Linux Analysis Report
na.elf

ID:	1528914
Product:	CloudBasic
Start time:	13:02:11
Start date:	08.10.2024
Sample:	na.elf
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	1ddf8090d1ffff3dc5f3dcebb3916429
SHA1:	2842a9625617f02c494c944e30ed5edc3ba77867
SHA256:	563ecbe4128c754032d4e6914af6c40a1745dcdef8cd03a28cdec8a984bd40a4
Filetype:	ELF Executable and Linkable format (generic) (4004/1) 100.00%

Name	Type	MD5	SHA1	SHA256

Networking

Source: /tmp/na.elf (PID: 6277)	Opens: /sys/class/net/			Jump to behavior
Source: /tmp/na.elf (PID: 6277)	Opens: /sys/class/net/ens160/address			Jump to behavior
Source: /tmp/na.elf (PID: 6277)	Opens: /sys/class/net/ens160/flags			Jump to behavior
Source: /tmp/na.elf (PID: 6277)	Opens: /sys/class/net/ens160/carrier			Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.23:41224 -> 5.230.229.84:3478

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.229.84
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.229.84
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.229.84
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.229.84
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.229.84
Source: unknown	UDP traffic detected without corresponding DNS query: 172.217.192.127
Source: unknown	UDP traffic detected without corresponding DNS query: 51.77.149.139

Source: global traffic

DNS traffic detected: DNS query: iranistrash.libre

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39260
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39260 -> 443

System Summary

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal52.spyw.evad.linELF@0/0@1/0

Persistence and Installation Behavior

Source: /usr/bin/dash (PID: 6291)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.DGA79cPZXZ /tmp/tmp.ssuri6dQxf /tmp/tmp.nHD3hupuB3			Jump to behavior
Source: /usr/bin/dash (PID: 6292)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.DGA79cPZXZ /tmp/tmp.ssuri6dQxf /tmp/tmp.nHD3hupuB3			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: /tmp/na.elf (PID: 6275)

File: /tmp/na.elf

Jump to behavior

Malware Analysis System Evasion

Source: /tmp/na.elf (PID: 6275)	Queries kernel information via 'uname':			Jump to behavior
Source: /tmp/na.elf (PID: 6277)	Queries kernel information via 'uname':			Jump to behavior

Source: na.elf, 6275.1.00007ffd3f584000.00007ffd3f5a5000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 6275.1.00005599f5766000.00005599f57ed000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mips
Source: na.elf, 6275.1.00005599f5766000.00005599f57ed000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: na.elf, 6275.1.00007ffd3f584000.00007ffd3f5a5000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips

HIPS / PFW / Operating System Protection Evasion

Source: Traffic

DNS traffic detected: queries for: iranistrash.libre