Linux Analysis Report
mips.elf

Overview

General Information

Sample name: mips.elf
Analysis ID: 1541321
MD5: 732c5d869200b05ed53e99f31e625648
SHA1: 7722e45463e8e2610c8eb2b1c21a926d7f6cf7ab
SHA256: 5437b35d57b21d956fd5e09a4c03e03a2454c0325d6965cdc2823e403e9bf923
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 1
Range: 0 - 100
Whitelisted: false

Signatures

Executes the "rm" command used to delete files or directories
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Source: unknown TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown TCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknown TCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknown TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown Network traffic detected: HTTP traffic on port 59324 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59324
Source: unknown Network traffic detected: HTTP traffic on port 46540 -> 443
Source: classification engine Classification label: clean1.linELF@0/0@0/0
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 5516) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.NiYOSl7grm /tmp/tmp.Fh8KaXmN0f /tmp/tmp.rHmVtNkreN Jump to behavior
Source: /usr/bin/dash (PID: 5517) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.NiYOSl7grm /tmp/tmp.Fh8KaXmN0f /tmp/tmp.rHmVtNkreN Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/mips.elf (PID: 5477) Queries kernel information via 'uname': Jump to behavior
Source: mips.elf, 5477.1.0000559176f13000.0000559176f9a000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mips
Source: mips.elf, 5477.1.0000559176f13000.0000559176f9a000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: mips.elf, 5477.1.00007ffc3be76000.00007ffc3be97000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mips.elf
Source: mips.elf, 5477.1.00007ffc3be76000.00007ffc3be97000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.125.190.26
 unknown United Kingdom
41231 CANONICAL-ASGB false
34.254.182.186
 unknown United States
16509 AMAZON-02US false