Edit tour

Linux Analysis Report
rhash

Overview

General Information

Sample name:	rhash
Analysis ID:	1672711
MD5:	fe63e957fbb77f728e922d03398fa263
SHA1:	c6310e5e7c4fe6e4ecc5f17f8dc3c5221f0e215c
SHA256:	13f77c480c860fba3cb7aafeb79620c48854b8181d6565e4c705de2666058cbe

Detection

Score:	48
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

Sample has stripped symbol table

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1672711
Start date and time:	2025-04-24 07:55:44 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 16.04 x64 (Kernel 4.4.0-116, Firefox 88.0, Document Viewer 3.18.2, LibreOffice 5.1.6.2, OpenJDK 1.8.0_171)
Analysis Mode:	default
Sample name:	rhash
Detection:	MAL
Classification:	mal48.lin@0/0@0/0

Runtime Messages

Command:	/tmp/rhash
PID:	4713
Exit Code:	127
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:	/tmp/rhash: error while loading shared libraries: librhash.so.1: cannot open shared object file: No such file or directory

Process Tree

system is lnxubuntu1

rhash (PID: 4713, Parent: 4615, MD5: fe63e957fbb77f728e922d03398fa263) Arguments: /tmp/rhash

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: rhash	ReversingLabs: Detection: 29%
Source: rhash	Virustotal: Detection: 9%			Perma Link

Source: rhash

String found in binary or memory: http://rhash.sf.net/

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal48.lin@0/0@0/0

Mitre Att&ck Matrix

⊘No Mitre Att&ck techniques found

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
rhash	29%	ReversingLabs	Linux.Trojan.Generic
rhash	9%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://rhash.sf.net/	rhash	true		unknown

World Map of Contacted IPs

⊘No contacted IP infos

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=b956690bdb370842b2faa5f6be481319b4ac1dfc, for GNU/Linux 4.4.0, stripped
Entropy (8bit):	5.62015127010672
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 49.77% ELF Executable and Linkable format (generic) (4004/1) 49.46% Lumena CEL bitmap (63/63) 0.78%
File name:	rhash
File size:	96'000 bytes
MD5:	fe63e957fbb77f728e922d03398fa263
SHA1:	c6310e5e7c4fe6e4ecc5f17f8dc3c5221f0e215c
SHA256:	13f77c480c860fba3cb7aafeb79620c48854b8181d6565e4c705de2666058cbe
SHA512:	1fd4b5f8facfebe9ada27a006c1f2bcfae1074f31b4d983f80ff4c72768cfe32f2cba37839299f4b207400c54b679c4ee8a85d9078e50bf4bb05116c2229b8e6
SSDEEP:	1536:OTur1qhqRI+kh5Mrc7GHV71zv3EMASByjfoU2nsBF9H:OTur1CqRI+G60G3fSSByj+4H
TLSH:	20934A06B5A218FDC155C530826BD6335B3678A051213B7F3A94AA3C3F56F253F6EEA0
File Content Preview:	.ELF..............>.....@6......@........p..........@.8...@.............@.......@.......@........................................................................................................................................................0.......0.....

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	DYN (Shared object file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x3640
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	13
Section Header Offset:	94336
Section Header Size:	64
Number of Section Headers:	26
Header String Table Index:	25

