Edit tour

Linux Analysis Report
sh4.elf

Overview

General Information

Sample name:sh4.elf
Analysis ID:1654219
MD5:5de069289a8b9818408598e09abf66e0
SHA1:fdcd4642930bf187ccb05789fd0a8c3f097b12f5
SHA256:7ce50411aaaa58648c44522eae656de97c804bb42031c5111a1d586d3ae6b630
Tags:elfuser-abuse_ch
Infos:

Detection

Score:48
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Enumerates processes within the "proc" file system
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample contains strings indicative of password brute-forcing capabilities
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1654219
Start date and time:2025-04-02 05:23:16 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 37s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:sh4.elf
Detection:MAL
Classification:mal48.linELF@0/4@0/0
Command:/tmp/sh4.elf
PID:6222
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
For God so loved the world
Standard Error:
  • system is lnxubuntu20
  • sh4.elf (PID: 6222, Parent: 6140, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/sh4.elf
    • sh4.elf New Fork (PID: 6226, Parent: 6222)
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: sh4.elfVirustotal: Detection: 39%Perma Link
Source: sh4.elfReversingLabs: Detection: 33%
Source: /tmp/sh4.elf (PID: 6226)Socket: 127.0.0.1:22448Jump to behavior
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne "\x77\x68\x69\x6c\x65\x20\x72\x65\x61\x64\x20\x2d\x72\x20\x6c\x3b\x20\x64\x6f\x20\x6d\x70\x3d\x24\x28\x65\x63\x68\x6f\x20\x22\x24" > kmount
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne "\x6c\x22\x20\x7c\x20\x61\x77\x6b\x20\x27\x7b\x70\x72\x69\x6e\x74\x20\x24\x32\x7d\x27\x20\x7c\x20\x73\x65\x64\x20\x27\x73\x2f\x5c" >> kmount
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne "\x5c\x30\x34\x30\x2f\x20\x2f\x67\x27\x29\x3b\x20\x63\x61\x73\x65\x20\x22\x24\x6d\x70\x22\x20\x69\x6e\x20\x2f\x70\x72\x6f\x63\x2f" >> kmount
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne "\x5b\x30\x2d\x39\x5d\x2a\x29\x20\x70\x69\x64\x3d\x24\x7b\x6d\x70\x23\x2f\x70\x72\x6f\x63\x2f\x7d\x3b\x20\x5b\x20\x2d\x64\x20\x22" >> kmount
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne "\x2f\x70\x72\x6f\x63\x2f\x24\x70\x69\x64\x22\x20\x5d\x20\x26\x26\x20\x6b\x69\x6c\x6c\x20\x2d\x39\x20\x22\x24\x70\x69\x64\x22\x20" >> kmount
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne "\x32\x3e\x2f\x64\x65\x76\x2f\x6e\x75\x6c\x6c\x20\x26\x26\x20\x75\x6d\x6f\x75\x6e\x74\x20\x22\x24\x6d\x70\x22\x20\x32\x3e\x2f\x64" >> kmount
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne "\x65\x76\x2f\x6e\x75\x6c\x6c\x3b\x3b\x20\x65\x73\x61\x63\x3b\x20\x64\x6f\x6e\x65\x20\x3c\x20\x2f\x70\x72\x6f\x63\x2f\x6d\x6f\x75" >> kmount
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne "\x6e\x74\x73" >> kmount
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne "\x66\x6f\x72\x20\x70\x69\x64\x20\x69\x6e\x20\x2f\x70\x72\x6f\x63\x2f\x5b\x30\x2d\x39\x5d\x2a\x3b\x20\x64\x6f\x20\x70\x69\x64\x5f" > swan
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne "\x6e\x75\x6d\x3d\x22\x24\x7b\x70\x69\x64\x23\x23\x2a\x2f\x7d\x22\x3b\x20\x69\x66\x20\x5b\x20\x2d\x72\x20\x22\x24\x70\x69\x64\x2f" >> swan
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne "\x6d\x61\x70\x73\x22\x20\x5d\x3b\x20\x74\x68\x65\x6e\x20\x73\x75\x73\x70\x69\x63\x69\x6f\x75\x73\x3d\x74\x72\x75\x65\x3b\x20\x77" >> swan
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne "\x68\x69\x6c\x65\x20\x49\x46\x53\x3d\x20\x72\x65\x61\x64\x20\x2d\x72\x20\x6c\x69\x6e\x65\x3b\x20\x64\x6f\x20\x63\x61\x73\x65\x20" >> swan
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne "\x22\x24\x6c\x69\x6e\x65\x22\x20\x69\x6e\x20\x2a\x22\x2f\x6c\x69\x62\x2f\x22\x2a\x7c\x2a\x22\x2f\x6c\x69\x62\x36\x34\x2f\x22\x2a" >> swan
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne "\x7c\x2a\x22\x2e\x73\x6f\x22\x2a\x29\x20\x73\x75\x73\x70\x69\x63\x69\x6f\x75\x73\x3d\x66\x61\x6c\x73\x65\x3b\x20\x62\x72\x65\x61" >> swan
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne "\x6b\x3b\x3b\x20\x65\x73\x61\x63\x3b\x20\x64\x6f\x6e\x65\x20\x3c\x20\x22\x24\x70\x69\x64\x2f\x6d\x61\x70\x73\x22\x3b\x20\x69\x66" >> swan
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne "\x20\x5b\x20\x22\x24\x73\x75\x73\x70\x69\x63\x69\x6f\x75\x73\x22\x20\x3d\x20\x74\x72\x75\x65\x20\x5d\x3b\x20\x74\x68\x65\x6e\x20" >> swan
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne "\x6b\x69\x6c\x6c\x20\x2d\x39\x20\x22\x24\x70\x69\x64\x5f\x6e\x75\x6d\x22\x3b\x20\x66\x69\x3b\x20\x66\x69\x3b\x20\x64\x6f\x6e\x65" >> swan
Source: Initial sampleString containing 'busybox' found: sh kmount/bin/busybox echo -ne "\x66\x6f\x72\x20\x70\x69\x64\x20\x69\x6e\x20\x2f\x70\x72\x6f\x63\x2f\x5b\x30\x2d\x39\x5d\x2a\x3b\x20\x64\x6f\x20\x70\x69\x64\x5f" > swan
