Linux Analysis Report
arm7.elf

Overview

General Information

Sample name: arm7.elf
Analysis ID: 1544584
MD5: 788ed32b5ef088761ff4ff4ca3ff6b2e
SHA1: dc1d9f2cad54d66bb30f05da567674cd65f34963
SHA256: 3c6174201540db6942d67ab8c7be162db910f40bf8a587d414cdcf2e3ae71d63
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 80
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Connects to many ports of the same IP (likely port scanning)
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample scans a subnet
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: arm7.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: arm7.elf ReversingLabs: Detection: 50%

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.13:54038 -> 46.23.108.62:23360
Source: Network traffic Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.13:42098 -> 46.23.108.133:12505
Source: Network traffic Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.13:43062 -> 46.23.108.133:16269
Source: Network traffic Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.13:48266 -> 46.23.108.65:17998
Source: Network traffic Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.13:43064 -> 46.23.108.133:16269
Source: Network traffic Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.13:48268 -> 46.23.108.65:17998
Source: Network traffic Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.13:43066 -> 46.23.108.133:16269
Source: Network traffic Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.13:36166 -> 46.23.108.54:21202
Source: Network traffic Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.13:36168 -> 46.23.108.54:21202
Source: Network traffic Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.13:53444 -> 46.23.108.62:22799
Source: Network traffic Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.13:45716 -> 46.23.108.161:19318
Source: Network traffic Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.13:48270 -> 46.23.108.65:17998
Source: Network traffic Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.13:54892 -> 46.23.108.161:12304
Source: Network traffic Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.13:53446 -> 46.23.108.62:22799
Source: Network traffic Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.13:36170 -> 46.23.108.54:21202
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 46.23.108.62 ports 22799,0,2,3,23360,6
Source: global traffic TCP traffic: 46.23.108.161 ports 1,3,8,9,19318,12304
Source: global traffic TCP traffic: 46.23.108.133 ports 0,1,2,12505,5,16269
Sample scans a subnet
Source: ip traffic Subnet 46.23.108.0/24: 46.23.108.62, 46.23.108.65, 46.23.108.54, 46.23.108.161, 46.23.108.133
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: sandmen.geek. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: sliteyed.pirate. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: repo.dyn. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:45716 -> 46.23.108.161:19318
Source: global traffic TCP traffic: 192.168.2.13:42098 -> 46.23.108.133:12505
Source: global traffic TCP traffic: 192.168.2.13:54038 -> 46.23.108.62:23360
Source: global traffic TCP traffic: 192.168.2.13:48266 -> 46.23.108.65:17998
Source: global traffic TCP traffic: 192.168.2.13:36166 -> 46.23.108.54:21202
Sample listens on a socket
Source: /tmp/arm7.elf (PID: 5422) Socket: 127.0.0.1:1172 Jump to behavior
Source: unknown UDP traffic detected without corresponding DNS query: 137.220.52.23
Source: unknown UDP traffic detected without corresponding DNS query: 137.220.52.23
Source: unknown UDP traffic detected without corresponding DNS query: 80.152.203.134
Source: unknown UDP traffic detected without corresponding DNS query: 80.152.203.134
Source: unknown UDP traffic detected without corresponding DNS query: 64.176.6.48
Source: unknown UDP traffic detected without corresponding DNS query: 64.176.6.48
Source: unknown UDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknown UDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknown UDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknown UDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknown UDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknown UDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknown UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown UDP traffic detected without corresponding DNS query: 139.84.165.176
Source: unknown UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown UDP traffic detected without corresponding DNS query: 217.160.70.42
Source: unknown UDP traffic detected without corresponding DNS query: 70.34.254.19
Source: unknown UDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknown UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown UDP traffic detected without corresponding DNS query: 178.254.22.166
Source: unknown UDP traffic detected without corresponding DNS query: 65.21.1.106
Source: unknown UDP traffic detected without corresponding DNS query: 65.21.1.106
Source: unknown UDP traffic detected without corresponding DNS query: 70.34.254.19
Source: unknown UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown UDP traffic detected without corresponding DNS query: 80.152.203.134
Source: unknown UDP traffic detected without corresponding DNS query: 70.34.254.19
Source: unknown UDP traffic detected without corresponding DNS query: 65.21.1.106
Source: unknown UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown UDP traffic detected without corresponding DNS query: 80.152.203.134
Source: unknown UDP traffic detected without corresponding DNS query: 178.254.22.166
Source: unknown UDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknown UDP traffic detected without corresponding DNS query: 70.34.254.19
Source: unknown UDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknown UDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknown UDP traffic detected without corresponding DNS query: 70.34.254.19
Source: unknown UDP traffic detected without corresponding DNS query: 5.161.109.23
Source: unknown UDP traffic detected without corresponding DNS query: 137.220.52.23
Source: unknown UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown UDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknown UDP traffic detected without corresponding DNS query: 137.220.52.23
Source: unknown UDP traffic detected without corresponding DNS query: 70.34.254.19
Source: unknown UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown UDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknown UDP traffic detected without corresponding DNS query: 5.161.109.23
Source: unknown UDP traffic detected without corresponding DNS query: 139.84.165.176
Source: unknown UDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknown UDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknown UDP traffic detected without corresponding DNS query: 80.152.203.134
Source: global traffic DNS traffic detected: DNS query: repo.dyn
Source: global traffic DNS traffic detected: DNS query: sandmen.geek. [malformed]
Source: global traffic DNS traffic detected: DNS query: dingdingrouter.pirate
Source: global traffic DNS traffic detected: DNS query: sliteyed.pirate. [malformed]
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: global traffic DNS traffic detected: DNS query: repo.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: sandmen.geek
Source: global traffic DNS traffic detected: DNS query: sliteyed.pirate
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal80.spre.troj.linELF@0/0@57/0

