Edit tour
Linux
Analysis Report
la.bot.arm.elf
Overview
General Information
Sample name: | la.bot.arm.elf |
Analysis ID: | 1562371 |
MD5: | c8fd3309d90163eb73d5467c621e1fe6 |
SHA1: | 4ed384629bd69e4383677aa93965cebceb3ab8c7 |
SHA256: | e096304ab54f56078cfdce969ea5060f5de8a71d1ff9a9d8845baf43a8a5ebf0 |
Tags: | elfuser-abuse_ch |
Infos: |
Detection
Score: | 60 |
Range: | 0 - 100 |
Whitelisted: | false |
Signatures
Connects to many ports of the same IP (likely port scanning)
Deletes system log files
Performs DNS TXT record lookups
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Sample tries to kill multiple processes (SIGKILL)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)
Classification
Joe Sandbox version: | 41.0.0 Charoite |
Analysis ID: | 1562371 |
Start date and time: | 2024-11-25 14:46:13 +01:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 5m 15s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | defaultlinuxfilecookbook.jbs |
Analysis system description: | Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11) |
Analysis Mode: | default |
Sample name: | la.bot.arm.elf |
Detection: | MAL |
Classification: | mal60.spre.troj.evad.linELF@0/0@1/0 |
- Report size exceeded maximum capacity and may have missing network information.
- VT rate limit hit for: la.bot.arm.elf
Command: | /tmp/la.bot.arm.elf |
PID: | 5425 |
Exit Code: | 0 |
Exit Code Info: | |
Killed: | False |
Standard Output: | thIs wEek on xLaB lEarNs nOthinG xd |
Standard Error: |
- system is lnxubuntu20
- la.bot.arm.elf New Fork (PID: 5427, Parent: 5425)
- la.bot.arm.elf New Fork (PID: 5428, Parent: 5425)
- la.bot.arm.elf New Fork (PID: 5447, Parent: 5425)
- la.bot.arm.elf New Fork (PID: 5458, Parent: 5447)
- dash New Fork (PID: 5540, Parent: 3602)
- dash New Fork (PID: 5541, Parent: 3602)
- dash New Fork (PID: 5542, Parent: 3602)
- dash New Fork (PID: 5543, Parent: 3602)
- dash New Fork (PID: 5544, Parent: 3602)
- dash New Fork (PID: 5545, Parent: 3602)
- dash New Fork (PID: 5546, Parent: 3602)
- dash New Fork (PID: 5547, Parent: 3602)
- dash New Fork (PID: 5548, Parent: 3602)
- dash New Fork (PID: 5549, Parent: 3602)
- cleanup
⊘No yara matches
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
Source: | HTTPS traffic detected: |
Source: | String: | ||
Source: | String: | ||
Source: | String: |