Source: Initial sampleString containing potential weak password found: 12345
Source: Initial sampleString containing potential weak password found: 54321
Source: Initial sampleString containing potential weak password found: 654321
Source: Initial sampleString containing potential weak password found: admin1234
Source: Initial sampleString containing potential weak password found: administrator
Source: Initial sampleString containing potential weak password found: supervisor
Source: Initial sampleString containing potential weak password found: password
Source: Initial sampleString containing potential weak password found: default
Source: Initial sampleString containing potential weak password found: guest
Source: Initial sampleString containing potential weak password found: service
Source: Initial sampleString containing potential weak password found: support
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal48.linELF@0/4@0/0
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1582/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1582/fdJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1582/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/3088/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/230/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/110/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/231/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/111/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/232/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1579/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1579/fdJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1579/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/112/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/233/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1699/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1699/fdJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1699/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/113/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/234/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1335/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1335/fdJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1335/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1698/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1698/fdJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1698/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/114/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/235/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1334/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1334/fdJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1334/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1576/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1576/fdJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1576/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/2302/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/2302/fdJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/2302/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/115/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/236/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/116/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/237/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/117/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/118/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/910/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/119/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/912/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/912/fdJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/912/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/10/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/2307/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/2307/fdJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/2307/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/11/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/918/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/918/fdJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/918/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/12/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/13/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/14/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/15/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/16/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/17/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/18/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1594/