Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
Mozi.m

Overview

General Information

Sample Name:Mozi.m
Analysis ID:584698
MD5:3849f30b51a5c49e8d1546960cc206c7
SHA1:61c74136534b826059c63221a2373dc0613a47b7
SHA256:f6c97b1e2ed02578ca1066c8235ba4f991e645f89012406c639dbccc6582eec8
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Sample contains only a LOAD segment without any section mappings
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Non-zero exit code suggests an error during the execution. Lookup the error code for hints.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.
Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:584698
Start date:08.03.2022
Start time:01:58:43
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 12s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:Mozi.m
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal60.evad.linM@0/0@0/0
Command:/tmp/Mozi.m
Exit Code:133
Exit Code Info:
Killed:False
Standard Output:

Standard Error:qemu: uncaught target signal 5 (Trace/breakpoint trap) - core dumped
  • system is lnxubuntu20
  • Mozi.m (PID: 5223, Parent: 5119, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/Mozi.m
  • cleanup
SourceRuleDescriptionAuthorStrings
Mozi.mSUSP_ELF_LNX_UPX_Compressed_FileDetects a suspicious ELF binary with UPX compressionFlorian Roth
  • 0x20ec8:$s1: PROT_EXEC|PROT_WRITE failed.
  • 0x20f37:$s2: $Id: UPX
  • 0x20ee8:$s3: $Info: This file is packed with the UPX executable packer
SourceRuleDescriptionAuthorStrings
5223.1.00000000a9257ffb.0000000069d4eb3c.r-x.sdmpSUSP_ELF_LNX_UPX_Compressed_FileDetects a suspicious ELF binary with UPX compressionFlorian Roth
  • 0x20ec8:$s1: PROT_EXEC|PROT_WRITE failed.
  • 0x20f37:$s2: $Id: UPX
  • 0x20ee8:$s3: $Info: This file is packed with the UPX executable packer

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: Mozi.mAvira: detected
Source: Mozi.mVirustotal: Detection: 65%Perma Link
Source: Mozi.mMetadefender: Detection: 48%Perma Link
Source: Mozi.mReversingLabs: Detection: 69%
Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 196.170.57.55
Source: unknownTCP traffic detected without corresponding DNS query: 111.26.81.99
Source: unknownTCP traffic detected without corresponding DNS query: 111.26.81.99
Source: unknownTCP traffic detected without corresponding DNS query: 111.26.81.99
Source: Mozi.mString found in binary or memory: http://upx.sf.net
Source: LOAD without section mappingsProgram segment: 0x400000
Source: Mozi.m, type: SAMPLEMatched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, reference = Internal Research, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4
Source: 5223.1.00000000a9257ffb.0000000069d4eb3c.r-x.sdmp, type: MEMORYMatched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, reference = Internal Research, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4
Source: classification engineClassification label: mal60.evad.linM@0/0@0/0

