Linux Analysis Report
linux_ppc64el.elf

Overview

General Information

Sample name:	linux_ppc64el.elf
Analysis ID:	1562732
MD5:	04893430bfaf82b24e726e9980c338b3
SHA1:	9dfd9c35b547705b267b4c2acd5cb7699ba5edb5
SHA256:	535b04d328da7b0be034710aeb74c4460c873d72ccf1e6e8186d4faf2e158c60
Tags:	elfuser-abuse_ch
Infos:

Detection

Chaos

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Yara detected Chaos

Connects to many ports of the same IP (likely port scanning)

Drops files in suspicious directories

Sample tries to set files in /etc globally writable

Uses known network protocols on non-standard ports

Writes identical ELF files to multiple locations

Creates hidden files and/or directories

Creates hidden files without content (potentially used as a mutex)

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "sleep" command used to delay execution and potentially evade sandboxes

Executes the "systemctl" command used for controlling the systemd system and service manager

Reads CPU information from /sys indicative of miner or evasive malware

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Sleeps for long times indicative of sandbox evasion

Uses the "uname" system call to query kernel version information (possible evasion)

Writes ELF files to disk

Writes shell script file to disk with an unusual file extension

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
Chaos	Multi-functional malware written in Go, targeting both Linux and Windows, evolved from elf.kaiji.	No Attribution	https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/ https://www.trendmicro.com/en_us/research/22/l/linux-cryptomining-enhanced-via-chaos-rat-.html	https://malpedia.caad.fkie.fraunhofer.de/details/elf.chaos

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: linux_ppc64el.elf

ReversingLabs: Detection: 42%

Reads CPU information from /sys indicative of miner or evasive malware

Source: /tmp/linux_ppc64el.elf (PID: 5501)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5812)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 103.135.101.78 ports 808,52462,2,4,5,6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 47700 -> 808
Source: unknown	Network traffic detected: HTTP traffic on port 808 -> 47700

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.14:42412 -> 103.135.101.78:52462

Reads the 'hosts' file potentially containing internal network hosts

Source: /tmp/linux_ppc64el.elf (PID: 5501)

Reads hosts file: /etc/hosts

Jump to behavior

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /password.txt HTTP/1.1Host: 103.135.101.78:808User-Agent: Go-http-client/1.1Accept-Encoding: gzip

Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http2: Transport conn %p received error from processing frame %v: %vhttp2: Transport received unsolicited DATA frame; closing connectionhttp: message cannot contain multiple Content-Length headers; got %qpadding bytes must all be zeros unless AllowIllegalWrites is enabledreflect: reflect.Value.UnsafePointer on an invalid notinheap pointerhttp2: Transport closing idle conn %p (forSingleUse=%v, maxStream=%v)tls: handshake message of length %d bytes exceeds maximum of %d bytestls: peer doesn't support the certificate custom signature algorithmsbytes.Buffer: UnreadByte: previous operation was not a successful readcannot convert slice with length %y to pointer to array with length %xgot %s for stream %d; expected CONTINUATION following %s for stream %dx509: PKCS#8 wrapping contained private key with unknown algorithm: %vx509: certificate relies on legacy Common Name field, use SANs insteadMozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)Sogou Pic Spider/3.0(+http://www.sogou.com/docs/help/webmasters.htm#07)Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)dynamic table size update MUST occur at the beginning of a header blockssh: no common algorithm for %s; client offered: %v, server offered: %vtls: peer doesn't support any of the certificate's signature algorithmstoo many concurrent operations on a single file or socket (max 1048575)x509: issuer has name constraints but leaf doesn't have a SAN extensionMozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)tls: server's certificate contains an unsupported type of public key: %Ttls: received unexpected handshake message of type %T when waiting for %T91289437fa036b34da55d57af6192768c27bd433fa012169d626d934e0051b24dd67dd3cf49d7cc827bc012d259d7ac226e70829239d7ac226e7082968de60d520eb433722c07fd236f6crypto/elliptic: internal error: Unmarshal rejected a valid point encodingmalformed response from server: malformed non-numeric status pseudo headernet/http: server replied with more than declared Content-Length; truncatedtls: certificate RSA key size too small for supported signature algorithmsUnsolicited response received on idle HTTP channel starting with %q; err=%vtls: internal error: attempted to read record with pending application datatls: failed to send closeNotify alert (but connection was closed anyway): %wtls: server certificate contains incorrect key type for selected ciphersuite((2(5[0-5]\|[0-4]\d))\|[0-1]?\d{1,2})(\.((2(5[0-5]\|[0-4]\d))\|[0-1]?\d{1,2})){3}MapIter.Next called on an iterator that does not have an associated map Valuecrypto/tls: ExportKeyingMaterial is unavailable when renegotiation is enabled115792089210356248762697446949407573529996955224135760342422259061068512044369115792089210356248762697446949407573530086143415290314195533631308867097853951ssh: internal error: algorithmSignerWrapper invoked with non-default algorithmssh: unable to authenticate, attempted methods %v, no supported methods remainx509: signature check attempt
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http: RoundTripper implementation (%T) returned a nil Response with a nil errortls: either ServerName or InsecureSkipVerify must be specified in the tls.Configx509: invalid signature: parent certificate cannot sign this kind of certificaterefusing to use HTTP_PROXY value in CGI environment; see golang.org/s/cgihttpproxyx509: a root or intermediate certificate is not authorized to sign for this name: (possibly because of %q while trying to verify candidate authority certificate %q)Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)x509: issuer has name constraints but leaf contains unknown or unconstrained name: tls: downgrade attempt detected, possibly due to a MitM attack or a broken middleboxx509: signature algorithm specifies an %s public key, but have public key of type %Treflect.Value.Interface: cannot return value obtained from unexported field or methodx509: failed to parse private key (use ParseECPrivateKey instead for this key format)Mozilla/5.0 (compatible; YoudaoBot/1.0; http://www.youdao.com/help/webmaster/spider/;)reflect: New of type that may not be allocated in heap (possibly undefined cgo C type)x509: a root or intermediate certificate is not authorized for an extended key usage: fxfzUc6gtMGc/i26ld3KydGKy1k7QqyMMyxjbU1Rlk+F9LQxnaTeCHGHsDUpaBeOWDeY6l+2kHlB7EWTLcGwfg==whv+Kf1cEtOXzr+zuvmef2as0WfbUDm8l2LMWBMel10NDnbShg9CsMUt327VJhOTbXLoPYJVTKy8MBPCVwoT8A==x509: failed to parse private key (use ParsePKCS1PrivateKey instead for this key format)x509: failed to parse private key (use ParsePKCS8PrivateKey instead for this key format)Mozilla/5.0 (compatible; Baiduspider-render/2.0; +http://www.baidu.com/search/spider.html)http2: server sent GOAWAY and closed the connection; LastStreamID=%v, ErrCode=%v, debug=%qapplication/xml,application/xhtml+xml,text/html;q=0.9, text/plain;q=0.8,image/png,/;q=0.5tls: handshake hash for a client certificate requested after discarding the handshake buffertls: unsupported certificate: private key is ed25519.PrivateKey, expected ed25519.PrivateKey3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5faa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7b3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aefhttp: RoundTripper implementation (%T) returned a *Response with content length %d but a nil BodyNoClientCertRequestClientCertRequireAnyClientCertVerifyClientCertIfGivenRequireAndVerifyClientCertcipher: the nonce can't have zero length, or the security of the key will be immediately compromisedssh<<RMS>> equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: aras.liveya.org

Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http://help.yahoo.com/help/us/ysearch/slurp)x509:
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http://search.msn.com/msnbot.htm
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http://www.baidu.com/search/spider.html)000102030405060708091011121314151617181920212223242526272829
Source: id.services.conf.12.dr	String found in binary or memory: http://www.baidu.com/search/spider.html)Mozilla/5.0
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http://www.baidu.com/search/spider.html)http2:
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http://www.entireweb.com/about/search_tech/speedy_spider/)text/html
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http://www.google.com/mobile/adsbot.html)
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http://www.haosou.com/help/help_3_2.htmlMozilla/5.0
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http://www.huaweisymantec.com/cn/IRL/spider)Mozilla/5.0
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http://www.youdao.com/help/webmaster/spider/;)reflect:
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http://yandex.com/bots)http:
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: https://search.yahoo.com/search?p=illegal
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: https://www.baidu.com/s?wd=insufficient
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: https://www.so.com/s?q=index

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Sample tries to kill a process (SIGKILL)

Source: /usr/bin/pkill (PID: 5599)	SIGKILL sent: pid: 5503, result: successful			Jump to behavior
Source: /usr/bin/pkill (PID: 5812)	SIGKILL sent: pid: 5755, result: successful			Jump to behavior

Source: classification engine

Classification label: mal76.troj.evad.linELF@0/44@4/0

Source: ELF file section	Submission: linux_ppc64el.elf
Source: ELF file section	Dropped file: id.services.conf.12.dr
Source: ELF file section	Dropped file: System.img.config.19.dr

Persistence and Installation Behavior

Sample tries to set files in /etc globally writable

Source: /tmp/linux_ppc64el.elf (PID: 5483)	File: /etc/id.services.conf (bits: - usr: rx grp: rx all: rwx)			Jump to behavior
Source: /tmp/linux_ppc64el.elf (PID: 5483)	File: /etc/32678 (bits: - usr: rx grp: rx all: rwx)			Jump to behavior

Writes identical ELF files to multiple locations

Source: /tmp/linux_ppc64el.elf (PID: 5501)	File with SHA-256 535B04D328DA7B0BE034710AEB74C4460C873D72CCF1E6E8186D4FAF2E158C60 written: /boot/System.img.config			Jump to dropped file
Source: /tmp/linux_ppc64el.elf (PID: 5483)	File with SHA-256 535B04D328DA7B0BE034710AEB74C4460C873D72CCF1E6E8186D4FAF2E158C60 written: /etc/id.services.conf			Jump to dropped file

Creates hidden files and/or directories

Source: /tmp/linux_ppc64el.elf (PID: 5501)	File: /dev/.old	Jump to behavior
Source: /tmp/linux_ppc64el.elf (PID: 5501)	File: /dev/.img	Jump to behavior
Source: /etc/id.services.conf (PID: 5831)	File: /dev/.old	Jump to behavior
Source: /etc/id.services.conf (PID: 5831)	File: /dev/.img	Jump to behavior
Source: /boot/System.img.config (PID: 5756)	File: /dev/.old	Jump to behavior
Source: /boot/System.img.config (PID: 5756)	File: /dev/.img	Jump to behavior

Creates hidden files without content (potentially used as a mutex)

Source: /boot/System.img.config (PID: 5756)	Empty hidden file: /dev/.old			Jump to behavior
Source: /boot/System.img.config (PID: 5756)	Empty hidden file: /dev/.img			Jump to behavior

Enumerates processes within the "proc" file system

Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1583/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/2672/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3759/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3759/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1577/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1577/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3756/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3756/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3757/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3757/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/917/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/917/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3758/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3758/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/19/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/19/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1593/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/240/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/240/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/120/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/120/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3094/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/121/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/121/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/242/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/242/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3406/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/122/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/122/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/243/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/243/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/2/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/2/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/123/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/123/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/244/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/244/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1589/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/124/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/124/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/245/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/245/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1588/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/125/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/125/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/4/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/4/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/246/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/246/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3402/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/126/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/126/cmdline	Jump to behavior

