Linux Analysis Report
na.elf

Overview

General Information

Sample name: na.elf
Analysis ID: 1527370
MD5: 01fe3ad934fa66a72120acfb88bad44c
SHA1: 93514ae76cc5ac7b2c5fb77ef74f8b9b48ee8724
SHA256: ab20b8c733d2f1a34b837a37800b2bbcd48c80243f3cf1795bda8245c18ad6fb
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false

Signatures

Machine Learning detection for sample
Sample is packed with UPX
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Reads the 'hosts' file potentially containing internal network hosts
Sample contains only a LOAD segment without any section mappings
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Machine Learning detection for sample
Source: na.elf Joe Sandbox ML: detected
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:33588 -> 103.212.49.88:3232
Reads the 'hosts' file potentially containing internal network hosts
Source: /proc/self/exe (PID: 5461) Reads hosts file: /etc/hosts Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443
Source: unknown TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: ssh.updategoogle.cc
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: na.elf String found in binary or memory: http://upx.sf.net
Source: unknown Network traffic detected: HTTP traffic on port 48202 -> 443
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x8048000
Source: classification engine Classification label: mal48.evad.linELF@0/0@4/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.96 Copyright (C) 1996-2020 the UPX Team. All Rights Reserved. $
Source: submitted sample Stderr: 2024/10/06 16:03:44 Forking2024/10/06 16:03:45 Connecting to ssh.updategoogle.cc:32322024/10/06 16:03:48 Successfully connnected ssh.updategoogle.cc:32322024/10/06 16:03:48 [client] INFO ??:1 Its_ubl() : Handling channel: jump2024/10/06 16:03:51 [103.212.49.88:3232] INFO ??:1 () : New SSH connection, version SSH-2.0-paramiko_3.0.02024/10/06 16:03:52 [103.212.49.88:3232] INFO ??:1 Its_ubl() : Handling channel: session2024/10/06 16:03:53 [103.212.49.88:3232] INFO ??:1 Its_ubl() : Handling channel: session2024/10/06 16:03:53 [103.212.49.88:3232] INFO ??:1 DIEtEm() : Session got request: "exec"2024/10/06 16:03:54 [103.212.49.88:3232] INFO ??:3 DIEtEm() : Session disconnected2024/10/06 16:03:54 [103.212.49.88:3232] INFO ??:6 DIEtEm() : Session disconnected2024/10/06 16:03:54 [client] ERROR ??:1 () : Channel call back error: connection terminated: exit code = 0
ELF contains segments with high entropy indicating compressed/encrypted content
Source: na.elf Submission file: segment LOAD with 7.8868 entropy (max. 8.0)
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /proc/self/exe (PID: 5461) Queries kernel information via 'uname': Jump to behavior

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.125.190.26
 unknown United Kingdom
41231 CANONICAL-ASGB false
103.212.49.88
 ssh.updategoogle.cc China
55933 CLOUDIE-AS-APCloudieLimitedHK false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true
ssh.updategoogle.cc 103.212.49.88 true