Data Obfuscation

barindex
Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sampleString containing UPX found: $Id: UPX 3.95 Copyright (C) 1996-2018 the UPX Team. All Rights Reserved. $
Source: /tmp/Mozi.m (PID: 5223)Queries kernel information via 'uname': Jump to behavior
Source: Mozi.m, 5223.1.000000007a04d02b.00000000ef196140.rw-.sdmpBinary or memory string: ~qemu: uncaught target signal 5 (Trace/breakpoint trap) - core dumped
Source: Mozi.m, 5223.1.000000007a04d02b.00000000ef196140.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/Mozi.mSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Mozi.m
Source: Mozi.m, 5223.1.000000003acac292.00000000453eedfe.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mipsel
Source: Mozi.m, 5223.1.000000003acac292.00000000453eedfe.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/mipsel
Source: Mozi.m, 5223.1.000000007a04d02b.00000000ef196140.rw-.sdmpBinary or memory string: qemu: uncaught target signal 5 (Trace/breakpoint trap) - core dumped
Source: Mozi.m, 5223.1.000000007a04d02b.00000000ef196140.rw-.sdmpBinary or memory string: /usr/bin/qemu-mipsel
Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
Obfuscated Files or Information
OS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
Encrypted Channel
Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
Application Layer Protocol
Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
SourceDetectionScannerLabelLink
Mozi.m65%VirustotalBrowse
Mozi.m49%MetadefenderBrowse
Mozi.m70%ReversingLabsLinux.Trojan.Mirai
Mozi.m100%AviraLINUX/Mirai.trcie
No Antivirus matches
No Antivirus matches
No Antivirus matches
No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
http://upx.sf.netMozi.mfalse
    high
    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs
    IPDomainCountryFlagASNASN NameMalicious
    196.170.57.55
    unknownTogo
    24691TOGOTEL-ASTogoTelecomTogoTGfalse
    109.202.202.202
    unknownSwitzerland
    13030INIT7CHfalse
    91.189.91.43
    unknownUnited Kingdom
    41231CANONICAL-ASGBfalse
    91.189.91.42
    unknownUnited Kingdom
    41231CANONICAL-ASGBfalse
    111.26.81.99
    unknownChina
    134810CMNET-JILIN-AS-APChinaMobileGroupJiLincommunicationscofalse
    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
    109.202.202.202JU0kALEaN9Get hashmaliciousBrowse
      4vDzs1Oo0fGet hashmaliciousBrowse
        ObohesNIQPGet hashmaliciousBrowse
          n9wAX4nOESGet hashmaliciousBrowse
            jXp0aTiYqgGet hashmaliciousBrowse
              vtECDjIv5RGet hashmaliciousBrowse
                3A7PSUpOMYGet hashmaliciousBrowse
                  gnxSOH7bmwGet hashmaliciousBrowse
                    y1nhDbf8n4Get hashmaliciousBrowse
                      U9ElMa357kGet hashmaliciousBrowse
                        x1AFk63IJZGet hashmaliciousBrowse
                          QaPFI9U62uGet hashmaliciousBrowse
                            z1fZVdYR53Get hashmaliciousBrowse
                              IAfiLdVznDGet hashmaliciousBrowse
                                HLZVxM1TwuGet hashmaliciousBrowse
                                  SSV667s46EGet hashmaliciousBrowse
                                    4qGlQ9lUQkGet hashmaliciousBrowse
                                      ILGB1XZ8PpGet hashmaliciousBrowse
                                        Cronusarm7Get hashmaliciousBrowse
                                          Cronusarm6Get hashmaliciousBrowse
                                            91.189.91.43JU0kALEaN9Get hashmaliciousBrowse
                                              4vDzs1Oo0fGet hashmaliciousBrowse
                                                ObohesNIQPGet hashmaliciousBrowse
                                                  n9wAX4nOESGet hashmaliciousBrowse
                                                    jXp0aTiYqgGet hashmaliciousBrowse
                                                      vtECDjIv5RGet hashmaliciousBrowse
                                                        3A7PSUpOMYGet hashmaliciousBrowse
                                                          gnxSOH7bmwGet hashmaliciousBrowse
                                                            y1nhDbf8n4Get hashmaliciousBrowse
                                                              U9ElMa357kGet hashmaliciousBrowse
                                                                x1AFk63IJZGet hashmaliciousBrowse
                                                                  QaPFI9U62uGet hashmaliciousBrowse
                                                                    z1fZVdYR53Get hashmaliciousBrowse
                                                                      IAfiLdVznDGet hashmaliciousBrowse
                                                                        HLZVxM1TwuGet hashmaliciousBrowse
                                                                          SSV667s46EGet hashmaliciousBrowse
                                                                            4qGlQ9lUQkGet hashmaliciousBrowse
                                                                              ILGB1XZ8PpGet hashmaliciousBrowse
                                                                                Cronusarm7Get hashmaliciousBrowse
                                                                                  Cronusarm6Get hashmaliciousBrowse
                                                                                    No context
                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                    TOGOTEL-ASTogoTelecomTogoTGxjO2lyWgAVGet hashmaliciousBrowse
                                                                                    • 196.168.24.201
                                                                                    Ty233XSYtMGet hashmaliciousBrowse
                                                                                    • 196.168.72.122
                                                                                    w1mPIlKA17Get hashmaliciousBrowse
                                                                                    • 196.168.72.179
                                                                                    loligang.mpslGet hashmaliciousBrowse
                                                                                    • 196.169.98.177
                                                                                    KaWlpYPqwsGet hashmaliciousBrowse
                                                                                    • 196.171.217.106
                                                                                    5fAPZmn63MGet hashmaliciousBrowse
                                                                                    • 196.171.66.187
                                                                                    http___195.133.18.119_beastmode_b3astmode.mpslGet hashmaliciousBrowse
                                                                                    • 196.170.40.197
                                                                                    rYTbXjTHKIGet hashmaliciousBrowse
                                                                                    • 196.168.72.130
                                                                                    K5LXSGIoKRGet hashmaliciousBrowse
                                                                                    • 196.168.72.129
                                                                                    oWgux8eWLFGet hashmaliciousBrowse
                                                                                    • 196.168.72.143
                                                                                    rdXgLw2MBpGet hashmaliciousBrowse
                                                                                    • 196.170.140.184
                                                                                    6V9uZ6cydeGet hashmaliciousBrowse
                                                                                    • 196.170.140.129
                                                                                    kET53Ai3yKGet hashmaliciousBrowse
                                                                                    • 196.170.140.186
                                                                                    hY2x9ljVgHGet hashmaliciousBrowse
                                                                                    • 196.168.72.180
                                                                                    PKESJ2R94JGet hashmaliciousBrowse
                                                                                    • 196.170.230.152
                                                                                    qsy7sBs2QRGet hashmaliciousBrowse
                                                                                    • 196.168.72.122
                                                                                    apep.armGet hashmaliciousBrowse
                                                                                    • 196.168.72.186
                                                                                    iKDocbdHiSGet hashmaliciousBrowse
                                                                                    • 196.168.72.148
                                                                                    AzPnARFc9gGet hashmaliciousBrowse
                                                                                    • 196.168.72.144
                                                                                    905up3u4pEGet hashmaliciousBrowse
                                                                                    • 196.169.213.246
                                                                                    INIT7CHJU0kALEaN9Get hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    4vDzs1Oo0fGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    ObohesNIQPGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    n9wAX4nOESGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    jXp0aTiYqgGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    vtECDjIv5RGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    3A7PSUpOMYGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    gnxSOH7bmwGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    y1nhDbf8n4Get hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    U9ElMa357kGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    x1AFk63IJZGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    QaPFI9U62uGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    z1fZVdYR53Get hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    IAfiLdVznDGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    HLZVxM1TwuGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    SSV667s46EGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    4qGlQ9lUQkGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    ILGB1XZ8PpGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    Cronusarm7Get hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    Cronusarm6Get hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    No context
                                                                                    No context
                                                                                    No created / dropped files found
                                                                                    File type:ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
                                                                                    Entropy (8bit):7.812868686187402
                                                                                    TrID:
                                                                                    • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                                                    File name:Mozi.m
                                                                                    File size:137480
                                                                                    MD5:3849f30b51a5c49e8d1546960cc206c7
                                                                                    SHA1:61c74136534b826059c63221a2373dc0613a47b7
                                                                                    SHA256:f6c97b1e2ed02578ca1066c8235ba4f991e645f89012406c639dbccc6582eec8
                                                                                    SHA512:43d79293d1fbf716111c27e50df95a0860a0d706079625fa2b8a6b57c5ee06fa7b5b6b8c0acae33714a2181686426728513c990534e44b6f03a05dde0629ab86
                                                                                    SSDEEP:3072:biMYFJvw6Yh0b1gKobtCGCmCRlrisfrYm:fYFJvwe1gKCYVl2szN
                                                                                    File Content Preview:.ELF....................p.B.4...........4. ...(...............@...@...........................C...C....../..............UPX!0...................]........?d..ELF.......`.@.....4.p....... ...(.....-....@......n'.......H..._....=..Q.td.............@.........

                                                                                    ELF header

                                                                                    Class:ELF32
                                                                                    Data:2's complement, little endian
                                                                                    Version:1 (current)
                                                                                    Machine:MIPS R3000
                                                                                    Version Number:0x1
                                                                                    Type:EXEC (Executable file)
                                                                                    OS/ABI:UNIX - System V
                                                                                    ABI Version:0
                                                                                    Entry Point Address:0x420d70
                                                                                    Flags:0x1007
                                                                                    ELF Header Size:52
                                                                                    Program Header Offset:52
                                                                                    Program Header Size:32
                                                                                    Number of Program Headers:2
                                                                                    Section Header Offset:0
                                                                                    Section Header Size:40
                                                                                    Number of Section Headers:0
                                                                                    Header String Table Index:0
                                                                                    TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                                                    LOAD0x00x4000000x4000000x217960x217964.44050x5R E0x10000
                                                                                    LOAD0x00x4300000x4300000x00x92f180.00000x6RW 0x10000
                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                    Mar 8, 2022 01:59:28.281141996 CET42836443192.168.2.2391.189.91.43
                                                                                    Mar 8, 2022 01:59:29.049017906 CET4251680192.168.2.23109.202.202.202
                                                                                    Mar 8, 2022 01:59:43.126049042 CET43928443192.168.2.2391.189.91.42
                                                                                    Mar 8, 2022 01:59:55.411525011 CET42836443192.168.2.2391.189.91.43
                                                                                    Mar 8, 2022 01:59:59.506731987 CET4251680192.168.2.23109.202.202.202
                                                                                    Mar 8, 2022 02:00:24.077265024 CET43928443192.168.2.2391.189.91.42
                                                                                    Mar 8, 2022 02:00:34.018754005 CET2340810196.170.57.55192.168.2.23
                                                                                    Mar 8, 2022 02:00:34.018973112 CET4081023192.168.2.23196.170.57.55
                                                                                    Mar 8, 2022 02:00:44.247303009 CET2345232111.26.81.99192.168.2.23
                                                                                    Mar 8, 2022 02:00:44.247328043 CET2345232111.26.81.99192.168.2.23
                                                                                    Mar 8, 2022 02:00:44.247337103 CET2345232111.26.81.99192.168.2.23
                                                                                    Mar 8, 2022 02:00:44.247519016 CET4523223192.168.2.23111.26.81.99
                                                                                    Mar 8, 2022 02:00:44.247565031 CET4523223192.168.2.23111.26.81.99
                                                                                    Mar 8, 2022 02:00:44.247575998 CET4523223192.168.2.23111.26.81.99

                                                                                    System Behavior

                                                                                    Start time:01:59:27
                                                                                    Start date:08/03/2022
                                                                                    Path:/tmp/Mozi.m
                                                                                    Arguments:/tmp/Mozi.m
                                                                                    File size:5773336 bytes
                                                                                    MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9