Linux Analysis Report
arm6.elf

Overview

General Information

Sample name: arm6.elf
Analysis ID: 1544064
MD5: 5c320ba8d5241cfd1ca33225d2a35603
SHA1: 1a76d19cdefe38343d74caee4e0e465403330f87
SHA256: 2dbc45c9cfaa94e3dd3d62bd3bde75e259581e195b7642404318a3f657f3c231
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 76
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Drops files in suspicious directories
Sample is packed with UPX
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to persist itself using cron
Sample tries to set files in /etc globally writable
Writes identical ELF files to multiple locations
Creates hidden files and/or directories
Creates hidden files without content (potentially used as a mutex)
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Executes commands using a shell command-line interpreter
Executes the "systemctl" command used for controlling the systemd system and service manager
Reads the 'hosts' file potentially containing internal network hosts
Sample contains only a LOAD segment without any section mappings
Sample tries to set the executable flag
Sleeps for long times indicative of sandbox evasion
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Writes ELF files to disk
Writes shell script file to disk with an unusual file extension
Writes shell script files to disk

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: arm6.elf ReversingLabs: Detection: 18%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:42788 -> 93.123.109.118:1127
Reads the 'hosts' file potentially containing internal network hosts
Source: /tmp/arm6.elf (PID: 6228) Reads hosts file: /etc/hosts Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: j.xuanxuan1997.com
Source: libgdi.so.0.8.2, 6455.1.00007f94fc4bf000.00007f94fc524000.rw-.sdmp String found in binary or memory: http://.css
Source: libgdi.so.0.8.2, 6455.1.00007f94fc4bf000.00007f94fc524000.rw-.sdmp String found in binary or memory: http://.jpg
Source: libgdi.so.0.8.2, 6455.1.00007f94fc4bf000.00007f94fc524000.rw-.sdmp String found in binary or memory: http://html4/loose.dtd
Source: arm6.elf, libgdi.so.0.8.2.14.dr, system.mark.14.dr, system.pub.14.dr, bash.cfg.14.dr String found in binary or memory: http://upx.sf.net
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x10000
Source: classification engine Classification label: mal76.spre.troj.evad.linELF@0/61@4/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Persistence and Installation Behavior
barindex
Sample tries to persist itself using /etc/profile
Source: /tmp/arm6.elf (PID: 6228) File: /etc/profile.d/bash.cfg Jump to behavior
Source: /tmp/arm6.elf (PID: 6228) File: /etc/profile.d/bash.cfg.sh Jump to behavior
Source: /tmp/arm6.elf (PID: 6228) File: /etc/profile.d/gateway.sh Jump to behavior
Sample tries to persist itself using System V runlevels
Source: /usr/sbin/update-rc.d (PID: 6284) File: /etc/rc2.d/S01dns-udp4 -> ../init.d/dns-udp4 Jump to behavior
Source: /usr/sbin/update-rc.d (PID: 6284) File: /etc/rc3.d/S01dns-udp4 -> ../init.d/dns-udp4 Jump to behavior
Source: /usr/sbin/update-rc.d (PID: 6284) File: /etc/rc4.d/S01dns-udp4 -> ../init.d/dns-udp4 Jump to behavior
Source: /usr/sbin/update-rc.d (PID: 6284) File: /etc/rc5.d/S01dns-udp4 -> ../init.d/dns-udp4 Jump to behavior
Sample tries to persist itself using cron
Source: /bin/bash (PID: 6272) File: /etc/crontab Jump to behavior
Sample tries to set files in /etc globally writable
Source: /tmp/arm6.elf (PID: 6228) File: /etc/profile.d/bash.cfg (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Writes identical ELF files to multiple locations
Source: /tmp/arm6.elf (PID: 6228) File with SHA-256 2DBC45C9CFAA94E3DD3D62BD3BDE75E259581E195B7642404318A3F657F3C231 written: /boot/system.pub Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File with SHA-256 2DBC45C9CFAA94E3DD3D62BD3BDE75E259581E195B7642404318A3F657F3C231 written: /usr/lib/system.mark Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File with SHA-256 2DBC45C9CFAA94E3DD3D62BD3BDE75E259581E195B7642404318A3F657F3C231 written: /etc/profile.d/bash.cfg Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File with SHA-256 2DBC45C9CFAA94E3DD3D62BD3BDE75E259581E195B7642404318A3F657F3C231 written: /usr/lib/libgdi.so.0.8.2 Jump to dropped file
Creates hidden files and/or directories
Source: /tmp/arm6.elf (PID: 6228) File: /etc/.ffff4444 Jump to behavior
Source: /tmp/arm6.elf (PID: 6228) File: /etc/.cfg Jump to behavior
Source: /tmp/arm6.elf (PID: 6228) File: /etc/.cfg Jump to behavior
Source: /tmp/arm6.elf (PID: 6228) File: /.mod Jump to behavior
Source: /.mod (PID: 6395) Directory: /.mod Jump to behavior
Source: /usr/lib/libgdi.so.0.8.2 (PID: 6401) File: /etc/.ffff4444 Jump to behavior
Source: /usr/lib/libgdi.so.0.8.2 (PID: 6401) File: /etc/.cfg Jump to behavior
Source: /.mod (PID: 6449) Directory: /.mod Jump to behavior
Source: /usr/lib/libgdi.so.0.8.2 (PID: 6455) File: /etc/.ffff4444 Jump to behavior
Source: /usr/lib/libgdi.so.0.8.2 (PID: 6455) File: /etc/.cfg Jump to behavior
Creates hidden files without content (potentially used as a mutex)
