Edit tour
Linux
Analysis Report
nCEnoU35Wv.elf
Overview
General Information
Sample name: | nCEnoU35Wv.elfrenamed because original name is a hash value |
Original sample name: | d257c616cc3ebf39460a20e9d0150042.elf |
Analysis ID: | 1540177 |
MD5: | d257c616cc3ebf39460a20e9d0150042 |
SHA1: | 0d5a2779064046333e01e0d5e4c598b64b5261ee |
SHA256: | 4adf74d314f77261b046734ee165747a3ec007329c3ef4ea451cfb990a423554 |
Tags: | 32elfmirairenesas |
Infos: |
Detection
Okiru
Score: | 84 |
Range: | 0 - 100 |
Whitelisted: | false |
Signatures
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sample tries to kill a massive number of system processes
Yara detected Okiru
Reads system files that contain records of logged in users
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to kill multiple processes (SIGKILL)
Creates hidden files and/or directories
Deletes log files
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "grep" command used to find patterns in files or piped streams
Executes the "kill" or "pkill" command typically used to terminate processes
Found strings indicative of a multi-platform dropper
Reads CPU information from /sys indicative of miner or evasive malware
Reads system information from the proc file system
Reads system version information
Reads the 'hosts' file potentially containing internal network hosts
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Uses the "uname" system call to query kernel version information (possible evasion)
Classification
Joe Sandbox version: | 41.0.0 Charoite |
Analysis ID: | 1540177 |
Start date and time: | 2024-10-23 14:15:14 +02:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 4m 35s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | defaultlinuxfilecookbook.jbs |
Analysis system description: | Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11) |
Analysis Mode: | default |
Sample name: | nCEnoU35Wv.elfrenamed because original name is a hash value |
Original Sample Name: | d257c616cc3ebf39460a20e9d0150042.elf |
Detection: | MAL |
Classification: | mal84.spre.troj.linELF@0/170@1/0 |
- Connection to analysis system has been lost, crash info: Unknown
- Report size exceeded maximum capacity and may have missing behavior information.
- VT rate limit hit for: nCEnoU35Wv.elf
Command: | /tmp/nCEnoU35Wv.elf |
PID: | 5525 |
Exit Code: | 0 |
Exit Code Info: | |
Killed: | False |
Standard Output: | Connected To CNC |
Standard Error: |
- system is lnxubuntu20
- nCEnoU35Wv.elf New Fork (PID: 5527, Parent: 5525)
- nCEnoU35Wv.elf New Fork (PID: 5528, Parent: 5525)
- nCEnoU35Wv.elf New Fork (PID: 5530, Parent: 5525)
- nCEnoU35Wv.elf New Fork (PID: 5533, Parent: 5530)
- nCEnoU35Wv.elf New Fork (PID: 5535, Parent: 5530)
- nCEnoU35Wv.elf New Fork (PID: 5537, Parent: 5530)
- nCEnoU35Wv.elf New Fork (PID: 5539, Parent: 5530)
- nCEnoU35Wv.elf New Fork (PID: 5545, Parent: 5530)
- systemd New Fork (PID: 5548, Parent: 1)
- systemd New Fork (PID: 5569, Parent: 1)
- systemd New Fork (PID: 5580, Parent: 1)
- systemd New Fork (PID: 5581, Parent: 3044)
- gvfsd-fuse New Fork (PID: 5582, Parent: 3210)
- systemd New Fork (PID: 5585, Parent: 1)
- systemd New Fork (PID: 5589, Parent: 1)
- systemd New Fork (PID: 5590, Parent: 1)
- systemd New Fork (PID: 5591, Parent: 1)
- systemd New Fork (PID: 5599, Parent: 1)
- gdm3 New Fork (PID: 5656, Parent: 1333)
- gdm3 New Fork (PID: 5657, Parent: 1333)
- gdm3 New Fork (PID: 5658, Parent: 1333)
- systemd New Fork (PID: 5659, Parent: 1)
- systemd New Fork (PID: 5660, Parent: 1)
- gpu-manager New Fork (PID: 5661, Parent: 5660)
- sh New Fork (PID: 5662, Parent: 5661)
- gpu-manager New Fork (PID: 5663, Parent: 5660)
- sh New Fork (PID: 5664, Parent: 5663)
