Edit tour

Linux Analysis Report
spc.elf

Overview

General Information

Sample name:	spc.elf
Analysis ID:	1583937
MD5:	caf2512020d007fed8113fd5302c8f5f
SHA1:	d634fca4f006b081b5043a024133cfb85502f10e
SHA256:	ac93db4801f970a44992f548c1f814b66aa02e596ba7f9eaf5bd6d5952fb36fc
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Sample tries to kill multiple processes (SIGKILL)

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583937
Start date and time:	2025-01-03 21:47:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	spc.elf
Detection:	MAL
Classification:	mal52.spre.linELF@0/400@5/0

Warnings

VT rate limit hit for: spc.elf

Runtime Messages

Command:	/tmp/spc.elf
PID:	5469
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	dear
Standard Error:

Process Tree

system is lnxubuntu20

spc.elf (PID: 5469, Parent: 5397, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/spc.elf

spc.elf New Fork (PID: 5472, Parent: 5469)

spc.elf New Fork (PID: 5474, Parent: 5472)

spc.elf New Fork (PID: 5476, Parent: 5472)

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: spc.elf

ReversingLabs: Detection: 26%

Source: spc.elf

String: /proc/self/exeself/proc//bin/bash/bin/sh/bin/dashbashshftpwgettftpncnetcatnmaptcpdumpsocatcurlbusyboxpythonrebootechoinitcroniptablessshdtelnettelnetdtftpdrshdrexecdftpdxinetdpftp/bin/login

Source: global traffic	TCP traffic: 192.168.2.14:44446 -> 210.99.52.42:13566
Source: global traffic	TCP traffic: 192.168.2.14:45882 -> 210.99.107.189:13566
Source: global traffic	TCP traffic: 192.168.2.14:49846 -> 210.99.244.172:13566
Source: global traffic	TCP traffic: 192.168.2.14:42096 -> 210.99.80.209:13566
Source: global traffic	TCP traffic: 192.168.2.14:50100 -> 210.99.238.237:13566
Source: global traffic	TCP traffic: 192.168.2.14:50244 -> 210.99.113.226:13566
Source: global traffic	TCP traffic: 192.168.2.14:43044 -> 210.99.194.184:13566
Source: global traffic	TCP traffic: 192.168.2.14:52804 -> 210.99.1.252:13566
Source: global traffic	TCP traffic: 192.168.2.14:34234 -> 210.99.95.136:13566
Source: global traffic	TCP traffic: 192.168.2.14:55286 -> 210.99.86.82:13566
Source: global traffic	TCP traffic: 192.168.2.14:52962 -> 210.99.10.167:13566
Source: global traffic	TCP traffic: 192.168.2.14:43632 -> 210.99.154.16:13566
Source: global traffic	TCP traffic: 192.168.2.14:40472 -> 210.99.7.61:13566
Source: global traffic	TCP traffic: 192.168.2.14:46482 -> 210.99.44.180:13566
Source: global traffic	TCP traffic: 192.168.2.14:44044 -> 210.99.47.19:13566
Source: global traffic	TCP traffic: 192.168.2.14:51550 -> 210.99.94.100:13566
Source: global traffic	TCP traffic: 192.168.2.14:51282 -> 210.99.61.202:13566
Source: global traffic	TCP traffic: 192.168.2.14:52288 -> 210.99.33.50:13566
Source: global traffic	TCP traffic: 192.168.2.14:44952 -> 210.99.118.113:13566
Source: global traffic	TCP traffic: 192.168.2.14:32984 -> 210.99.3.100:13566
Source: global traffic	TCP traffic: 192.168.2.14:33402 -> 210.99.94.117:13566
Source: global traffic	TCP traffic: 192.168.2.14:46882 -> 210.99.70.32:13566
Source: global traffic	TCP traffic: 192.168.2.14:50344 -> 210.99.45.72:13566
Source: global traffic	TCP traffic: 192.168.2.14:43044 -> 210.99.28.141:13566
Source: global traffic	TCP traffic: 192.168.2.14:35944 -> 210.99.208.114:13566
Source: global traffic	TCP traffic: 192.168.2.14:60574 -> 210.99.223.219:13566
Source: global traffic	TCP traffic: 192.168.2.14:59788 -> 210.99.26.121:13566
Source: global traffic	TCP traffic: 192.168.2.14:48176 -> 210.99.235.33:13566
Source: global traffic	TCP traffic: 192.168.2.14:49204 -> 210.99.183.23:13566
Source: global traffic	TCP traffic: 192.168.2.14:44328 -> 210.99.213.230:13566
Source: global traffic	TCP traffic: 192.168.2.14:55072 -> 210.99.43.52:13566
Source: global traffic	TCP traffic: 192.168.2.14:59578 -> 210.99.74.104:13566
Source: global traffic	TCP traffic: 192.168.2.14:56410 -> 83.222.191.90:13566

Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90

Source: /tmp/spc.elf (PID: 5474)	SIGKILL sent: pid: 5476, result: successful	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	SIGKILL sent: pid: 5495, result: successful	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	SIGKILL sent: pid: 5496, result: successful	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	SIGKILL sent: pid: 5497, result: successful	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	SIGKILL sent: pid: 5498, result: successful	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	SIGKILL sent: pid: 5499, result: successful	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	SIGKILL sent: pid: 5500, result: successful	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	SIGKILL sent: pid: 5501, result: successful	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	SIGKILL sent: pid: 5502, result: successful	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	SIGKILL sent: pid: 5503, result: successful	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	SIGKILL sent: pid: 5504, result: successful	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	SIGKILL sent: pid: 5505, result: successful	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	SIGKILL sent: pid: 5506, result: successful	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	SIGKILL sent: pid: 5507, result: successful	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	SIGKILL sent: pid: 5508, result: successful	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	SIGKILL sent: pid: 5509, result: successful	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	SIGKILL sent: pid: 5510, result: successful	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	SIGKILL sent: pid: 5511, result: successful	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	SIGKILL sent: pid: 5561, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /proc/self/exeself/proc//bin/bash/bin/sh/bin/dashbashshftpwgettftpncnetcatnmaptcpdumpsocatcurlbusyboxpythonrebootechoinitcroniptablessshdtelnettelnetdtftpdrshdrexecdftpdxinetdpftp/bin/login

Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5495/maps	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5495/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5496/maps	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5496/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5497/maps	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5497/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5476/maps	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5476/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5498/maps	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5498/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5499/maps	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5499/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5510/maps	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5510/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5508/maps	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5508/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5509/maps	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5509/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5500/maps	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5500/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5511/maps	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5511/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5501/maps	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5501/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5502/maps	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5502/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5503/maps	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5503/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5504/maps	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5504/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5505/maps	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5505/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5506/maps	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5506/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5507/maps	Jump to behavior
Source: /tmp/spc.elf (PID: 5474)	File opened: /proc/5507/cmdline	Jump to behavior

Source: spc.elf, 5469.1.000055f7fa069000.000055f7fa0f3000.rw-.sdmp, spc.elf, 5476.1.000055f7fa069000.000055f7fa0f3000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: spc.elf, 5469.1.000055f7fa069000.000055f7fa0f3000.rw-.sdmp, spc.elf, 5476.1.000055f7fa069000.000055f7fa0f3000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: spc.elf, 5469.1.00007ffcfd105000.00007ffcfd126000.rw-.sdmp, spc.elf, 5476.1.00007ffcfd105000.00007ffcfd126000.rw-.sdmp	Binary or memory string: _{x86_64/usr/bin/qemu-sparc/tmp/spc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/spc.elf
Source: spc.elf, 5469.1.00007ffcfd105000.00007ffcfd126000.rw-.sdmp, spc.elf, 5476.1.00007ffcfd105000.00007ffcfd126000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

