Linux Analysis Report
nPRmTlXhOT.elf

Overview

General Information

Sample name: nPRmTlXhOT.elf
renamed because original name is a hash value
Original sample name: 59c205a826e489a7df70561ba1f0bf24.elf
Analysis ID: 1546910
MD5: 59c205a826e489a7df70561ba1f0bf24
SHA1: 00aa7cd1e876b38839b6a8612f2735904e215e11
SHA256: eb12049012474931f6858e8471368bcca906bd095ff469454175fc244d3697e6
Tags: 32elfmiraipowerpc
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Detected TCP or UDP traffic on non-standard ports
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: nPRmTlXhOT.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: nPRmTlXhOT.elf ReversingLabs: Detection: 71%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.15:34726 -> 95.164.4.65:666
Source: unknown TCP traffic detected without corresponding DNS query: 95.164.4.65
Source: unknown TCP traffic detected without corresponding DNS query: 95.164.4.65
Source: unknown TCP traffic detected without corresponding DNS query: 95.164.4.65
Source: unknown TCP traffic detected without corresponding DNS query: 95.164.4.65
Source: unknown TCP traffic detected without corresponding DNS query: 95.164.4.65
Source: unknown TCP traffic detected without corresponding DNS query: 95.164.4.65
Source: unknown TCP traffic detected without corresponding DNS query: 34.243.160.129
Source: unknown TCP traffic detected without corresponding DNS query: 34.243.160.129
Source: unknown TCP traffic detected without corresponding DNS query: 95.164.4.65
Source: unknown TCP traffic detected without corresponding DNS query: 95.164.4.65
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 36182
Source: unknown Network traffic detected: HTTP traffic on port 36182 -> 443
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal56.linELF@0/0@0/0
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 5568) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.KaRdTvI1NB /tmp/tmp.XqOJJlNwOM /tmp/tmp.d5pjy5IgSh Jump to behavior
Source: /usr/bin/dash (PID: 5569) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.KaRdTvI1NB /tmp/tmp.XqOJJlNwOM /tmp/tmp.d5pjy5IgSh Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/nPRmTlXhOT.elf (PID: 5517) Queries kernel information via 'uname': Jump to behavior
Source: nPRmTlXhOT.elf, 5517.1.00005625f5552000.00005625f5602000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: nPRmTlXhOT.elf, 5519.1.00005625f5552000.00005625f5602000.rw-.sdmp, nPRmTlXhOT.elf, 5523.1.00005625f5552000.00005625f5602000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: nPRmTlXhOT.elf, 5517.1.00007ffd78553000.00007ffd78574000.rw-.sdmp, nPRmTlXhOT.elf, 5519.1.00007ffd78553000.00007ffd78574000.rw-.sdmp, nPRmTlXhOT.elf, 5523.1.00007ffd78553000.00007ffd78574000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/nPRmTlXhOT.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nPRmTlXhOT.elf
Source: nPRmTlXhOT.elf, 5517.1.00005625f5552000.00005625f5602000.rw-.sdmp, nPRmTlXhOT.elf, 5519.1.00005625f5552000.00005625f5602000.rw-.sdmp, nPRmTlXhOT.elf, 5523.1.00005625f5552000.00005625f5602000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: nPRmTlXhOT.elf, 5517.1.00007ffd78553000.00007ffd78574000.rw-.sdmp, nPRmTlXhOT.elf, 5519.1.00007ffd78553000.00007ffd78574000.rw-.sdmp, nPRmTlXhOT.elf, 5523.1.00007ffd78553000.00007ffd78574000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
95.164.4.65
 unknown Gibraltar
29632 NASSIST-ASGI false
34.243.160.129
 unknown United States
16509 AMAZON-02US false