Linux Analysis Report
ppc.elf

Overview

General Information

Sample name: ppc.elf
Analysis ID: 1541320
MD5: 7ab217745786b7e010961f7a1e05280b
SHA1: 145d60110e501e96448d3977f8d21acbfcf5c5d4
SHA256: 63a53767059a1b7f81e8ae2c940b736d0f75c83100b0564798503f016a67dac5
Tags: elfuser-abuse_ch

Detection

Score: 0
Range: 0 - 100
Whitelisted: false

Signatures

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Source: classification engine Classification label: clean0.linELF@0/0@0/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/ppc.elf (PID: 5430) Queries kernel information via 'uname': Jump to behavior
Source: ppc.elf, 5430.1.000055b0d9165000.000055b0d9215000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: ppc.elf, 5430.1.00007ffc4442b000.00007ffc4444c000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ppc.elf
Source: ppc.elf, 5430.1.000055b0d9165000.000055b0d9215000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: ppc.elf, 5430.1.00007ffc4442b000.00007ffc4444c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc

No Screenshots

⊘No contacted IP infos