Source: /usr/lib/libgdi.so.0.8.2 (PID: 6455) Empty hidden file: /etc/.ffff4444 Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/arm6.elf (PID: 6236) Shell command executed: /bin/bash -c "cd /boot;systemctl daemon-reload;systemctl enable quotaon.service;systemctl start quotaon.service;journalctl -xe --no-pager" Jump to behavior
Source: /tmp/arm6.elf (PID: 6262) Shell command executed: /bin/bash -c "cd /boot;ausearch -c 'system.pub' --raw | audit2allow -M my-Systemmod;semodule -X 300 -i my-Systemmod.pp" Jump to behavior
Source: /tmp/arm6.elf (PID: 6272) Shell command executed: /bin/bash -c "echo \"*/1 * * * * root /.mod \" >> /etc/crontab" Jump to behavior
Source: /usr/sbin/cron (PID: 6394) Shell command executed: /bin/sh -c "/.mod " Jump to behavior
Source: /usr/sbin/cron (PID: 6448) Shell command executed: /bin/sh -c "/.mod " Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /bin/bash (PID: 6242) Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload Jump to behavior
Source: /bin/bash (PID: 6247) Systemctl executable: /usr/bin/systemctl -> systemctl enable quotaon.service Jump to behavior
Source: /bin/bash (PID: 6260) Systemctl executable: /usr/bin/systemctl -> systemctl start quotaon.service Jump to behavior
Source: /usr/sbin/update-rc.d (PID: 6289) Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload Jump to behavior
Source: /usr/sbin/service (PID: 6316) Systemctl executable: /usr/bin/systemctl -> systemctl start cron.service Jump to behavior
Source: /usr/sbin/service (PID: 6320) Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active multi-user.target Jump to behavior
Source: /usr/sbin/service (PID: 6333) Systemctl executable: /usr/bin/systemctl -> systemctl list-unit-files --full --type=socket Jump to behavior
Source: /tmp/arm6.elf (PID: 6339) Systemctl executable: /usr/bin/systemctl -> systemctl start crond.service Jump to behavior
Sample tries to set the executable flag
Source: /tmp/arm6.elf (PID: 6228) File: /boot/system.pub (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/arm6.elf (PID: 6228) File: /etc/profile.d/bash.cfg (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/arm6.elf (PID: 6228) File: /usr/lib/libgdi.so.0.8.2 (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/arm6.elf (PID: 6228) File: /usr/lib/system.mark (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Writes ELF files to disk
Source: /tmp/arm6.elf (PID: 6228) File written: /boot/system.pub Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File written: /etc/profile.d/bash.cfg Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File written: /usr/lib/libgdi.so.0.8.2 Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File written: /usr/lib/system.mark Jump to dropped file
Writes shell script file to disk with an unusual file extension
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /.mod Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/acpid Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/alsa-utils Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/anacron Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/apparmor Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/apport Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/avahi-daemon Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/binfmt-support Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/bluetooth Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/cron Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/cryptdisks Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/cryptdisks-early Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/cups Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/cups-browsed Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/dbus Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/gdm3 Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/hddtemp Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/irqbalance Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/iscsid Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/kmod Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/lightdm Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/lm-sensors Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/lvm2-lvmpolld Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/mono-xsp4 Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/multipath-tools Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/open-iscsi Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/open-vm-tools Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/plymouth Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/plymouth-log Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/procps Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/rsync Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/rsyslog Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/saned Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/screen-cleanup Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/spice-vdagent Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/ssh Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/udev Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/ufw Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/unattended-upgrades Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/uuidd Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/x11-common Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/dns-udp4 Jump to dropped file
