Summary

uYtea.arm6

File uYtea.arm6

Summary
Download Resubmit sample

Size 70.6KB
Type ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
MD5 a44c4eb88af076bc63c604195e60c081
SHA1 3d0c85c5fdce3558599e61364b3c9cb7f4272977
SHA256 44dd263627dc726ee87bbb5d37296200561b93c7143718e1da48f5c96ec207ad
SHA512
662e3420d3125768f686a15704bd7bfc8dcf03fb7e8a0818283c7afcd1d17b502c23204ff5b398948d3867b148ca138ab264da7ee78f339e830392337c45a4b3
CRC32 4B864129
ssdeep None
Yara None matched

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE July 8, 2025, 4:24 p.m. July 8, 2025, 4:28 p.m. 265 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2025-07-08 15:53:00,004 [root] DEBUG: Starting analyzer from: /tmp/tmprqOoYx
2025-07-08 15:53:00,005 [root] DEBUG: Storing results at: /tmp/uxoASmckbb
2025-07-08 15:53:01,841 [modules.auxiliary.filecollector] INFO: FileCollector started v0.08
2025-07-08 15:53:02,342 [modules.auxiliary.human] INFO: Human started v0.02
2025-07-08 15:53:02,343 [modules.auxiliary.screenshots] INFO: Screenshots started v0.03
2025-07-08 15:53:08,260 [lib.core.packages] INFO: Process startup took 5.91 seconds
2025-07-08 15:53:08,261 [root] INFO: Added new process to list with pid: 2069
2025-07-08 15:53:17,271 [root] INFO: Process with pid 2069 has terminated
2025-07-08 15:53:17,272 [root] INFO: Process list is empty, terminating analysis.
2025-07-08 15:53:20,281 [lib.core.packages] INFO: Package requested stop
2025-07-08 15:53:20,283 [lib.core.packages] WARNING: Exception uploading log: [Errno 3] No such process

Cuckoo Log

2025-07-08 16:24:33,109 [cuckoo.core.scheduler] INFO: Task #6688902: acquired machine Ubuntu1904x646 (label=Ubuntu1904x646)
2025-07-08 16:24:33,110 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.106 for task #6688902
2025-07-08 16:24:33,410 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 514951 (interface=vboxnet0, host=192.168.168.106)
2025-07-08 16:24:33,447 [cuckoo.machinery.virtualbox] DEBUG: Starting vm Ubuntu1904x646
2025-07-08 16:24:34,097 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine Ubuntu1904x646 to Snapshot
2025-07-08 16:26:18,212 [cuckoo.core.guest] INFO: Starting analysis #6688902 on guest (id=Ubuntu1904x646, ip=192.168.168.106)
2025-07-08 16:26:19,219 [cuckoo.core.guest] DEBUG: Ubuntu1904x646: not ready yet
2025-07-08 16:26:24,249 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=Ubuntu1904x646, ip=192.168.168.106)
2025-07-08 16:26:24,294 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=Ubuntu1904x646, ip=192.168.168.106, monitor=latest, size=73219)
2025-07-08 16:26:24,535 [cuckoo.core.resultserver] DEBUG: Task #6688902: live log analysis.log initialized.
2025-07-08 16:26:29,742 [cuckoo.core.resultserver] DEBUG: Task #6688902: File upload for 'shots/0001.jpg'
2025-07-08 16:26:29,763 [cuckoo.core.resultserver] DEBUG: Task #6688902 uploaded file length: 171468
2025-07-08 16:26:39,490 [cuckoo.core.guest] DEBUG: Ubuntu1904x646: analysis #6688902 still processing
2025-07-08 16:26:44,835 [cuckoo.core.resultserver] DEBUG: Task #6688902: File upload for 'logs/all.stap'
2025-07-08 16:26:44,839 [cuckoo.core.resultserver] DEBUG: Task #6688902 uploaded file length: 53827
2025-07-08 16:26:54,568 [cuckoo.core.guest] DEBUG: Ubuntu1904x646: analysis #6688902 still processing
2025-07-08 16:27:09,662 [cuckoo.core.guest] DEBUG: Ubuntu1904x646: analysis #6688902 still processing
2025-07-08 16:27:24,760 [cuckoo.core.guest] INFO: Ubuntu1904x646: end of analysis reached!
2025-07-08 16:27:24,776 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-07-08 16:27:24,798 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-07-08 16:27:25,613 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label Ubuntu1904x646 to path /srv/cuckoo/cwd/storage/analyses/6688902/memory.dmp
2025-07-08 16:27:25,615 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm Ubuntu1904x646
2025-07-08 16:28:57,604 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.106 for task #6688902
2025-07-08 16:28:57,604 [cuckoo.core.resultserver] DEBUG: Cancel <Context for LOG> for task 6688902
2025-07-08 16:28:58,020 [cuckoo.core.scheduler] DEBUG: Released database task #6688902
2025-07-08 16:28:58,032 [cuckoo.core.scheduler] INFO: Task #6688902: analysis procedure completed

