Linux Analysis Report
na.elf

Overview

General Information

Sample name: na.elf
Analysis ID: 1527363
MD5: 778e1ff29f5da2dda333c7444004b45b
SHA1: 006217f481ded514ab7809bce6e54536a719c9f7
SHA256: a681485663455d8d9e2ab4c756704c644c1d30263cc6acec659001fbfc6c6130
Tags: elfGafgytuser-abuse_ch
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: na.elf ReversingLabs: Detection: 21%
Found strings indicative of a multi-platform dropper
Source: na.elf String: /proc//exewgetinitcurltftp/fdsocketproc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin/
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal48.linELF@0/0@2/0
Enumerates processes within the "proc" file system
Source: /tmp/na.elf (PID: 5484) File opened: /proc/11/maps Jump to behavior
Source: /tmp/na.elf (PID: 5484) File opened: /proc/22/maps Jump to behavior
Source: /tmp/na.elf (PID: 5484) File opened: /proc/55/maps Jump to behavior
Source: /tmp/na.elf (PID: 5484) File opened: /proc/66/maps Jump to behavior
Source: /tmp/na.elf (PID: 5484) File opened: /proc/88/maps Jump to behavior
Source: /tmp/na.elf (PID: 5484) File opened: /proc/99/maps Jump to behavior
Source: /tmp/na.elf (PID: 5484) File opened: /proc/111/maps Jump to behavior
Source: /tmp/na.elf (PID: 5484) File opened: /proc/222/maps Jump to behavior
Source: /tmp/na.elf (PID: 5484) File opened: /proc/333/maps Jump to behavior
Source: /tmp/na.elf (PID: 5484) File opened: /proc/777/maps Jump to behavior
Source: /tmp/na.elf (PID: 5484) File opened: /proc/888/maps Jump to behavior
Source: /tmp/na.elf (PID: 5484) File opened: /proc/11111/maps Jump to behavior
Source: /tmp/na.elf (PID: 5484) File opened: /proc/999/maps Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/na.elf (PID: 5484) Queries kernel information via 'uname': Jump to behavior
Source: na.elf, 5484.1.00007ffc40880000.00007ffc408a1000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 5484.1.0000556ca1ea5000.0000556ca1ff4000.rw-.sdmp Binary or memory string: lU!/etc/qemu-binfmt/arm
Source: na.elf, 5484.1.0000556ca1ea5000.0000556ca1ff4000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: na.elf, 5484.1.00007ffc40880000.00007ffc408a1000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: na.elf, 5484.1.00007ffc40880000.00007ffc408a1000.rw-.sdmp Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

No Screenshots

⊘No contacted IP infos

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.24 true