Writes shell script files to disk
Source: /tmp/arm6.elf (PID: 6228) Shell script file created: /etc/profile.d/bash.cfg.sh Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Shell script file created: /etc/init.d/console-setup.sh Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Shell script file created: /etc/init.d/hwclock.sh Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Shell script file created: /etc/init.d/keyboard-setup.sh Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) Shell script file created: /etc/profile.d/gateway.sh Jump to dropped file
Source: /usr/sbin/service (PID: 6334) Sed executable: /usr/bin/sed -> sed -ne s/\\.socket\\s*[a-z]*\\s*$/.socket/p Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Drops files in suspicious directories
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/acpid Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/alsa-utils Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/anacron Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/apparmor Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/apport Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/avahi-daemon Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/binfmt-support Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/bluetooth Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/console-setup.sh Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/cron Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/cryptdisks Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/cryptdisks-early Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/cups Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/cups-browsed Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/dbus Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/gdm3 Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/hddtemp Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/hwclock.sh Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/irqbalance Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/iscsid Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/keyboard-setup.sh Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/kmod Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/lightdm Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/lm-sensors Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/lvm2-lvmpolld Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/mono-xsp4 Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/multipath-tools Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/open-iscsi Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/open-vm-tools Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/plymouth Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/plymouth-log Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/procps Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/rsync Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/rsyslog Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/saned Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/screen-cleanup Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/spice-vdagent Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/ssh Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/udev Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/ufw Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/unattended-upgrades Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/uuidd Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/x11-common Jump to dropped file
Source: /tmp/arm6.elf (PID: 6228) File: /etc/init.d/dns-udp4 Jump to dropped file
ELF contains segments with high entropy indicating compressed/encrypted content
Source: arm6.elf Submission file: segment LOAD with 7.8877 entropy (max. 8.0)
Source: system.pub.14.dr Dropped file: segment LOAD with 7.8877 entropy (max. 8.0)
Source: bash.cfg.14.dr Dropped file: segment LOAD with 7.8877 entropy (max. 8.0)
Source: libgdi.so.0.8.2.14.dr Dropped file: segment LOAD with 7.8877 entropy (max. 8.0)
Source: system.mark.14.dr Dropped file: segment LOAD with 7.8877 entropy (max. 8.0)
Sleeps for long times indicative of sandbox evasion
Source: /usr/sbin/cron (PID: 6338) Sleeps longer then 60s: 60.0s Jump to behavior
Source: /usr/sbin/cron (PID: 6417) Sleeps longer then 60s: 60.0s Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/arm6.elf (PID: 6223) Queries kernel information via 'uname': Jump to behavior
Source: /tmp/arm6.elf (PID: 6228) Queries kernel information via 'uname': Jump to behavior
Source: /bin/bash (PID: 6236) Queries kernel information via 'uname': Jump to behavior
Source: /bin/bash (PID: 6262) Queries kernel information via 'uname': Jump to behavior
Source: /bin/bash (PID: 6272) Queries kernel information via 'uname': Jump to behavior