IP	Domain	Country	ASN	ASN Name	Malicious
210.99.244.172	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.183.23	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.86.82	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.80.209	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.47.19	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.235.33	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.223.219	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.33.50	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.70.32	unknown	Korea Republic of	45400	NICNETKoreaTelecomKR	false
210.99.28.141	unknown	Korea Republic of	17841	NCIA-AS-KRNATIONALINFORMATIONRESOURCESSERVICEKR	false
210.99.10.167	unknown	Korea Republic of	45400	NICNETKoreaTelecomKR	false
210.99.94.117	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.107.189	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.194.184	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.95.136	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.118.113	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.74.104	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.61.202	unknown	Korea Republic of	17841	NCIA-AS-KRNATIONALINFORMATIONRESOURCESSERVICEKR	false
210.99.113.226	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
83.222.191.90	unknown	Bulgaria	43561	NET1-ASBG	false
210.99.208.114	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.238.237	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.7.61	unknown	Korea Republic of	10185	HNB-ASHanaBankCoKR	false
210.99.52.42	unknown	Korea Republic of	17841	NCIA-AS-KRNATIONALINFORMATIONRESOURCESSERVICEKR	false
210.99.94.100	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.45.72	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.44.180	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.3.100	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.1.252	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.213.230	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.43.52	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.26.121	unknown	Korea Republic of	17841	NCIA-AS-KRNATIONALINFORMATIONRESOURCESSERVICEKR	false
210.99.154.16	unknown	Korea Republic of	45400	NICNETKoreaTelecomKR	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
83.222.191.90	x86_64.elf	Get hash	malicious	Unknown	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse
	x86.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Mirai	Browse
	arm4.elf	Get hash	malicious	Unknown	Browse
	m68k.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	m68k.elf	Get hash	malicious	Mirai	Browse
210.99.95.136	mpsl.elf	Get hash	malicious	Unknown	Browse

Process:	/tmp/spc.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	249
Entropy (8bit):	3.2469482537690313
Encrypted:	false
SSDEEP:	6:MhvNDFxdTY/V05sDFLyj/VfKoO/VNfiY/VH:MbP5Ex9l
MD5:	8BC820A9531B0A231DB4729849605643
SHA1:	FF678F2045DC28B60C0444DC58ACDCD5CD22941C
SHA-256:	F965F94F908CA9900718F27FA71D69A4B36E6AFA3969F1FAE8FC52B4830CD2B2
SHA-512:	7F26CAABC19E2F9ACC0EC231580E423C1B3DBD071C1A015EC839EFEF74F8D8FFC9C583AE488C8CEFCCE142745EBDCAECBE70ABBA0F4FD4E884AF51A440B1A7F4
Malicious:	false
Reputation:	low
Preview:	10000-1d000 r-xp 00000000 fd:00 531606 /tmp/..2c000-2d000 rw-p 0000c000 fd:00 531606 /tmp/..2d000-2e000 rw-p 00000000 00:00 0 .ff7fe000-ff7ff000 ---p 00000000 00:00 0 .ff7ff000-fffff000 rw-p 00000000 00:00 0 [stack].

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.077023350605056
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	spc.elf
File size:	52'664 bytes
MD5:	caf2512020d007fed8113fd5302c8f5f
SHA1:	d634fca4f006b081b5043a024133cfb85502f10e
SHA256:	ac93db4801f970a44992f548c1f814b66aa02e596ba7f9eaf5bd6d5952fb36fc
SHA512:	4c83409ed0378d0b77e264ae66f6edb217e26fb6f4e4f4b122019eee26a397cc2d5c698821ef264ecfba8fc5fbb6f27013e51824502a3303a0468c2eb3a5a74a
SSDEEP:	768:d6osVFPyrJE3Wclpbq9j03uyTEkWPO+UXdFeHN:d6vFPyrJH2tSg3uyTEkWzScHN
TLSH:	DA334A22BA7A1E17C4D5A87E21F34314F2A25B1E34A8CA1A7DB30F5EFF1194066476F4
File Content Preview:	.ELF...........................4...(.....4. ...(.......................................................\............dt.Q................................@..(....@./m................#.....c...`.....!.....!...@.....".........`......$!...!...@...........`....

