp/J26H423OMJ
    Arguments:/tmp/J26H423OMJ
    File size:5388968 bytes
    MD5 hash:ae65271c943d3451b7f026d1fadccea6

    General

    Start time:01:22:54
    Start date:15/01/2022
    Path:/tmp/J26H423OMJ
    Arguments:n/a
    File size:5388968 bytes
    MD5 hash:ae65271c943d3451b7f026d1fadccea6

    General

    Start time:01:26:04
    Start date:15/01/2022
    Path:/tmp/J26H423OMJ
    Arguments:n/a
    File size:5388968 bytes
    MD5 hash:ae65271c943d3451b7f026d1fadccea6

    General

    Start time:01:26:04
    Start date:15/01/2022
    Path:/tmp/J26H423OMJ
    Arguments:n/a
    File size:5388968 bytes
    MD5 hash:ae65271c943d3451b7f026d1fadccea6

    General

    Start time:01:26:04
    Start date:15/01/2022
    Path:/tmp/J26H423OMJ
    Arguments:n/a
    File size:5388968 bytes
    MD5 hash:ae65271c943d3451b7f026d1fadccea6

    General

    Start time:01:26:09
    Start date:15/01/2022
    Path:/tmp/J26H423OMJ
    Arguments:n/a
    File size:5388968 bytes
    MD5 hash:ae65271c943d3451b7f026d1fadccea6

    General

    Start time:01:26:09
    Start date:15/01/2022
    Path:/tmp/J26H423OMJ
    Arguments:n/a
    File size:5388968 bytes
    MD5 hash:ae65271c943d3451b7f026d1fadccea6

    General

    Start time:01:26:04
    Start date:15/01/2022
    Path:/tmp/J26H423OMJ
    Arguments:n/a
    File size:5388968 bytes
    MD5 hash:ae65271c943d3451b7f026d1fadccea6

    General

    Start time:01:26:05
    Start date:15/01/2022
    Path:/tmp/J26H423OMJ
    Arguments:n/a
    File size:5388968 bytes
    MD5 hash:ae65271c943d3451b7f026d1fadccea6

    General

    Start time:01:22:54
    Start date:15/01/2022
    Path:/tmp/J26H423OMJ
    Arguments:n/a
    File size:5388968 bytes
    MD5 hash:ae65271c943d3451b7f026d1fadccea6

    General

    Start time:01:22:54
    Start date:15/01/2022
    Path:/tmp/J26H423OMJ
    Arguments:n/a
    File size:5388968 bytes
    MD5 hash:ae65271c943d3451b7f026d1fadccea6

    General

    Start time:01:22:54
    Start date:15/01/2022
    Path:/tmp/J26H423OMJ
    Arguments:n/a
    File size:5388968 bytes
    MD5 hash:ae65271c943d3451b7f026d1fadccea6

    General

    Start time:01:26:04
    Start date:15/01/2022
    Path:/tmp/J26H423OMJ
    Arguments:n/a
    File size:5388968 bytes
    MD5 hash:ae65271c943d3451b7f026d1fadccea6

    General

    Start time:01:26:04
    Start date:15/01/2022
    Path:/tmp/J26H423OMJ
    Arguments:n/a
    File size:5388968 bytes
    MD5 hash:ae65271c943d3451b7f026d1fadccea6

    General

    Start time:01:22:54
    Start date:15/01/2022
    Path:/tmp/J26H423OMJ
    Arguments:n/a
    File size:5388968 bytes
    MD5 hash:ae65271c943d3451b7f026d1fadccea6

    General

    Start time:01:22:54
    Start date:15/01/2022
    Path:/tmp/J26H423OMJ
    Arguments:n/a
    File size:5388968 bytes
    MD5 hash:ae65271c943d3451b7f026d1fadccea6

    General

    Start time:01:22:56
    Start date:15/01/2022
    Path:/tmp/J26H423OMJ
    Arguments:n/a
    File size:5388968 bytes
    MD5 hash:ae65271c943d3451b7f026d1fadccea6

    General

    Start time:01:22:56
    Start date:15/01/2022
    Path:/tmp/J26H423OMJ
    Arguments:n/a
    File size:5388968 bytes
    MD5 hash:ae65271c943d3451b7f026d1fadccea6

    General

    Start time:01:24:40
    Start date:15/01/2022
    Path:/tmp/J26H423OMJ
    Arguments:n/a
    File size:5388968 bytes
    MD5 hash:ae65271c943d3451b7f026d1fadccea6

    General

    Start time:01:24:40
    Start date:15/01/2022
    Path:/tmp/J26H423OMJ
    Arguments:n/a
    File size:5388968 bytes
    MD5 hash:ae65271c943d3451b7f026d1fadccea6