Edit tour

# Linux Analysis Report JTRoTsbtta.elf

## Overview

### General Information

 Sample Name: JTRoTsbtta.elf Analysis ID: 756331 MD5: a13d93164b6015407938dac68c380990 SHA1: ab5c6f3b316f689db45efd079de452ea44c115f8 SHA256: 17acb276d0c8b60d2956aca60d3635fd5f720b018d5eacba149ac1394187535e Tags: 32elfintelmirai Infos:

### Detection

Mirai
 Score: 72 Range: 0 - 100 Whitelisted: false

### Signatures

Malicious sample detected (through community Yara rule)
Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Sample tries to kill multiple processes (SIGKILL)
Sample contains only a LOAD segment without any section mappings
Yara signature match
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample tries to kill a process (SIGKILL)
ELF contains segments with high entropy indicating compressed/encrypted content

### Classification

 All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
 Joe Sandbox Version: 36.0.0 Rainbow Opal Analysis ID: 756331 Start date and time: 2022-11-30 01:44:39 +01:00 Joe Sandbox Product: CloudBasic Overall analysis duration: 0h 5m 23s Hypervisor based Inspection enabled: false Report type: full Sample file name: JTRoTsbtta.elf Cookbook file name: defaultlinuxfilecookbook.jbs Analysis system description: Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11) Analysis Mode: default Detection: MAL Classification: mal72.spre.troj.evad.linELF@0/0@0/0
 Command: /tmp/JTRoTsbtta.elf PID: 6230 Exit Code: 0 Exit Code Info: Killed: False Standard Output: lzrd cock fest"/proc/"/exe Standard Error:
• system is lnxubuntu20
• wrapper-2.0 (PID: 6237, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
• wrapper-2.0 (PID: 6238, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
• wrapper-2.0 (PID: 6239, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
• wrapper-2.0 (PID: 6240, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
• wrapper-2.0 (PID: 6242, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
• cleanup
SourceRuleDescriptionAuthorStrings
JTRoTsbtta.elfLinux_Trojan_Gafgyt_ea92cca8unknownunknown
• 0x4417:\$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
SourceRuleDescriptionAuthorStrings
6232.1.0000000008048000.0000000008054000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
6232.1.0000000008048000.0000000008054000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
• 0xa820:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0xa834:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0xa848:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0xa85c:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0xa870:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0xa884:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0xa898:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0xa8ac:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0xa8c0:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0xa8d4:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0xa8e8:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0xa8fc:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0xa910:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0xa924:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0xa938:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0xa94c:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0xa960:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0xa974:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0xa988:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0xa99c:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0xa9b0:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6232.1.0000000008048000.0000000008054000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
• 0xad78:\$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6232.1.0000000008048000.0000000008054000.r-x.sdmpLinux_Trojan_Mirai_b14f4c5dunknownunknown
• 0x5990:\$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6232.1.0000000008048000.0000000008054000.r-x.sdmpLinux_Trojan_Mirai_88de437funknownunknown
• 0x7d02:\$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
Click to see the 22 entries
No Snort rule has matched

### AV Detection

 Source: JTRoTsbtta.elf ReversingLabs: Detection: 48% Source: JTRoTsbtta.elf Virustotal: Detection: 46% Perma Link
 Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443 Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80 Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
 Source: global traffic TCP traffic: 192.168.2.23:35438 -> 212.86.104.147:3778
 Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443 Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
 Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43 Source: unknown TCP traffic detected without corresponding DNS query: 212.86.104.147 Source: unknown TCP traffic detected without corresponding DNS query: 212.86.104.147 Source: unknown TCP traffic detected without corresponding DNS query: 212.86.104.147 Source: unknown TCP traffic detected without corresponding DNS query: 212.86.104.147 Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202 Source: unknown TCP traffic detected without corresponding DNS query: 212.86.104.147 Source: unknown TCP traffic detected without corresponding DNS query: 212.86.104.147 Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42 Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43 Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202 Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
 Source: JTRoTsbtta.elf String found in binary or memory: http://upx.sf.net

### System Summary

 Source: JTRoTsbtta.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown Source: 6232.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown Source: 6232.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown Source: 6232.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown Source: 6232.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown Source: 6232.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown Source: 6232.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown Source: 6232.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown Source: 6232.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown Source: 6233.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown Source: 6233.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown Source: 6233.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown Source: 6233.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown Source: 6233.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown Source: 6233.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown Source: 6233.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown Source: 6233.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown Source: 6230.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown Source: 6230.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown Source: 6230.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown Source: 6230.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown Source: 6230.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown Source: 6230.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown Source: 6230.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown Source: 6230.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown