Automated Malware Analysis Report for Funny Linux.Elf
Total Page:16
File Type:pdf, Size:1020Kb
ID: 449051 Sample Name: funny_linux.elf Cookbook: defaultlinuxfilecookbook.jbs Time: 05:20:57 Date: 15/07/2021 Version: 33.0.0 White Diamond Table of Contents Table of Contents 2 Linux Analysis Report funny_linux.elf 3 Overview 3 General Information 3 Detection 3 Signatures 3 Classification 3 Analysis Advice 3 General Information 3 Process Tree 3 Yara Overview 3 Jbx Signature Overview 4 Mitre Att&ck Matrix 4 Malware Configuration 4 Behavior Graph 4 Antivirus, Machine Learning and Genetic Malware Detection 5 Initial Sample 5 Dropped Files 5 Domains 5 URLs 5 Domains and IPs 5 Contacted Domains 5 Contacted IPs 5 Runtime Messages 6 Joe Sandbox View / Context 6 IPs 6 Domains 6 ASN 6 JA3 Fingerprints 6 Dropped Files 6 Created / dropped Files 6 Static File Info 6 General 6 Static ELF Info 7 ELF header 7 Sections 7 Program Segments 8 Dynamic Tags 8 Symbols 8 Network Behavior 10 System Behavior 10 Analysis Process: funny_linux.elf PID: 4576 Parent PID: 4498 10 General 10 File Activities 10 File Read 10 Copyright Joe Security LLC 2021 Page 2 of 10 Linux Analysis Report funny_linux.elf Overview General Information Detection Signatures Classification Sample funny_linux.elf Name: SSaampplllee hhaass sstttrrriiippppeedd ssyymbboolll tttaabblllee Analysis ID: 449051 Sample has stripped symbol table MD5: e0ba4089e9b457… Ransomware SHA1: 21b3392a2fdab2a… Miner Spreading SHA256: d2544462756205… mmaallliiiccciiioouusss malicious Evader Phishing Infos: sssuusssppiiiccciiioouusss suspicious cccllleeaann clean Exploiter Banker Spyware Trojan / Bot Adware Score: 0 Range: 0 - 100 Whitelisted: false Analysis Advice Non-zero exit code suggests an error during the execution. Lookup the error code for hints. General Information Joe Sandbox Version: 33.0.0 White Diamond Analysis ID: 449051 Start date: 15.07.2021 Start time: 05:20:57 Joe Sandbox Product: CloudBasic Overall analysis duration: 0h 3m 59s Hypervisor based Inspection enabled: false Report type: light Sample file name: funny_linux.elf Cookbook file name: defaultlinuxfilecookbook.jbs Analysis system description: Ubuntu Linux 16.04 x64 (Kernel 4.4.0-116, Firefox 59.0, Document Viewer 3.18.2, LibreOffice 5.1.6.2, OpenJDK 1.8.0_171) Analysis Mode: default Detection: CLEAN Classification: clean0.linELF@0/0@0/0 Process Tree system is lnxubuntu1 funny_linux.elf (PID: 4576, Parent: 4498, MD5: e0ba4089e9b45793af55966134e3446e) Arguments: /tmp/funny_linux.elf cleanup Yara Overview Copyright Joe Security LLC 2021 Page 3 of 10 No yara matches Jbx Signature Overview • System Summary Click to jump to signature section There are no malicious signatures, click here to show all signatures . Mitre Att&ck Matrix No Mitre Att&ck techniques found Malware Configuration No configs have been found Behavior Graph Copyright Joe Security LLC 2021 Page 4 of 10 Hide Legend Legend: Process Behavior Graph Signature Created File ID: 449051 DNS/IP Info Is Dropped Sample: funny_linux.elf Number of created Files Is malicious Startdate: 15/07/2021 Internet Architecture: LINUX Score: 0 started funny_linux.elf Antivirus, Machine Learning