Executes commands using a shell command-line interpreter

Source: /tmp/linux_ppc64el.elf (PID: 5490)	Shell command executed: /bin/bash -c /etc/32678&			Jump to behavior
Source: /tmp/linux_ppc64el.elf (PID: 5560)	Shell command executed: /bin/bash -c "cd /boot;systemctl daemon-reload;systemctl enable linux.service;systemctl start linux.service;journalctl -xe --no-pager"			Jump to behavior

Executes the "kill" or "pkill" command typically used to terminate processes

Source: /boot/System.img.config (PID: 5599)	Pkill executable: /usr/bin/pkill -> pkill -9 32678			Jump to behavior
Source: /etc/id.services.conf (PID: 5812)	Pkill executable: /usr/bin/pkill -> pkill -9 32678			Jump to behavior

Executes the "systemctl" command used for controlling the systemd system and service manager

Source: /usr/sbin/service (PID: 5496)	Systemctl executable: /usr/bin/systemctl -> systemctl start crond.service	Jump to behavior
Source: /usr/sbin/service (PID: 5516)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active multi-user.target	Jump to behavior
Source: /usr/sbin/service (PID: 5530)	Systemctl executable: /usr/bin/systemctl -> systemctl list-unit-files --full --type=socket	Jump to behavior
Source: /usr/sbin/update-rc.d (PID: 5532)	Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload	Jump to behavior
Source: /bin/bash (PID: 5562)	Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload	Jump to behavior
Source: /bin/bash (PID: 5566)	Systemctl executable: /usr/bin/systemctl -> systemctl enable linux.service	Jump to behavior
Source: /bin/bash (PID: 5570)	Systemctl executable: /usr/bin/systemctl -> systemctl start linux.service	Jump to behavior
Source: /usr/sbin/service (PID: 5825)	Systemctl executable: /usr/bin/systemctl -> systemctl start crond.service	Jump to behavior
Source: /usr/sbin/service (PID: 5839)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active multi-user.target	Jump to behavior
Source: /usr/sbin/service (PID: 5845)	Systemctl executable: /usr/bin/systemctl -> systemctl list-unit-files --full --type=socket	Jump to behavior
Source: /usr/sbin/service (PID: 5748)	Systemctl executable: /usr/bin/systemctl -> systemctl start crond.service	Jump to behavior
Source: /usr/sbin/service (PID: 5766)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active multi-user.target	Jump to behavior
Source: /usr/sbin/service (PID: 5773)	Systemctl executable: /usr/bin/systemctl -> systemctl list-unit-files --full --type=socket	Jump to behavior

Sample tries to set the executable flag

Source: /tmp/linux_ppc64el.elf (PID: 5483)	File: /etc/id.services.conf (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/linux_ppc64el.elf (PID: 5483)	File: /etc/32678 (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/linux_ppc64el.elf (PID: 5501)	File: /boot/System.img.config (bits: - usr: rx grp: rx all: rwx)	Jump to behavior

Writes ELF files to disk

Source: /tmp/linux_ppc64el.elf (PID: 5483)	File written: /etc/id.services.conf			Jump to dropped file
Source: /tmp/linux_ppc64el.elf (PID: 5501)	File written: /boot/System.img.config			Jump to dropped file

Writes shell script file to disk with an unusual file extension

Source: /tmp/linux_ppc64el.elf (PID: 5483)	Writes shell script file to disk with an unusual file extension: /etc/32678			Jump to dropped file
Source: /tmp/linux_ppc64el.elf (PID: 5501)	Writes shell script file to disk with an unusual file extension: /etc/init.d/linux_kill			Jump to dropped file

Source: /usr/sbin/service (PID: 5531)	Sed executable: /usr/bin/sed -> sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p	Jump to behavior
Source: /usr/sbin/service (PID: 5846)	Sed executable: /usr/bin/sed -> sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p	Jump to behavior
Source: /usr/sbin/service (PID: 5774)	Sed executable: /usr/bin/sed -> sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Drops files in suspicious directories

Source: /tmp/linux_ppc64el.elf (PID: 5501)

File: /etc/init.d/linux_kill

Jump to dropped file

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 47700 -> 808
Source: unknown	Network traffic detected: HTTP traffic on port 808 -> 47700

Executes the "sleep" command used to delay execution and potentially evade sandboxes

Source: /etc/32678 (PID: 5514)	Sleep executable: /usr/bin/sleep -> sleep 60	Jump to behavior
Source: /etc/32678 (PID: 5763)	Sleep executable: /usr/bin/sleep -> sleep 60	Jump to behavior
Source: /etc/32678 (PID: 5837)	Sleep executable: /usr/bin/sleep -> sleep 60	Jump to behavior

Reads CPU information from /sys indicative of miner or evasive malware

Source: /tmp/linux_ppc64el.elf (PID: 5501)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5812)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior

Sleeps for long times indicative of sandbox evasion

Source: /usr/bin/sleep (PID: 5514)	Sleeps longer then 60s: 60.0s	Jump to behavior
Source: /usr/bin/sleep (PID: 5763)	Sleeps longer then 60s: 60.0s	Jump to behavior
Source: /usr/bin/sleep (PID: 5837)	Sleeps longer then 60s: 60.0s	Jump to behavior