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101a4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	52264
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	4
.text	PROGBITS	0x100b0	0xb0	0xbdec	0x0	0x6	AX	4
.fini	PROGBITS	0x1be9c	0xbe9c	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x1beb0	0xbeb0	0xad8	0x0	0x2	A	8
.ctors	PROGBITS	0x2c98c	0xc98c	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x2c994	0xc994	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x2c9a0	0xc9a0	0x248	0x0	0x3	WA	8
.bss	NOBITS	0x2cbe8	0xcbe8	0x178	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0xcbe8	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0xc988	0xc988	6.1059	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0xc98c	0x2c98c	0x2c98c	0x25c	0x3d4	3.1541	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 21:47:51.727618933 CET	44446	13566	192.168.2.14	210.99.52.42
Jan 3, 2025 21:47:51.731571913 CET	45882	13566	192.168.2.14	210.99.107.189
Jan 3, 2025 21:47:51.732508898 CET	13566	44446	210.99.52.42	192.168.2.14
Jan 3, 2025 21:47:51.732567072 CET	44446	13566	192.168.2.14	210.99.52.42
Jan 3, 2025 21:47:51.732992887 CET	49846	13566	192.168.2.14	210.99.244.172
Jan 3, 2025 21:47:51.733783960 CET	42096	13566	192.168.2.14	210.99.80.209
Jan 3, 2025 21:47:51.736475945 CET	13566	45882	210.99.107.189	192.168.2.14
Jan 3, 2025 21:47:51.736546040 CET	45882	13566	192.168.2.14	210.99.107.189
Jan 3, 2025 21:47:51.737823009 CET	13566	49846	210.99.244.172	192.168.2.14
Jan 3, 2025 21:47:51.737862110 CET	49846	13566	192.168.2.14	210.99.244.172
Jan 3, 2025 21:47:51.738548994 CET	13566	42096	210.99.80.209	192.168.2.14
Jan 3, 2025 21:47:51.738615990 CET	42096	13566	192.168.2.14	210.99.80.209
Jan 3, 2025 21:47:51.745354891 CET	50100	13566	192.168.2.14	210.99.238.237
Jan 3, 2025 21:47:51.748543978 CET	50244	13566	192.168.2.14	210.99.113.226
Jan 3, 2025 21:47:51.749613047 CET	43044	13566	192.168.2.14	210.99.194.184
Jan 3, 2025 21:47:51.750212908 CET	13566	50100	210.99.238.237	192.168.2.14
Jan 3, 2025 21:47:51.750250101 CET	50100	13566	192.168.2.14	210.99.238.237
Jan 3, 2025 21:47:51.753448009 CET	13566	50244	210.99.113.226	192.168.2.14
Jan 3, 2025 21:47:51.753498077 CET	50244	13566	192.168.2.14	210.99.113.226
Jan 3, 2025 21:47:51.754411936 CET	13566	43044	210.99.194.184	192.168.2.14
Jan 3, 2025 21:47:51.754446030 CET	43044	13566	192.168.2.14	210.99.194.184
Jan 3, 2025 21:47:51.761214972 CET	43044	13566	192.168.2.14	210.99.194.184
Jan 3, 2025 21:47:51.762335062 CET	52804	13566	192.168.2.14	210.99.1.252
Jan 3, 2025 21:47:51.763518095 CET	34234	13566	192.168.2.14	210.99.95.136
Jan 3, 2025 21:47:51.765187979 CET	55286	13566	192.168.2.14	210.99.86.82
Jan 3, 2025 21:47:51.766114950 CET	13566	43044	210.99.194.184	192.168.2.14
Jan 3, 2025 21:47:51.766149998 CET	43044	13566	192.168.2.14	210.99.194.184
Jan 3, 2025 21:47:51.766969919 CET	52962	13566	192.168.2.14	210.99.10.167
Jan 3, 2025 21:47:51.767175913 CET	13566	52804	210.99.1.252	192.168.2.14
Jan 3, 2025 21:47:51.767218113 CET	52804	13566	192.168.2.14	210.99.1.252
Jan 3, 2025 21:47:51.768407106 CET	13566	34234	210.99.95.136	192.168.2.14
Jan 3, 2025 21:47:51.768440962 CET	34234	13566	192.168.2.14	210.99.95.136
Jan 3, 2025 21:47:51.768646955 CET	43632	13566	192.168.2.14	210.99.154.16
Jan 3, 2025 21:47:51.770010948 CET	13566	55286	210.99.86.82	192.168.2.14
Jan 3, 2025 21:47:51.770049095 CET	55286	13566	192.168.2.14	210.99.86.82
Jan 3, 2025 21:47:51.770421982 CET	40472	13566	192.168.2.14	210.99.7.61
Jan 3, 2025 21:47:51.771786928 CET	13566	52962	210.99.10.167	192.168.2.14
Jan 3, 2025 21:47:51.771827936 CET	52962	13566	192.168.2.14	210.99.10.167
Jan 3, 2025 21:47:51.772389889 CET	46482	13566	192.168.2.14	210.99.44.180
Jan 3, 2025 21:47:51.773406029 CET	13566	43632	210.99.154.16	192.168.2.14
Jan 3, 2025 21:47:51.773447037 CET	43632	13566	192.168.2.14	210.99.154.16
Jan 3, 2025 21:47:51.773844004 CET	44044	13566	192.168.2.14	210.99.47.19
Jan 3, 2025 21:47:51.775207996 CET	13566	40472	210.99.7.61	192.168.2.14
Jan 3, 2025 21:47:51.775238037 CET	40472	13566	192.168.2.14	210.99.7.61
Jan 3, 2025 21:47:51.775705099 CET	51550	13566	192.168.2.14	210.99.94.100
Jan 3, 2025 21:47:51.777126074 CET	13566	46482	210.99.44.180	192.168.2.14
Jan 3, 2025 21:47:51.777158976 CET	46482	13566	192.168.2.14	210.99.44.180
Jan 3, 2025 21:47:51.778086901 CET	51282	13566	192.168.2.14	210.99.61.202
Jan 3, 2025 21:47:51.778696060 CET	13566	44044	210.99.47.19	192.168.2.14
Jan 3, 2025 21:47:51.778738976 CET	44044	13566	192.168.2.14	210.99.47.19
Jan 3, 2025 21:47:51.780493021 CET	13566	51550	210.99.94.100	192.168.2.14
Jan 3, 2025 21:47:51.780569077 CET	51550	13566	192.168.2.14	210.99.94.100
Jan 3, 2025 21:47:51.782133102 CET	52288	13566	192.168.2.14	210.99.33.50