- gpu-manager New Fork (PID: 5665, Parent: 5660)
- sh New Fork (PID: 5666, Parent: 5665)
- gpu-manager New Fork (PID: 5667, Parent: 5660)
- sh New Fork (PID: 5668, Parent: 5667)
- gpu-manager New Fork (PID: 5669, Parent: 5660)
- sh New Fork (PID: 5670, Parent: 5669)
- gpu-manager New Fork (PID: 5671, Parent: 5660)
- sh New Fork (PID: 5672, Parent: 5671)
- gpu-manager New Fork (PID: 5673, Parent: 5660)
- sh New Fork (PID: 5674, Parent: 5673)
- gpu-manager New Fork (PID: 5675, Parent: 5660)
- sh New Fork (PID: 5676, Parent: 5675)
- systemd New Fork (PID: 5679, Parent: 1)
- generate-config New Fork (PID: 5680, Parent: 5679)
- systemd New Fork (PID: 5681, Parent: 1)
- systemd New Fork (PID: 5686, Parent: 1)
- gdm3 New Fork (PID: 5689, Parent: 5686)
- gdm3 New Fork (PID: 5705, Parent: 5686)
- gdm-session-worker New Fork (PID: 5709, Parent: 5705)
- gdm-wayland-session New Fork (PID: 5713, Parent: 5709)
- dbus-run-session New Fork (PID: 5714, Parent: 5713)
- dbus-daemon New Fork (PID: 5720, Parent: 5714)
- dbus-daemon New Fork (PID: 5721, Parent: 5720)
- dbus-daemon New Fork (PID: 5723, Parent: 5714)
- dbus-daemon New Fork (PID: 5724, Parent: 5723)
- dbus-daemon New Fork (PID: 5725, Parent: 5714)
- dbus-daemon New Fork (PID: 5726, Parent: 5725)
- dbus-daemon New Fork (PID: 5727, Parent: 5714)
- dbus-daemon New Fork (PID: 5728, Parent: 5727)
- dbus-daemon New Fork (PID: 5729, Parent: 5714)
- dbus-daemon New Fork (PID: 5730, Parent: 5729)
- dbus-daemon New Fork (PID: 5731, Parent: 5714)
- dbus-daemon New Fork (PID: 5732, Parent: 5731)
- dbus-daemon New Fork (PID: 5734, Parent: 5714)
- dbus-daemon New Fork (PID: 5735, Parent: 5734)
- dbus-run-session New Fork (PID: 5715, Parent: 5713)
- gnome-session-binary New Fork (PID: 5736, Parent: 5715)
- gnome-session-binary New Fork (PID: 5737, Parent: 5715)
- gdm3 New Fork (PID: 5745, Parent: 5686)
- gdm-session-worker New Fork (PID: 5750, Parent: 5745)
- gdm-x-session New Fork (PID: 5752, Parent: 5750)
- Xorg New Fork (PID: 5763, Parent: 5752)
- sh New Fork (PID: 5764, Parent: 5763)
- Xorg New Fork (PID: 5987, Parent: 5752)
- sh New Fork (PID: 5991, Parent: 5987)
- gdm-x-session New Fork (PID: 5769, Parent: 5750)
- gdm-x-session New Fork (PID: 5770, Parent: 5750)
- dbus-run-session New Fork (PID: 5771, Parent: 5770)
- dbus-daemon New Fork (PID: 5784, Parent: 5771)
- dbus-daemon New Fork (PID: 5785, Parent: 5784)
- at-spi-bus-launcher New Fork (PID: 5790, Parent: 5785)
- dbus-daemon New Fork (PID: 6150, Parent: 5790)
- dbus-daemon New Fork (PID: 6151, Parent: 6150)
- dbus-daemon New Fork (PID: 5813, Parent: 5771)
- dbus-daemon New Fork (PID: 5814, Parent: 5813)
- dbus-daemon New Fork (PID: 5816, Parent: 5771)
- dbus-daemon New Fork (PID: 5817, Parent: 5816)
- dbus-daemon New Fork (PID: 5818, Parent: 5771)
- dbus-daemon New Fork (PID: 5819, Parent: 5818)
- dbus-daemon New Fork (PID: 5820, Parent: 5771)
- dbus-daemon New Fork (PID: 5821, Parent: 5820)
- dbus-daemon New Fork (PID: 5822, Parent: 5771)
- dbus-daemon New Fork (PID: 5823, Parent: 5822)
- dbus-daemon New Fork (PID: 5824, Parent: 5771)
- dbus-daemon New Fork (PID: 5825, Parent: 5824)
- dbus-daemon New Fork (PID: 5827, Parent: 5771)
- dbus-daemon New Fork (PID: 5828, Parent: 5827)
- dbus-daemon New Fork (PID: 5992, Parent: 5771)
- dbus-daemon New Fork (PID: 5993, Parent: 5992)
- dbus-daemon New Fork (PID: 6163, Parent: 5771)
- dbus-daemon New Fork (PID: 6164, Parent: 6163)
- dbus-daemon New Fork (PID: 6372, Parent: 5771)
- dbus-daemon New Fork (PID: 6373, Parent: 6372)
- dbus-run-session New Fork (PID: 5772, Parent: 5770)
- gnome-session-binary New Fork (PID: 5773, Parent: 5772)
- gnome-session-check-accelerated New Fork (PID: 5791, Parent: 5773)
- gnome-session-check-accelerated New Fork (PID: 5802, Parent: 5773)
- gnome-session-binary New Fork (PID: 5829, Parent: 5772)
- gnome-session-binary New Fork (PID: 5830, Parent: 5772)
- gnome-shell New Fork (PID: 5885, Parent: 5830)
- ibus-daemon New Fork (PID: 5986, Parent: 5885)
- ibus-daemon New Fork (PID: 5989, Parent: 5885)
- ibus-daemon New Fork (PID: 5990, Parent: 5989)
- ibus-daemon New Fork (PID: 6202, Parent: 5885)
- gnome-session-binary New Fork (PID: 6183, Parent: 5772)
- gnome-session-binary New Fork (PID: 6185, Parent: 5772)
- gnome-session-binary New Fork (PID: 6189, Parent: 5772)
- gnome-session-binary New Fork (PID: 6191, Parent: 5772)
- gnome-session-binary New Fork (PID: 6193, Parent: 5772)
- gsd-print-notifications New Fork (PID: 6369, Parent: 6193)
- gsd-print-notifications New Fork (PID: 6370, Parent: 6369)
- gnome-session-binary New Fork (PID: 6195, Parent: 5772)
- gnome-session-binary New Fork (PID: 6196, Parent: 5772)
- gnome-session-binary New Fork (PID: 6200, Parent: 5772)
- gnome-session-binary New Fork (PID: 6203, Parent: 5772)
- gnome-session-binary New Fork (PID: 6204, Parent: 5772)
- gnome-session-binary New Fork (PID: 6207, Parent: 5772)
- gnome-session-binary New Fork (PID: 6209, Parent: 5772)
- gnome-session-binary New Fork (PID: 6213, Parent: 5772)
- gnome-session-binary New Fork (PID: 6215, Parent: 5772)
- gnome-session-binary New Fork (PID: 6717, Parent: 5772)
- gnome-session-binary New Fork (PID: 6723, Parent: 5772)
- gdm3 New Fork (PID: 5746, Parent: 5686)
- gdm3 New Fork (PID: 5747, Parent: 5686)
- systemd New Fork (PID: 5690, Parent: 1)
- accounts-daemon New Fork (PID: 5694, Parent: 5690)
- language-validate New Fork (PID: 5695, Parent: 5694)
- language-options New Fork (PID: 5696, Parent: 5695)
- systemd New Fork (PID: 5699, Parent: 1)
- systemd New Fork (PID: 5711, Parent: 1431)
- systemd New Fork (PID: 5854, Parent: 1)
- systemd New Fork (PID: 5999, Parent: 1)
- systemd New Fork (PID: 6037, Parent: 1431)
- systemd New Fork (PID: 6040, Parent: 1)
- systemd New Fork (PID: 6149, Parent: 1)
- systemd New Fork (PID: 6159, Parent: 1)
- systemd New Fork (PID: 6160, Parent: 1)
- avahi-daemon New Fork (PID: 6165, Parent: 6160)
- systemd New Fork (PID: 6161, Parent: 1)
- packagekitd New Fork (PID: 6190, Parent: 6161)
- systemd New Fork (PID: 6175, Parent: 3044)
- systemd New Fork (PID: 6177, Parent: 3044)
- systemd New Fork (PID: 6239, Parent: 1)
- systemd New Fork (PID: 6412, Parent: 1)
- systemd New Fork (PID: 6445, Parent: 1)
- systemd New Fork (PID: 6563, Parent: 1)
- colord New Fork (PID: 6725, Parent: 6563)
- systemd New Fork (PID: 6570, Parent: 1)
- cleanup
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Okiru | Yara detected Okiru | Joe Security |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Okiru | Yara detected Okiru | Joe Security | ||
JoeSecurity_Okiru | Yara detected Okiru | Joe Security | ||
JoeSecurity_Okiru | Yara detected Okiru | Joe Security | ||
JoeSecurity_Okiru | Yara detected Okiru | Joe Security | ||
JoeSecurity_Okiru | Yara detected Okiru | Joe Security | ||
Click to see the 13 entries |
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Avira: |
Source: | ReversingLabs: |
Source: | Reads CPU info from /sys: | Jump to behavior | ||
Source: | Reads CPU info from /sys: | Jump to behavior | ||
Source: | Reads CPU info from /sys: | Jump to behavior | ||
Source: | Reads CPU info from /sys: | Jump to behavior | ||
Source: | Reads CPU info from /sys: | Jump to behavior | ||
Source: | Reads CPU info from /sys: | Jump to behavior | ||
Source: | Reads CPU info from /sys: | |||
Source: | Reads CPU info from /sys: |
Source: | String: |