Edit tour
Linux
Analysis Report
la.bot.mipsel.elf
Overview
General Information
| Sample name: | la.bot.mipsel.elf |
| Analysis ID: | 1543052 |
| MD5: | f5c72b4f9eca5aee02e08704897d5782 |
| SHA1: | 3d5754cf379d2dfbf69a9e87ebcede6387c00b4e |
| SHA256: | 54219ee063d0d1dd24aec9b40af0612341c131e06d4b9df77f5c65f1d416aef7 |
| Tags: | elfuser-abuse_ch |
| Infos: |
Detection
| Score: | 48 |
| Range: | 0 - 100 |
| Whitelisted: | false |
Signatures
Multi AV Scanner detection for submitted file
Creates hidden files and/or directories
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)
Classification
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1543052 |
| Start date and time: | 2024-10-27 07:17:05 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 5m 23s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultlinuxfilecookbook.jbs |
| Analysis system description: | Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11) |
| Analysis Mode: | default |
| Sample name: | la.bot.mipsel.elf |
| Detection: | MAL |
| Classification: | mal48.linELF@0/0@0/0 |
- Skipping network analysis since amount of network traffic is too extensive
| Command: | /tmp/la.bot.mipsel.elf |
| PID: | 6236 |
| Exit Code: | 0 |
| Exit Code Info: | |
| Killed: | False |
| Standard Output: | thIs wEek on xLaB lEarNs nOthinG xd |
| Standard Error: |
- system is lnxubuntu20
- la.bot.mipsel.elf New Fork (PID: 6238, Parent: 6236)
- la.bot.mipsel.elf New Fork (PID: 6239, Parent: 6236)
- la.bot.mipsel.elf New Fork (PID: 6252, Parent: 6236)
- la.bot.mipsel.elf New Fork (PID: 6270, Parent: 6252)
- la.bot.mipsel.elf New Fork (PID: 6318, Parent: 6252)
- la.bot.mipsel.elf New Fork (PID: 6320, Parent: 6318)
- la.bot.mipsel.elf New Fork (PID: 6393, Parent: 6252)
- la.bot.mipsel.elf New Fork (PID: 6395, Parent: 6393)
- la.bot.mipsel.elf New Fork (PID: 6426, Parent: 6252)
- la.bot.mipsel.elf New Fork (PID: 6428, Parent: 6426)
- la.bot.mipsel.elf New Fork (PID: 6476, Parent: 6252)
- la.bot.mipsel.elf New Fork (PID: 6478, Parent: 6476)
- la.bot.mipsel.elf New Fork (PID: 6507, Parent: 6252)
- la.bot.mipsel.elf New Fork (PID: 6509, Parent: 6507)
- cleanup
⊘No yara matches
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | ReversingLabs: | |||
| Source: | Virustotal: | Perma Link | ||
| Source: | String: | ||
| Source: | String: | ||
| Source: | String: | ||