Linux Analysis Report
sh4.elf

Overview

General Information

Sample name: sh4.elf
Analysis ID: 1541784
MD5: 81f832b8b6d01d21abc30f809765e7b1
SHA1: d17e81ab879a728aea30d152219168cd1cb8819e
SHA256: c19c04e6b344cf911337464583d37fde4bafee0765c8cde6ef8d984027333114
Tags: elfuser-abuse_ch

Detection

Score: 48
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: sh4.elf Virustotal: Detection: 9% Perma Link
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal48.linELF@0/0@0/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/sh4.elf (PID: 5432) Queries kernel information via 'uname': Jump to behavior
Source: sh4.elf, 5432.1.00007ffcd6caf000.00007ffcd6cd0000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: sh4.elf, 5432.1.0000560a0d331000.0000560a0d394000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4
Source: sh4.elf, 5432.1.00007ffcd6caf000.00007ffcd6cd0000.rw-.sdmp Binary or memory string: bx86_64/usr/bin/qemu-sh4/tmp/sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sh4.elf
Source: sh4.elf, 5432.1.0000560a0d331000.0000560a0d394000.rw-.sdmp Binary or memory string: V5!/etc/qemu-binfmt/sh4
windows-stand
⊘No contacted IP infos