Create Interactive Tour
Linux
Analysis Report
sh4.elf
Overview
General Information
| Sample name: | sh4.elf |
| Analysis ID: | 1648238 |
| MD5: | 19b061c750e329b9a64af04f4f551374 |
| SHA1: | b580e646101b4ecc59d2c32a6abd3fcfdfb55093 |
| SHA256: | ff5e93ab91c246bdb6a6c2a7a38316a94e140212cd1a259ceb116d6d4d944933 |
| Tags: | elfuser-abuse_ch |
| Infos: |  |
Detection
Gafgyt, Okiru
| Score: | 92 |
| Range: | 0 - 100 |
Signatures
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sample tries to kill a massive number of system processes
Yara detected Gafgyt
Yara detected Okiru
Reads system files that contain records of logged in users
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to kill multiple processes (SIGKILL)
Creates hidden files and/or directories
Deletes log files
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "grep" command used to find patterns in files or piped streams
Executes the "kill" or "pkill" command typically used to terminate processes
Found strings indicative of a multi-platform dropper
HTTP GET or POST without a user agent
Reads CPU information from /sys indicative of miner or evasive malware
Reads system information from the proc file system
Reads system version information
Reads the 'hosts' file potentially containing internal network hosts
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Uses the "uname" system call to query kernel version information (possible evasion)
Classification
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1648238 |
| Start date and time: | 2025-03-25 17:17:30 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 16s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultlinuxfilecookbook.jbs |
| Analysis system description: | Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11) |
| Analysis Mode: | default |
| Sample name: | sh4.elf |
| Detection: | MAL |
| Classification: | mal92.spre.troj.linELF@0/44@3/0 |
- Connection to analysis system has been lost, crash info: Unknown
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
| Command: | /tmp/sh4.elf |
| PID: | 6222 |
| Exit Code: | 0 |
| Exit Code Info: | |
| Killed: | False |
| Standard Output: | Connected To CNC |
| Standard Error: |
- system is lnxubuntu20
- systemd New Fork (PID: 6246, Parent: 1)
- systemd New Fork (PID: 6266, Parent: 1)
- systemd New Fork (PID: 6280, Parent: 1860)
- systemd New Fork (PID: 6281, Parent: 1)
- gvfsd-fuse New Fork (PID: 6282, Parent: 2038)
- systemd New Fork (PID: 6285, Parent: 1)
- systemd New Fork (PID: 6289, Parent: 1)
- systemd New Fork (PID: 6290, Parent: 1)
- gdm3 New Fork (PID: 6298, Parent: 1320)
- gdm3 New Fork (PID: 6299, Parent: 1320)
- gdm3 New Fork (PID: 6300, Parent: 1320)
- systemd New Fork (PID: 6304, Parent: 1)
- systemd New Fork (PID: 6362, Parent: 1)
- gpu-manager New Fork (PID: 6363, Parent: 6362)
- sh New Fork (PID: 6364, Parent: 6363)
- gpu-manager New Fork (PID: 6367, Parent: 6362)
- sh New Fork (PID: 6368, Parent: 6367)
- gpu-manager New Fork (PID: 6369, Parent: 6362)
- sh New Fork (PID: 6370, Parent: 6369)
- gpu-manager New Fork (PID: 6371, Parent: 6362)
- sh New Fork (PID: 6372, Parent: 6371)
- gpu-manager New Fork (PID: 6375, Parent: 6362)
- sh New Fork (PID: 6376, Parent: 6375)
- gpu-manager New Fork (PID: 6377, Parent: 6362)
- sh New Fork (PID: 6378, Parent: 6377)
- gpu-manager New Fork (PID: 6379, Parent: 6362)
- sh New Fork (PID: 6380, Parent: 6379)
- gpu-manager New Fork (PID: 6381, Parent: 6362)
- sh New Fork (PID: 6382, Parent: 6381)
- systemd New Fork (PID: 6366, Parent: 1)
- systemd New Fork (PID: 6383, Parent: 1)
- generate-config New Fork (PID: 6384, Parent: 6383)
- systemd New Fork (PID: 6385, Parent: 1)
- systemd New Fork (PID: 6391, Parent: 1)
- systemd New Fork (PID: 6396, Parent: 1)
- gdm3 New Fork (PID: 6399, Parent: 6396)
- gdm3 New Fork (PID: 6413, Parent: 6396)
- gdm-session-worker New Fork (PID: 6419, Parent: 6413)
- gdm-wayland-session New Fork (PID: 6421, Parent: 6419)
- dbus-daemon New Fork (PID: 6423, Parent: 6421)
- dbus-daemon New Fork (PID: 6424, Parent: 6423)
- gdm-wayland-session New Fork (PID: 6425, Parent: 6419)
- dbus-run-session New Fork (PID: 6426, Parent: 6425)
- gdm3 New Fork (PID: 6427, Parent: 6396)
- gdm3 New Fork (PID: 6428, Parent: 6396)
- systemd New Fork (PID: 6400, Parent: 1)
- accounts-daemon New Fork (PID: 6404, Parent: 6400)
- language-validate New Fork (PID: 6405, Parent: 6404)
- language-options New Fork (PID: 6406, Parent: 6405)
- systemd New Fork (PID: 6409, Parent: 1)
- systemd New Fork (PID: 6454, Parent: 1860)
- systemd New Fork (PID: 6455, Parent: 1860)
- systemd New Fork (PID: 6456, Parent: 1)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| Bashlite, Gafgyt | Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps. | No Attribution |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Gafgyt | Yara detected Gafgyt | Joe Security | ||
| JoeSecurity_Okiru | Yara detected Okiru | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Gafgyt | Yara detected Gafgyt | Joe Security | ||
| JoeSecurity_Okiru | Yara detected Okiru | Joe Security | ||
| JoeSecurity_Gafgyt | Yara detected Gafgyt | Joe Security | ||
| JoeSecurity_Okiru | Yara detected Okiru | Joe Security | ||
| JoeSecurity_Gafgyt | Yara detected Gafgyt | Joe Security | ||
| Click to see the 22 entries | ||||
⊘No Suricata rule has matched
- • AV Detection
- • Bitcoin Miner
- • Spreading
- • Networking
- • System Summary
- • Persistence and Installation Behavior
- • Malware Analysis System Evasion
- • Language, Device and Operating System Detection
- • Stealing of Sensitive Information
- • Remote Access Functionality
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Reads CPU info from /sys: | Jump to behavior | ||
| Source: | Reads CPU info from /sys: | Jump to behavior | ||
| Source: | String: | ||