Jan 3, 2025 21:47:51.782864094 CET	13566	51282	210.99.61.202	192.168.2.14
Jan 3, 2025 21:47:51.782907963 CET	51282	13566	192.168.2.14	210.99.61.202
Jan 3, 2025 21:47:51.784564018 CET	44952	13566	192.168.2.14	210.99.118.113
Jan 3, 2025 21:47:51.786967039 CET	13566	52288	210.99.33.50	192.168.2.14
Jan 3, 2025 21:47:51.787002087 CET	52288	13566	192.168.2.14	210.99.33.50
Jan 3, 2025 21:47:51.787467957 CET	32984	13566	192.168.2.14	210.99.3.100
Jan 3, 2025 21:47:51.789392948 CET	13566	44952	210.99.118.113	192.168.2.14
Jan 3, 2025 21:47:51.789439917 CET	44952	13566	192.168.2.14	210.99.118.113
Jan 3, 2025 21:47:51.789942026 CET	33402	13566	192.168.2.14	210.99.94.117
Jan 3, 2025 21:47:51.791107893 CET	46882	13566	192.168.2.14	210.99.70.32
Jan 3, 2025 21:47:51.792254925 CET	50344	13566	192.168.2.14	210.99.45.72
Jan 3, 2025 21:47:51.792320013 CET	13566	32984	210.99.3.100	192.168.2.14
Jan 3, 2025 21:47:51.792351961 CET	32984	13566	192.168.2.14	210.99.3.100
Jan 3, 2025 21:47:51.793330908 CET	43044	13566	192.168.2.14	210.99.28.141
Jan 3, 2025 21:47:51.794481039 CET	35944	13566	192.168.2.14	210.99.208.114
Jan 3, 2025 21:47:51.794779062 CET	13566	33402	210.99.94.117	192.168.2.14
Jan 3, 2025 21:47:51.794811010 CET	33402	13566	192.168.2.14	210.99.94.117
Jan 3, 2025 21:47:51.795690060 CET	60574	13566	192.168.2.14	210.99.223.219
Jan 3, 2025 21:47:51.796000004 CET	13566	46882	210.99.70.32	192.168.2.14
Jan 3, 2025 21:47:51.796036005 CET	46882	13566	192.168.2.14	210.99.70.32
Jan 3, 2025 21:47:51.796696901 CET	59788	13566	192.168.2.14	210.99.26.121
Jan 3, 2025 21:47:51.797068119 CET	13566	50344	210.99.45.72	192.168.2.14
Jan 3, 2025 21:47:51.797108889 CET	50344	13566	192.168.2.14	210.99.45.72
Jan 3, 2025 21:47:51.797863960 CET	48176	13566	192.168.2.14	210.99.235.33
Jan 3, 2025 21:47:51.798172951 CET	13566	43044	210.99.28.141	192.168.2.14
Jan 3, 2025 21:47:51.798214912 CET	43044	13566	192.168.2.14	210.99.28.141
Jan 3, 2025 21:47:51.798856974 CET	49204	13566	192.168.2.14	210.99.183.23
Jan 3, 2025 21:47:51.799282074 CET	13566	35944	210.99.208.114	192.168.2.14
Jan 3, 2025 21:47:51.799346924 CET	35944	13566	192.168.2.14	210.99.208.114
Jan 3, 2025 21:47:51.799597979 CET	44328	13566	192.168.2.14	210.99.213.230
Jan 3, 2025 21:47:51.800200939 CET	55072	13566	192.168.2.14	210.99.43.52
Jan 3, 2025 21:47:51.800509930 CET	13566	60574	210.99.223.219	192.168.2.14
Jan 3, 2025 21:47:51.800544977 CET	60574	13566	192.168.2.14	210.99.223.219
Jan 3, 2025 21:47:51.800776005 CET	59578	13566	192.168.2.14	210.99.74.104
Jan 3, 2025 21:47:51.801462889 CET	13566	59788	210.99.26.121	192.168.2.14
Jan 3, 2025 21:47:51.801505089 CET	59788	13566	192.168.2.14	210.99.26.121
Jan 3, 2025 21:47:51.802644968 CET	13566	48176	210.99.235.33	192.168.2.14
Jan 3, 2025 21:47:51.802685022 CET	48176	13566	192.168.2.14	210.99.235.33
Jan 3, 2025 21:47:51.803699017 CET	13566	49204	210.99.183.23	192.168.2.14
Jan 3, 2025 21:47:51.803738117 CET	49204	13566	192.168.2.14	210.99.183.23
Jan 3, 2025 21:47:51.804573059 CET	13566	44328	210.99.213.230	192.168.2.14
Jan 3, 2025 21:47:51.804605007 CET	44328	13566	192.168.2.14	210.99.213.230
Jan 3, 2025 21:47:51.804976940 CET	13566	55072	210.99.43.52	192.168.2.14
Jan 3, 2025 21:47:51.805010080 CET	55072	13566	192.168.2.14	210.99.43.52
Jan 3, 2025 21:47:51.805547953 CET	13566	59578	210.99.74.104	192.168.2.14
Jan 3, 2025 21:47:51.805586100 CET	59578	13566	192.168.2.14	210.99.74.104
Jan 3, 2025 21:47:51.844137907 CET	56410	13566	192.168.2.14	83.222.191.90
Jan 3, 2025 21:47:51.849076986 CET	13566	56410	83.222.191.90	192.168.2.14
Jan 3, 2025 21:47:51.849127054 CET	56410	13566	192.168.2.14	83.222.191.90
Jan 3, 2025 21:47:51.850042105 CET	56410	13566	192.168.2.14	83.222.191.90
Jan 3, 2025 21:47:51.854947090 CET	13566	56410	83.222.191.90	192.168.2.14
Jan 3, 2025 21:47:51.854990005 CET	56410	13566	192.168.2.14	83.222.191.90
Jan 3, 2025 21:47:51.859786034 CET	13566	56410	83.222.191.90	192.168.2.14
Jan 3, 2025 21:48:01.851095915 CET	56410	13566	192.168.2.14	83.222.191.90
Jan 3, 2025 21:48:01.856127024 CET	13566	56410	83.222.191.90	192.168.2.14
Jan 3, 2025 21:48:02.097358942 CET	13566	56410	83.222.191.90	192.168.2.14
Jan 3, 2025 21:48:02.097594023 CET	56410	13566	192.168.2.14	83.222.191.90
Jan 3, 2025 21:48:02.430567980 CET	13566	56410	83.222.191.90	192.168.2.14
Jan 3, 2025 21:48:02.430692911 CET	56410	13566	192.168.2.14	83.222.191.90
Jan 3, 2025 21:49:02.467272997 CET	56410	13566	192.168.2.14	83.222.191.90
Jan 3, 2025 21:49:02.472055912 CET	13566	56410	83.222.191.90	192.168.2.14
Jan 3, 2025 21:49:02.669210911 CET	13566	56410	83.222.191.90	192.168.2.14
Jan 3, 2025 21:49:02.669322968 CET	56410	13566	192.168.2.14	83.222.191.90
Jan 3, 2025 21:49:03.424660921 CET	13566	56410	83.222.191.90	192.168.2.14
Jan 3, 2025 21:49:03.424781084 CET	56410	13566	192.168.2.14	83.222.191.90

