Linux Analysis Report
SecuriteInfo.com.Trojan.Linux.GenericKD.24576.3485.14308.elf

Overview

General Information

Sample name: SecuriteInfo.com.Trojan.Linux.GenericKD.24576.3485.14308.elf
Analysis ID: 1531106
MD5: a50d54660d522f5c77af71a40c505f90
SHA1: 1f0b35f22e916af951351c84f71d4995018d9674
SHA256: b25a8cd9278cf18b09b3a8e98c9316f350313fdbb47d47b3494473934379cbc1
Tags: elf
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Trojan.Linux.GenericKD.24576.3485.14308.elf ReversingLabs: Detection: 13%
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal48.linELF@0/0@0/0
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 5498) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.D1NmELB0rm /tmp/tmp.toLr81zlGk /tmp/tmp.Vg0HMZOoDB Jump to behavior
Source: /usr/bin/dash (PID: 5499) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.D1NmELB0rm /tmp/tmp.toLr81zlGk /tmp/tmp.Vg0HMZOoDB Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/SecuriteInfo.com.Trojan.Linux.GenericKD.24576.3485.14308.elf (PID: 5517) Queries kernel information via 'uname': Jump to behavior
Source: SecuriteInfo.com.Trojan.Linux.GenericKD.24576.3485.14308.elf, 5517.1.00007ffcc9d31000.00007ffcc9d52000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips64
Source: SecuriteInfo.com.Trojan.Linux.GenericKD.24576.3485.14308.elf, 5517.1.00005570126cf000.0000557012755000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips64
Source: SecuriteInfo.com.Trojan.Linux.GenericKD.24576.3485.14308.elf, 5517.1.00005570126cf000.0000557012755000.rw-.sdmp Binary or memory string: pU!/etc/qemu-binfmt/mips641RelativeDistinguishedName
Source: SecuriteInfo.com.Trojan.Linux.GenericKD.24576.3485.14308.elf, 5517.1.00007ffcc9d31000.00007ffcc9d52000.rw-.sdmp Binary or memory string: Ux86_64/usr/bin/qemu-mips64/tmp/SecuriteInfo.com.Trojan.Linux.GenericKD.24576.3485.14308.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/SecuriteInfo.com.Trojan.Linux.GenericKD.24576.3485.14308.elf
windows-stand
⊘No contacted IP infos