Linux Analysis Report
na.elf

Overview

General Information

Sample name: na.elf
Analysis ID: 1527088
MD5: 137de3e8da2c676dfa376710d85673e2
SHA1: 3f1b5f0aaf135e63605d6635feb2d202bb8a57a8
SHA256: 687e099d9dd3f9bbf9d17bea0039c070783655bdb13782c9d9deb1f87febc88b
Tags: elfuser-abuse_ch

Detection

Score: 48
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: na.elf ReversingLabs: Detection: 50%
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal48.linELF@0/0@0/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/na.elf (PID: 5511) Queries kernel information via 'uname': Jump to behavior
Source: na.elf, 5511.1.0000557ebd456000.0000557ebd4bb000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sparc
Source: na.elf, 5511.1.00007ffd0d3dd000.00007ffd0d3fe000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 5511.1.00007ffd0d3dd000.00007ffd0d3fe000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc
Source: na.elf, 5511.1.0000557ebd456000.0000557ebd4bb000.rw-.sdmp Binary or memory string: ~U!/etc/qemu-binfmt/sparc
windows-stand
⊘No contacted IP infos