Linux Analysis Report
kBNrex15s8.elf

Overview

General Information

Sample name: kBNrex15s8.elf
renamed because original name is a hash value
Original sample name: c24d81ebf3483fde718d20064d0817ce.elf
Analysis ID: 1427867
MD5: c24d81ebf3483fde718d20064d0817ce
SHA1: 40842dc0a0ad06b4f04ea1e11dfde1a2106f4b3c
SHA256: d40205245ed1ca9ce3f55730a1cf2afbde414a8ce06a4cfce853657a2a9ee7e2
Tags: 32armelfmirai
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: kBNrex15s8.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: kBNrex15s8.elf ReversingLabs: Detection: 71%
Source: kBNrex15s8.elf Virustotal: Detection: 61% Perma Link
Source: unknown DNS traffic detected: queries for: daisy.ubuntu.com
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal56.linELF@0/0@2/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/kBNrex15s8.elf (PID: 5525) Queries kernel information via 'uname': Jump to behavior
Source: kBNrex15s8.elf, 5525.1.000055d6d3bb9000.000055d6d3ce7000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: kBNrex15s8.elf, 5525.1.00007fff6e4f6000.00007fff6e517000.rw-.sdmp Binary or memory string: qemu: %s: %s
Source: kBNrex15s8.elf, 5525.1.00007fff6e4f6000.00007fff6e517000.rw-.sdmp Binary or memory string: leqemu: %s: %s
Source: kBNrex15s8.elf, 5525.1.000055d6d3bb9000.000055d6d3ce7000.rw-.sdmp Binary or memory string: Urg.qemu.gdb.arm.sys.regs">
Source: kBNrex15s8.elf, 5525.1.000055d6d3bb9000.000055d6d3ce7000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: kBNrex15s8.elf, 5525.1.00007fff6e4f6000.00007fff6e517000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: kBNrex15s8.elf, 5525.1.00007fff6e4f6000.00007fff6e517000.rw-.sdmp Binary or memory string: hx86_64/usr/bin/qemu-arm/tmp/kBNrex15s8.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/kBNrex15s8.elf
Source: kBNrex15s8.elf, 5525.1.000055d6d3bb9000.000055d6d3ce7000.rw-.sdmp Binary or memory string: rg.qemu.gdb.arm.sys.regs">
windows-stand
⊘No contacted IP infos

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true