Linux Analysis Report
arm6.elf

Overview

General Information

Sample name: arm6.elf
Analysis ID: 1545007
MD5: 2676bf3f45c3a54d86c959ffd5c47902
SHA1: b2abb8e04c8434eb9d86f1618fab472c1e40a483
SHA256: 430723f14f44b719126a6fcad988c2d93bcbcc2497e7262d79c1fbb78bf175e7
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: arm6.elf ReversingLabs: Detection: 52%
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal48.linELF@0/0@2/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/arm6.elf (PID: 5431) Queries kernel information via 'uname': Jump to behavior
Source: arm6.elf, 5431.1.0000564c27dde000.0000564c27f0c000.rw-.sdmp Binary or memory string: 'LV!/etc/qemu-binfmt/arm
Source: arm6.elf, 5431.1.0000564c27dde000.0000564c27f0c000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: arm6.elf, 5431.1.00007ffd1c9b4000.00007ffd1c9d5000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: arm6.elf, 5431.1.00007ffd1c9b4000.00007ffd1c9d5000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm6.elf
Source: arm6.elf, 5431.1.00007ffd1c9b4000.00007ffd1c9d5000.rw-.sdmp Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

No Screenshots

⊘No contacted IP infos

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.24 true