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/linux_ppc64el.elf (PID: 5483)	Queries kernel information via 'uname':	Jump to behavior
Source: /bin/bash (PID: 5490)	Queries kernel information via 'uname':	Jump to behavior
Source: /tmp/linux_ppc64el.elf (PID: 5501)	Queries kernel information via 'uname':	Jump to behavior
Source: /bin/bash (PID: 5560)	Queries kernel information via 'uname':	Jump to behavior
Source: /boot/System.img.config (PID: 5571)	Queries kernel information via 'uname':	Jump to behavior
Source: /etc/id.services.conf (PID: 5806)	Queries kernel information via 'uname':	Jump to behavior
Source: /etc/id.services.conf (PID: 5831)	Queries kernel information via 'uname':	Jump to behavior
Source: /boot/System.img.config (PID: 5756)	Queries kernel information via 'uname':	Jump to behavior

Source: System.img.config, 5756.1.00007fffe6300000.00007fffe6321000.rw-.sdmp	Binary or memory string: yx86_64/usr/bin/qemu-ppc64le/boot/System.img.config
Source: 32678, 5806.1.00007ffe5d7ea000.00007ffe5d80b000.rw-.sdmp, id.services.conf, 5806.1.00007ffe5d7ea000.00007ffe5d80b000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc64le/etc/id.services.confJOURNAL_STREAM=9:65259PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binINVOCATION_ID=bc2b0857337944388045c478d181f5c8LANG=en_US.UTF-8PWD=//etc/id.services.conf
Source: System.img.config, 5756.1.00007fffe6300000.00007fffe6321000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc64le
Source: systemd, 5571.1.00007ffd69e45000.00007ffd69e66000.rw-.sdmp, System.img.config, 5571.1.00007ffd69e45000.00007ffd69e66000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc64le/boot/System.img.configLANG=en_US.UTF-8PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binINVOCATION_ID=bc2b0857337944388045c478d181f5c8JOURNAL_STREAM=9:65259/boot/System.img.config
Source: id.services.conf, 5831.1.000056139f635000.000056139fad6000.rw-.sdmp	Binary or memory string: Vsbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin1/etc/qemu-binfmt/ppc64le1/machine/unattached/device[1]u>1
Source: linux_ppc64el.elf, 5483.1.00007fff85016000.00007fff85037000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc64le/tmp/linux_ppc64el.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/linux_ppc64el.elf
Source: linux_ppc64el.elf, 5483.1.0000559ab95cf000.0000559ab9a98000.rw-.sdmp, systemd, 5571.1.000055b4066b1000.000055b406b6b000.rw-.sdmp, System.img.config, 5571.1.000055b4066b1000.000055b406b6b000.rw-.sdmp	Binary or memory string: (8:@HPX`hp1/etc/qemu-binfmt/ppc64le1/machine/unattached/device[1]u>1
Source: id.services.conf, 5831.1.00007ffeff5e3000.00007ffeff604000.rw-.sdmp	Binary or memory string: XXx86_64/usr/bin/qemu-ppc64le/etc/id.services.conf
Source: 32678, 5806.1.000055d94a6c2000.000055d94ab81000.rw-.sdmp, id.services.conf, 5806.1.000055d94a6c2000.000055d94ab81000.rw-.sdmp	Binary or memory string: 1/etc/qemu-binfmt/ppc64le1/machine/unattached/device[1]u>1
Source: System.img.config, 5756.1.00005585a57ad000.00005585a5c74000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc64le
Source: System.img.config, 5756.1.00005585a57ad000.00005585a5c74000.rw-.sdmp	Binary or memory string: Usbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin1/etc/qemu-binfmt/ppc64le1/machine/unattached/device[1]u>1

Stealing of Sensitive Information

Yara detected Chaos

Source: Yara match	File source: linux_ppc64el.elf, type: SAMPLE
Source: Yara match	File source: /etc/id.services.conf, type: DROPPED
Source: Yara match	File source: /boot/System.img.config, type: DROPPED

Remote Access Functionality

Yara detected Chaos

Source: Yara match	File source: linux_ppc64el.elf, type: SAMPLE
Source: Yara match	File source: /etc/id.services.conf, type: DROPPED
Source: Yara match	File source: /boot/System.img.config, type: DROPPED

Screenshots

No Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.135.101.78	aras.liveya.org	Hong Kong		4842	TH-AS-APTianhaiInfoTechCN	true

Contacted Domains

Name	IP	Active
aras.liveya.org	103.135.101.78	true
www.google.com	142.250.181.100	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://103.135.101.78:808/password.txt	true	Avira URL Cloud: safe	unknown

AV Detection

Multi AV Scanner detection for submitted file

Source: linux_ppc64el.elf

ReversingLabs: Detection: 42%

Reads CPU information from /sys indicative of miner or evasive malware

Source: /tmp/linux_ppc64el.elf (PID: 5501)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5812)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 103.135.101.78 ports 808,52462,2,4,5,6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 47700 -> 808
Source: unknown	Network traffic detected: HTTP traffic on port 808 -> 47700

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.14:42412 -> 103.135.101.78:52462

Reads the 'hosts' file potentially containing internal network hosts

Source: /tmp/linux_ppc64el.elf (PID: 5501)

Reads hosts file: /etc/hosts

Jump to behavior

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /password.txt HTTP/1.1Host: 103.135.101.78:808User-Agent: Go-http-client/1.1Accept-Encoding: gzip

Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http2: Transport conn %p received error from processing frame %v: %vhttp2: Transport received unsolicited DATA frame; closing connectionhttp: message cannot contain multiple Content-Length headers; got %qpadding bytes must all be zeros unless AllowIllegalWrites is enabledreflect: reflect.Value.UnsafePointer on an invalid notinheap pointerhttp2: Transport closing idle conn %p (forSingleUse=%v, maxStream=%v)tls: handshake message of length %d bytes exceeds maximum of %d bytestls: peer doesn't support the certificate custom signature algorithmsbytes.Buffer: UnreadByte: previous operation was not a successful readcannot convert slice with length %y to pointer to array with length %xgot %s for stream %d; expected CONTINUATION following %s for stream %dx509: PKCS#8 wrapping contained private key with unknown algorithm: %vx509: certificate relies on legacy Common Name field, use SANs insteadMozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)Sogou Pic Spider/3.0(+http://www.sogou.com/docs/help/webmasters.htm#07)Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)dynamic table size update MUST occur at the beginning of a header blockssh: no common algorithm for %s; client offered: %v, server offered: %vtls: peer doesn't support any of the certificate's signature algorithmstoo many concurrent operations on a single file or socket (max 1048575)x509: issuer has name constraints but leaf doesn't have a SAN extensionMozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)tls: server's certificate contains an unsupported type of public key: %Ttls: received unexpected handshake message of type %T when waiting for %T91289437fa036b34da55d57af6192768c27bd433fa012169d626d934e0051b24dd67dd3cf49d7cc827bc012d259d7ac226e70829239d7ac226e7082968de60d520eb433722c07fd236f6crypto/elliptic: internal error: Unmarshal rejected a valid point encodingmalformed response from server: malformed non-numeric status pseudo headernet/http: server replied with more than declared Content-Length; truncatedtls: certificate RSA key size too small for supported signature algorithmsUnsolicited response received on idle HTTP channel starting with %q; err=%vtls: internal error: attempted to read record with pending application datatls: failed to send closeNotify alert (but connection was closed anyway): %wtls: server certificate contains incorrect key type for selected ciphersuite((2(5[0-5]\|[0-4]\d))\|[0-1]?\d{1,2})(\.((2(5[0-5]\|[0-4]\d))\|[0-1]?\d{1,2})){3}MapIter.Next called on an iterator that does not have an associated map Valuecrypto/tls: ExportKeyingMaterial is unavailable when renegotiation is enabled115792089210356248762697446949407573529996955224135760342422259061068512044369115792089210356248762697446949407573530086143415290314195533631308867097853951ssh: internal error: algorithmSignerWrapper invoked with non-default algorithmssh: unable to authenticate, attempted methods %v, no supported methods remainx509: signature check attempt
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http: RoundTripper implementation (%T) returned a nil Response with a nil errortls: either ServerName or InsecureSkipVerify must be specified in the tls.Configx509: invalid signature: parent certificate cannot sign this kind of certificaterefusing to use HTTP_PROXY value in CGI environment; see golang.org/s/cgihttpproxyx509: a root or intermediate certificate is not authorized to sign for this name: (possibly because of %q while trying to verify candidate authority certificate %q)Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)x509: issuer has name constraints but leaf contains unknown or unconstrained name: tls: downgrade attempt detected, possibly due to a MitM attack or a broken middleboxx509: signature algorithm specifies an %s public key, but have public key of type %Treflect.Value.Interface: cannot return value obtained from unexported field or methodx509: failed to parse private key (use ParseECPrivateKey instead for this key format)Mozilla/5.0 (compatible; YoudaoBot/1.0; http://www.youdao.com/help/webmaster/spider/;)reflect: New of type that may not be allocated in heap (possibly undefined cgo C type)x509: a root or intermediate certificate is not authorized for an extended key usage: fxfzUc6gtMGc/i26ld3KydGKy1k7QqyMMyxjbU1Rlk+F9LQxnaTeCHGHsDUpaBeOWDeY6l+2kHlB7EWTLcGwfg==whv+Kf1cEtOXzr+zuvmef2as0WfbUDm8l2LMWBMel10NDnbShg9CsMUt327VJhOTbXLoPYJVTKy8MBPCVwoT8A==x509: failed to parse private key (use ParsePKCS1PrivateKey instead for this key format)x509: failed to parse private key (use ParsePKCS8PrivateKey instead for this key format)Mozilla/5.0 (compatible; Baiduspider-render/2.0; +http://www.baidu.com/search/spider.html)http2: server sent GOAWAY and closed the connection; LastStreamID=%v, ErrCode=%v, debug=%qapplication/xml,application/xhtml+xml,text/html;q=0.9, text/plain;q=0.8,image/png,/;q=0.5tls: handshake hash for a client certificate requested after discarding the handshake buffertls: unsupported certificate: private key is ed25519.PrivateKey, expected ed25519.PrivateKey3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5faa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7b3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aefhttp: RoundTripper implementation (%T) returned a *Response with content length %d but a nil BodyNoClientCertRequestClientCertRequireAnyClientCertVerifyClientCertIfGivenRequireAndVerifyClientCertcipher: the nonce can't have zero length, or the security of the key will be immediately compromisedssh<<RMS>> equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: aras.liveya.org

Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http://help.yahoo.com/help/us/ysearch/slurp)x509:
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http://search.msn.com/msnbot.htm
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http://www.baidu.com/search/spider.html)000102030405060708091011121314151617181920212223242526272829
Source: id.services.conf.12.dr	String found in binary or memory: http://www.baidu.com/search/spider.html)Mozilla/5.0
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http://www.baidu.com/search/spider.html)http2:
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http://www.entireweb.com/about/search_tech/speedy_spider/)text/html
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http://www.google.com/mobile/adsbot.html)
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http://www.haosou.com/help/help_3_2.htmlMozilla/5.0
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http://www.huaweisymantec.com/cn/IRL/spider)Mozilla/5.0
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http://www.youdao.com/help/webmaster/spider/;)reflect:
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: http://yandex.com/bots)http:
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: https://search.yahoo.com/search?p=illegal
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: https://www.baidu.com/s?wd=insufficient
Source: linux_ppc64el.elf, System.img.config.19.dr, id.services.conf.12.dr	String found in binary or memory: https://www.so.com/s?q=index