and Genetic Malware Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Domains No Antivirus matches URLs No Antivirus matches Domains and IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Copyright Joe Security LLC 2021 Page 5 of 10 Runtime Messages Command: /tmp/funny_linux.elf Exit Code: 1 Exit Code Info: Killed: False Standard Output: Usage:/tmp/funny_linux.elf [-m (5-10-20-25-33-50) -v -d] Start Path Standard Error: Joe Sandbox View / Context IPs No context Domains No context ASN No context JA3 Fingerprints No context Dropped Files No context Created / dropped Files No created / dropped files found Static File Info General File type: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so .2, for GNU/Linux 2.6.24, BuildID[sha1]=d105854d92 8f73f1059a3784e18a48eb4b7dddbc, stripped Entropy (8bit): 6.176039995696959 TrID: ELF Executable and Linkable format (Linux) (4029/14) 49.77% ELF Executable and Linkable format (generic) (4004/1) 49.46% Lumena CEL bitmap (63/63) 0.78% File name: funny_linux.elf File size: 86480 MD5: e0ba4089e9b45793af55966134e3446e SHA1: 21b3392a2fdab2a07dd7b7366413917fa4f4c4c4 SHA256: d254446275620501006cc796dee7e9a667217277190c29 98d96cbc31389ccd4c Copyright Joe Security LLC 2021 Page 6 of 10 General SHA512: 83b7e5f4a03072600edb85c949489926baf5e0d5b199d98 851b653fc489624f13a18e129ff724dc1a6670e65c90892 6078a9a6043e9182770271448931f72a44 SSDEEP: 768:qeWD0pLe7z4LDX/7kcYIwCuXZUxYcF7onj07ef/6+ e2YahXF+cwu2+9KPlL0+6jF:qeWwpVfQcYzCpJe1vx+r 5V43nFmuoKX File Content Preview: .ELF..............>......)@[email protected][email protected]...@........... ..@.......@.@.....@[email protected].................................@.. .....@...............................................@[email protected]... ...... ..............=.......=a.... Static ELF Info ELF header Class: ELF64 Data: 2's complement, little endian Version: 1 (current) Machine: Advanced Micro Devices X86-64 Version Number: 0x1 Type: EXEC (Executable file) OS/ABI: UNIX - System V ABI Version: 0 Entry Point Address: 0x402903 Flags: 0x0 ELF Header Size: 64 Program Header Offset: 64 Program Header Size: 56 Number of Program Headers: 11 Section Header Offset: 84560 Section Header Size: 64 Number of Section Headers: 30 Header String Table Index: 29 Sections Flags Name Type Address Offset Size EntSize Flags Description Link Info Align NULL 0x0 0x0 0x0 0x0 0x0 0 0 0 .interp PROGBITS 0x4002a8 0x2a8 0x1c 0x0 0x2 A 0 0 1 .note.ABI-tag NOTE 0x4002c4 0x2c4 0x20 0x0 0x2 A 0 0 4 .note.gnu.property NOTE 0x4002e8 0x2e8 0x80 0x0 0x2 A 0 0 8 .note.gnu.build-id NOTE 0x400368 0x368 0x24 0x0 0x2 A 0 0 4 .gnu.hash GNU_HASH 0x400390 0x390 0x34 0x0 0x2 A 6 0 8 .dynsym DYNSYM 0x4003c8 0x3c8 0x7e0 0x18 0x2 A 7 1 8 .dynstr STRTAB 0x400ba8 0xba8 0x3de 0x0 0x2 A 0 0 1 .gnu.version VERSYM 0x400f86 0xf86 0xa8 0x2 0x2 A 6 0 2 .gnu.version_r VERNEED 0x401030 0x1030 0xe0 0x0 0x2 A 7 5 8 .rela.dyn RELA 0x401110 0x1110 0x60 0x18 0x2 A 6 0 8 .rela.plt RELA 0x401170 0x1170 0x738 0x18 0x2 A 6 13 8 .init PROGBITS 0x4018a8 0x18a8 0x1f 0x0 0x6 AX 0 0 4 .plt PROGBITS 0x4018d0 0x18d0 0x4e0 0x10 0x6 AX 0 0 16 .text PROGBITS 0x401dc0 0x1dc0 0xed2f 0x0 0x6 AX 0 0 64 .fini PROGBITS 0x410af0 0x10af0 