Linux Analysis Report
sh4.elf

ID:	1541253
Product:	CloudBasic
Start time:	16:14:09
Start date:	24.10.2024
Sample:	sh4.elf
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	e607d972f00d8bf2043163444a144e20
SHA1:	f48bf81bdecd5cbebd8bc617654c9e398a33202e
SHA256:	c67a5a0e9d5691e2dc3cb8111620c57a32e6daed42bacb3104301522629b271f
Filetype:	ELF Executable and Linkable format (generic) (4004/1) 100.00%

Name	Type	MD5	SHA1	SHA256

Compliance

Source: unknown

HTTPS traffic detected: 54.171.230.55:443 -> 192.168.2.23:33606 version: TLS 1.2

Networking

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown

HTTPS traffic detected: 54.171.230.55:443 -> 192.168.2.23:33606 version: TLS 1.2

System Summary

Source: classification engine

Classification label: clean1.linELF@0/0@0/0

Persistence and Installation Behavior

Source: /usr/bin/dash (PID: 6244)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.3DwdTi16Ey /tmp/tmp.oMjial0suc /tmp/tmp.tYZ1IjG1gO			Jump to behavior
Source: /usr/bin/dash (PID: 6253)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.3DwdTi16Ey /tmp/tmp.oMjial0suc /tmp/tmp.tYZ1IjG1gO			Jump to behavior

Malware Analysis System Evasion

Source: /tmp/sh4.elf (PID: 6209)

Queries kernel information via 'uname':

Jump to behavior

Source: sh4.elf, 6209.1.00007ffd02c30000.00007ffd02c51000.rw-.sdmp	Binary or memory string: )Ct'/x86_64/usr/bin/qemu-sh4/tmp/sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sh4.elf
Source: sh4.elf, 6209.1.00007ffd02c30000.00007ffd02c51000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: sh4.elf, 6209.1.0000559c29042000.0000559c290a5000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: sh4.elf, 6209.1.0000559c29042000.0000559c290a5000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4