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1594/fdJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1594/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/120/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/121/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1349/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1349/fdJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1349/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1/mapsJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1/fdJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/122/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/243/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/123/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/2/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/124/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/3/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/4/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/125/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/126/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1344/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1344/fdJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1344/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1465/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1465/fdJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1465/mapsJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1465/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1586/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1586/fdJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1586/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/127/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/6/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/248/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/128/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/249/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1463/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1463/fdJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1463/mapsJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/1463/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/800/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/800/fdJump to behavior
Source: /tmp/sh4.elf (PID: 6222)File opened: /proc/800/cmdlineJump to behavior
Source: /tmp/sh4.elf (PID: 6222)Queries kernel information via 'uname': Jump to behavior
Source: sh4.elf, 6222.1.00007fa6e4425000.00007fa6e442c000.rw-.sdmp, sh4.elf, 6226.1.00007fa6e4425000.00007fa6e442c000.rw-.sdmpBinary or memory string: B!!a1gAWFxuAXsFWUgBRQAA!!a1gAWFxuAXsAWUgKRXgA!!a1gAWFxuAXsAWEgJR3IA!!a10CWFxuAHsGWVcWQHAA!!a10CWFxuAHsGWVcWQHUA!!aFwAWF9uA3sGW0gLRgAA!!aFwAWFlpG2QBW0gJTwAA!!qemu-arm2QBW0gJTwAA!
Source: sh4.elf, 6226.1.00007fa6e4425000.00007fa6e442c000.rw-.sdmpBinary or memory string: vmware
Source: sh4.elf, 6222.1.00007fa6e4425000.00007fa6e442c000.rw-.sdmp, sh4.elf, 6226.1.00007fa6e4425000.00007fa6e442c000.rw-.sdmpBinary or memory string: qemu-arm
Source: sh4.elf, 6222.1.00007ffc58359000.00007ffc5837a000.rw-.sdmpBinary or memory string: /tmp/qemu-open.uq2YqF
Source: sh4.elf, 6222.1.00007ffc58359000.00007ffc5837a000.rw-.sdmp, sh4.elf, 6226.1.00007ffc58359000.00007ffc5837a000.rw-.sdmpBinary or memory string: /usr/bin/qemu-sh4
Source: sh4.elf, 6222.1.0000558f4a13d000.0000558f4a1e6000.rw-.sdmp, sh4.elf, 6226.1.0000558f4a13d000.0000558f4a1e6000.rw-.sdmpBinary or memory string: U5!/etc/qemu-binfmt/sh4
Source: sh4.elf, 6222.1.00007ffc58359000.00007ffc5837a000.rw-.sdmpBinary or memory string: U/tmp/qemu-open.uq2YqF\TIl
Source: sh4.elf, 6222.1.0000558f4a13d000.0000558f4a1e6000.rw-.sdmp, sh4.elf, 6226.1.0000558f4a13d000.0000558f4a1e6000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/sh4
Source: sh4.elf, 6222.1.00007ffc58359000.00007ffc5837a000.rw-.sdmp, sh4.elf, 6226.1.00007ffc58359000.00007ffc5837a000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-sh4/tmp/sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sh4.elf
Source: sh4.elf, 6226.1.00007ffc58359000.00007ffc5837a000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume Access1
OS Credential Dumping
11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkit1
Brute Force
Application Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1654219 Sample: sh4.elf Startdate: 02/04/2025 Architecture: LINUX Score: 48 11 109.202.202.202, 80 INIT7CH Switzerland 2->11 13 91.189.91.42, 443 CANONICAL-ASGB United Kingdom 2->13 15 91.189.91.43, 443 CANONICAL-ASGB United Kingdom 2->15 17 Multi AV Scanner detection for submitted file 2->17 7 sh4.elf 2->7         started        signatures3 process4 process5 9 sh4.elf 7->9         started       

