Linux Analysis Report
na.elf

Overview

General Information

Sample name: na.elf
Analysis ID: 1530548
MD5: fa3c6920dff42bdd5fc2df75ca68f4b0
SHA1: 0552c7e1df1e8eb9955d22b9790e83127d024cac
SHA256: aa09c044eff6603ab32746a5e04c577133b84261d95c58d1fad524b7796f99aa
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Found strings indicative of a multi-platform dropper
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sleeps for long times indicative of sandbox evasion
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: na.elf ReversingLabs: Detection: 26%
Found strings indicative of a multi-platform dropper
Source: na.elf String: ash|login|wget|curl|tftp|ntpdate
Source: na.elf String: l/proc//exe|ash|login|wget|curl|tftp|ntpdate/fdsocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin/
Sample listens on a socket
Source: /tmp/na.elf (PID: 5524) Socket: 127.0.0.1:1234 Jump to behavior
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/na.elf (PID: 5615) SIGKILL sent: pid: 5613, result: successful Jump to behavior
Source: classification engine Classification label: mal48.linELF@0/0@0/0
Sleeps for long times indicative of sandbox evasion
Source: /tmp/na.elf (PID: 5615) Sleeps longer then 60s: 60.0s Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/na.elf (PID: 5524) Queries kernel information via 'uname': Jump to behavior
Source: na.elf, 5524.1.00007fff32e90000.00007fff32eb1000.rw-.sdmp, na.elf, 5613.1.00007fff32e90000.00007fff32eb1000.rw-.sdmp, na.elf, 5615.1.00007fff32e90000.00007fff32eb1000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 5524.1.00007fff32e90000.00007fff32eb1000.rw-.sdmp, na.elf, 5613.1.00007fff32e90000.00007fff32eb1000.rw-.sdmp, na.elf, 5615.1.00007fff32e90000.00007fff32eb1000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: na.elf, 5524.1.00005584d1da6000.00005584d1e09000.rw-.sdmp, na.elf, 5613.1.00005584d1da6000.00005584d1e09000.rw-.sdmp, na.elf, 5615.1.00005584d1da6000.00005584d1e09000.rw-.sdmp Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: na.elf, 5524.1.00005584d1da6000.00005584d1e09000.rw-.sdmp, na.elf, 5613.1.00005584d1da6000.00005584d1e09000.rw-.sdmp, na.elf, 5615.1.00005584d1da6000.00005584d1e09000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4
windows-stand
⊘No contacted IP infos