Linux Analysis Report
na.elf

Overview

General Information

Sample name: na.elf
Analysis ID: 1530546
MD5: 61aeb14eea0086548eb566cb02038943
SHA1: 1c3b440bbc22b2eb13148a4db2a4df4ff8111a13
SHA256: f0cc28a1a112d77b10d1a738593a2aab3169c2c01371447e456265e48484d223
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Executes the "rm" command used to delete files or directories
Found strings indicative of a multi-platform dropper
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: na.elf ReversingLabs: Detection: 21%
Found strings indicative of a multi-platform dropper
Source: na.elf String: ash|login|wget|curl|tftp|ntpdate
Source: na.elf String: l/proc//exe|ash|login|wget|curl|tftp|ntpdate/fdsocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin/

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 154.90.62.142 ports 0,1,2,4,6,42061
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:52330 -> 154.90.62.142:42061
Sample listens on a socket
Source: /tmp/na.elf (PID: 6277) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown UDP traffic detected without corresponding DNS query: 116.203.104.203
Source: global traffic DNS traffic detected: DNS query: 21savage.dyn
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal60.troj.evad.linELF@0/0@1/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/na.elf (PID: 6283) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/na.elf (PID: 6283) Directory: /root/.cache Jump to behavior
Source: /tmp/na.elf (PID: 6283) Directory: /root/.ssh Jump to behavior
Source: /tmp/na.elf (PID: 6283) Directory: /root/.config Jump to behavior
Source: /tmp/na.elf (PID: 6283) Directory: /root/.local Jump to behavior
Source: /tmp/na.elf (PID: 6283) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/na.elf (PID: 6283) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/na.elf (PID: 6283) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/na.elf (PID: 6283) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/na.elf (PID: 6283) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/na.elf (PID: 6283) Directory: /etc/.java Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6247) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.4jLf3h3Uqq /tmp/tmp.jmvgMJk7cC /tmp/tmp.7rbvlX96eN Jump to behavior
Source: /usr/bin/dash (PID: 6248) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.4jLf3h3Uqq /tmp/tmp.jmvgMJk7cC /tmp/tmp.7rbvlX96eN Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/na.elf (PID: 6283) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/na.elf (PID: 6277) Queries kernel information via 'uname': Jump to behavior
Source: na.elf, 6277.1.0000557078d26000.0000557078d89000.rw-.sdmp Binary or memory string: xpU5!/etc/qemu-binfmt/sh4
Source: na.elf, 6277.1.00007ffe04412000.00007ffe04433000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: na.elf, 6277.1.0000557078d26000.0000557078d89000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4
Source: na.elf, 6277.1.00007ffe04412000.00007ffe04433000.rw-.sdmp Binary or memory string: NLx86_64/usr/bin/qemu-sh4/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
154.90.62.142
 21savage.dyn Seychelles
40065 CNSERVERSUS true
109.202.202.202
 unknown Switzerland
13030 INIT7CH false
91.189.91.43
 unknown United Kingdom
41231 CANONICAL-ASGB false
91.189.91.42
 unknown United Kingdom
41231 CANONICAL-ASGB false

Contacted Domains

Name IP Active
21savage.dyn 154.90.62.142 true