Persistence and Installation Behavior
barindex
Sample reads /proc/mounts (often used for finding a writable filesystem)
Source: /tmp/arm7.elf (PID: 5424) File: /proc/5424/mounts Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/arm7.elf (PID: 5433) File opened: /proc/5470/status Jump to behavior
Source: /tmp/arm7.elf (PID: 5433) File opened: /proc/5460/status Jump to behavior
Source: /tmp/arm7.elf (PID: 5433) File opened: /proc/5461/status Jump to behavior
Source: /tmp/arm7.elf (PID: 5433) File opened: /proc/5462/status Jump to behavior
Source: /tmp/arm7.elf (PID: 5433) File opened: /proc/5495/status Jump to behavior
Source: /tmp/arm7.elf (PID: 5433) File opened: /proc/5265/cmdline Jump to behavior
Source: /tmp/arm7.elf (PID: 5433) File opened: /proc/5463/status Jump to behavior
Source: /tmp/arm7.elf (PID: 5433) File opened: /proc/5453/status Jump to behavior
Source: /tmp/arm7.elf (PID: 5433) File opened: /proc/5464/status Jump to behavior
Source: /tmp/arm7.elf (PID: 5433) File opened: /proc/5454/status Jump to behavior
Source: /tmp/arm7.elf (PID: 5433) File opened: /proc/5465/status Jump to behavior
Source: /tmp/arm7.elf (PID: 5433) File opened: /proc/5455/status Jump to behavior
Source: /tmp/arm7.elf (PID: 5433) File opened: /proc/5466/status Jump to behavior
Source: /tmp/arm7.elf (PID: 5433) File opened: /proc/1/cmdline Jump to behavior
Source: /tmp/arm7.elf (PID: 5433) File opened: /proc/2/cmdline Jump to behavior
Source: /tmp/arm7.elf (PID: 5433) File opened: /proc/5456/status Jump to behavior
Source: /tmp/arm7.elf (PID: 5433) File opened: /proc/5467/status Jump to behavior
Source: /tmp/arm7.elf (PID: 5433) File opened: /proc/5457/status Jump to behavior
Source: /tmp/arm7.elf (PID: 5433) File opened: /proc/5468/status Jump to behavior
Source: /tmp/arm7.elf (PID: 5433) File opened: /proc/5458/status Jump to behavior
Source: /tmp/arm7.elf (PID: 5433) File opened: /proc/5469/status Jump to behavior
Source: /tmp/arm7.elf (PID: 5433) File opened: /proc/5459/status Jump to behavior
Source: /tmp/arm7.elf (PID: 5433) File opened: /proc/319/cmdline Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/arm7.elf (PID: 5422) Queries kernel information via 'uname': Jump to behavior
Source: arm7.elf, 5422.1.00005631f4cb3000.00005631f4e2a000.rw-.sdmp, arm7.elf, 5424.1.00005631f4cb3000.00005631f4e2a000.rw-.sdmp, arm7.elf, 5435.1.00005631f4cb3000.00005631f4e2a000.rw-.sdmp, arm7.elf, 5426.1.00005631f4cb3000.00005631f4e2a000.rw-.sdmp Binary or memory string: 1V!/etc/qemu-binfmt/arm
Source: arm7.elf, 5422.1.00005631f4cb3000.00005631f4e2a000.rw-.sdmp, arm7.elf, 5424.1.00005631f4cb3000.00005631f4e2a000.rw-.sdmp, arm7.elf, 5435.1.00005631f4cb3000.00005631f4e2a000.rw-.sdmp, arm7.elf, 5426.1.00005631f4cb3000.00005631f4e2a000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: arm7.elf, 5422.1.00007ffef5064000.00007ffef5085000.rw-.sdmp, arm7.elf, 5424.1.00007ffef5064000.00007ffef5085000.rw-.sdmp, arm7.elf, 5435.1.00007ffef5064000.00007ffef5085000.rw-.sdmp, arm7.elf, 5426.1.00007ffef5064000.00007ffef5085000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: arm7.elf, 5422.1.00007ffef5064000.00007ffef5085000.rw-.sdmp, arm7.elf, 5424.1.00007ffef5064000.00007ffef5085000.rw-.sdmp, arm7.elf, 5435.1.00007ffef5064000.00007ffef5085000.rw-.sdmp, arm7.elf, 5426.1.00007ffef5064000.00007ffef5085000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm7.elf
Source: arm7.elf, 5435.1.00007ffef5064000.00007ffef5085000.rw-.sdmp Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
46.23.108.62
 sandmen.geek Azerbaijan
15723 AZERONLINEAZ true
46.23.108.65
 unknown Azerbaijan
15723 AZERONLINEAZ true
46.23.108.54
 unknown Azerbaijan
15723 AZERONLINEAZ true
46.23.108.161
 unknown Azerbaijan
15723 AZERONLINEAZ true
46.23.108.133
 unknown Azerbaijan
15723 AZERONLINEAZ true

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true
sandmen.geek 46.23.108.62 true
dingdingrouter.pirate 46.23.108.58 true
repo.dyn unknown unknown
sliteyed.pirate. [malformed] unknown unknown
sandmen.geek. [malformed] unknown unknown
repo.dyn. [malformed] unknown unknown
sliteyed.pirate unknown unknown