Linux Analysis Report
vqsjh4.elf

Overview

General Information

Sample name: vqsjh4.elf
Analysis ID: 1561809
MD5: 57622eddb94ab9f8b0a25a2276223c06
SHA1: ba817b02403f9799dd70b6c50ab3606963dcfb11
SHA256: fa0e7b8c31c8d4790c9991c372f5c401c6a4e9cf5849aa0e486a3ebc10c0a2d7
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 1
Range: 0 - 100
Whitelisted: false

Signatures

Executes the "rm" command used to delete files or directories
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: classification engine Classification label: clean1.linELF@0/0@0/0
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6222) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.dOldhQuHgN /tmp/tmp.zyp883466Y /tmp/tmp.dO3arOJraK Jump to behavior
Source: /usr/bin/dash (PID: 6223) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.dOldhQuHgN /tmp/tmp.zyp883466Y /tmp/tmp.dO3arOJraK Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/vqsjh4.elf (PID: 6250) Queries kernel information via 'uname': Jump to behavior
Source: vqsjh4.elf, 6250.1.00007ffc04885000.00007ffc048a6000.rw-.sdmp Binary or memory string: /x86_64/usr/bin/qemu-sh4/tmp/vqsjh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/vqsjh4.elf
Source: vqsjh4.elf, 6250.1.00007ffc04885000.00007ffc048a6000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: vqsjh4.elf, 6250.1.00005559ac4ef000.00005559ac531000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4
Source: vqsjh4.elf, 6250.1.00005559ac4ef000.00005559ac531000.rw-.sdmp Binary or memory string: YU5!/etc/qemu-binfmt/sh4

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
109.202.202.202
 unknown Switzerland
13030 INIT7CH false
91.189.91.43
 unknown United Kingdom
41231 CANONICAL-ASGB false
91.189.91.42
 unknown United Kingdom
41231 CANONICAL-ASGB false