Source: /.mod (PID: 6395) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/libgdi.so.0.8.2 (PID: 6396) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/libgdi.so.0.8.2 (PID: 6401) Queries kernel information via 'uname': Jump to behavior
Source: /.mod (PID: 6449) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/libgdi.so.0.8.2 (PID: 6450) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/libgdi.so.0.8.2 (PID: 6455) Queries kernel information via 'uname': Jump to behavior
Source: .mod, 6396.1.00007ffe5ace9000.00007ffe5ad0a000.rw-.sdmp, libgdi.so.0.8.2, 6396.1.00007ffe5ace9000.00007ffe5ad0a000.rw-.sdmp Binary or memory string: Ix86_64/usr/bin/qemu-arm/usr/lib/libgdi.so.0.8.2SHELL=/bin/shPWD=/rootLOGNAME=rootHOME=/rootLANG=en_US.UTF-8SHLVL=1PATH=/usr/bin:/bin_=/usr/lib/libgdi.so.0.8.2/usr/lib/libgdi.so.0.8.2
Source: libgdi.so.0.8.2, 6455.1.00005587ab4f4000.00005587abb1f000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm1RelativeDistinguishedName
Source: open-vm-tools.14.dr Binary or memory string: rm -f /var/run/vmtoolsd.pid
Source: arm6.elf, 6223.1.000055f85b551000.000055f85bb7d000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: libgdi.so.0.8.2, 6401.1.0000562059b4d000.000056205a178000.rw-.sdmp Binary or memory string: Y V!/etc/qemu-binfmt/arm1RelativeDistinguishedName
Source: .mod, 6450.1.00007ffd2cf0a000.00007ffd2cf2b000.rw-.sdmp, libgdi.so.0.8.2, 6450.1.00007ffd2cf0a000.00007ffd2cf2b000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/usr/lib/libgdi.so.0.8.2SHELL=/bin/shPWD=/rootLOGNAME=rootHOME=/rootLANG=en_US.UTF-8SHLVL=1PATH=/usr/bin:/bin_=/usr/lib/libgdi.so.0.8.2/usr/lib/libgdi.so.0.8.2
Source: open-vm-tools.14.dr Binary or memory string: checktool='vmware-checkvm'
Source: libgdi.so.0.8.2, 6455.1.00005587ab4f4000.00005587abb1f000.rw-.sdmp Binary or memory string: Urg.qemu.gdb.arm.sys.regs">
Source: .mod, 6396.1.000056536a5e9000.000056536ac14000.rw-.sdmp, libgdi.so.0.8.2, 6396.1.000056536a5e9000.000056536ac14000.rw-.sdmp Binary or memory string: _jSV!/etc/qemu-binfmt/arm
Source: open-vm-tools.14.dr Binary or memory string: log_daemon_msg "Starting open-vm daemon" "vmtoolsd"
Source: libgdi.so.0.8.2, 6455.1.00005587ab4f4000.00005587abb1f000.rw-.sdmp Binary or memory string: rg.qemu.gdb.arm.sys.regs">
Source: arm6.elf, 6223.1.00007ffd0f02f000.00007ffd0f050000.rw-.sdmp Binary or memory string: 2+\x86_64/usr/bin/qemu-arm/tmp/arm6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm6.elf
Source: open-vm-tools.14.dr Binary or memory string: status_of_proc -p /var/run/vmtoolsd.pid /usr/bin/vmtoolsd vmtoolsd && exit 0 || exit $?
Source: open-vm-tools.14.dr Binary or memory string: # Check if we're running inside VMWare
Source: open-vm-tools.14.dr Binary or memory string: start-stop-daemon --start --quiet --pidfile /var/run/vmtoolsd.pid --exec /usr/bin/vmtoolsd --test > /dev/null || exit 1
Source: open-vm-tools.14.dr Binary or memory string: if ! ${checktool} | grep -iq vmware; then
Source: libgdi.so.0.8.2, 6455.1.00007ffceca90000.00007ffcecab1000.rw-.sdmp Binary or memory string: 8apx86_64/usr/bin/qemu-arm/usr/lib/libgdi.so.0.8.2
Source: libgdi.so.0.8.2, 6401.1.00007fff034fa000.00007fff0351b000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/usr/lib/libgdi.so.0.8.2
Source: .mod, 6450.1.0000561186ac0000.00005611870eb000.rw-.sdmp, libgdi.so.0.8.2, 6450.1.0000561186ac0000.00005611870eb000.rw-.sdmp Binary or memory string: Vrg.qemu.gdb.arm.sys.regs">
Source: libgdi.so.0.8.2, 6401.1.0000562059b4d000.000056205a178000.rw-.sdmp Binary or memory string: Y Vrg.qemu.gdb.arm.sys.regs">
Source: open-vm-tools.14.dr Binary or memory string: start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile /var/run/vmtoolsd.pid --exec /usr/bin/vmtoolsd
Source: open-vm-tools.14.dr Binary or memory string: log_daemon_msg "Stopping open-vm guest daemon" "vmtoolsd"
Source: open-vm-tools.14.dr Binary or memory string: echo "open-vm-tools: not starting as this is not a VMware VM"
Source: libgdi.so.0.8.2, 6455.1.00005587ab4f4000.00005587abb1f000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: libgdi.so.0.8.2, 6455.1.00007ffceca90000.00007ffcecab1000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: .mod, 6396.1.000056536a5e9000.000056536ac14000.rw-.sdmp, libgdi.so.0.8.2, 6396.1.000056536a5e9000.000056536ac14000.rw-.sdmp Binary or memory string: ^jSVrg.qemu.gdb.arm.sys.regs">
Source: .mod, 6450.1.0000561186ac0000.00005611870eb000.rw-.sdmp, libgdi.so.0.8.2, 6450.1.0000561186ac0000.00005611870eb000.rw-.sdmp Binary or memory string: V!/etc/qemu-binfmt/arm
Source: open-vm-tools.14.dr Binary or memory string: start-stop-daemon --start --quiet --pidfile /var/run/vmtoolsd.pid --exec /usr/bin/vmtoolsd -- --background /var/run/vmtoolsd.pid || exit 2

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
93.123.109.118
 j.xuanxuan1997.com Bulgaria
48584 SARNICA-ASBG false
109.202.202.202
 unknown Switzerland
13030 INIT7CH false
91.189.91.43
 unknown United Kingdom
41231 CANONICAL-ASGB false
91.189.91.42
 unknown United Kingdom
41231 CANONICAL-ASGB false

Contacted Domains

Name IP Active
j.xuanxuan1997.com 93.123.109.118 true
www.google.com 142.250.185.100 true