Edit tour

# Linux Analysis Report A8b8wTzn0g.elf

## Overview

### General Information

 Sample Name: A8b8wTzn0g.elf Analysis ID: 756341 MD5: 828d2d73ce0e3d038abd7e36c8a7aa62 SHA1: 59cc3208ee9e14d529fd57974e1fcf96ec5338c2 SHA256: e979301b88347daf2cef17c66361d971c54eff3a3c4edcd8fd61a16380ddc309 Tags: 32elfmipsmirai Infos:

### Detection

Mirai
 Score: 72 Range: 0 - 100 Whitelisted: false

### Signatures

Malicious sample detected (through community Yara rule)
Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Sample tries to kill multiple processes (SIGKILL)
Sample contains only a LOAD segment without any section mappings
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample tries to kill a process (SIGKILL)
ELF contains segments with high entropy indicating compressed/encrypted content

### Classification

 Static ELF header machine description suggests that the sample might not execute correctly on this machine.
 All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
 Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.
 Joe Sandbox Version: 36.0.0 Rainbow Opal Analysis ID: 756341 Start date and time: 2022-11-30 02:15:18 +01:00 Joe Sandbox Product: CloudBasic Overall analysis duration: 0h 5m 37s Hypervisor based Inspection enabled: false Report type: full Sample file name: A8b8wTzn0g.elf Cookbook file name: defaultlinuxfilecookbook.jbs Analysis system description: Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11) Analysis Mode: default Detection: MAL Classification: mal72.spre.troj.evad.linELF@0/0@0/0
 Command: /tmp/A8b8wTzn0g.elf PID: 6249 Exit Code: 0 Exit Code Info: Killed: False Standard Output: lzrd cock fest"/proc/"/exe Standard Error:
• system is lnxubuntu20
• wrapper-2.0 (PID: 6261, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
• wrapper-2.0 (PID: 6262, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
• wrapper-2.0 (PID: 6263, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
• wrapper-2.0 (PID: 6264, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
• wrapper-2.0 (PID: 6266, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
• cleanup
SourceRuleDescriptionAuthorStrings
6252.1.00007f2e54400000.00007f2e54412000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
6252.1.00007f2e54400000.00007f2e54412000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
• 0x10700:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x10714:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x10728:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x1073c:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x10750:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x10764:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x10778:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x1078c:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x107a0:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x107b4:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x107c8:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x107dc:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x107f0:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x10804:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x10818:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x1082c:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x10840:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x10854:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x10868:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x1087c:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x10890:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6252.1.00007f2e54400000.00007f2e54412000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
• 0x10c58:\$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6253.1.00007f2e54400000.00007f2e54412000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
6253.1.00007f2e54400000.00007f2e54412000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
• 0x10700:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x10714:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x10728:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x1073c:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x10750:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x10764:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x10778:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x1078c:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x107a0:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x107b4:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x107c8:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x107dc:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x107f0:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x10804:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x10818:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x1082c:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x10840:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x10854:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x10868:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x1087c:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
• 0x10890:\$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 6 entries
No Snort rule has matched

### AV Detection

 Source: A8b8wTzn0g.elf ReversingLabs: Detection: 47% Source: A8b8wTzn0g.elf Virustotal: Detection: 47% Perma Link
 Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443 Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80 Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
 Source: global traffic TCP traffic: 192.168.2.23:35438 -> 212.86.104.147:3778
 Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443 Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
 Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43 Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202 Source: unknown TCP traffic detected without corresponding DNS query: 212.86.104.147 Source: unknown TCP traffic detected without corresponding DNS query: 212.86.104.147 Source: unknown TCP traffic detected without corresponding DNS query: 212.86.104.147 Source: unknown TCP traffic detected without corresponding DNS query: 212.86.104.147 Source: unknown TCP traffic detected without corresponding DNS query: 212.86.104.147 Source: unknown TCP traffic detected without corresponding DNS query: 212.86.104.147 Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42 Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43 Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202 Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
 Source: A8b8wTzn0g.elf String found in binary or memory: http://upx.sf.net

### System Summary

 Source: 6252.1.00007f2e54400000.00007f2e54412000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown Source: 6252.1.00007f2e54400000.00007f2e54412000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown Source: 6253.1.00007f2e54400000.00007f2e54412000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown Source: 6253.1.00007f2e54400000.00007f2e54412000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown Source: 6249.1.00007f2e54400000.00007f2e54412000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown Source: 6249.1.00007f2e54400000.00007f2e54412000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown Source: Process Memory Space: A8b8wTzn0g.elf PID: 6252, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown Source: Process Memory Space: A8b8wTzn0g.elf PID: 6252, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown