Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
Mozi.m

Overview

General Information

Sample Name:Mozi.m
Analysis ID:650139
MD5:59ce0baba11893f90527fc951ac69912
SHA1:5857a7dd621c4c3ebb0b5a3bec915d409f70d39f
SHA256:4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Sample contains only a LOAD segment without any section mappings
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
ELF contains segments with high entropy indicating compressed/encrypted content

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Non-zero exit code suggests an error during the execution. Lookup the error code for hints.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.
Joe Sandbox Version:35.0.0 Citrine
Analysis ID:650139
Start date and time: 22/06/202207:42:562022-06-22 07:42:56 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 7s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:Mozi.m
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal60.evad.linM@0/0@0/0
Command:/tmp/Mozi.m
PID:6231
Exit Code:133
Exit Code Info:
Killed:False
Standard Output:

Standard Error:qemu: uncaught target signal 5 (Trace/breakpoint trap) - core dumped
  • system is lnxubuntu20
  • Mozi.m (PID: 6231, Parent: 6129, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/Mozi.m
  • cleanup
SourceRuleDescriptionAuthorStrings
Mozi.mSUSP_ELF_LNX_UPX_Compressed_FileDetects a suspicious ELF binary with UPX compressionFlorian Roth
  • 0x20828:$s1: PROT_EXEC|PROT_WRITE failed.
  • 0x20897:$s2: $Id: UPX
  • 0x20848:$s3: $Info: This file is packed with the UPX executable packer
SourceRuleDescriptionAuthorStrings
6231.1.0000000010bd2900.00000000e293fe0c.r-x.sdmpSUSP_ELF_LNX_UPX_Compressed_FileDetects a suspicious ELF binary with UPX compressionFlorian Roth
  • 0x20828:$s1: PROT_EXEC|PROT_WRITE failed.
  • 0x20897:$s2: $Id: UPX
  • 0x20848:$s3: $Info: This file is packed with the UPX executable packer
No Snort rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: Mozi.mAvira: detected
Source: Mozi.mVirustotal: Detection: 65%Perma Link
Source: Mozi.mMetadefender: Detection: 41%Perma Link
Source: Mozi.mReversingLabs: Detection: 70%
Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: Mozi.mString found in binary or memory: http://upx.sf.net
Source: LOAD without section mappingsProgram segment: 0x400000
Source: Mozi.m, type: SAMPLEMatched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, reference = Internal Research, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4
Source: 6231.1.0000000010bd2900.00000000e293fe0c.r-x.sdmp, type: MEMORYMatched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, reference = Internal Research, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4
Source: classification engineClassification label: mal60.evad.linM@0/0@0/0