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Sample tries to kill a process (SIGKILL)

Source: /usr/bin/pkill (PID: 5599)	SIGKILL sent: pid: 5503, result: successful			Jump to behavior
Source: /usr/bin/pkill (PID: 5812)	SIGKILL sent: pid: 5755, result: successful			Jump to behavior

Source: classification engine

Classification label: mal76.troj.evad.linELF@0/44@4/0

Source: ELF file section	Submission: linux_ppc64el.elf
Source: ELF file section	Dropped file: id.services.conf.12.dr
Source: ELF file section	Dropped file: System.img.config.19.dr

Persistence and Installation Behavior

Sample tries to set files in /etc globally writable

Source: /tmp/linux_ppc64el.elf (PID: 5483)	File: /etc/id.services.conf (bits: - usr: rx grp: rx all: rwx)			Jump to behavior
Source: /tmp/linux_ppc64el.elf (PID: 5483)	File: /etc/32678 (bits: - usr: rx grp: rx all: rwx)			Jump to behavior

Writes identical ELF files to multiple locations

Source: /tmp/linux_ppc64el.elf (PID: 5501)	File with SHA-256 535B04D328DA7B0BE034710AEB74C4460C873D72CCF1E6E8186D4FAF2E158C60 written: /boot/System.img.config			Jump to dropped file
Source: /tmp/linux_ppc64el.elf (PID: 5483)	File with SHA-256 535B04D328DA7B0BE034710AEB74C4460C873D72CCF1E6E8186D4FAF2E158C60 written: /etc/id.services.conf			Jump to dropped file

Creates hidden files and/or directories

Source: /tmp/linux_ppc64el.elf (PID: 5501)	File: /dev/.old	Jump to behavior
Source: /tmp/linux_ppc64el.elf (PID: 5501)	File: /dev/.img	Jump to behavior
Source: /etc/id.services.conf (PID: 5831)	File: /dev/.old	Jump to behavior
Source: /etc/id.services.conf (PID: 5831)	File: /dev/.img	Jump to behavior
Source: /boot/System.img.config (PID: 5756)	File: /dev/.old	Jump to behavior
Source: /boot/System.img.config (PID: 5756)	File: /dev/.img	Jump to behavior

Creates hidden files without content (potentially used as a mutex)

Source: /boot/System.img.config (PID: 5756)	Empty hidden file: /dev/.old			Jump to behavior
Source: /boot/System.img.config (PID: 5756)	Empty hidden file: /dev/.img			Jump to behavior

Enumerates processes within the "proc" file system

Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1583/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/2672/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3759/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3759/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1577/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1577/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3756/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3756/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3757/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3757/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/917/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/917/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3758/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3758/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/19/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/19/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1593/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/240/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/240/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/120/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/120/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3094/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/121/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/121/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/242/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/242/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3406/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/122/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/122/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/243/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/243/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/2/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/2/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/123/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/123/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/244/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/244/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1589/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/124/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/124/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/245/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/245/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1588/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/125/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/125/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/4/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/4/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/246/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/246/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3402/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/126/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	File opened: /proc/126/cmdline	Jump to behavior

Executes commands using a shell command-line interpreter

Source: /tmp/linux_ppc64el.elf (PID: 5490)	Shell command executed: /bin/bash -c /etc/32678&			Jump to behavior
Source: /tmp/linux_ppc64el.elf (PID: 5560)	Shell command executed: /bin/bash -c "cd /boot;systemctl daemon-reload;systemctl enable linux.service;systemctl start linux.service;journalctl -xe --no-pager"			Jump to behavior

Executes the "kill" or "pkill" command typically used to terminate processes

Source: /boot/System.img.config (PID: 5599)	Pkill executable: /usr/bin/pkill -> pkill -9 32678			Jump to behavior
Source: /etc/id.services.conf (PID: 5812)	Pkill executable: /usr/bin/pkill -> pkill -9 32678			Jump to behavior

Executes the "systemctl" command used for controlling the systemd system and service manager

Source: /usr/sbin/service (PID: 5496)	Systemctl executable: /usr/bin/systemctl -> systemctl start crond.service	Jump to behavior
Source: /usr/sbin/service (PID: 5516)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active multi-user.target	Jump to behavior
Source: /usr/sbin/service (PID: 5530)	Systemctl executable: /usr/bin/systemctl -> systemctl list-unit-files --full --type=socket	Jump to behavior
Source: /usr/sbin/update-rc.d (PID: 5532)	Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload	Jump to behavior
Source: /bin/bash (PID: 5562)	Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload	Jump to behavior
Source: /bin/bash (PID: 5566)	Systemctl executable: /usr/bin/systemctl -> systemctl enable linux.service	Jump to behavior
Source: /bin/bash (PID: 5570)	Systemctl executable: /usr/bin/systemctl -> systemctl start linux.service	Jump to behavior
Source: /usr/sbin/service (PID: 5825)	Systemctl executable: /usr/bin/systemctl -> systemctl start crond.service	Jump to behavior
Source: /usr/sbin/service (PID: 5839)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active multi-user.target	Jump to behavior
Source: /usr/sbin/service (PID: 5845)	Systemctl executable: /usr/bin/systemctl -> systemctl list-unit-files --full --type=socket	Jump to behavior
Source: /usr/sbin/service (PID: 5748)	Systemctl executable: /usr/bin/systemctl -> systemctl start crond.service	Jump to behavior
Source: /usr/sbin/service (PID: 5766)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active multi-user.target	Jump to behavior
Source: /usr/sbin/service (PID: 5773)	Systemctl executable: /usr/bin/systemctl -> systemctl list-unit-files --full --type=socket	Jump to behavior

