Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

KKveTTgaAAsecNNaaaa.arm7

ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped

initial sample

Details

Filetype:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy:	6.047291053932471
Filename:	KKveTTgaAAsecNNaaaa.arm7
Filesize:	183778
MD5:	97b077cb62ee38b844602b48cfe02d73
SHA1:	a800c58b51de800550e7ca30a20fedb94115a76f
SHA256:	d6378301896dfeba58f24d5bd1b71fa00ab98b954ec74424a61f9b3f992aac34
SHA512:	e38ca5850103064dd717f8cfe32a242ac57a79c94934f431a101e1eb66129bd0a4199bb81282bfef4cd52a60af0024f785f8070c2adbb836fb54efda03f8fdea
SSDEEP:	3072:4K7JIQs2tpbPiYltZ4m0Or8AkNaKCu9rniQhdVCNHL6TcnfM/9jfcmvXwJRJob:dFs8pbPiYTZLGNaKCu9rnThor6TcfM/X
Preview:	.ELF..............(.........4....C......4. ...(........p.....V...V.......................................................................5..........................................Q.td..................................-...L..................@-.,@...0....S

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara signature match	System Summary
Uses the "uname" system call to query kernel version information (possible evasion)	Malware Analysis System Evasion	Security Software Discovery
Enumerates processes within the "proc" file system	Persistence and Installation Behavior	OS Credential Dumping
Sample listens on a socket	Networking
Sample tries to kill a process (SIGKILL)	System Summary
Found detection on Joe Sandbox Cloud Basic with higher score	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion

/run/systemd/journal/streams/.#9:74909sRlrzC

ASCII text

dropped

Details

File:	/run/systemd/journal/streams/.#9:74909sRlrzC
Category:	dropped
Dump:	.#9_74909sRlrzC.23.dr
ID:	dr_2
Target ID:	23
Process:	/lib/systemd/systemd-journald
Type:	ASCII text
Entropy:	5.513153612691522
Encrypted:	false
Ssdeep:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzfch7RS0Dkin9lsjq:SbFuFyLVIg1BG+f+MW7R9DB92ji4s
Size:	223
Whitelisted:	false
Reputation:	low

/run/systemd/journal/streams/.#9:74914GLndJA

ASCII text

dropped

Details

File:	/run/systemd/journal/streams/.#9:74914GLndJA
Category:	dropped
Dump:	.#9_74914GLndJA.23.dr
ID:	dr_3
Target ID:	23
Process:	/lib/systemd/systemd-journald
Type:	ASCII text
Entropy:	5.5429844560520385
Encrypted:	false
Ssdeep:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmznmoAtE2ySbMqjs77:SbFuFyLVIg1BG+f+MaoAlBgqji4s
Size:	223
Whitelisted:	false
Reputation:	low

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

data

dropped

Details

File:	/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal
Category:	dropped
Dump:	system.journal.23.dr
ID:	dr_0
Target ID:	23
Process:	/lib/systemd/systemd-journald
Type:	data
Entropy:	1.448047321524811
Encrypted:	false
Ssdeep:	3:F31HloUes/:F3P
Size:	240
Whitelisted:	false
Reputation:	low

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

data

dropped

Details

File:	/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal
Category:	dropped
Dump:	user-1000.journal.23.dr
ID:	dr_1
Target ID:	23
Process:	/lib/systemd/systemd-journald
Type:	data
Entropy:	1.4226312153993532
Encrypted:	false
Ssdeep:	3:F31HlcY+UlXUY+Ml:F3MWk2l
Size:	240
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

/tmp/KKveTTgaAAsecNNaaaa.arm7

n/a

/tmp/KKveTTgaAAsecNNaaaa.arm7

n/a

/tmp/KKveTTgaAAsecNNaaaa.arm7

n/a

/tmp/KKveTTgaAAsecNNaaaa.arm7

n/a

/tmp/KKveTTgaAAsecNNaaaa.arm7

n/a

/tmp/KKveTTgaAAsecNNaaaa.arm7

n/a

/tmp/KKveTTgaAAsecNNaaaa.arm7

n/a

/tmp/KKveTTgaAAsecNNaaaa.arm7

n/a

/tmp/KKveTTgaAAsecNNaaaa.arm7

n/a

/usr/lib/systemd/systemd

n/a

/usr/bin/journalctl

/usr/bin/journalctl --smart-relinquish-var

/usr/lib/systemd/systemd

n/a

/lib/systemd/systemd-journald

/usr/bin/xfce4-session

n/a

/usr/bin/xfsettingsd