Signatures

File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)
G Data Antivirus (Windows) Virus: Trojan.Generic.37965074 (Engine A)
Avast Core Security (Linux) ELF:Agent-AGS [Trj]
C4S ClamAV (Linux) Unix.Trojan.Mirai-9441505-0
Trellix (Linux) GenericRXNP-CK
WithSecure (Linux) Trojan:W32/Generic.abch!mind
eScan Antivirus (Linux) Trojan.Generic.37965074(DB)
ESET Security (Windows) a variant of Linux/Mirai.BDF trojan
Sophos Anti-Virus (Linux) Linux/DDoS-CI
DrWeb Antivirus (Linux) Linux.Siggen.9999
ClamAV (Linux) Unix.Trojan.Mirai-9441505-0
Bitdefender Antivirus (Linux) Trojan.Generic.37965074
Kaspersky Standard (Windows) HEUR:Backdoor.Linux.Mirai.cw
Emsisoft Commandline Scanner (Windows) Trojan.Generic.37965074 (B)
File has been identified by 42 AntiVirus engines on VirusTotal as malicious (42 events)
Lionic Trojan.ELF.Mirai.4!c
Elastic Linux.Generic.Threat
Cynet Malicious (score: 99)
CTX elf.trojan.generic
Skyhigh GenericRXNP-CK!A44C4EB88AF0
ALYac Trojan.Generic.37965074
VIPRE Trojan.Generic.37965074
Sangfor Suspicious.Linux.Save.a
Arcabit Trojan.Generic.D2434D12
Symantec Linux.Mirai
ESET-NOD32 a variant of Linux/Mirai.BDF
TrendMicro-HouseCall Possible_MIRAI.SMLBO13
Avast ELF:Agent-AGS [Trj]
ClamAV Unix.Trojan.Mirai-9441505-0
Kaspersky HEUR:Backdoor.Linux.Mirai.cw
BitDefender Trojan.Generic.37965074
MicroWorld-eScan Trojan.Generic.37965074
Rising Backdoor.Mirai/Linux!1.128BE (CLASSIC)
Emsisoft Trojan.Generic.37965074 (B)
F-Secure Exploit.EXP/ELF.Mirai.Z.D
DrWeb Linux.Siggen.9999
TrendMicro Possible_MIRAI.SMLBO13
Sophos Linux/DDoS-CI
Ikarus Backdoor.Linux.Mirai
Avast-Mobile ELF:Agent-AGS [Trj]
Jiangmin Backdoor.Linux.heiw
Google Detected
Avira EXP/ELF.Mirai.Z.D
Antiy-AVL Trojan[Backdoor]/Linux.Mirai.cw
Kingsoft Linux.Backdoor.elf.2023796
Microsoft Backdoor:Linux/Bushido.A!xp
ZoneAlarm Linux/DDoS-CI
GData Trojan.Generic.37965074
Varist E32/Mirai.EH.gen!Camelot
AhnLab-V3 Worm/Linux.Mirai.SE189
Tencent Backdoor.Linux.Mirai.wam
TrellixENS GenericRXNP-CK!A44C4EB88AF0
huorong Backdoor/Linux.Mirai.gm
MaxSecure Trojan.Malware.121218.susgen
Fortinet Linux/Mirai.BWR!tr
AVG ELF:Agent-AGS [Trj]
alibabacloud Backdoor:Linux/Mirai.ffd50e0b
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.