Linux Analysis Report
harm5.elf

Overview

General Information

Sample name: harm5.elf
Analysis ID: 1542852
MD5: 627deaac5fdde56b3f78435c2808de5a
SHA1: 5260a5eaddf324fb0dcb5dbf6170d61076d75c93
SHA256: 617ba4ae800ae20547d6cac4779e5a9068380b0a59ff3c00018514ce051fc46d
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: harm5.elf ReversingLabs: Detection: 21%

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 86.107.100.80 ports 18236,1,2,3,6,8
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:45254 -> 185.82.200.181:5436
Source: global traffic TCP traffic: 192.168.2.14:60360 -> 31.13.248.89:19598
Source: global traffic TCP traffic: 192.168.2.14:46784 -> 193.233.193.45:4446
Source: global traffic TCP traffic: 192.168.2.14:40796 -> 86.107.100.80:18236
Source: global traffic TCP traffic: 192.168.2.14:49462 -> 213.182.204.57:21761
Sample listens on a socket
Source: /tmp/harm5.elf (PID: 5575) Socket: 127.0.0.1:1172 Jump to behavior
Source: unknown UDP traffic detected without corresponding DNS query: 217.160.70.42
Source: unknown UDP traffic detected without corresponding DNS query: 217.160.70.42
Source: unknown UDP traffic detected without corresponding DNS query: 80.152.203.134
Source: unknown UDP traffic detected without corresponding DNS query: 70.34.254.19
Source: unknown UDP traffic detected without corresponding DNS query: 64.176.6.48
Source: unknown UDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknown UDP traffic detected without corresponding DNS query: 64.176.6.48
Source: unknown UDP traffic detected without corresponding DNS query: 5.161.109.23
Source: unknown UDP traffic detected without corresponding DNS query: 178.254.22.166
Source: unknown UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown UDP traffic detected without corresponding DNS query: 178.254.22.166
Source: unknown UDP traffic detected without corresponding DNS query: 217.160.70.42
Source: unknown UDP traffic detected without corresponding DNS query: 217.160.70.42
Source: unknown UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown UDP traffic detected without corresponding DNS query: 139.84.165.176
Source: unknown UDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknown UDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknown UDP traffic detected without corresponding DNS query: 137.220.52.23
Source: unknown UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown UDP traffic detected without corresponding DNS query: 5.161.109.23
Source: unknown UDP traffic detected without corresponding DNS query: 152.53.15.127
Source: global traffic DNS traffic detected: DNS query: kingstonwikkerink.dyn
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal52.troj.linELF@0/0@10/0
Enumerates processes within the "proc" file system
Source: /tmp/harm5.elf (PID: 5632) File opened: /proc/5706/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5632) File opened: /proc/5409/cmdline Jump to behavior
Source: /tmp/harm5.elf (PID: 5632) File opened: /proc/5717/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5632) File opened: /proc/5707/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5632) File opened: /proc/5718/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5632) File opened: /proc/5708/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5632) File opened: /proc/5719/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5632) File opened: /proc/5709/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5632) File opened: /proc/5720/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5632) File opened: /proc/5710/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5632) File opened: /proc/5721/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5632) File opened: /proc/5711/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5632) File opened: /proc/5722/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5632) File opened: /proc/5712/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5632) File opened: /proc/5723/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5632) File opened: /proc/5713/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5632) File opened: /proc/5724/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5632) File opened: /proc/5714/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5632) File opened: /proc/5725/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5632) File opened: /proc/5715/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5632) File opened: /proc/5716/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5579) File opened: /proc/5706/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5579) File opened: /proc/5409/cmdline Jump to behavior
Source: /tmp/harm5.elf (PID: 5579) File opened: /proc/5717/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5579) File opened: /proc/5707/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5579) File opened: /proc/5718/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5579) File opened: /proc/5708/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5579) File opened: /proc/5719/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5579) File opened: /proc/5709/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5579) File opened: /proc/5632/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5579) File opened: /proc/5720/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5579) File opened: /proc/5633/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5579) File opened: /proc/5710/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5579) File opened: /proc/5721/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5579) File opened: /proc/5711/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5579) File opened: /proc/5722/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5579) File opened: /proc/5657/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5579) File opened: /proc/5712/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5579) File opened: /proc/5723/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5579) File opened: /proc/5713/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5579) File opened: /proc/5724/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5579) File opened: /proc/5714/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5579) File opened: /proc/5715/status Jump to behavior
Source: /tmp/harm5.elf (PID: 5579) File opened: /proc/5716/status Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/harm5.elf (PID: 5575) Queries kernel information via 'uname': Jump to behavior
Source: harm5.elf, 5575.1.000055f9c1d21000.000055f9c1e97000.rw-.sdmp, harm5.elf, 5577.1.000055f9c1d21000.000055f9c1e97000.rw-.sdmp, harm5.elf, 5633.1.000055f9c1d21000.000055f9c1e97000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: harm5.elf, 5575.1.000055f9c1d21000.000055f9c1e97000.rw-.sdmp, harm5.elf, 5577.1.000055f9c1d21000.000055f9c1e97000.rw-.sdmp, harm5.elf, 5633.1.000055f9c1d21000.000055f9c1e97000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: harm5.elf, 5575.1.00007ffeb9507000.00007ffeb9528000.rw-.sdmp, harm5.elf, 5577.1.00007ffeb9507000.00007ffeb9528000.rw-.sdmp, harm5.elf, 5633.1.00007ffeb9507000.00007ffeb9528000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: harm5.elf, 5575.1.00007ffeb9507000.00007ffeb9528000.rw-.sdmp, harm5.elf, 5577.1.00007ffeb9507000.00007ffeb9528000.rw-.sdmp, harm5.elf, 5633.1.00007ffeb9507000.00007ffeb9528000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/harm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/harm5.elf
Source: harm5.elf, 5633.1.00007ffeb9507000.00007ffeb9528000.rw-.sdmp Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.82.200.181
 unknown Netherlands
60117 HSAE false
213.182.204.57
 kingstonwikkerink.dyn Latvia
9009 M247GB false
193.233.193.45
 unknown Russian Federation
2895 FREE-NET-ASFREEnetEU false
31.13.248.89
 unknown Bulgaria
34224 NETERRA-ASBG false
86.107.100.80
 unknown Romania
38995 AMG-ASRO true

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true
kingstonwikkerink.dyn 213.182.204.57 true