Sample tries to set the executable flag

Source: /tmp/linux_ppc64el.elf (PID: 5483)	File: /etc/id.services.conf (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/linux_ppc64el.elf (PID: 5483)	File: /etc/32678 (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/linux_ppc64el.elf (PID: 5501)	File: /boot/System.img.config (bits: - usr: rx grp: rx all: rwx)	Jump to behavior

Writes ELF files to disk

Source: /tmp/linux_ppc64el.elf (PID: 5483)	File written: /etc/id.services.conf			Jump to dropped file
Source: /tmp/linux_ppc64el.elf (PID: 5501)	File written: /boot/System.img.config			Jump to dropped file

Writes shell script file to disk with an unusual file extension

Source: /tmp/linux_ppc64el.elf (PID: 5483)	Writes shell script file to disk with an unusual file extension: /etc/32678			Jump to dropped file
Source: /tmp/linux_ppc64el.elf (PID: 5501)	Writes shell script file to disk with an unusual file extension: /etc/init.d/linux_kill			Jump to dropped file

Source: /usr/sbin/service (PID: 5531)	Sed executable: /usr/bin/sed -> sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p	Jump to behavior
Source: /usr/sbin/service (PID: 5846)	Sed executable: /usr/bin/sed -> sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p	Jump to behavior
Source: /usr/sbin/service (PID: 5774)	Sed executable: /usr/bin/sed -> sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Drops files in suspicious directories

Source: /tmp/linux_ppc64el.elf (PID: 5501)

File: /etc/init.d/linux_kill

Jump to dropped file

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 47700 -> 808
Source: unknown	Network traffic detected: HTTP traffic on port 808 -> 47700

Executes the "sleep" command used to delay execution and potentially evade sandboxes

Source: /etc/32678 (PID: 5514)	Sleep executable: /usr/bin/sleep -> sleep 60	Jump to behavior
Source: /etc/32678 (PID: 5763)	Sleep executable: /usr/bin/sleep -> sleep 60	Jump to behavior
Source: /etc/32678 (PID: 5837)	Sleep executable: /usr/bin/sleep -> sleep 60	Jump to behavior

Reads CPU information from /sys indicative of miner or evasive malware

Source: /tmp/linux_ppc64el.elf (PID: 5501)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5599)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5812)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior

Sleeps for long times indicative of sandbox evasion

Source: /usr/bin/sleep (PID: 5514)	Sleeps longer then 60s: 60.0s	Jump to behavior
Source: /usr/bin/sleep (PID: 5763)	Sleeps longer then 60s: 60.0s	Jump to behavior
Source: /usr/bin/sleep (PID: 5837)	Sleeps longer then 60s: 60.0s	Jump to behavior

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/linux_ppc64el.elf (PID: 5483)	Queries kernel information via 'uname':	Jump to behavior
Source: /bin/bash (PID: 5490)	Queries kernel information via 'uname':	Jump to behavior
Source: /tmp/linux_ppc64el.elf (PID: 5501)	Queries kernel information via 'uname':	Jump to behavior
Source: /bin/bash (PID: 5560)	Queries kernel information via 'uname':	Jump to behavior
Source: /boot/System.img.config (PID: 5571)	Queries kernel information via 'uname':	Jump to behavior
Source: /etc/id.services.conf (PID: 5806)	Queries kernel information via 'uname':	Jump to behavior
Source: /etc/id.services.conf (PID: 5831)	Queries kernel information via 'uname':	Jump to behavior
Source: /boot/System.img.config (PID: 5756)	Queries kernel information via 'uname':	Jump to behavior

Source: System.img.config, 5756.1.00007fffe6300000.00007fffe6321000.rw-.sdmp	Binary or memory string: yx86_64/usr/bin/qemu-ppc64le/boot/System.img.config
Source: 32678, 5806.1.00007ffe5d7ea000.00007ffe5d80b000.rw-.sdmp, id.services.conf, 5806.1.00007ffe5d7ea000.00007ffe5d80b000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc64le/etc/id.services.confJOURNAL_STREAM=9:65259PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binINVOCATION_ID=bc2b0857337944388045c478d181f5c8LANG=en_US.UTF-8PWD=//etc/id.services.conf
Source: System.img.config, 5756.1.00007fffe6300000.00007fffe6321000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc64le
Source: systemd, 5571.1.00007ffd69e45000.00007ffd69e66000.rw-.sdmp, System.img.config, 5571.1.00007ffd69e45000.00007ffd69e66000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc64le/boot/System.img.configLANG=en_US.UTF-8PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binINVOCATION_ID=bc2b0857337944388045c478d181f5c8JOURNAL_STREAM=9:65259/boot/System.img.config
Source: id.services.conf, 5831.1.000056139f635000.000056139fad6000.rw-.sdmp	Binary or memory string: Vsbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin1/etc/qemu-binfmt/ppc64le1/machine/unattached/device[1]u>1
Source: linux_ppc64el.elf, 5483.1.00007fff85016000.00007fff85037000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc64le/tmp/linux_ppc64el.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/linux_ppc64el.elf
Source: linux_ppc64el.elf, 5483.1.0000559ab95cf000.0000559ab9a98000.rw-.sdmp, systemd, 5571.1.000055b4066b1000.000055b406b6b000.rw-.sdmp, System.img.config, 5571.1.000055b4066b1000.000055b406b6b000.rw-.sdmp	Binary or memory string: (8:@HPX`hp1/etc/qemu-binfmt/ppc64le1/machine/unattached/device[1]u>1
Source: id.services.conf, 5831.1.00007ffeff5e3000.00007ffeff604000.rw-.sdmp	Binary or memory string: XXx86_64/usr/bin/qemu-ppc64le/etc/id.services.conf
Source: 32678, 5806.1.000055d94a6c2000.000055d94ab81000.rw-.sdmp, id.services.conf, 5806.1.000055d94a6c2000.000055d94ab81000.rw-.sdmp	Binary or memory string: 1/etc/qemu-binfmt/ppc64le1/machine/unattached/device[1]u>1
Source: System.img.config, 5756.1.00005585a57ad000.00005585a5c74000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc64le
Source: System.img.config, 5756.1.00005585a57ad000.00005585a5c74000.rw-.sdmp	Binary or memory string: Usbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin1/etc/qemu-binfmt/ppc64le1/machine/unattached/device[1]u>1