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.interp	PROGBITS	0x318	0x318	0x1c	0x0	0x2	A	0	0	1
.note.gnu.property	NOTE	0x338	0x338	0x50	0x0	0x2	A	0	0	8
.note.gnu.build-id	NOTE	0x388	0x388	0x24	0x0	0x2	A	0	0	4
.note.ABI-tag	NOTE	0x3ac	0x3ac	0x20	0x0	0x2	A	0	0	4
.gnu.hash	GNU_HASH	0x3d0	0x3d0	0x34	0x0	0x2	A	6	0	8
.dynsym	DYNSYM	0x408	0x408	0x8d0	0x18	0x2	A	7	1	8
.dynstr	STRTAB	0xcd8	0xcd8	0x48c	0x0	0x2	A	0	0	1
.gnu.version	VERSYM	0x1164	0x1164	0xbc	0x2	0x2	A	6	0	2
.gnu.version_r	VERNEED	0x1220	0x1220	0x80	0x0	0x2	A	7	1	8
.rela.dyn	RELA	0x12a0	0x12a0	0x1c20	0x18	0x2	A	6	0	8
.init	PROGBITS	0x3000	0x3000	0x1b	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x3020	0x3020	0xd855	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x10878	0x10878	0xd	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x11000	0x11000	0x1f24	0x0	0x2	A	0	0	32
.eh_frame_hdr	PROGBITS	0x12f24	0x12f24	0x51c	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x13440	0x13440	0x1edc	0x0	0x2	A	0	0	8
.init_array	INIT_ARRAY	0x16b48	0x15b48	0x8	0x8	0x3	WA	0	0	8
.fini_array	FINI_ARRAY	0x16b50	0x15b50	0x8	0x8	0x3	WA	0	0	8
.dynamic	DYNAMIC	0x16b58	0x15b58	0x1c0	0x10	0x3	WA	7	0	8
.got	PROGBITS	0x16d18	0x15d18	0x2e8	0x8	0x3	WA	0	0	8
.data	PROGBITS	0x17000	0x16000	0xf50	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x17f60	0x16f50	0x1900	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0x16f50	0x1b	0x1	0x30	MS	0	0	1
.gnu_debuglink	PROGBITS	0x0	0x16f6c	0x10	0x0	0x0		0	0	4
.shstrtab	STRTAB	0x0	0x16f7c	0x102	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Prog Interpreter	Section Mappings
PHDR	0x40	0x40	0x40	0x2d8	0x2d8	1.8236	0x4	R	0x8
INTERP	0x318	0x318	0x318	0x1c	0x1c	3.9408	0x4	R	0x1	/lib64/ld-linux-x86-64.so.2	.interp
LOAD	0x0	0x0	0x0	0x2ec0	0x2ec0	2.7377	0x4	R	0x1000		.interp .note.gnu.property .note.gnu.build-id .note.ABI-tag .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn
LOAD	0x3000	0x3000	0x3000	0xd885	0xd885	6.2110	0x5	R E	0x1000		.init .text .fini
LOAD	0x11000	0x11000	0x11000	0x431c	0x431c	5.7793	0x4	R	0x1000		.rodata .eh_frame_hdr .eh_frame
LOAD	0x15b48	0x16b48	0x16b48	0x1408	0x2d18	1.5273	0x6	RW	0x1000		.init_array .fini_array .dynamic .got .data .bss
DYNAMIC	0x15b58	0x16b58	0x16b58	0x1c0	0x1c0	1.5384	0x6	RW	0x8		.dynamic
NOTE	0x338	0x338	0x338	0x50	0x50	1.8976	0x4	R	0x8		.note.gnu.property
NOTE	0x388	0x388	0x388	0x44	0x44	3.3378	0x4	R	0x4		.note.gnu.build-id .note.ABI-tag
GNU_PROPERTY	0x338	0x338	0x338	0x50	0x50	1.8976	0x4	R	0x8		.note.gnu.property
GNU_EH_FRAME	0x12f24	0x12f24	0x12f24	0x51c	0x51c	4.8565	0x4	R	0x4		.eh_frame_hdr
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x10
GNU_RELRO	0x15b48	0x16b48	0x16b48	0x4b8	0x4b8	0.7307	0x4	R	0x1		.init_array .fini_array .dynamic .got

