Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
U1lnaOUMhH.elf

Overview

General Information

Sample Name:U1lnaOUMhH.elf
Analysis ID:780067
MD5:4fdbbd14946d8a267dc6444143d27184
SHA1:a79c4c4d79e1f24b33aac62e3b588495be6e3a5d
SHA256:d4c7fe29eab5d7bb41d842c962c78f3707eee4069e509ebd002eb3bc26a81e00
Tags:32elfgafgytintelMirai
Infos:

Detection

Mirai, Moobot
Score:100
Range:0 - 100
Whitelisted:false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected Moobot
Snort IDS alert for network traffic
Connects to many ports of the same IP (likely port scanning)
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sets full permissions to files and/or directories
Sample contains only a LOAD segment without any section mappings
Yara signature match
Executes the "mkdir" command used to create folders
Executes the "chmod" command used to modify permissions
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Sample tries to set the executable flag
HTTP GET or POST without a user agent
Executes commands using a shell command-line interpreter
Executes the "rm" command used to delete files or directories

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

General Information

Joe Sandbox Version:36.0.0 Rainbow Opal
Analysis ID:780067
Start date and time:2023-01-08 11:07:33 +01:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 7m 43s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:U1lnaOUMhH.elf
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal100.troj.evad.linELF@0/0@45/0

Warnings

  • Report size exceeded maximum capacity and may have missing network information.
  • VT rate limit hit for: http://89.208.107.26/miniupd.sh
  • VT rate limit hit for: http://89.208.107.26/miniupd.sh;sh

Runtime Messages

Command:/tmp/U1lnaOUMhH.elf
PID:6228
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
SHA8192
Standard Error:

Process Tree

  • system is lnxubuntu20
  • cleanup

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
U1lnaOUMhH.elfSUSP_ELF_LNX_UPX_Compressed_FileDetects a suspicious ELF binary with UPX compressionFlorian Roth
  • 0xa2ed:$s1: PROT_EXEC|PROT_WRITE failed.
  • 0xa299:$s2: $Id: UPX
  • 0xa24a:$s3: $Info: This file is packed with the UPX executable packer

Memory Dumps

SourceRuleDescriptionAuthorStrings
7259.1.0000000008291000.0000000008292000.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
  • 0x490:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
  • 0x570:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
  • 0x600:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
  • 0x690:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6497.1.0000000008291000.0000000008292000.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
  • 0x490:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
  • 0x570:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
  • 0x600:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
  • 0x690:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7142.1.0000000008291000.0000000008292000.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
  • 0x490:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
  • 0x570:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
  • 0x600:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
  • 0x690:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7393.1.0000000008291000.0000000008292000.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
  • 0x490:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
  • 0x570:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
  • 0x600:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
  • 0x690:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
8280.1.0000000008291000.0000000008292000.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
  • 0x490:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
  • 0x570:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
  • 0x600:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
  • 0x690:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB