Linux Analysis Report
2pcIneMurs.elf

Overview

General Information

Sample name: 2pcIneMurs.elf
renamed because original name is a hash value
Original sample name: f946de3390cdc1ff3335c5f08ac84191.elf
Analysis ID: 1427798
MD5: f946de3390cdc1ff3335c5f08ac84191
SHA1: c28b8e08755cef21e59ffa147a93804a370d84a5
SHA256: 30d7cd9723a8c35e03692f23154a0d35fd8e2db816dd059b130feecdc97916ca
Tags: 32armelf
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Sample is packed with UPX
ELF contains segments with high entropy indicating compressed/encrypted content
Sample contains only a LOAD segment without any section mappings
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection

barindex
Source: 2pcIneMurs.elf ReversingLabs: Detection: 34%
Source: 2pcIneMurs.elf Virustotal: Detection: 37% Perma Link
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: 2pcIneMurs.elf String found in binary or memory: http://upx.sf.net
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: LOAD without section mappings Program segment: 0x8000
Source: classification engine Classification label: mal52.evad.linELF@0/0@0/0

Data Obfuscation

barindex
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.96 Copyright (C) 1996-2020 the UPX Team. All Rights Reserved. $
Source: 2pcIneMurs.elf Submission file: segment LOAD with 7.9699 entropy (max. 8.0)
Source: /tmp/2pcIneMurs.elf (PID: 6259) Queries kernel information via 'uname': Jump to behavior
Source: 2pcIneMurs.elf, 6259.1.00007ffcd4e29000.00007ffcd4e4a000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/2pcIneMurs.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/2pcIneMurs.elf
Source: 2pcIneMurs.elf, 6259.1.00005602dd9c8000.00005602ddaf6000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: 2pcIneMurs.elf, 6259.1.00005602dd9c8000.00005602ddaf6000.rw-.sdmp Binary or memory string: V!/etc/qemu-binfmt/arm
Source: 2pcIneMurs.elf, 6259.1.00007ffcd4e29000.00007ffcd4e4a000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: 2pcIneMurs.elf, 6259.1.00007ffcd4e29000.00007ffcd4e4a000.rw-.sdmp Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs