Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
tU468ylYjx

Overview

General Information

Sample Name:tU468ylYjx
Analysis ID:626477
MD5:1f435b2e68e159ee636a17bf3552d7de
SHA1:8c76b05125e6bf6c32f72934181d52fd07ba9ad9
SHA256:2a918615507819ee0c0c1c1ced7afd8ab35e44488b78340273c39e5fd60c77a3
Tags:32elfmiraipowerpc
Infos:

Detection

Mirai
Score:64
Range:0 - 100
Whitelisted:false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample contains only a LOAD segment without any section mappings
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:626477
Start date and time: 14/05/202204:25:242022-05-14 04:25:24 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 6m 50s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:tU468ylYjx
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal64.troj.evad.lin@0/0@0/0
  • Report size exceeded maximum capacity and may have missing network information.
Command:/tmp/tU468ylYjx
PID:6224
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Connected To CNC
Standard Error:
  • system is lnxubuntu20
  • cleanup
SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security
    No Snort rule has matched

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Source: tU468ylYjxVirustotal: Detection: 39%Perma Link

    Networking

    barindex
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 45984
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46012
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46028
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46040
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46056
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46068
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46080
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46086
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46092
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46114
    Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
    Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
    Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
    Source: global trafficTCP traffic: 192.168.2.23:60988 -> 107.172.197.117:1312
    Source: /tmp/tU468ylYjx (PID: 6226)Socket: 0.0.0.0::0Jump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)Socket: 0.0.0.0::0Jump to behavior
    Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
    Source: unknownTCP traffic detected without corresponding DNS query: 107.172.197.117
    Source: unknownTCP traffic detected without corresponding DNS query: 12.163.181.164
    Source: unknownTCP traffic detected without corresponding DNS query: 124.201.35.249
    Source: unknownTCP traffic detected without corresponding DNS query: 171.213.184.249
    Source: unknownTCP traffic detected without corresponding DNS query: 13.176.229.145
    Source: unknownTCP traffic detected without corresponding DNS query: 40.189.128.38
    Source: unknownTCP traffic detected without corresponding DNS query: 81.1.19.123
    Source: unknownTCP traffic detected without corresponding DNS query: 44.239.254.250
    Source: unknownTCP traffic detected without corresponding DNS query: 195.248.207.10
    Source: unknownTCP traffic detected without corresponding DNS query: 125.160.224.12
    Source: unknownTCP traffic detected without corresponding DNS query: 176.219.82.86
    Source: unknownTCP traffic detected without corresponding DNS query: 181.167.224.33
    Source: unknownTCP traffic detected without corresponding DNS query: 192.158.30.22
    Source: unknownTCP traffic detected without corresponding DNS query: 164.121.109.58
    Source: unknownTCP traffic detected without corresponding DNS query: 255.50.154.97
    Source: unknownTCP traffic detected without corresponding DNS query: 195.182.138.20
    Source: unknownTCP traffic detected without corresponding DNS query: 34.87.70.255
    Source: unknownTCP traffic detected without corresponding DNS query: 84.179.75.208
    Source: unknownTCP traffic detected without corresponding DNS query: 153.32.229.82
    Source: unknownTCP traffic detected without corresponding DNS query: 167.144.133.226
    Source: unknownTCP traffic detected without corresponding DNS query: 165.129.120.248
    Source: unknownTCP traffic detected without corresponding DNS query: 23.135.109.15
    Source: unknownTCP traffic detected without corresponding DNS query: 130.209.114.86
    Source: unknownTCP traffic detected without corresponding DNS query: 201.237.134.237
    Source: unknownTCP traffic detected without corresponding DNS query: 90.177.55.159
    Source: unknownTCP traffic detected without corresponding DNS query: 142.111.164.126
    Source: unknownTCP traffic detected without corresponding DNS query: 194.175.222.234
    Source: unknownTCP traffic detected without corresponding DNS query: 102.170.32.54
    Source: unknownTCP traffic detected without corresponding DNS query: 65.33.147.242
    Source: unknownTCP traffic detected without corresponding DNS query: 162.35.238.129
    Source: unknownTCP traffic detected without corresponding DNS query: 68.39.20.181
    Source: unknownTCP traffic detected without corresponding DNS query: 82.242.120.172
    Source: unknownTCP traffic detected without corresponding DNS query: 160.75.41.82
    Source: unknownTCP traffic detected without corresponding DNS query: 54.61.51.66
    Source: unknownTCP traffic detected without corresponding DNS query: 8.111.142.254
    Source: unknownTCP traffic detected without corresponding DNS query: 202.134.62.135
    Source: unknownTCP traffic detected without corresponding DNS query: 130.227.86.83
    Source: unknownTCP traffic detected without corresponding DNS query: 182.166.35.149
    Source: unknownTCP traffic detected without corresponding DNS query: 146.188.246.197
    Source: unknownTCP traffic detected without corresponding DNS query: 252.177.70.187
    Source: unknownTCP traffic detected without corresponding DNS query: 103.112.133.170
    Source: unknownTCP traffic detected without corresponding DNS query: 27.173.221.44
    Source: unknownTCP traffic detected without corresponding DNS query: 59.64.215.233
    Source: unknownTCP traffic detected without corresponding DNS query: 167.152.64.82
    Source: unknownTCP traffic detected without corresponding DNS query: 95.212.120.53
    Source: unknownTCP traffic detected without corresponding DNS query: 197.18.69.91
    Source: unknownTCP traffic detected without corresponding DNS query: 36.235.194.65
    Source: unknownTCP traffic detected without corresponding DNS query: 162.206.45.56
    Source: unknownTCP traffic detected without corresponding DNS query: 77.5.227.75
    Source: tU468ylYjxString found in binary or memory: http://upx.sf.net
    Source: LOAD without section mappingsProgram segment: 0x100000
    Source: /tmp/tU468ylYjx (PID: 6226)SIGKILL sent: pid: 936, result: successfulJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)SIGKILL sent: pid: 936, result: successfulJump to behavior
    Source: classification engineClassification label: mal64.troj.evad.lin@0/0@0/0

