Linux Analysis Report
arm.elf

Overview

General Information

Sample name: arm.elf
Analysis ID: 1543494
MD5: 4e5af7ad1a478cf4868db8477b80dc85
SHA1: c6dae6712d01ea83435dd4bbff518c41401dd00c
SHA256: 1dd69f848467acdc10ff8b1c7ebfdd454d65bb78141f4284c3d808c7c2f5b539
Tags: elfuser-abuse_ch

Detection

Score: 48
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: arm.elf Virustotal: Detection: 10% Perma Link
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal48.linELF@0/0@0/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/arm.elf (PID: 5433) Queries kernel information via 'uname': Jump to behavior
Source: arm.elf, 5433.1.000055d01ae93000.000055d01afc1000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: arm.elf, 5433.1.00007ffd3d7c6000.00007ffd3d7e7000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm.elf
Source: arm.elf, 5433.1.000055d01ae93000.000055d01afc1000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: arm.elf, 5433.1.00007ffd3d7c6000.00007ffd3d7e7000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
windows-stand
⊘No contacted IP infos