Edit tour
Linux
Analysis Report
na.elf
Overview
General Information
Detection
Score: | 1 |
Range: | 0 - 100 |
Whitelisted: | false |
Signatures
Sample contains strings that are potentially command strings
Uses the "uname" system call to query kernel version information (possible evasion)
Classification
Joe Sandbox version: | 41.0.0 Charoite |
Analysis ID: | 1532543 |
Start date and time: | 2024-10-13 16:11:11 +02:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 4m 26s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | defaultlinuxfilecookbook.jbs |
Analysis system description: | Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11) |
Analysis Mode: | default |
Sample name: | na.elf |
Detection: | CLEAN |
Classification: | clean1.linELF@0/0@0/0 |
Command: | /tmp/na.elf |
PID: | 5526 |
Exit Code: | 255 |
Exit Code Info: | |
Killed: | False |
Standard Output: | |
Standard Error: | /lib/ld-linux-armhf.so.3: No such file or directory |
- system is lnxubuntu20
- cleanup
⊘No yara matches
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
There are no malicious signatures, click here to show all signatures.
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
Source: | Potential command found: | ||
Source: | Potential command found: | ||
Source: | Potential command found: | ||
Source: | Potential command found: | ||
Source: | Potential command found: | ||
Source: | Potential command found: | ||
Source: | Potential command found: | ||
Source: | Potential command found: | ||
Source: | Potential command found: | ||
Source: | Potential command found: | ||
Source: | Potential command found: | ||
Source: | Potential command found: | ||
Source: | Potential command found: | ||
Source: | Potential command found: |
Source: | Classification label: |
Source: | Queries kernel information via 'uname': | Jump to behavior |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 1 Command and Scripting Interpreter | Path Interception | Path Interception | Direct Volume Access | OS Credential Dumping | 11 Security Software Discovery | Remote Services | Data from Local System | Data Obfuscation | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
⊘No configs have been found
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
0% | URL Reputation | safe | ||
0% | URL Reputation | safe |
⊘No contacted domains info
Name | Source | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|
false | unknown | |||
false |
| unknown |
⊘No contacted IP infos
⊘No created / dropped files found
File type: | |
Entropy (8bit): | 6.239745363472608 |
TrID: |
|
File name: | na.elf |
File size: | 1'106'231 bytes |
MD5: | e83445627e74888ea1849bbb54660c47 |
SHA1: | 224b7843f35c4337d2236e6e33733372b041978c |
SHA256: | 45b6b99192b5b49a391de4d4f23070abba00f6b8b96c32b16436982ec472662c |
SHA512: | 15d7f04e434bd3467cb46a71858dcf43e62c059cbe6826bea8433e7fed60b098b72b235c8b5f8327139cc14dbb727d560cd3ff8a2e1e7ba8a5a33dc876d7b3f8 |
SSDEEP: | 12288:00Bw2wHeeJgR3asIAksAi0uObzkzOgFr1qwRcFjV1D7a9KbsaKjpeFmz4T28bLvr:00BnRED/TwOjX0a5xTdvr |
TLSH: | E4356D56F9808EA2C5D8177BB75DC35833534B78D7DEB102CD08672877AB94A0E3B982 |
File Content Preview: | .ELF..............(......d..4...p.......4. ...(........pl...l...l.......................4...4...4... ... ...............T...T...T...................................x...x...........................0....m..........................(...(...............p...p.. |
⊘No network behavior found
System Behavior
Start time (UTC): | 14:12:00 |
Start date (UTC): | 13/10/2024 |
Path: | /tmp/na.elf |
Arguments: | /tmp/na.elf |
File size: | 4956856 bytes |
MD5 hash: | 5ebfcae4fe2471fcc5695c2394773ff1 |