Linux Analysis Report qlmOM0y98B

Overview

General Information

Sample Name:	qlmOM0y98B
Analysis ID:	511561
MD5:	6c982efa63458b428ed98b6f2fa70165
SHA1:	199fd3f587ed36e207696f3642986bd508dc0839
SHA256:	1b20443752270cfe8fcd3f4d21ca7fbb9094e150d1b508826eaf1a454280d40b
Tags:	32elfmiraipowerpc
Infos:
Most interesting Screenshot:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample tries to kill a process (SIGKILL)

Classification

Signatures

AV Detection:

Multi AV Scanner detection for submitted file

Source: qlmOM0y98B	Virustotal: Detection: 21%			Perma Link
Source: qlmOM0y98B	ReversingLabs: Detection: 18%

Networking:

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.23:56596 -> 45.95.169.120:455

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43

System Summary:

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Sample tries to kill a process (SIGKILL)

Source: /tmp/qlmOM0y98B (PID: 5245)	SIGKILL sent: pid: 2256, result: successful	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	SIGKILL sent: pid: 2258, result: no such process	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	SIGKILL sent: pid: 5199, result: successful	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	SIGKILL sent: pid: 5203, result: successful	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	SIGKILL sent: pid: 5318, result: successful	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	SIGKILL sent: pid: 5323, result: successful	Jump to behavior

Source: classification engine

Classification label: mal48.lin@0/4@0/0

Source: qlmOM0y98B

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Persistence and Installation Behavior:

Enumerates processes within the "proc" file system

Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/5140/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/5140/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/5140/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/5140/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1582/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1582/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/3088/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/3088/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1579/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1579/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1699/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1699/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1335/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1335/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1698/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1698/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1334/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1334/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1576/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/1576/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/2302/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/2302/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/qlmOM0y98B (PID: 5245)	File opened: /proc/118/status	Jump to behavior

Malware Analysis System Evasion:

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/qlmOM0y98B (PID: 5241)

Queries kernel information via 'uname':

Jump to behavior

Source: qlmOM0y98B, 5241.1.0000000019aeb338.00000000dd6019eb.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: qlmOM0y98B, 5241.1.000000005b549101.0000000009a43fa9.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/qlmOM0y98BSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/qlmOM0y98B
Source: qlmOM0y98B, 5241.1.0000000019aeb338.00000000dd6019eb.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: qlmOM0y98B, 5241.1.000000005b549101.0000000009a43fa9.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
45.95.169.120	unknown	Croatia (LOCAL Name: Hrvatska)	42864	GIGANET-HUGigaNetInternetServiceProviderCoHU	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

ID:	511561
Product:	CloudBasic
Start time:	09:52:38
Start date:	29.10.2021
Sample:	qlmOM0y98B
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	6c982efa63458b428ed98b6f2fa70165
SHA1:	199fd3f587ed36e207696f3642986bd508dc0839
SHA256:	1b20443752270cfe8fcd3f4d21ca7fbb9094e150d1b508826eaf1a454280d40b
Filetype:	ELF Executable and Linkable format (generic) (4004/1) 100.00%

Name	Type	MD5	SHA1	SHA256
/tmp/qemu-open.6hO9oM (deleted)	ASCII text, with no line terminators	CAE7C392B7851555C9DBF864483AB04F	84A9D88EE93B6802DE508FEAF538033842458EDE	05A76277B50E280A830A7902624F7EC52E40FEBE76C3EEF017516565B5340117
/tmp/qemu-open.YxTKIM (deleted)	ASCII text, with no line terminators	CAE7C392B7851555C9DBF864483AB04F	84A9D88EE93B6802DE508FEAF538033842458EDE	05A76277B50E280A830A7902624F7EC52E40FEBE76C3EEF017516565B5340117
/tmp/qemu-open.a4xBGL (deleted)	ASCII text, with no line terminators	CAE7C392B7851555C9DBF864483AB04F	84A9D88EE93B6802DE508FEAF538033842458EDE	05A76277B50E280A830A7902624F7EC52E40FEBE76C3EEF017516565B5340117
/tmp/qemu-open.cTqsEP (deleted)	ASCII text, with no line terminators	CAE7C392B7851555C9DBF864483AB04F	84A9D88EE93B6802DE508FEAF538033842458EDE	05A76277B50E280A830A7902624F7EC52E40FEBE76C3EEF017516565B5340117

Linux Analysis Report qlmOM0y98B

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Networking:

System Summary:

Persistence and Installation Behavior:

Malware Analysis System Evasion:

Screenshots

Network Map

Contacted Public IPs