Linux Analysis Report
arm5.elf

Overview

General Information

Sample name: arm5.elf
Analysis ID: 1543109
MD5: 5f91760acadeeb8da9be0e8e3e96c146
SHA1: d651f3746a68e5fc93292706c3ddbdde6f0f314d
SHA256: edffa5484df311638141cbdb6cdc2209532e0d9ef4a93ee813d5eecd9fe45046
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: arm5.elf ReversingLabs: Detection: 39%
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: busybox
Source: Initial sample String containing 'busybox' found: sys_monitor_cnrbusyboxadbddockerdBlink_Cloudsystemdhttpshsshdbashmsg_centerlte_mgrmain_mgrarm7arm5arm6mipsx86_32x86_64/tmp/var/mnt/root/boot/sbin/home/dev/media/opt/../(deleted)x86sh4softbot.armsoftbot.mpsl/dev/watchdog/dev/misc/watchdog/hello
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal48.linELF@0/0@2/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/arm5.elf (PID: 5493) Queries kernel information via 'uname': Jump to behavior
Source: arm5.elf, 5493.1.00005631b09f5000.00005631b0b23000.rw-.sdmp Binary or memory string: 1V!/etc/qemu-binfmt/arm
Source: arm5.elf, 5493.1.00007fffab958000.00007fffab979000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm5.elf
Source: arm5.elf, 5493.1.00007fffab958000.00007fffab979000.rw-.sdmp Binary or memory string: qemu: %s: %s
Source: arm5.elf, 5493.1.00007fffab958000.00007fffab979000.rw-.sdmp Binary or memory string: leqemu: %s: %s
Source: arm5.elf, 5493.1.00005631b09f5000.00005631b0b23000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: arm5.elf, 5493.1.00007fffab958000.00007fffab979000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: arm5.elf, 5493.1.00005631b09f5000.00005631b0b23000.rw-.sdmp Binary or memory string: rg.qemu.gdb.arm.sys.regs">
Source: arm5.elf, 5493.1.00005631b09f5000.00005631b0b23000.rw-.sdmp Binary or memory string: 1Vrg.qemu.gdb.arm.sys.regs">

No Screenshots

⊘No contacted IP infos

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.24 true