Linux Analysis Report
dlr.ppc.elf

Overview

General Information

Sample name: dlr.ppc.elf
Analysis ID: 1542865
MD5: f1f7ccb6a6a43126cf2e7f6a0503e9c9
SHA1: ed01b351de75fc870ca7317ffcb6dfba7d182930
SHA256: 6b88cab948133651aa162e3e2fa35d88d4951089d3e38c6f6069d1c80ad57a09
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: dlr.ppc.elf ReversingLabs: Detection: 42%
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal48.linELF@0/0@2/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/dlr.ppc.elf (PID: 5474) Queries kernel information via 'uname': Jump to behavior
Source: dlr.ppc.elf, 5474.1.00005581c07ab000.00005581c083a000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/ppc11!hotpluggableq
Source: dlr.ppc.elf, 5474.1.00005581c07ab000.00005581c083a000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: dlr.ppc.elf, 5474.1.00007ffe54467000.00007ffe54488000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc
Source: dlr.ppc.elf, 5474.1.00007ffe54467000.00007ffe54488000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/dlr.ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/dlr.ppc.elf

No Screenshots

⊘No contacted IP infos

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true