Linux Analysis Report
x86.elf

Overview

General Information

Sample name: x86.elf
Analysis ID: 1541825
MD5: 6c5f14de57bc36a6fa22bbf554e8049f
SHA1: 6422fa0c77161c15298af285be511e5b3cef6e3c
SHA256: 78b479fc15b2171a97a082f840f4c130158ee5033ba933247eb4d98ab8fc4122
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Machine Learning detection for sample
ELF contains segments with high entropy indicating compressed/encrypted content
Sample contains only a LOAD segment without any section mappings
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

AV Detection
barindex
Machine Learning detection for sample
Source: x86.elf Joe Sandbox ML: detected
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 6209.1.0000000008048000.0000000008052000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_e6d75e6f Author: unknown
Source: 6209.1.0000000008048000.0000000008052000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: 6209.1.0000000008048000.0000000008052000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_fa48b592 Author: unknown
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x8048000
Yara signature match
Source: 6209.1.0000000008048000.0000000008052000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_e6d75e6f reference_sample = 48b15093f33c18778724c48c34199a420be4beb0d794e36034097806e1521eb8, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e99805e8917d6526031270b6da5c2f3cc1c8235fed1d47134835a107d0df497c, id = e6d75e6f-aa04-4767-8730-6909958044a7, last_modified = 2021-09-16
Source: 6209.1.0000000008048000.0000000008052000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: 6209.1.0000000008048000.0000000008052000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_fa48b592 reference_sample = c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88, id = fa48b592-8d80-45af-a3e4-232695b8f5dd, last_modified = 2021-09-16
Source: classification engine Classification label: mal52.linELF@0/0@0/0
ELF contains segments with high entropy indicating compressed/encrypted content
Source: x86.elf Submission file: segment LOAD with 7.6812 entropy (max. 8.0)
Source: x86.elf Submission file: segment LOAD with 7.8626 entropy (max. 8.0)

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
109.202.202.202
 unknown Switzerland
13030 INIT7CH false
91.189.91.43
 unknown United Kingdom
41231 CANONICAL-ASGB false
91.189.91.42
 unknown United Kingdom
41231 CANONICAL-ASGB false