Linux Analysis Report SL92Sz9pl2

Overview

General Information

Sample Name: SL92Sz9pl2
Analysis ID: 511528
MD5: acf775d467b2008bfad563cd934576b2
SHA1: a51182722d62e8d152dfc4bbe8c5c6245e1a11da
SHA256: 54999861537c5c4f4c2ced5fdf0256b7b005603bee17b25e6ae5bb3f747e16cb
Tags: 32armelfmirai
Infos:

Most interesting Screenshot:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample tries to kill a process (SIGKILL)

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: SL92Sz9pl2 Virustotal: Detection: 18% Perma Link
Source: SL92Sz9pl2 ReversingLabs: Detection: 15%

Networking:

barindex
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:56596 -> 45.95.169.120:455
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 121.165.132.200
Source: unknown TCP traffic detected without corresponding DNS query: 121.165.132.200
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 122.55.159.118
Source: unknown TCP traffic detected without corresponding DNS query: 122.55.159.118
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 186.7.246.235
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown TCP traffic detected without corresponding DNS query: 112.108.36.180
Source: unknown TCP traffic detected without corresponding DNS query: 107.150.181.17
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown TCP traffic detected without corresponding DNS query: 1.217.238.242
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.120

System Summary:

barindex
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/SL92Sz9pl2 (PID: 5248) SIGKILL sent: pid: 2256, result: successful Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) SIGKILL sent: pid: 2258, result: no such process Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) SIGKILL sent: pid: 5206, result: successful Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) SIGKILL sent: pid: 5207, result: successful Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) SIGKILL sent: pid: 5322, result: successful Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) SIGKILL sent: pid: 5327, result: successful Jump to behavior
Source: classification engine Classification label: mal48.lin@0/4@0/0
Source: SL92Sz9pl2 Joe Sandbox Cloud Basic: Detection: clean Score: 0 Perma Link

Persistence and Installation Behavior:

barindex
Enumerates processes within the "proc" file system
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/5143/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/5143/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/5143/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/5143/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1582/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1582/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1582/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1582/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/3088/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/3088/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/3088/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/3088/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/230/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/230/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/230/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/230/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/110/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/110/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/110/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/110/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/231/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/231/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/231/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/231/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/111/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/111/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/111/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/111/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/232/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/232/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/232/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/232/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1579/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1579/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1579/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1579/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/112/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/112/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/112/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/112/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/233/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/233/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/233/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/233/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1699/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1699/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1699/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1699/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/113/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/113/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/113/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/113/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/234/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/234/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/234/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/234/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1335/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1335/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1335/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1335/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1698/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1698/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1698/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1698/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/114/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/114/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/114/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/114/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/235/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/235/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/235/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/235/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1334/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1334/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1334/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1334/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1576/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1576/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1576/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/1576/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/2302/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/2302/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/2302/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/2302/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/115/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/115/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/115/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/115/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/236/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/236/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/236/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/236/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/116/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/116/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/116/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/116/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/237/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/237/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/237/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/237/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/117/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/117/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/117/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/117/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/118/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/118/cmdline Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/118/status Jump to behavior
Source: /tmp/SL92Sz9pl2 (PID: 5248) File opened: /proc/118/status Jump to behavior

Malware Analysis System Evasion:

barindex
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/SL92Sz9pl2 (PID: 5244) Queries kernel information via 'uname': Jump to behavior
Source: SL92Sz9pl2, 5244.1.00000000881539d1.0000000004a7d495.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: SL92Sz9pl2, 5244.1.0000000052529d4a.0000000007a03fda.rw-.sdmp Binary or memory string: Jx86_64/usr/bin/qemu-arm/tmp/SL92Sz9pl2SUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/SL92Sz9pl2
Source: SL92Sz9pl2, 5244.1.00000000881539d1.0000000004a7d495.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: SL92Sz9pl2, 5244.1.0000000052529d4a.0000000007a03fda.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
107.150.181.17
 unknown United States
3257 GTT-BACKBONEGTTDE false
112.108.36.180
 unknown Korea Republic of
6619 SAMSUNGSDS-AS-KRSamsungSDSIncKR false
45.95.169.120
 unknown Croatia (LOCAL Name: Hrvatska)
42864 GIGANET-HUGigaNetInternetServiceProviderCoHU false
186.7.246.235
 unknown Dominican Republic
6400 CompaniaDominicanadeTelefonosSADO false
1.217.238.242
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
122.55.159.118
 unknown Philippines
9299 IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH false
109.202.202.202
 unknown Switzerland
13030 INIT7CH false
121.165.132.200
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
91.189.91.43
 unknown United Kingdom
41231 CANONICAL-ASGB false
91.189.91.42
 unknown United Kingdom
41231 CANONICAL-ASGB false