Linux Analysis Report
na.elf

Overview

General Information

Sample name: na.elf
Analysis ID: 1528820
MD5: 44f1728dd9ec6f5d00fccd45da2363d4
SHA1: 9242ac9a8676583d71abf1e5ef87d3ac8c7890d6
SHA256: 9edafa2b46af5cb22421efb939fb94662805fcfd51b85cb1860b8f7ba75abba6
Tags: elfMiraiuser-abuse_ch

Detection

Score: 48
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Found strings indicative of a multi-platform dropper
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: na.elf Virustotal: Detection: 53% Perma Link
Source: na.elf ReversingLabs: Detection: 47%
Found strings indicative of a multi-platform dropper
Source: na.elf String: %s/%s/exe/usr/lib/systemd/systemd/usr/sbin/cron/usr/lib/policykit-1/polkitd/usr/bin/dbus-daemon/usr/lib/openssh/sshd/usr/bin/systemctl/usr/bin/bash/usr/sbin/sshd/usr/sbin/init/usr/sbin/apache2/usr/sbin/nginx/usr/sbin/dovecot/usr/sbin/postfix/usr/bin/vim/bin/sh/bin/bash/sbin/init/usr/sbin/snapd/bin/systemd/usr/bin/sudo/usr/sbin/rsyslogd/bin/kmod/usr/bin/wget/usr/bin/curl.S.Sx86_64.Sx86.Sppc.Sspc.Ssh4.Smpsl.Smips.Sarm7.Sarm6.Sarm5.Sarmkthreaddkworkermigrationidle_injectcpuhpksoftirqdoom_reaperkswapd0ksmdkhugepagedirqgjg*iavmwtvmrepa*jap
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal48.linELF@0/0@0/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/na.elf (PID: 5557) Queries kernel information via 'uname': Jump to behavior
Source: na.elf, 5557.1.0000556a7f2e2000.0000556a7f347000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sparc
Source: na.elf, 5557.1.00007ffc3f138000.00007ffc3f159000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 5557.1.0000556a7f2e2000.0000556a7f347000.rw-.sdmp Binary or memory string: jU!/etc/qemu-binfmt/sparc
Source: na.elf, 5557.1.00007ffc3f138000.00007ffc3f159000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc

No Screenshots

⊘No contacted IP infos