    Data Obfuscation

    barindex
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/491/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/793/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/772/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/796/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/774/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/797/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/777/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/799/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/658/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/912/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/759/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/936/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/918/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/1/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/761/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/785/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/884/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/720/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/721/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/788/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/789/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/800/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/801/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/847/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6232)File opened: /proc/904/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/491/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/793/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/772/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/796/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/774/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/797/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/777/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/799/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/658/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/912/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/759/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/936/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/918/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/1/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/761/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/785/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/884/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/720/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/721/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/788/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/789/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/800/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/801/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/847/fdJump to behavior
    Source: /tmp/tU468ylYjx (PID: 6226)File opened: /proc/904/fdJump to behavior

    Hooking and other Techniques for Hiding and Protection

    barindex
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 45984
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46012
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46028
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46040
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46056
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46068
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46080
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46086
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46092
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46114
    Source: /tmp/tU468ylYjx (PID: 6224)Queries kernel information via 'uname': Jump to behavior
    Source: tU468ylYjx, 6224.1.0000000051be361b.00000000322ed218.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
    Source: tU468ylYjx, 6226.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6323.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6340.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6328.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6227.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6333.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6233.1.0000000051be361b.00000000322ed218.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc1
    Source: tU468ylYjx, 6224.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6226.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6323.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6340.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6328.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6227.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6333.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6233.1.0000000051be361b.00000000322ed218.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/ppc
    Source: tU468ylYjx, 6224.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6226.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6323.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6340.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6328.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6227.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6333.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6233.1.00000000631a968b.0000000029cdfeac.rw-.sdmpBinary or memory string: /usr/bin/qemu-ppc
    Source: tU468ylYjx, 6224.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6226.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6323.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6340.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6328.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6227.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6333.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6233.1.00000000631a968b.0000000029cdfeac.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-ppc/tmp/tU468ylYjxSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/tU468ylYjx

    Stealing of Sensitive Information

    barindex
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Remote Access Functionality

    barindex
    Source: Yara matchFile source: dump.pcap, type: PCAP
    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
    Obfuscated Files or Information
    1
    OS Credential Dumping
    11
    Security Software Discovery
    Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
    Encrypted Channel
    Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth11
    Non-Standard Port
    Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
    Application Layer Protocol
    Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    No configs have been found
    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 626477 Sample: tU468ylYjx Startdate: 14/05/2022 Architecture: LINUX Score: 64 42 66.239.22.93 XO-AS15US United States 2->42 44 185.210.112.87 WIME-ASIT Italy 2->44 46 98 other IPs or domains 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected Mirai 2->50 52 Uses known network protocols on non-standard ports 2->52 54 Sample is packed with UPX 2->54 10 tU468ylYjx 2->10         started        signatures3 process4 process5 12 tU468ylYjx 10->12         started        14 tU468ylYjx 10->14         started        16 tU468ylYjx 10->16         started        process6 18 tU468ylYjx 12->18         started        20 tU468ylYjx 12->20         started        22 tU468ylYjx 14->22         started        24 tU468ylYjx 14->24         started        26 tU468ylYjx 14->26         started        process7 28 tU468ylYjx 18->28         started        30 tU468ylYjx 18->30         started        32 tU468ylYjx 18->32         started        34 tU468ylYjx 22->34         started        36 tU468ylYjx 22->36         started        process8 38 tU468ylYjx 28->38         started        40 tU468ylYjx 28->40         started       
    SourceDetectionScannerLabelLink
    tU468ylYjx39%VirustotalBrowse
    No Antivirus matches
    No Antivirus matches
    No Antivirus matches
    No contacted domains info
    NameSourceMaliciousAntivirus DetectionReputation
    http://upx.sf.nettU468ylYjxfalse
      high
      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs
      IPDomainCountryFlagASNASN NameMalicious
      124.75.165.150
      unknownChina
      4812CHINANET-SH-APChinaTelecomGroupCNfalse
      216.92.92.101
      unknownUnited States
      7859PAIR-NETWORKSUSfalse
      150.217.3.109
      unknownItaly
      137ASGARRConsortiumGARREUfalse
      244.158.124.82
      unknownReserved
      unknownunknownfalse
      170.248.7.61
      unknownUnited States
      21433ACCENTUREFSSCLondonDCGBfalse
      71.99.94.185
      unknownUnited States
      5650FRONTIER-FRTRUSfalse
      208.165.164.65
      unknownUnited States
      3561CENTURYLINK-LEGACY-SAVVISUSfalse
      220.210.235.162
      unknownJapan18144AS-ENECOMEnergiaCommunicationsIncJPfalse
      125.76.82.63
      unknownChina
      4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      83.207.100.101
      unknownFrance
      3215FranceTelecom-OrangeFRfalse
      174.140.145.193
      unknownUnited States
      29748QTS-ASHUSfalse
      248.171.46.242
      unknownReserved
      unknownunknownfalse
      35.255.218.17
      unknownUnited States
      3549LVLT-3549USfalse
      78.110.158.83
      unknownRussian Federation