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
sh4.elf39%VirustotalBrowse
sh4.elf33%ReversingLabsLinux.Backdoor.Gafgyt
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

No contacted domains info
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs
IPDomainCountryFlagASNASN NameMalicious
109.202.202.202
unknownSwitzerland
13030INIT7CHfalse
91.189.91.43
unknownUnited Kingdom
41231CANONICAL-ASGBfalse
91.189.91.42
unknownUnited Kingdom
41231CANONICAL-ASGBfalse
MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
  • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43efefa7.elfGet hashmaliciousMiraiBrowse
    mips.elfGet hashmaliciousUnknownBrowse
      na.elfGet hashmaliciousPrometeiBrowse
        eehah4.elfGet hashmaliciousUnknownBrowse
          sh4.elfGet hashmaliciousUnknownBrowse
            mips.elfGet hashmaliciousUnknownBrowse
              arm5.elfGet hashmaliciousUnknownBrowse
                na.elfGet hashmaliciousPrometeiBrowse
                  na.elfGet hashmaliciousPrometeiBrowse
                    na.elfGet hashmaliciousPrometeiBrowse
                      91.189.91.42efefa7.elfGet hashmaliciousMiraiBrowse
                        mips.elfGet hashmaliciousUnknownBrowse
                          na.elfGet hashmaliciousPrometeiBrowse
                            eehah4.elfGet hashmaliciousUnknownBrowse
                              sh4.elfGet hashmaliciousUnknownBrowse
                                mips.elfGet hashmaliciousUnknownBrowse
                                  arm5.elfGet hashmaliciousUnknownBrowse
                                    na.elfGet hashmaliciousPrometeiBrowse
                                      na.elfGet hashmaliciousPrometeiBrowse
                                        na.elfGet hashmaliciousPrometeiBrowse
                                          No context
                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                          CANONICAL-ASGBefefa7.elfGet hashmaliciousMiraiBrowse
                                          • 91.189.91.42
                                          mips.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 91.189.91.42
                                          eehah4.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          sh4.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          mips.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          arm5.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          arc.elfGet hashmaliciousUnknownBrowse
                                          • 185.125.190.26
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 91.189.91.42
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 91.189.91.42
                                          CANONICAL-ASGBefefa7.elfGet hashmaliciousMiraiBrowse
                                          • 91.189.91.42
                                          mips.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 91.189.91.42
                                          eehah4.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          sh4.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          mips.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          arm5.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          arc.elfGet hashmaliciousUnknownBrowse
                                          • 185.125.190.26
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 91.189.91.42
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 91.189.91.42
                                          INIT7CHefefa7.elfGet hashmaliciousMiraiBrowse
                                          • 109.202.202.202
                                          mips.elfGet hashmaliciousUnknownBrowse
                                          • 109.202.202.202
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 109.202.202.202
                                          eehah4.elfGet hashmaliciousUnknownBrowse
                                          • 109.202.202.202
                                          sh4.elfGet hashmaliciousUnknownBrowse
                                          • 109.202.202.202
                                          mips.elfGet hashmaliciousUnknownBrowse
                                          • 109.202.202.202
                                          arm5.elfGet hashmaliciousUnknownBrowse
                                          • 109.202.202.202
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 109.202.202.202
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 109.202.202.202
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 109.202.202.202
                                          No context
                                          No context
                                          Process:/tmp/sh4.elf
                                          File Type:ASCII text
                                          Category:dropped
                                          Size (bytes):360
                                          Entropy (8bit):3.8370222648475893
                                          Encrypted:false
                                          SSDEEP:6:URJdFYgcaFF1SaI/VUR4caFF1SWdIwVb/VKAvVVyAb/3hM/V+4D/VH:ITFyaPJRlazKgoaVIAbRMfF
                                          MD5:1BE2AD4A22B38ECE3D57C24DDADDB29C
                                          SHA1:DB4E5A6C00F3939DEAE0B14DB17CE2EE388221E7
                                          SHA-256:5E892F1EC61A9E009F827C9969882AF7AE7BA68A90F4D13E19179CBAF6414C0A
