Linux
Analysis Report
la.bot.m68k.elf
Overview
General Information
Sample name: | la.bot.m68k.elf |
Analysis ID: | 1537593 |
MD5: | 9db1f523804a79cd16cb977005766baf |
SHA1: | 5767011df38349bc36864d781dcb606d8c1ffa37 |
SHA256: | 1435855230f052a83f009ccf90094941a2aa2d844b667b4115dfa8c279df8ac2 |
Tags: | elfuser-abuse_ch |
Infos: |
Detection
Score: | 48 |
Range: | 0 - 100 |
Whitelisted: | false |
Signatures
Multi AV Scanner detection for submitted file
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Reads system version information
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)
Classification
Joe Sandbox version: | 41.0.0 Charoite |
Analysis ID: | 1537593 |
Start date and time: | 2024-10-19 08:37:41 +02:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 6m 2s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | defaultlinuxfilecookbook.jbs |
Analysis system description: | Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11) |
Analysis Mode: | default |
Sample name: | la.bot.m68k.elf |
Detection: | MAL |
Classification: | mal48.linELF@0/0@2/0 |
- Report size exceeded maximum capacity and may have missing network information.
Command: | /tmp/la.bot.m68k.elf |
PID: | 5722 |
Exit Code: | 0 |
Exit Code Info: | |
Killed: | False |
Standard Output: | thIs wEek on xLaB lEarNs nOthinG xd |
Standard Error: |
- system is lnxubuntu20
- la.bot.m68k.elf New Fork (PID: 5724, Parent: 5722)
- la.bot.m68k.elf New Fork (PID: 5743, Parent: 5722)
- la.bot.m68k.elf New Fork (PID: 5746, Parent: 5743)
- systemd New Fork (PID: 5807, Parent: 1)
- snap-failure New Fork (PID: 5824, Parent: 5807)
- snap-failure New Fork (PID: 5825, Parent: 5807)
- cleanup
⊘No yara matches
⊘No Suricata rule has matched
- • AV Detection
- • Spreading
- • Networking
- • System Summary
- • Persistence and Installation Behavior
- • Malware Analysis System Evasion
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link |
Source: | String: | ||
Source: | String: | ||
Source: | String: |