Linux Analysis Report
na.elf

Overview

General Information

Sample name: na.elf
Analysis ID: 1527366
MD5: 45b4ff7fb018ec5f15b8cab9e059fd49
SHA1: 15d8928d37c39dfe15d9f1ae58b9e5b00fc040be
SHA256: 5add8a4f2a478cc28ec39689221732df121c8244553f2de9d5a3abb512318223
Tags: elfSupershelluser-abuse_ch
Infos:

Detection

Score: 64
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Machine Learning detection for sample
Sample is packed with UPX
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Executes the "rm" command used to delete files or directories
Sample contains only a LOAD segment without any section mappings
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: na.elf ReversingLabs: Detection: 18%
Machine Learning detection for sample
Source: na.elf Joe Sandbox ML: detected

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2850023 - Severity 1 - ETPRO JA3 Hash - Possible Ligolo Server/Golang Binary Response : 121.41.18.122:3232 -> 192.168.2.23:54174
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:54174 -> 121.41.18.122:3232
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: unknown TCP traffic detected without corresponding DNS query: 121.41.18.122
Source: na.elf String found in binary or memory: http://upx.sf.net
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 39256
Source: unknown Network traffic detected: HTTP traffic on port 39256 -> 443
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x400000
Source: classification engine Classification label: mal64.evad.linELF@0/0@0/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.96 Copyright (C) 1996-2020 the UPX Team. All Rights Reserved. $
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6295) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.hsFND1riiL /tmp/tmp.h3IQgAEO96 /tmp/tmp.5cGkCVw7uC Jump to behavior
Source: /usr/bin/dash (PID: 6296) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.hsFND1riiL /tmp/tmp.h3IQgAEO96 /tmp/tmp.5cGkCVw7uC Jump to behavior
Source: submitted sample Stderr: 2024/10/06 15:59:10 Forking2024/10/06 15:59:11 Connecting to 121.41.18.122:32322024/10/06 15:59:14 Successfully connnected 121.41.18.122:32322024/10/06 15:59:14 [client] INFO ??:1 BoFsrOtr() : Handling channel: jump2024/10/06 15:59:17 [121.41.18.122:3232] INFO ??:1 () : New SSH connection, version SSH-2.0-paramiko_3.0.02024/10/06 15:59:18 [121.41.18.122:3232] INFO ??:1 BoFsrOtr() : Handling channel: session2024/10/06 15:59:19 [121.41.18.122:3232] INFO ??:1 BoFsrOtr() : Handling channel: session2024/10/06 15:59:20 [121.41.18.122:3232] INFO ??:1 IFu6thF7() : Session got request: "exec"2024/10/06 15:59:20 [121.41.18.122:3232] INFO ??:3 IFu6thF7() : Session disconnected2024/10/06 15:59:20 [121.41.18.122:3232] INFO ??:6 IFu6thF7() : Session disconnected2024/10/06 15:59:20 [client] ERROR ??:1 () : Channel call back error: connection terminated: exit code = 0
ELF contains segments with high entropy indicating compressed/encrypted content
Source: na.elf Submission file: segment LOAD with 7.8849 entropy (max. 8.0)
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /proc/self/exe (PID: 6282) Queries kernel information via 'uname': Jump to behavior
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
34.249.145.219
 unknown United States
16509 AMAZON-02US false
121.41.18.122
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd true
109.202.202.202
 unknown Switzerland
13030 INIT7CH false
91.189.91.42
 unknown United Kingdom
41231 CANONICAL-ASGB false