Linux Analysis Report
SecuriteInfo.com.Trojan.Linux.GenericKD.24576.12596.14920.elf

Overview

General Information

Sample name: SecuriteInfo.com.Trojan.Linux.GenericKD.24576.12596.14920.elf
Analysis ID: 1531110
MD5: bb7cc7c4e17cdd054a336f4d5aeaad62
SHA1: 5b64d9bfe4ca4bb4c776ceb0b7debed89f244534
SHA256: e7eea6500b08adcb507695a7149adb51b3fd9c3e2e343e63a4c8aecc2a0a6ced
Tags: elf
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Trojan.Linux.GenericKD.24576.12596.14920.elf ReversingLabs: Detection: 15%
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal48.linELF@0/0@2/0
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 5468) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.Ze5FXhQGmx /tmp/tmp.zyEcEV5Ve8 /tmp/tmp.ePWjI8w4A6 Jump to behavior
Source: /usr/bin/dash (PID: 5469) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.Ze5FXhQGmx /tmp/tmp.zyEcEV5Ve8 /tmp/tmp.ePWjI8w4A6 Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/SecuriteInfo.com.Trojan.Linux.GenericKD.24576.12596.14920.elf (PID: 5481) Queries kernel information via 'uname': Jump to behavior
Source: SecuriteInfo.com.Trojan.Linux.GenericKD.24576.12596.14920.elf, 5481.1.00007ffffc8dc000.00007ffffc8fd000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips64
Source: SecuriteInfo.com.Trojan.Linux.GenericKD.24576.12596.14920.elf, 5481.1.000055d120983000.000055d120a31000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mips641RelativeDistinguishedName
Source: SecuriteInfo.com.Trojan.Linux.GenericKD.24576.12596.14920.elf, 5481.1.000055d120983000.000055d120a31000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips64
Source: SecuriteInfo.com.Trojan.Linux.GenericKD.24576.12596.14920.elf, 5481.1.00007ffffc8dc000.00007ffffc8fd000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips64/tmp/SecuriteInfo.com.Trojan.Linux.GenericKD.24576.12596.14920.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/SecuriteInfo.com.Trojan.Linux.GenericKD.24576.12596.14920.elf
Source: SecuriteInfo.com.Trojan.Linux.GenericKD.24576.12596.14920.elf, 5481.1.00007ffffc8dc000.00007ffffc8fd000.rw-.sdmp Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

No Screenshots

⊘No contacted IP infos

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true