Linux Analysis Report
flow.elf

Overview

General Information

Sample name:	flow.elf
Analysis ID:	1520643
MD5:	3f110a26621193c8e1a7c8f58231ad3f
SHA1:	39c767af6e1da1bd504e986107526c72a566c87e
SHA256:	d7bece4b8b7eab33488a5ade41981d63f5217f5451d381daabc98758970a8282
Tags:	elf
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Sample and/or dropped files likely contain functionality related to malicious behavior

ELF contains segments with high entropy indicating compressed/encrypted content

Executes the "rm" command used to delete files or directories

Sample and/or dropped files contains symbols with suspicious names

Sample has stripped symbol table

Sample tries to set the executable flag

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Writes ELF files to disk

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: flow.elf

ReversingLabs: Detection: 15%

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43

Source: flow.elf, 6229.1.000000000104e000.0000000001070000.rw-.sdmp	String found in binary or memory: https://blog.jaraco.com/skeleton
Source: _cffi_backend.cpython-310-x86_64-linux-gnu.so.16.dr	String found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
Source: flow.elf, 6229.1.000000000104e000.0000000001070000.rw-.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.metadata.html
Source: flow.elf, 6229.1.000000000104e000.0000000001070000.rw-.sdmp	String found in binary or memory: https://docs.python.org/3/reference/import.html#finders-and-loaders
Source: flow.elf, 6229.1.000000000104e000.0000000001070000.rw-.sdmp	String found in binary or memory: https://github.com/fake-useragent/fake-useragent/blob/main/AUTHORS).
Source: flow.elf, 6229.1.000000000104e000.0000000001070000.rw-.sdmp	String found in binary or memory: https://github.com/psf/black
Source: flow.elf, 6229.1.000000000104e000.0000000001070000.rw-.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata
Source: flow.elf, 6229.1.000000000104e000.0000000001070000.rw-.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22
Source: flow.elf, 6229.1.000000000104e000.0000000001070000.rw-.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/issues
Source: flow.elf, 6229.1.000000000104e000.0000000001070000.rw-.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/workflows/tests/badge.svg
Source: flow.elf, 6229.1.000000000104e000.0000000001070000.rw-.sdmp	String found in binary or memory: https://github.com/tailhook/injections
Source: flow.elf, 6229.1.000000000104e000.0000000001070000.rw-.sdmp	String found in binary or memory: https://img.shields.io/badge/code%20style-black-000000.svg
Source: flow.elf, 6229.1.000000000104e000.0000000001070000.rw-.sdmp	String found in binary or memory: https://img.shields.io/badge/skeleton-2021-informational
Source: flow.elf, 6229.1.000000000104e000.0000000001070000.rw-.sdmp	String found in binary or memory: https://img.shields.io/pypi/pyversions/importlib_metadata.svg
Source: flow.elf, 6229.1.000000000104e000.0000000001070000.rw-.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/importlib_metadata.svg
Source: flow.elf, 6229.1.000000000104e000.0000000001070000.rw-.sdmp	String found in binary or memory: https://importlib-metadata.readthedocs.io/en/latest/?badge=latest
Source: flow.elf, 6229.1.000000000104e000.0000000001070000.rw-.sdmp	String found in binary or memory: https://importlib_metadata.readthedocs.io/
Source: flow.elf, 6229.1.000000000104e000.0000000001070000.rw-.sdmp	String found in binary or memory: https://pypi.org/project/black/)
Source: flow.elf, 6229.1.000000000104e000.0000000001070000.rw-.sdmp	String found in binary or memory: https://pypi.org/project/fake-useragent/#history)):
Source: flow.elf, 6229.1.000000000104e000.0000000001070000.rw-.sdmp	String found in binary or memory: https://pypi.org/project/importlib_metadata
Source: flow.elf, 6229.1.000000000104e000.0000000001070000.rw-.sdmp	String found in binary or memory: https://readthedocs.org/projects/importlib-metadata/badge/?version=latest
Source: flow.elf, 6229.1.000000000104e000.0000000001070000.rw-.sdmp	String found in binary or memory: https://www.w3schools.com/browsers/browsers_stats.asp

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Sample and/or dropped files likely contain functionality related to malicious behavior