Dynamic Tags

Type	Meta	Value	Tag
DT_NEEDED	sharedlib	librhash.so.1	0x1
DT_NEEDED	sharedlib	libc.so.6	0x1
DT_INIT	value	0x3000	0xc
DT_FINI	value	0x10878	0xd
DT_INIT_ARRAY	value	0x16b48	0x19
DT_INIT_ARRAYSZ	bytes	8	0x1b
DT_FINI_ARRAY	value	0x16b50	0x1a
DT_FINI_ARRAYSZ	bytes	8	0x1c
DT_GNU_HASH	value	0x3d0	0x6ffffef5
DT_STRTAB	value	0xcd8	0x5
DT_SYMTAB	value	0x408	0x6
DT_STRSZ	bytes	1164	0xa
DT_SYMENT	bytes	24	0xb
DT_DEBUG	value	0x0	0x15
DT_RELA	value	0x12a0	0x7
DT_RELASZ	bytes	7200	0x8
DT_RELAENT	bytes	24	0x9
DT_FLAGS	value	0x8	0x1e
DT_FLAGS_1	value	0x8000001	0x6ffffffb
DT_VERNEED	value	0x1220	0x6ffffffe
DT_VERNEEDNUM	value	1	0x6fffffff
DT_VERSYM	value	0x1164	0x6ffffff0
DT_RELACOUNT	value	207	0x6ffffff9
DT_NULL	value	0x0	0x0

Symbols

Name	Version Info Name	Version Info File Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_ITM_deregisterTMCloneTable			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_ITM_registerTMCloneTable			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__ctype_b_loc	GLIBC_2.3	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__ctype_tolower_loc	GLIBC_2.3	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__ctype_toupper_loc	GLIBC_2.3	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__cxa_finalize	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__errno_location	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__fprintf_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__gmon_start__			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__libc_start_main	GLIBC_2.34	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__sprintf_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__stack_chk_fail	GLIBC_2.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__strcpy_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__vfprintf_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
access	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
bindtextdomain	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
calloc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
closedir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dcgettext	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
exit	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fclose	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
feof	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ferror	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fflush	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fgetc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fgets	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fileno	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fopen64	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fputc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fputs	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fread	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
free	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fseek	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ftell	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fwrite	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getenv	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
gettimeofday	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
isatty	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
localtime	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
lstat64	GLIBC_2.33	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
malloc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memcmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memcpy	GLIBC_2.14	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memset	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
opendir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
posix_fadvise64	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
putc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
qsort	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
readdir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
realloc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rename	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rhash_count			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rhash_file_update			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rhash_final			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rhash_free			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rhash_get_digest_size			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rhash_get_magnet_name			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rhash_get_name			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rhash_init			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rhash_library_init			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rhash_msg			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rhash_print			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rhash_reset			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rhash_set_callback			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rhash_torrent_add_announce			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rhash_torrent_add_file			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rhash_torrent_generate_content			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rhash_torrent_set_batch_size			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rhash_torrent_set_options			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rhash_torrent_set_piece_length			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rhash_torrent_set_program_name			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rhash_transmit			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rhash_update			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setlocale	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
signal	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
stat64	GLIBC_2.33	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
stderr	GLIBC_2.2.5	libc.so.6	.dynsym	0x17f80	8	OBJECT	<unknown>	DEFAULT	22
stdin	GLIBC_2.2.5	libc.so.6	.dynsym	0x17f70	8	OBJECT	<unknown>	DEFAULT	22
stdout	GLIBC_2.2.5	libc.so.6	.dynsym	0x17f60	8	OBJECT	<unknown>	DEFAULT	22
strchr	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcpy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcspn	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strdup	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strerror	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strlen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strncmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strrchr	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strspn	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strstr	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strtol	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
textdomain	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
time	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF

Network Behavior

⊘No network behavior found

System Behavior

Analysis Process: rhash PID: 4713, Parent PID: 4615

General

Start time (UTC):	05:56:21
Start date (UTC):	24/04/2025
Path:	/tmp/rhash
Arguments:	/tmp/rhash
File size:	96000 bytes
MD5 hash:	fe63e957fbb77f728e922d03398fa263

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report rhash

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Dynamic Tags

Symbols

Network Behavior

System Behavior

Analysis Process: rhash PID: 4713, Parent PID: 4615

General

File Activities

File Opened

Chronological Activities

Linux Analysis Report
rhash