                                          SHA-512:627E671C3455C1F12694384B84494A3B3BCE669F3091D608688235EEDC25A98320E21037AFB4B8491B67755AE1405E2FEED99CC4E83BB3A09C6B4A494ACDD39F
                                          Malicious:false
                                          Reputation:low
                                          Preview:400000-415000 r-xp 00000000 fd:00 531563 /tmp/sh4.elf.424000-425000 rw-p 00014000 fd:00 531563 /tmp/sh4.elf.425000-42c000 rw-p 00000000 00:00 0 .7f7fe000-7f7ff000 r--p 00000000 fd:00 793309 /usr/lib/x86_64-linux-gnu/libm-2.31.so.7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].
                                          Process:/tmp/sh4.elf
                                          File Type:ASCII text, with no line terminators
                                          Category:dropped
                                          Size (bytes):13
                                          Entropy (8bit):3.5465935642949384
                                          Encrypted:false
                                          SSDEEP:3:TgKYn:TgKYn
                                          MD5:AEF4020327A62D78F5A8202D453B0A74
                                          SHA1:84FC7A7CBE0B4EF5BDB927B95EA1BD01665BE8B1
                                          SHA-256:1878DDF74B755A998CBFD2140779771966ADF507D2B95CA86906476BFD80575B
                                          SHA-512:0E1BF58363F746F19B92730E15E2091F05A2C87B120B004F3819735F4D60268E66711EBEB06E3B771B2DE327FCBB3DDD368241E7A6E1A1B759384F6D70A2C528
                                          Malicious:false
                                          Reputation:moderate, very likely benign file
                                          Preview:/tmp/sh4.elf.
                                          Process:/tmp/sh4.elf
                                          File Type:ASCII text, with no line terminators
                                          Category:dropped
                                          Size (bytes):13
                                          Entropy (8bit):3.5465935642949384
                                          Encrypted:false
                                          SSDEEP:3:TgKYn:TgKYn
                                          MD5:AEF4020327A62D78F5A8202D453B0A74
                                          SHA1:84FC7A7CBE0B4EF5BDB927B95EA1BD01665BE8B1
                                          SHA-256:1878DDF74B755A998CBFD2140779771966ADF507D2B95CA86906476BFD80575B
                                          SHA-512:0E1BF58363F746F19B92730E15E2091F05A2C87B120B004F3819735F4D60268E66711EBEB06E3B771B2DE327FCBB3DDD368241E7A6E1A1B759384F6D70A2C528
                                          Malicious:false
                                          Reputation:moderate, very likely benign file
                                          Preview:/tmp/sh4.elf.
                                          Process:/tmp/sh4.elf
                                          File Type:ASCII text, with no line terminators
                                          Category:dropped
                                          Size (bytes):13
                                          Entropy (8bit):3.5465935642949384
                                          Encrypted:false
                                          SSDEEP:3:TgKYn:TgKYn
                                          MD5:AEF4020327A62D78F5A8202D453B0A74
                                          SHA1:84FC7A7CBE0B4EF5BDB927B95EA1BD01665BE8B1
                                          SHA-256:1878DDF74B755A998CBFD2140779771966ADF507D2B95CA86906476BFD80575B
                                          SHA-512:0E1BF58363F746F19B92730E15E2091F05A2C87B120B004F3819735F4D60268E66711EBEB06E3B771B2DE327FCBB3DDD368241E7A6E1A1B759384F6D70A2C528
                                          Malicious:false
                                          Reputation:moderate, very likely benign file
                                          Preview:/tmp/sh4.elf.
                                          File type:ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), dynamically linked, stripped
                                          Entropy (8bit):6.967910666873201
                                          TrID:
                                          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                          File name:sh4.elf
                                          File size:83'944 bytes
                                          MD5:5de069289a8b9818408598e09abf66e0
                                          SHA1:fdcd4642930bf187ccb05789fd0a8c3f097b12f5
                                          SHA256:7ce50411aaaa58648c44522eae656de97c804bb42031c5111a1d586d3ae6b630
                                          SHA512:b42934406212d29aace19f2f2beb9150dd5062c334dae8e5debf7be19d0fd9a5e0b8d5af5b95b3e5e2f78e47783f045bd30c970c1d476434ff4d8641f1ab33a6
                                          SSDEEP:1536:WakKtvKpTbLgyPf+QPS5W2FlUJP0H8viPGuFdTlnOBr:WnKt6TbLgynDPSX4+ZxFdo
                                          TLSH:58839E22F4207D66CC1E68B6F4B0C9798B015AB244C61EB2ADEDF1744067E89F54EF6C
                                          File Content Preview:.ELF..............*.......@.4...XF......4. ...(...............@...@..D...D..............pE..pEB.pEB.....,H............................................././"O.n......#.*@........#.*@....&O.n.l..................................././.../.a"O.!...n...a.b("...q.