Source: _openssl.abi3.so.16.dr	ELF static info symbol of dropped file: SSL_CTX_get_keylog_callback
Source: _openssl.abi3.so.16.dr	ELF static info symbol of dropped file: SSL_CTX_set_keylog_callback
Source: _ssl.cpython-310-x86_64-linux-gnu.so.16.dr	ELF static info symbol of dropped file: SSL_CTX_set_keylog_callback

Sample and/or dropped files contains symbols with suspicious names

Source: _openssl.abi3.so.16.dr	ELF static info symbol of dropped file: Cryptography_pem_password_cb
Source: _openssl.abi3.so.16.dr	ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb
Source: _openssl.abi3.so.16.dr	ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb_userdata
Source: _ssl.cpython-310-x86_64-linux-gnu.so.16.dr	ELF static info symbol of dropped file: SSL_CTX_get_default_passwd_cb
Source: _ssl.cpython-310-x86_64-linux-gnu.so.16.dr	ELF static info symbol of dropped file: SSL_CTX_get_default_passwd_cb_userdata
Source: _ssl.cpython-310-x86_64-linux-gnu.so.16.dr	ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb
Source: _ssl.cpython-310-x86_64-linux-gnu.so.16.dr	ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb_userdata
Source: readline.cpython-310-x86_64-linux-gnu.so.16.dr	ELF static info symbol of dropped file: PyOS_InputHook
Source: readline.cpython-310-x86_64-linux-gnu.so.16.dr	ELF static info symbol of dropped file: rl_completion_display_matches_hook
Source: readline.cpython-310-x86_64-linux-gnu.so.16.dr	ELF static info symbol of dropped file: rl_pre_input_hook
Source: readline.cpython-310-x86_64-linux-gnu.so.16.dr	ELF static info symbol of dropped file: rl_startup_hook

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal52.linELF@0/29@0/0

Executes the "rm" command used to delete files or directories

Source: /usr/bin/dash (PID: 6199)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.9Q77JLay1z /tmp/tmp.M1BKrdKBH5 /tmp/tmp.qgT6A2WxQj			Jump to behavior
Source: /usr/bin/dash (PID: 6200)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.9Q77JLay1z /tmp/tmp.M1BKrdKBH5 /tmp/tmp.qgT6A2WxQj			Jump to behavior

Sample tries to set the executable flag

Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/_cffi_backend.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/bcrypt/_bcrypt.abi3.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/cryptography/hazmat/bindings/_openssl.abi3.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/_bz2.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/_codecs_cn.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/_codecs_hk.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/_codecs_iso2022.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/_codecs_jp.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/_codecs_kr.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/_codecs_tw.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/_contextvars.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/_ctypes.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/_decimal.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/_hashlib.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/_json.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/_lzma.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/_multibytecodec.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/_multiprocessing.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/_opcode.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/_posixshmem.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/_queue.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/_ssl.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/_uuid.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/mmap.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/readline.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/resource.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/lib-dynload/termios.cpython-310-x86_64-linux-gnu.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/libbz2.so.1.0 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/libcrypto.so.3 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/libexpat.so.1 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/libffi.so.8 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/liblzma.so.5 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/libmpdec.so.3 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/libpython3.10.so.1.0 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/libreadline.so.8 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/libssl.so.3 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/libtinfo.so.6 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/libuuid.so.1 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/libz.so.1 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/flow.elf (PID: 6229)	File: /tmp/_MEIx67uLe/ossl-modules/legacy.so (bits: - usr: - grp: - all: rwx)	Jump to behavior

Writes ELF files to disk

Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/_cffi_backend.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/bcrypt/_bcrypt.abi3.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/cryptography/hazmat/bindings/_openssl.abi3.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/_bz2.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/_codecs_cn.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/_codecs_hk.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/_codecs_iso2022.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/_codecs_jp.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/_codecs_kr.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/_codecs_tw.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/_contextvars.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/_ctypes.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/_decimal.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/_hashlib.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/_json.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/_lzma.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/_multibytecodec.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/_multiprocessing.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/_opcode.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/_posixshmem.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/_queue.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/_ssl.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/_uuid.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/mmap.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/readline.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/resource.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/lib-dynload/termios.cpython-310-x86_64-linux-gnu.so	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/libbz2.so.1.0	Jump to dropped file
Source: /tmp/flow.elf (PID: 6229)	File written: /tmp/_MEIx67uLe/libcrypto.so.3	Jump to dropped file

