Linux Analysis Report
dlr.mips.elf

Overview

General Information

Sample name: dlr.mips.elf
Analysis ID: 1546737
MD5: 87cf97359604746cbca018ba33cf8bfc
SHA1: d07ad880b56cf29da33a36aa9533d24c022a0cfd
SHA256: a5c044028e5b2aa2cb837419dba772124ac293529251089727ddde63c6745dec
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Found strings indicative of a multi-platform dropper
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Writes ELF files to disk

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: dlr.mips.elf ReversingLabs: Detection: 21%
Found strings indicative of a multi-platform dropper
Source: dvrHelper.12.dr String: W|||self(deleted)/dev/usr//bin//sbin//cmdlinewgetcurlftp
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: unknown TCP traffic detected without corresponding DNS query: 190.123.46.55
Source: global traffic HTTP traffic detected: GET /hiss.mips HTTP/1.0User-Agent: Wget
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal48.linELF@0/1@0/0
Writes ELF files to disk
Source: /tmp/dlr.mips.elf (PID: 5843) File written: /tmp/dvrHelper Jump to dropped file
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/dlr.mips.elf (PID: 5843) Queries kernel information via 'uname': Jump to behavior
Source: dlr.mips.elf, 5843.1.0000558fad56d000.0000558fad5f4000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mips
Source: dlr.mips.elf, 5843.1.0000558fad56d000.0000558fad5f4000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: dlr.mips.elf, 5843.1.00007ffd05914000.00007ffd05935000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips
Source: dlr.mips.elf, 5843.1.00007ffd05914000.00007ffd05935000.rw-.sdmp Binary or memory string: ax86_64/usr/bin/qemu-mips/tmp/dlr.mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/dlr.mips.elf

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
190.123.46.55
 unknown Panama
265540 ALTANREDESSAPIdeCVMX false