Stealing of Sensitive Information

Yara detected Chaos

Source: Yara match	File source: linux_ppc64el.elf, type: SAMPLE
Source: Yara match	File source: /etc/id.services.conf, type: DROPPED
Source: Yara match	File source: /boot/System.img.config, type: DROPPED

Remote Access Functionality

Yara detected Chaos

Source: Yara match	File source: linux_ppc64el.elf, type: SAMPLE
Source: Yara match	File source: /etc/id.services.conf, type: DROPPED
Source: Yara match	File source: /boot/System.img.config, type: DROPPED

ID:	1562732
Product:	CloudBasic
Start time:	23:46:15
Start date:	25.11.2024
Sample:	linux_ppc64el.elf
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	04893430bfaf82b24e726e9980c338b3
SHA1:	9dfd9c35b547705b267b4c2acd5cb7699ba5edb5
SHA256:	535b04d328da7b0be034710aeb74c4460c873d72ccf1e6e8186d4faf2e158c60
Filetype:	ELF Executable and Linkable format (generic) (4004/1) 98.45%

Name	Type	MD5	SHA1	SHA256
/boot/System.img.config	ELF 64-bit LSB executable, 64-bit PowerPC or cisco 7500, OpenPOWER ELF V2 ABI, version 1 (SYSV), statically linked, Go BuildID=Y52nvXRmmagZPlBTD-aN/NAr5Akn8HWwmUdYC_fAB/CpqR8sVX_ghDLQQPm5P-/GAtPsar0-LeUP45KvIBJ, stripped	04893430BFAF82B24E726E9980C338B3	9DFD9C35B547705B267B4C2ACD5CB7699BA5EDB5	535B04D328DA7B0BE034710AEB74C4460C873D72CCF1E6E8186D4FAF2E158C60
/etc/32678	POSIX shell script, ASCII text executable	768EAF287796DA19E1CF5E0B2FB1B161	6A1CE2EE5CCC86D1F33806FEB14547B35290DF2A	1D22620DFB2A6715E5D745AED5CF841EDE0E75E1747F12B9B925A2D346BC7ECB
/etc/id.services.conf	ELF 64-bit LSB executable, 64-bit PowerPC or cisco 7500, OpenPOWER ELF V2 ABI, version 1 (SYSV), statically linked, Go BuildID=Y52nvXRmmagZPlBTD-aN/NAr5Akn8HWwmUdYC_fAB/CpqR8sVX_ghDLQQPm5P-/GAtPsar0-LeUP45KvIBJ, stripped	04893430BFAF82B24E726E9980C338B3	9DFD9C35B547705B267B4C2ACD5CB7699BA5EDB5	535B04D328DA7B0BE034710AEB74C4460C873D72CCF1E6E8186D4FAF2E158C60
/etc/init.d/linux_kill	POSIX shell script, ASCII text executable	3909975F7CC0D1121C1819B800069F31	3E68DE708C2E6C40FAB6794AFDEE3104E5590189	6876DAC71F13A068AFB863D257134275F2EDBA43B2ACAF4924FABF97C079070B
/memfd:snapd-env-generator (deleted)	ASCII text	D86A1F5765F37989EB0EC3837AD13ECC	D749672A734D9DEAFD61DCA501C6929EC431B83E	85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
/tmp/qemu-open.0lVY39 (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.0utOWb (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.2XcNfa (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.3TchF8 (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.47zsTa (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.7RtYha (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.7ufIb9 (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.8ac428 (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.9gi6V9 (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.DoIUS7 (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.EM99t8 (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.GWYcub (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.IK52Fb (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.KBwJd8 (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.RuzPjc (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.Vv9Bwa (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.YA7549 (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.ZDVBi9 (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.athKA9 (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.c4IWL8 (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.g5Ysw8 (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.i17Hbb (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.i76MTa (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.iDGec9 (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.k0YN07 (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.owQ7ta (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.r6b4o9 (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.rQm068 (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.sAYifb (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.sXjU99 (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/tmp/qemu-open.vtExu8 (deleted)	ASCII text	9FEEAE83800D5D74A3080BAAA524BB9C	76F979366C6755FAB2EF419DF70CA86F9BA6ED82	882E8F9183178EA985AFCDFA7C0D9232567F6FFCA4CB10C96CE1EC83085D8F09
/usr/lib/systemd/system/linux.service	ASCII text	D80CCC7CED99538F22336F2EC0249087	BE4DE9F604E065B53076A3D7BA702FE98C6B8746	0DC3E8552C3E6217E0DC7FD440C7BA4C9CD6E676CE2561E4F71949D2783AE968
/var/log/btmp	data	9D70E6711CCDB75E9591CD6CCD456113	8F2ABC19335C299FCCB3874B97AA33380BDB6A5F	E8EF7A0CD99AFB1D3C8FF88B1783C3C944A12B8C863C4734AD16DA0C2B63E16F

Linux Analysis Report
linux_ppc64el.elf

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel
Provided by

Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Linux Analysis Report linux_ppc64el.elf

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Linux Analysis Report
linux_ppc64el.elf

Malware Threat Intel
Provided by