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 21:47:51.803821087 CET	59168	53	192.168.2.14	8.8.8.8
Jan 3, 2025 21:47:51.810636997 CET	53	59168	8.8.8.8	192.168.2.14
Jan 3, 2025 21:47:51.811494112 CET	54841	53	192.168.2.14	8.8.8.8
Jan 3, 2025 21:47:51.818427086 CET	53	54841	8.8.8.8	192.168.2.14
Jan 3, 2025 21:47:51.819075108 CET	44966	53	192.168.2.14	8.8.8.8
Jan 3, 2025 21:47:51.827207088 CET	53	44966	8.8.8.8	192.168.2.14
Jan 3, 2025 21:47:51.827850103 CET	36952	53	192.168.2.14	8.8.8.8
Jan 3, 2025 21:47:51.834995031 CET	53	36952	8.8.8.8	192.168.2.14
Jan 3, 2025 21:47:51.835690022 CET	36105	53	192.168.2.14	8.8.8.8
Jan 3, 2025 21:47:51.843724966 CET	53	36105	8.8.8.8	192.168.2.14

Start time (UTC):	20:47:50
Start date (UTC):	03/01/2025
Path:	/tmp/spc.elf
Arguments:	/tmp/spc.elf
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report spc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.04aSz8 (deleted)