0x9 0x0 0x6 AX 0 0 4 .rodata PROGBITS 0x410b00 0x10b00 0xe17 0x0 0x2 A 0 0 16 .eh_frame_hdr PROGBITS 0x411918 0x11918 0x394 0x0 0x2 A 0 0 4 .eh_frame PROGBITS 0x411cb0 0x11cb0 0x118c 0x0 0x2 A 0 0 8 .gcc_except_table PROGBITS 0x412e3c 0x12e3c 0x34 0x0 0x2 A 0 0 4 .init_array INIT_ARRAY 0x613dc8 0x13dc8 0x10 0x0 0x3 WA 0 0 8 .fini_array FINI_ARRAY 0x613dd8 0x13dd8 0x8 0x0 0x3 WA 0 0 8 .jcr PROGBITS 0x613de0 0x13de0 0x8 0x0 0x3 WA 0 0 8 .dynamic DYNAMIC 0x613de8 0x13de8 0x210 0x10 0x3 WA 7 0 8 .got PROGBITS 0x613ff8 0x13ff8 0x8 0x8 0x3 WA 0 0 8 .got.plt PROGBITS 0x614000 0x14000 0x280 0x8 0x3 WA 0 0 8 .data PROGBITS 0x614280 0x14280 0x688 0x0 0x3 WA 0 0 16 .bss NOBITS 0x614920 0x14908 0x1e0 0x0 0x3 WA 0 0 32 .comment PROGBITS 0x0 0x14908 0x2b 0x1 0x30 MS 0 0 1 Copyright Joe Security LLC 2021 Page 7 of 10 Flags Name Type Address Offset Size EntSize Flags Description Link Info Align .shstrtab STRTAB 0x0 0x14933 0x11d 0x0 0x0 0 0 1 Program Segments Virtual Physical Memory Flags Prog Type Offset Address Address File Size Size Entropy Flags Description Align Interpreter Section Mappings PHDR 0x40 0x400040 0x400040 0x268 0x268 1.6604 0x5 R E 0x8 INTERP 0x2a8 0x4002a8 0x4002a8 0x1c 0x1c 3.9408 0x4 R 0x1 /lib64/ld-linux- .interp x86-64.so.2 LOAD 0x0 0x400000 0x400000 0x12e70 0x12e70 4.0435 0x5 R E 0x200000 .interp .note.ABI-tag .note.gnu.property .note.gnu.build- id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt .text .fini .rodata .eh_frame_hdr .eh_frame .gcc_except_table LOAD 0x13dc8 0x613dc8 0x613dc8 0xb40 0xd38 1.5364 0x6 RW 0x200000 .init_array .fini_array .jcr .dynamic .got .got.plt .data .bss DYNAMIC 0x13de8 0x613de8 0x613de8 0x210 0x210 1.2256 0x6 RW 0x8 .dynamic NOTE 0x2c4 0x4002c4 0x4002c4 0x20 0x20 1.7487 0x4 R 0x4 .note.ABI-tag NOTE 0x2e8 0x4002e8 0x4002e8 0x80 0x80 1.7154 0x4 R 0x8 .note.gnu.property NOTE 0x368 0x400368 0x400368 0x24 0x24 2.4683 0x4 R 0x4 .note.gnu.build-id GNU_EH_FRAME 0x11918 0x411918 0x411918 0x394 0x394 2.9679 0x4 R 0x4 .eh_frame_hdr GNU_STACK 0x0 0x0 0x0 0x0 0x0 0.0000 0x7 RWE 0x10 GNU_RELRO 0x13dc8 0x613dc8 0x613dc8 0x238 0x238 1.2401 0x4 R 0x1 .init_array .fini_array .jcr .dynamic .got Dynamic Tags Type Meta Value Tag DT_NEEDED sharedlib libpthread.so.0 0x1 DT_NEEDED sharedlib libdl.so.2 0x1 DT_NEEDED sharedlib libstdc++.so.6 0x1 DT_NEEDED sharedlib libgcc_s.so.1 0x1 DT_NEEDED sharedlib libc.so.6 0x1 DT_INIT value 0x4018a8 0xc DT_FINI value 0x410af0 0xd DT_INIT_ARRAY value 0x613dc8 0x19 DT_INIT_ARRAYSZ bytes 16 0x1b DT_FINI_ARRAY value 0x613dd8 0x1a DT_FINI_ARRAYSZ bytes 8 0x1c DT_GNU_HASH value 0x400390 0x6ffffef5 DT_STRTAB value 0x400ba8 0x5 DT_SYMTAB value 0x4003c8 0x6 DT_STRSZ bytes 990 0xa DT_SYMENT bytes 24 0xb DT_DEBUG value 0x0 0x15 DT_PLTGOT value 0x614000 0x3 DT_PLTRELSZ bytes 1848 0x2 DT_PLTREL pltrel DT_RELA 0x14 DT_JMPREL value 0x401170 0x17 DT_RELA value 0x401110 0x7 DT_RELASZ bytes 96 0x8 DT_RELAENT bytes 24 0x9 DT_VERNEED value 0x401030 0x6ffffffe DT_VERNEEDNUM value 5 0x6fffffff DT_VERSYM value 0x400f86 0x6ffffff0 DT_NULL value 0x0 0x0 Symbols Version Info Version Info File Symbol Name Name Name Section Name Value Size Symbol Type Symbol Bind Visibility Ndx .dynsym 0x0 0 NOTYPE