ELF contains segments with high entropy indicating compressed/encrypted content

Source: _bcrypt.abi3.so.16.dr	Dropped file: segment LOAD with 7.4819 entropy (max. 8.0)
Source: _codecs_cn.cpython-310-x86_64-linux-gnu.so.16.dr	Dropped file: segment LOAD with 7.6419 entropy (max. 8.0)

Screenshots

No Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

ID:	1520643
Product:	CloudBasic
Start time:	17:48:05
Start date:	27.09.2024
Sample:	flow.elf
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	3f110a26621193c8e1a7c8f58231ad3f
SHA1:	39c767af6e1da1bd504e986107526c72a566c87e
SHA256:	d7bece4b8b7eab33488a5ade41981d63f5217f5451d381daabc98758970a8282
Filetype:	ELF Executable and Linkable format (Linux) (4029/14) 49.77%

Name	Type	MD5	SHA1	SHA256
/tmp/_MEIx67uLe/_cffi_backend.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=ed2f400ec911275cdcfe419baa7399c5750f536b, with debug_info, not stripped	870A8D950571B3A486FC55D5AE604CA6	4BEE5EEB61B6CE762C42345BEF8623E1FA59966D	9DB4618E0772E9707E3791BEB1A72F57F457EB765C7A76DE92A8BC2CCF85E932
/tmp/_MEIx67uLe/bcrypt/_bcrypt.abi3.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=59a01b5d3a6800fe52797e791ea5d81c655ba8b4, stripped	1AFF51982EB4A7C90D08012D2FA0F61B	82A6CC087D5317CA54C2D7BB51A47F7484B3BB56	CB58EB5A588380F73698024A34BAD5EFF52AB15ABFF8F3BCD6823E7C4AF2DB30
/tmp/_MEIx67uLe/cryptography/hazmat/bindings/_openssl.abi3.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=1e6eae65decfe239e139e79ba14710c3ecabcf8d, stripped	605D5E724FFB45AED4E59382ADAC42ED	04BC336E8B93F8E0792431BA574334E3EE5B74F1	DD61A9B0A6B3D2E00883B000BFCBE7BB6CF9E5029D4272697AACC5D69D5CA9D0
/tmp/_MEIx67uLe/lib-dynload/_bz2.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=d17e3de2dc59aa2cb080a24acb809318862278b8, stripped	E63B446654C05BE6D2235568E30F9FC6	F8881A78E6DC8FAAAD4C582E8F99CADB04EB02A9	739AEA7A634F336564FE8EE9FC898598D54A86B85F052944A03DF2F18A17E21A
/tmp/_MEIx67uLe/lib-dynload/_codecs_cn.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=271fec538389e0b44d93bb037e145a9713f821d5, stripped	6A6BD4C39BAF16CF5C7D5F309F9BBD39	C90B70F71188B6F8E4C429861F1F7AB563C99AB5	D035F163C498CFE2DA2B62C06C38C2EEFB757B8B5DF1C0B99C64A8E2F38FF816
/tmp/_MEIx67uLe/lib-dynload/_codecs_hk.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=581b2b2daf99975167b6538c18db901765d86f7c, stripped	45E7D79E63B499ADEFA31CED29DC8077	7A5349A17DE625F00DC32A1761E2E13D23674F8B	204387BA933146C36B98057CE0D847F0429C42735EC5859A0EA171A3A66C7111
/tmp/_MEIx67uLe/lib-dynload/_codecs_iso2022.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=a955065648305a7a6a22a8e0292d83478a271559, stripped	1E414C44824FCDEBD8978FB43BBF555E	94A4A001CE552DABD7E596AE6D2EFE10472324E6	ECB8A1564EF7CEA5801FFC3F208A5F291E1EBF45641A967C88FB35A67AC9AB93
/tmp/_MEIx67uLe/lib-dynload/_codecs_jp.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=36b2c97398a3e8f38c5c79d43276ff7c1c26f02e, stripped	514F26142313E112761099491FFAA735	FE5E23DD9FA753D1E110FBF0929205FAF5066F57	8454A449B90B70B760978EE64FDE147194F8289F72649205CCB51FF71D5C694A
/tmp/_MEIx67uLe/lib-dynload/_codecs_kr.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=f7ff5c1f0f55f047b291bf40d435181a57b06c3f, stripped	FE86E2802C93EA3CBD85DC919353FC38	9EF166CAF2624517E0CFE02C761D217C528B7716	885B73C95D09313B1F1C22E4BA0B5F1C048CF13FA36982307D921C9C8170EA66
/tmp/_MEIx67uLe/lib-dynload/_codecs_tw.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=bbe80590601c759b20687f46b428138371aa7766, stripped	70AC5EF828F24F35BB628F36A6564289	F65F3601086CD3325D0170A1036237F21D36E1BC	505D7128555E8737E15A815CD585F2060D5BF25D1E8E31BED9797E567D165394
/tmp/_MEIx67uLe/lib-dynload/_contextvars.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=3d85a5e9b32cd79ac70a020f158180e090ccf1a8, stripped	FAD5657BE3D3DF59E4409CC3AC3876B6	9E48D38437DE7F27DD89628214FF1BF7F436D13B	A700AC1C9B0D1EEB97094E18078642B5A88475726F0AD8736D92F58676602154
/tmp/_MEIx67uLe/lib-dynload/_ctypes.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=e92627054248c18027e5dcdac11df158041d594b, stripped	4D7894CD042BE3C8798970A4F3C6751D	8BA3D9EA409AC5D2A3417376AE5D54D6F1A4839E	16B1ABC80A026D58203AE2BB99789A8EFF46DB68D25B69A276ACF73B51462692
/tmp/_MEIx67uLe/lib-dynload/_decimal.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=7f8299dec6439d65236d86ce686c90e4e4e5d206, stripped	CC0A5D8BDDA933AEB1B7059B10257586	132B3E10C77391567BA57CD81861DE776BEF9FF7	56A7C17060BCA2EE27DC8245A108CFD3F5DA125A9357BB5A74B13883A53E929B
/tmp/_MEIx67uLe/lib-dynload/_hashlib.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=bdd0048456f1021dab11fcdf8cea59ba8b84864b, stripped	52A9305F5153CEC04457107302797D46	8CF0C32855F9339DDD10FC715B648B3D4B2EB94A	ED8DDC0D3891FED3308A11F5834344FE3EF510C4A77BCE3B2F42D55513F77F05
/tmp/_MEIx67uLe/lib-dynload/_json.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=6aeb5e9ddaffc4186adf4a718d896d495dc491bc, stripped	3B9E0A2316BAB1225F6594D3BD1B39D7	C50D72764B7141524F144DECB73E99FB5DB6E281	188FFE352896CFAF2CF102299035E7BC4A5F25275FF6341358473F0D6A75B786
/tmp/_MEIx67uLe/lib-dynload/_lzma.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=6d2f32d58a5df0728774fa80580ece4f44b5255d, stripped	463D21ECF8ACE3F7B26E65321554CDA2	221A6B3D692A05A012B406396C25F563552DB3A6	EFCC8EE2A226B25F31A977B80D65D95DEE1A63DD269A5C53F3C0D3E8C19E643C
/tmp/_MEIx67uLe/lib-dynload/_multibytecodec.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=b76ad1c2d4794921864e4a341e8df7b7a4519716, stripped	A54F402ABF54D34F557FB72AE248C2FE	6218A5708B8C490B270FDF47327CC48C9F1FC2E1	D3AFCB499245780CD2B449C5555EA4D4D80CED7EFA778ED035ED051532C37A18
/tmp/_MEIx67uLe/lib-dynload/_multiprocessing.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=3d98325706828fff98c9c51b55470601a34b0050, stripped	9F0468DCD6EE7C05BDE411831501B6BF	10446C991636E78D9024A58DAD008B145E54BCE1	566CE9B50B5016208DA5E337B8F7EB240B16DF04FFAB6423B68BF0B8553F32EF
/tmp/_MEIx67uLe/lib-dynload/_opcode.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=7318afefac295d968b1e800563ea0e44765649b1, stripped	C80BBC97C66657B8D1D024FC58E1CA32	ADFA97795E582CA5C13ED1FA1548EE518AD1AE94	EAF60CF82E21D9468C5966CF1A920308403089FBE5661B2146AAFE2C818399A6
/tmp/_MEIx67uLe/lib-dynload/_posixshmem.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=a893ad39bb16ba959725f0d20481efee588d2dde, stripped	AE28DBBE0EAAC7503A837D19CD778426	167C90C63F7A59AD41D56B267FD38C4017B5CCC9	8874FF77C10EF2F0E36DA85D2F6996B92EA6A514681B6D03B54CFECC97E7906B
/tmp/_MEIx67uLe/lib-dynload/_queue.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=a3c4e6f427190d92ae9db00bbb9548fa5c54fcc2, stripped	D1747A367908D5D7922ABF405DB21D9A	0694DFF30FBB87DE7D5026CB41744E847CBBC963	02D2FA24083FB75694FF3F7D26C3BDA3F17DB03157023442DDC923CCF3F42F9C
/tmp/_MEIx67uLe/lib-dynload/_ssl.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=174b847b3e5356edcfcb9440b162efda7e57eae7, stripped	DE3916BB6F25E2714F2B573783F03816	AC3B377957C44378E930A7238644B3E44C4DC86E	2A639F489A398697FB56A0B3BBBC28DFB656EF029547B9DE394ED525508C7D43
/tmp/_MEIx67uLe/lib-dynload/_uuid.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=5f3d3bf42c567a8d3ccd8642a0b1e2dfeec11f43, stripped	296F2CD2EAE76A88A83A5E5B9D3537C3	CC36B29BEB451858C05614605B5A1131F75A0A57	3D4F30A9CDBC39EA559B0B302FBA56741653E34FB9101111F54CF454EA7E44EC
/tmp/_MEIx67uLe/lib-dynload/mmap.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=da188afdc68626afc5bd36ad3b1dd89e8ff84032, stripped	5DF7A6AC240326AC5D5035AAA9FD487F	D6C8248E71CA3AFD1F7524BD54C244DB4D58FEC6	603E9A3A8BD6F1AF0DA7C7996888C43DAF05CFA5C9013C02402B47ED0B98276B
/tmp/_MEIx67uLe/lib-dynload/readline.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=0176e2bbf93b1808600b9eea70363b299459711f, stripped	2FF617818EA8BACC4CCA5206E9374BDC	D196FBE5F7401FD144FFC6ACD552F3A25580FEC9	623E8C68CB51237C0EC8AA82B3BF744DA771E8237685F3B0E8E62489CF136834
/tmp/_MEIx67uLe/lib-dynload/resource.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=2ee58fae68a7aa956214eb225e72fcc44102ac67, stripped	54C7A4760F8542F66440BECE1895E97C	B84F3C8DD6BAE39D5D56406C27DC244771F5DF88	C81CFCE6CEEBA3524AF1C23862471A155D70843CF7B9B08F8EF09B2F6701BBDF
/tmp/_MEIx67uLe/lib-dynload/termios.cpython-310-x86_64-linux-gnu.so	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=20995ace64bf6184cc89bafd2d6dd344ffe4a064, stripped	4F1658AB53E36333B6A3FD0AB1DDF8A2	DCB13D18B4001869725E37571865577E8CF39A2D	E1DD1448306BEEDA1F8179510C19A1E7E3A0D1B038EE3F6AFBA1BB1EB71B0591
/tmp/_MEIx67uLe/libbz2.so.1.0	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=e56b62c27bcc7ace8f9be36b255bd7b31bfde405, stripped	CE4B6426EDFD19EEE5C7FF0E4E911112	C38894EC21666A76704AEB2B302E8F07BDB583BA	5E516F77FC36DD924FDF02C8489A217F55FA1548883D32C3A5E041FB25D47D6E
/tmp/_MEIx67uLe/libcrypto.so.3	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, missing section headers at 4455664	F4BB6F78B61D489531A2DFA41F7B55C1	60680B1054B7B24D41B6A8C64C16500C53DC96A1	5F0A450EE0299CC3F25F01C3E67E75CB564476C3494BB82F4DFE0CAE0B6B215F

Linux Analysis Report
flow.elf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Screenshots

Network Map

Contacted Public IPs

Linux Analysis Report flow.elf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Screenshots

Network Map

Contacted Public IPs

Linux Analysis Report
flow.elf