                                          ELF header

                                          Class:ELF32
                                          Data:2's complement, little endian
                                          Version:1 (current)
                                          Machine:<unknown>
                                          Version Number:0x1
                                          Type:EXEC (Executable file)
                                          OS/ABI:UNIX - System V
                                          ABI Version:0
                                          Entry Point Address:0x4001a0
                                          Flags:0xc
                                          ELF Header Size:52
                                          Program Header Offset:52
                                          Program Header Size:32
                                          Number of Program Headers:3
                                          Section Header Offset:83544
                                          Section Header Size:40
                                          Number of Section Headers:10
                                          Header String Table Index:9
                                          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                          NULL0x00x00x00x00x0000
                                          .initPROGBITS0x4000940x940x2e0x00x6AX004
                                          .textPROGBITS0x4000e00xe00x11b200x00x6AX0032
                                          .finiPROGBITS0x411c000x11c000x220x00x6AX004
                                          .rodataPROGBITS0x411c240x11c240x28700x00x2A004
                                          .ctorsPROGBITS0x4245700x145700x80x00x3WA004
                                          .dtorsPROGBITS0x4245780x145780x80x00x3WA004
                                          .dataPROGBITS0x4245840x145840x940x00x3WA004
                                          .bssNOBITS0x4246180x146180x47840x00x3WA004
                                          .shstrtabSTRTAB0x00x146180x3e0x00x0001
                                          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                          LOAD0x00x4000000x4000000x144940x144946.99320x5R E0x10000.init .text .fini .rodata
                                          LOAD0x145700x4245700x4245700xa80x482c4.07400x6RW 0x10000.ctors .dtors .data .bss
                                          DYNAMIC0x00x00x00x00x00.00000x7RWE0x4

                                          Download Network PCAP: filteredfull

                                          • Total Packets: 7
                                          • 443 (HTTPS)
                                          • 80 (HTTP)
                                          TimestampSource PortDest PortSource IPDest IP
                                          Apr 2, 2025 05:23:55.351092100 CEST43928443192.168.2.2391.189.91.42
                                          Apr 2, 2025 05:24:00.982258081 CEST42836443192.168.2.2391.189.91.43
                                          Apr 2, 2025 05:24:02.518156052 CEST4251680192.168.2.23109.202.202.202
                                          Apr 2, 2025 05:24:15.572535992 CEST43928443192.168.2.2391.189.91.42
                                          Apr 2, 2025 05:24:27.858707905 CEST42836443192.168.2.2391.189.91.43
                                          Apr 2, 2025 05:24:31.954102039 CEST4251680192.168.2.23109.202.202.202
                                          Apr 2, 2025 05:24:56.527221918 CEST43928443192.168.2.2391.189.91.42

                                          System Behavior

                                          Start time (UTC):03:23:55
                                          Start date (UTC):02/04/2025
                                          Path:/tmp/sh4.elf
                                          Arguments:-
                                          File size:4139976 bytes
                                          MD5 hash:8943e5f8f8c280467b4472c15ae93ba9