Linux Analysis Report
na.elf

Overview

General Information

Sample name: na.elf
Analysis ID: 1532427
MD5: c81262fa3e68475c435e4ad979a23f4b
SHA1: e88ffd39cf36a512ed781c92975429d1031122d4
SHA256: a2b058bd145d4c563f15fc072730185c8fbf67401e5f784db5b0b6940d131d6b
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Contains symbols with names commonly found in malware
Found strings indicative of a multi-platform dropper
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: na.elf ReversingLabs: Detection: 15%
Source: na.elf Virustotal: Detection: 12% Perma Link
Found strings indicative of a multi-platform dropper
Source: na.elf String: /lib//sbin//usr//proc//exeself/fd/fd/socket:/proc/proc//exewgetcurlftpmountabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789/proc/net/tcp/proc//exe/fd//proc//maps/lib/usr/lib
Sample listens on a socket
Source: /tmp/na.elf (PID: 5428) Socket: 127.0.0.1:45295 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 172.235.51.77
Source: unknown TCP traffic detected without corresponding DNS query: 172.235.51.77
Source: unknown TCP traffic detected without corresponding DNS query: 172.235.51.77
Source: unknown TCP traffic detected without corresponding DNS query: 172.235.51.77
Source: unknown TCP traffic detected without corresponding DNS query: 172.235.51.77
Source: unknown TCP traffic detected without corresponding DNS query: 172.235.51.77
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: ipcamlover.ru
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary
barindex
Contains symbols with names commonly found in malware
Source: ELF static info symbol of initial sample Name: add_attack
Source: ELF static info symbol of initial sample Name: attack_add_pid
Source: ELF static info symbol of initial sample Name: attack_init
Source: ELF static info symbol of initial sample Name: attack_ongoing
Source: ELF static info symbol of initial sample Name: attack_parse
Source: ELF static info symbol of initial sample Name: attack_remove_id
Source: ELF static info symbol of initial sample Name: attack_start
Source: ELF static info symbol of initial sample Name: attack_stop
Source: ELF static info symbol of initial sample Name: attacks_ack
Source: ELF static info symbol of initial sample Name: attacks_gre
Source: classification engine Classification label: mal52.linELF@0/511@3/0
Source: na.elf ELF static info symbol of initial sample: libc/string/mips/memcpy.S
Source: na.elf ELF static info symbol of initial sample: libc/string/mips/memset.S
Source: na.elf ELF static info symbol of initial sample: libc/sysdeps/linux/mips/crt1.S
Source: na.elf ELF static info symbol of initial sample: libc/sysdeps/linux/mips/crti.S
Source: na.elf ELF static info symbol of initial sample: libc/sysdeps/linux/mips/crtn.S
Source: na.elf ELF static info symbol of initial sample: libc/sysdeps/linux/mips/pipe.S
Source: na.elf ELF static info symbol of initial sample: libc/sysdeps/linux/mips/syscall_error.S
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/na.elf (PID: 5428) Queries kernel information via 'uname': Jump to behavior
Source: na.elf, 5428.1.00007ffde6d03000.00007ffde6d24000.rw-.sdmp Binary or memory string: $V/tmp/qemu-open.HaQ7mE\
Source: na.elf, 5428.1.00007ffde6d03000.00007ffde6d24000.rw-.sdmp Binary or memory string: /tmp/qemu-open.HaQ7mE
Source: na.elf, 5428.1.00005624a7c22000.00005624a7ceb000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: na.elf, 5428.1.00007ffde6d03000.00007ffde6d24000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips
Source: na.elf, 5428.1.00007ffde6d03000.00007ffde6d24000.rw-.sdmp Binary or memory string: zjx86_64/usr/bin/qemu-mips/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 5428.1.00005624a7c22000.00005624a7ceb000.rw-.sdmp Binary or memory string: $V!/etc/qemu-binfmt/mips

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.235.51.77
 unknown United States
20940 AKAMAI-ASN1EU false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true
ipcamlover.ru unknown unknown