Data Obfuscation

barindex
Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sampleString containing UPX found: $Id: UPX 3.95 Copyright (C) 1996-2018 the UPX Team. All Rights Reserved. $
Source: Mozi.mSubmission file: segment LOAD with 7.8156 entropy (max. 8.0)
Source: /tmp/Mozi.m (PID: 6231)Queries kernel information via 'uname': Jump to behavior
Source: Mozi.m, 6231.1.00000000ec777324.0000000083cc2190.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mips
Source: Mozi.m, 6231.1.0000000065833679.00000000f7b12639.rw-.sdmpBinary or memory string: vx86_64/usr/bin/qemu-mips/tmp/Mozi.mSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Mozi.m
Source: Mozi.m, 6231.1.0000000065833679.00000000f7b12639.rw-.sdmpBinary or memory string: /usr/bin/qemu-mips
Source: Mozi.m, 6231.1.0000000065833679.00000000f7b12639.rw-.sdmpBinary or memory string: qemu: uncaught target signal 5 (Trace/breakpoint trap) - core dumped
Source: Mozi.m, 6231.1.00000000ec777324.0000000083cc2190.rw-.sdmpBinary or memory string: ,V!/etc/qemu-binfmt/mips
Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management InstrumentationPath InterceptionPath Interception11
Obfuscated Files or Information
OS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
Encrypted Channel
Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
Application Layer Protocol
Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
SourceDetectionScannerLabelLink
Mozi.m66%VirustotalBrowse
Mozi.m41%MetadefenderBrowse
Mozi.m71%ReversingLabsLinux.Trojan.Mirai
Mozi.m100%AviraLINUX/Mirai.dpaeh
No Antivirus matches
No Antivirus matches
No Antivirus matches
No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
http://upx.sf.netMozi.mfalse
    high
    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs
    IPDomainCountryFlagASNASN NameMalicious
    109.202.202.202
    unknownSwitzerland
    13030INIT7CHfalse
    91.189.91.43
    unknownUnited Kingdom
    41231CANONICAL-ASGBfalse
    91.189.91.42
    unknownUnited Kingdom
    41231CANONICAL-ASGBfalse
    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
    109.202.202.2029Wlxxr6nYw.elfGet hashmaliciousBrowse
      MIPSGet hashmaliciousBrowse
        SecuriteInfo.com.Linux.Mirai.4338.5915.2788Get hashmaliciousBrowse
          D2XRxbln0jGet hashmaliciousBrowse
            eNeC42CjPiGet hashmaliciousBrowse
              e4SwuQIOCsGet hashmaliciousBrowse
                uebj2shHRxGet hashmaliciousBrowse
                  TIKDt71jFmGet hashmaliciousBrowse
                    UUbbi2UE6IGet hashmaliciousBrowse
                      guQwtk8LXPGet hashmaliciousBrowse
                        ZYxT2ZxebLGet hashmaliciousBrowse
                          LU9FJx69kxGet hashmaliciousBrowse
                            lFuzO1U3ruGet hashmaliciousBrowse
                              on6s1PXAaxGet hashmaliciousBrowse
                                arm7Get hashmaliciousBrowse
                                  x86Get hashmaliciousBrowse
                                    x-3.2-.SakuraGet hashmaliciousBrowse
                                      m-i.p-s.SakuraGet hashmaliciousBrowse
                                        p-p.c-.SakuraGet hashmaliciousBrowse
                                          x-8.6-.SakuraGet hashmaliciousBrowse
                                            91.189.91.439Wlxxr6nYw.elfGet hashmaliciousBrowse
                                              MIPSGet hashmaliciousBrowse
                                                SecuriteInfo.com.Linux.Mirai.4338.5915.2788Get hashmaliciousBrowse
                                                  D2XRxbln0jGet hashmaliciousBrowse
                                                    eNeC42CjPiGet hashmaliciousBrowse
                                                      e4SwuQIOCsGet hashmaliciousBrowse
                                                        uebj2shHRxGet hashmaliciousBrowse
                                                          TIKDt71jFmGet hashmaliciousBrowse
                                                            UUbbi2UE6IGet hashmaliciousBrowse
                                                              guQwtk8LXPGet hashmaliciousBrowse
                                                                ZYxT2ZxebLGet hashmaliciousBrowse
                                                                  LU9FJx69kxGet hashmaliciousBrowse
                                                                    lFuzO1U3ruGet hashmaliciousBrowse
                                                                      on6s1PXAaxGet hashmaliciousBrowse
                                                                        arm7Get hashmaliciousBrowse
                                                                          x86Get hashmaliciousBrowse
                                                                            x-3.2-.SakuraGet hashmaliciousBrowse
                                                                              m-i.p-s.SakuraGet hashmaliciousBrowse
                                                                                p-p.c-.SakuraGet hashmaliciousBrowse
                                                                                  x-8.6-.SakuraGet hashmaliciousBrowse
                                                                                    No context
                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                    CANONICAL-ASGB9Wlxxr6nYw.elfGet hashmaliciousBrowse
                                                                                    • 91.189.91.42
                                                                                    MIPSGet hashmaliciousBrowse
                                                                                    • 91.189.91.42
                                                                                    SecuriteInfo.com.Linux.Mirai.4338.5915.2788Get hashmaliciousBrowse
                                                                                    • 91.189.91.42
                                                                                    D2XRxbln0jGet hashmaliciousBrowse
                                                                                    • 91.189.91.42
                                                                                    eNeC42CjPiGet hashmaliciousBrowse
                                                                                    • 91.189.91.42
                                                                                    e4SwuQIOCsGet hashmaliciousBrowse
                                                                                    • 91.189.91.42
                                                                                    uebj2shHRxGet hashmaliciousBrowse
                                                                                    • 91.189.91.42
                                                                                    TIKDt71jFmGet hashmaliciousBrowse
                                                                                    • 91.189.91.42
                                                                                    UUbbi2UE6IGet hashmaliciousBrowse
                                                                                    • 91.189.91.42
                                                                                    guQwtk8LXPGet hashmaliciousBrowse
                                                                                    • 91.189.91.42
                                                                                    ZYxT2ZxebLGet hashmaliciousBrowse
                                                                                    • 91.189.91.42
                                                                                    LU9FJx69kxGet hashmaliciousBrowse
                                                                                    • 91.189.91.42
                                                                                    lFuzO1U3ruGet hashmaliciousBrowse
                                                                                    • 91.189.91.42
                                                                                    on6s1PXAaxGet hashmaliciousBrowse
                                                                                    • 91.189.91.42
                                                                                    arm7Get hashmaliciousBrowse
                                                                                    • 91.189.91.42
                                                                                    x86Get hashmaliciousBrowse
                                                                                    • 91.189.91.42
                                                                                    x-3.2-.SakuraGet hashmaliciousBrowse
                                                                                    • 91.189.91.42
                                                                                    m-i.p-s.SakuraGet hashmaliciousBrowse
                                                                                    • 91.189.91.42
                                                                                    p-p.c-.SakuraGet hashmaliciousBrowse
                                                                                    • 91.189.91.42
                                                                                    x-8.6-.SakuraGet hashmaliciousBrowse
                                                                                    • 91.189.91.42
                                                                                    INIT7CH9Wlxxr6nYw.elfGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    MIPSGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    SecuriteInfo.com.Linux.Mirai.4338.5915.2788Get hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    D2XRxbln0jGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    eNeC42CjPiGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    e4SwuQIOCsGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    uebj2shHRxGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    TIKDt71jFmGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    UUbbi2UE6IGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    guQwtk8LXPGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    ZYxT2ZxebLGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    LU9FJx69kxGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    lFuzO1U3ruGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    on6s1PXAaxGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    arm7Get hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    x86Get hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    x-3.2-.SakuraGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    m-i.p-s.SakuraGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    p-p.c-.SakuraGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    x-8.6-.SakuraGet hashmaliciousBrowse
                                                                                    • 109.202.202.202
                                                                                    No context
                                                                                    No context
                                                                                    No created / dropped files found
                                                                                    File type:ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
                                                                                    Entropy (8bit):7.814832789965999
                                                                                    TrID:
                                                                                    • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
                                                                                    • ELF Executable and Linkable format (generic) (4004/1) 49.84%
                                                                                    File name:Mozi.m
                                                                                    File size:135784
                                                                                    MD5:59ce0baba11893f90527fc951ac69912
                                                                                    SHA1:5857a7dd621c4c3ebb0b5a3bec915d409f70d39f
                                                                                    SHA256:4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7
                                                                                    SHA512:c5b12797b477e5e5964a78766bb40b1c0d9fdfb8eef1f9aee3df451e3441a40c61d325bf400ba51048811b68e1c70a95f15e4166b7a65a4eca0c624864328647
                                                                                    SSDEEP:3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioP:p3lOYoaja8xzx/0wsxzSi2
                                                                                    TLSH:E5D3128BEF36DC1ECF001EB226DA5B9E9C6D756B41CBF0A4B9C1818F13A01C97D52215
                                                                                    File Content Preview:.ELF.....................B.....4.........4. ...(.............@...@...........................C...C......../..........*.*UPX!.X.....................^....|.$..ELF..........@.`....4...0... ...(......<...@......[v......H...`.t..;_...dt.Q.....].M..............

                                                                                    ELF header

                                                                                    Class:ELF32
                                                                                    Data:2's complement, big endian
                                                                                    Version:1 (current)
                                                                                    Machine:MIPS R3000
                                                                                    Version Number:0x1
                                                                                    Type:EXEC (Executable file)
                                                                                    OS/ABI:UNIX - System V
                                                                                    ABI Version:0
                                                                                    Entry Point Address:0x4206a8
                                                                                    Flags:0x1007
                                                                                    ELF Header Size:52
                                                                                    Program Header Offset:52
                                                                                    Program Header Size:32
                                                                                    Number of Program Headers:2
                                                                                    Section Header Offset:0
                                                                                    Section Header Size:40
                                                                                    Number of Section Headers:0
                                                                                    Header String Table Index:0
                                                                                    TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                                                    LOAD0x00x4000000x4000000x210f20x210f27.81560x5R E0x10000
                                                                                    LOAD0x00x4300000x4300000x00x92fd80.00000x6RW 0x10000
                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                    Jun 22, 2022 07:43:43.754591942 CEST42836443192.168.2.2391.189.91.43
                                                                                    Jun 22, 2022 07:43:44.524537086 CEST4251680192.168.2.23109.202.202.202
                                                                                    Jun 22, 2022 07:43:58.601978064 CEST43928443192.168.2.2391.189.91.42
                                                                                    Jun 22, 2022 07:44:10.889358044 CEST42836443192.168.2.2391.189.91.43
                                                                                    Jun 22, 2022 07:44:14.985119104 CEST4251680192.168.2.23109.202.202.202
                                                                                    Jun 22, 2022 07:44:39.559787035 CEST43928443192.168.2.2391.189.91.42

                                                                                    System Behavior

                                                                                    Start time:07:43:41
                                                                                    Start date:22/06/2022
                                                                                    Path:/tmp/Mozi.m
                                                                                    Arguments:/tmp/Mozi.m
                                                                                    File size:5777432 bytes
                                                                                    MD5 hash:0083f1f0e77be34ad27f849842bbb00c