/tmp/qemu-open.08ILV6 (deleted)

/tmp/qemu-open.0Gx3N7 (deleted)

/tmp/qemu-open.0S6WM6 (deleted)

/tmp/qemu-open.0rGgm8 (deleted)

/tmp/qemu-open.0ss7k6 (deleted)

/tmp/qemu-open.0ynLb8 (deleted)

/tmp/qemu-open.1BUYf8 (deleted)

/tmp/qemu-open.1YjP75 (deleted)

/tmp/qemu-open.1b0jA9 (deleted)

/tmp/qemu-open.252iH6 (deleted)

/tmp/qemu-open.28aDP6 (deleted)

/tmp/qemu-open.2DrEJ5 (deleted)

/tmp/qemu-open.2HNvL5 (deleted)

/tmp/qemu-open.2HgGf5 (deleted)

/tmp/qemu-open.2S98o9 (deleted)

/tmp/qemu-open.2kZCQ7 (deleted)

/tmp/qemu-open.2s3bn6 (deleted)

/tmp/qemu-open.2v61L9 (deleted)

/tmp/qemu-open.32zJg9 (deleted)

/tmp/qemu-open.3Axf96 (deleted)

/tmp/qemu-open.3I7Tp7 (deleted)

/tmp/qemu-open.3QVnD5 (deleted)

/tmp/qemu-open.3RCDw7 (deleted)

/tmp/qemu-open.3SJ1J6 (deleted)

/tmp/qemu-open.3flmA7 (deleted)

/tmp/qemu-open.3pIDl9 (deleted)

/tmp/qemu-open.45r0b7 (deleted)

/tmp/qemu-open.49JjC7 (deleted)

/tmp/qemu-open.4FSHs7 (deleted)

/tmp/qemu-open.4TWwz6 (deleted)

/tmp/qemu-open.4rbcc7 (deleted)

/tmp/qemu-open.4uIj18 (deleted)

Linux Analysis Report
spc.elf

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre