Edit tour

# Linux Analysis Report ZuCtGOdazy.elf

## Overview

### General Information

 Sample Name: ZuCtGOdazy.elf Analysis ID: 756335 MD5: 9c5901e0d822839ef3b090b12ef905db SHA1: 2435914fdaa21e6b4a628da4871b0f67a8a7b4ea SHA256: 96e68ef121527c25c30fa8a29764e81e83a0b8b907eb6e3993cfa1a233818424 Tags: 32armelfmirai Infos:

### Detection

Mirai
 Score: 72 Range: 0 - 100 Whitelisted: false

### Signatures

Malicious sample detected (through community Yara rule)
Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Sample tries to kill multiple processes (SIGKILL)
Sample contains only a LOAD segment without any section mappings
Yara signature match
Creates hidden files and/or directories
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample tries to kill a process (SIGKILL)
ELF contains segments with high entropy indicating compressed/encrypted content

### Classification

 Static ELF header machine description suggests that the sample might not execute correctly on this machine.
 All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
 Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.
 Joe Sandbox Version: 36.0.0 Rainbow Opal Analysis ID: 756335 Start date and time: 2022-11-30 01:57:57 +01:00 Joe Sandbox Product: CloudBasic Overall analysis duration: 0h 5m 49s Hypervisor based Inspection enabled: false Report type: full Sample file name: ZuCtGOdazy.elf Cookbook file name: defaultlinuxfilecookbook.jbs Analysis system description: Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11) Analysis Mode: default Detection: MAL Classification: mal72.spre.troj.evad.linELF@0/0@0/0
 Command: /tmp/ZuCtGOdazy.elf PID: 6222 Exit Code: 0 Exit Code Info: Killed: False Standard Output: lzrd cock fest"/proc/"/exe Standard Error:
• system is lnxubuntu20
• wrapper-2.0 (PID: 6235, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
• wrapper-2.0 (PID: 6236, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
• wrapper-2.0 (PID: 6237, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
• wrapper-2.0 (PID: 6238, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
• wrapper-2.0 (PID: 6240, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
• xfconfd (PID: 6246, Parent: 6245, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
• cleanup
SourceRuleDescriptionAuthorStrings
ZuCtGOdazy.elfSUSP_ELF_LNX_UPX_Compressed_FileDetects a suspicious ELF binary with UPX compressionFlorian Roth
• 0x743c:\$s1: PROT_EXEC|PROT_WRITE failed.
• 0x74ab:\$s2: \$Id: UPX
• 0x745c:\$s3: \$Info: This file is packed with the UPX executable packer
SourceRuleDescriptionAuthorStrings
6226.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
6226.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
• 0x11dec:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11e00:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11e14:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11e28:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11e3c:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11e50:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11e64:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11e78:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11e8c:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11ea0:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11eb4:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11ec8:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11edc:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11ef0:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11f04:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11f18:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11f2c:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11f40:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11f54:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11f68:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11f7c:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6226.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
• 0x12344:\$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6222.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
6222.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
• 0x11dec:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11e00:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11e14:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11e28:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11e3c:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11e50:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11e64:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11e78:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11e8c:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11ea0:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11eb4:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11ec8:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11edc:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11ef0:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11f04:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11f18:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11f2c:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11f40:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11f54:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11f68:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x11f7c:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 6 entries
No Snort rule has matched

### AV Detection

 Source: ZuCtGOdazy.elf ReversingLabs: Detection: 43% Source: ZuCtGOdazy.elf Virustotal: Detection: 44% Perma Link
 Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443 Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80 Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
 Source: global traffic TCP traffic: 192.168.2.23:35438 -> 212.86.104.147:3778
 Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443 Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
 Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43 Source: unknown TCP traffic detected without corresponding DNS query: 212.86.104.147 Source: unknown TCP traffic detected without corresponding DNS query: 212.86.104.147 Source: unknown TCP traffic detected without corresponding DNS query: 212.86.104.147 Source: unknown TCP traffic detected without corresponding DNS query: 212.86.104.147 Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202 Source: unknown TCP traffic detected without corresponding DNS query: 212.86.104.147 Source: unknown TCP traffic detected without corresponding DNS query: 212.86.104.147 Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42 Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43 Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202 Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
 Source: ZuCtGOdazy.elf String found in binary or memory: http://upx.sf.net

### System Summary

 Source: 6226.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown Source: 6226.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown Source: 6222.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown Source: 6222.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown Source: 6228.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown Source: 6228.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown Source: Process Memory Space: ZuCtGOdazy.elf PID: 6226, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown Source: Process Memory Space: ZuCtGOdazy.elf PID: 6226, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown