Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
na.elf

Overview

General Information

Sample name:na.elf
Analysis ID:1527222
MD5:71481f6ca8315b68ea13f18375671c3f
SHA1:e60a7e8b42555d51b222bc355a8968c5269ac720
SHA256:413a131005421c004268630e678f02d0311f9128b59f33daf5b3be6b3028324f
Tags:elfuser-abuse_ch

Detection

Score:60
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Machine Learning detection for sample
Sample has stripped symbol table

Classification

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1527222
Start date and time:2024-10-06 21:59:14 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 32s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:na.elf
Detection:MAL
Classification:mal60.linELF@0/0@0/0

Warnings

  • VT rate limit hit for: na.elf

Runtime Messages

Command:/tmp/na.elf
PID:5529
Exit Code:1
Exit Code Info:
Killed:False
Standard Output:
open ./frpc.ini: no such file or directory
Standard Error:

Process Tree

  • system is lnxubuntu20
  • na.elf (PID: 5529, Parent: 5449, MD5: 71481f6ca8315b68ea13f18375671c3f) Arguments: /tmp/na.elf
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: na.elfAvira: detected
Multi AV Scanner detection for submitted file
Source: na.elfReversingLabs: Detection: 42%
Machine Learning detection for sample
Source: na.elfJoe Sandbox ML: detected
Source: na.elfString found in binary or memory: http://fontello.com
Source: na.elfString found in binary or memory: https://github.com/fatedier/frp)http2:
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal60.linELF@0/0@0/0
Source: ELF file sectionSubmission: na.elf
Source: na.elfBinary or memory string: Subject: AMDisbetter!AuthenticAMDBidi_ControlCIDR addressCONTINUATIONCentaurHaulsContent-TypeCookie.ValueECDSA-SHA256ECDSA-SHA384ECDSA-SHA512FECRecoveredGenuineIntelGenuineTMx86Geode by NSCI'm a teapotI/O possibleInCsumErrorsInstAltMatchJoin_ControlKVMKVMKVMKVMLittleEndianMax-ForwardsMeetei_MayekMicrosoft HvMime-VersionMulti-StatusNot ExtendedNot ModifiedPUSH_PROMISEPahawh_HmongPassiveOpensRCPT TO:<%s>SERIALNUMBERSSL_CERT_DIRSora_SompengSyloti_NagriTransitionalTransmetaCPUUnauthorizedVIA VIA VIA VMwareVMwareX-ImforwardsX-Powered-ByXenVMMXenVMM_arguments \abi mismatchaltmatch -> anynotnl -> bad flushGenbad g statusbad recoveryblock clausec ap trafficc hs trafficcan't happencas64 failedchan receivecheck failedchild exitedclose notifycontent-typecontext.TODOdumping heapecho requestend tracegc

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping1
Security Software Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
na.elf42%ReversingLabsLinux.Hacktool.ServerProxy
na.elf100%AviraLINUX/ReverseShell..otijv
na.elf100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://github.com/fatedier/frp)http2:na.elffalse
    		unknown
    http://fontello.comna.elffalse
      		unknown

      World Map of Contacted IPs

      ⊘No contacted IP infos

      Joe Sandbox View / Context

      IPs

      ⊘No context

      Domains

      ⊘No context

      ASNs

      ⊘No context

      JA3 Fingerprints

      ⊘No context

      Dropped Files

      ⊘No context

      Created / dropped Files

      ⊘No created / dropped files found

      Static File Info

      General

      File type:ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, Go BuildID=8mtijgXdxenWAfZK7ig6/P_rL_L52ddCI63QyXqYu/REsExO3nBA1arecocedz/nXBi3jbHgz-1aDuhhLJ2, stripped
      Entropy (8bit):6.118986234026611
      TrID:
      • ELF Executable and Linkable format (Linux) (4029/14) 49.77%
      • ELF Executable and Linkable format (generic) (4004/1) 49.46%
      • Lumena CEL bitmap (63/63) 0.78%
      File name:na.elf
      File size:10'400'928 bytes
      MD5:71481f6ca8315b68ea13f18375671c3f
      SHA1:e60a7e8b42555d51b222bc355a8968c5269ac720
      SHA256:413a131005421c004268630e678f02d0311f9128b59f33daf5b3be6b3028324f
      SHA512:362338a14a022d831858a4f5013aa9db7d75978b5fc3298989a97f1b7408c7ebbbd0678fe0d868b9201b210dcce08c48b936702b544a2ac53c98977866eddfdc
      SSDEEP:98304:S2HqWUYrOWvlKxher++Dj5V9/Rt4F7cPAmHb4fCHpuV8X8U1:P3UYrJlKxhe1/n9JOZcom3oFU1
      TLSH:8CA65C17F89214E6C9FFF1B0869A5311BE7178A6C33137D76F909A960626BF4693E300
      File Content Preview:.ELF..............>.....0.E.....@...................@.8...@.............@.......@.@.....@.@...............................................@.......@.....d.......d.................................@.......@......sB......sB.......................B............

      Static ELF Info

      ELF header

      Class:ELF64
      Data:2's complement, little endian
      Version:1 (current)
      Machine:Advanced Micro Devices X86-64
      Version Number:0x1
      Type:EXEC (Executable file)
      OS/ABI:UNIX - System V
      ABI Version:0
      Entry Point Address:0x459c30
      Flags:0x0
      ELF Header Size:64
      Program Header Offset:64
      Program Header Size:56
      Number of Program Headers:7
      Section Header Offset:456
      Section Header Size:64
      Number of Section Headers:13
      Header String Table Index:3

      Sections

      NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
      NULL0x00x00x00x00x0000
      .textPROGBITS0x4010000x10000x4263a60x00x6AX0016
      .rodataPROGBITS0x8280000x4280000x2651a00x00x2A0032
      .shstrtabSTRTAB0x00x68d1a00x7c0x00x0001
      .typelinkPROGBITS0xa8d2200x68d2200x3c380x00x2A0032
      .itablinkPROGBITS0xa90e580x690e580x10100x00x2A008
      .gosymtabPROGBITS0xa91e680x691e680x00x00x2A001
      .gopclntabPROGBITS0xa91e800x691e800x30c4db0x00x2A0032
      .noptrdataPROGBITS0xd9f0000x99f0000x3f0e00x00x3WA0032
      .dataPROGBITS0xdde0e00x9de0e00xd3b00x00x3WA0032
      .bssNOBITS0xdeb4a00x9eb4a00x1f1b00x00x3WA0032
      .noptrbssNOBITS0xe0a6600xa0a6600x34780x00x3WA0032
      .note.go.buildidNOTE0x400f9c0xf9c0x640x00x2A004

      Program Segments

      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
      PHDR0x400x4000400x4000400x1880x1881.65020x4R 0x1000
      NOTE0xf9c0x400f9c0x400f9c0x640x645.41330x4R 0x4.note.go.buildid
      LOAD0x00x4000000x4000000x4273a60x4273a65.88810x5R E0x1000.text .note.go.buildid
      LOAD0x4280000x8280000x8280000x57635b0x57635b5.62050x4R 0x1000.rodata .typelink .itablink .gosymtab .gopclntab
      LOAD0x99f0000xd9f0000xd9f0000x4c4a00x6ead86.09020x6RW 0x1000.noptrdata .data .bss .noptrbss
      GNU_STACK0x00x00x00x00x00.00000x6RW 0x8
      LOOS+50415800x00x00x00x00x00.00000x2a00 0x8

      Network Behavior

      ⊘No network behavior found

      System Behavior

      General

      Start time (UTC):20:00:00
      Start date (UTC):06/10/2024
      Path:/tmp/na.elf
      Arguments:/tmp/na.elf
      File size:10400928 bytes
      MD5 hash:71481f6ca8315b68ea13f18375671c3f

      Chronological Activities