Linux Analysis Report
4QuhksnsA6.elf

Overview

General Information

Sample name: 4QuhksnsA6.elf
renamed because original name is a hash value
Original sample name: 8e94a58a9ea60b7ecb5aca256902bbae.elf
Analysis ID: 1428275
MD5: 8e94a58a9ea60b7ecb5aca256902bbae
SHA1: a54f2fc5d503dc8baa67c0b5fa4efe84bf85856a
SHA256: cbab9972feafdbeb7d2a67fcad49b5402fea6480ad7b7cccff931bbc11b1cfcc
Tags: 32armelfmirai
Infos:

Detection

Score: 64
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Sample tries to kill multiple processes (SIGKILL)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 4QuhksnsA6.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: 4QuhksnsA6.elf ReversingLabs: Detection: 34%

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 159.89.195.76 ports 2,3,6,7,8,32876
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.15:39744 -> 159.89.195.76:32876
Source: global traffic UDP traffic: 192.168.2.15:57869 -> 45.224.4.218:28496
Source: global traffic UDP traffic: 192.168.2.15:58391 -> 45.239.240.196:8964
Source: global traffic UDP traffic: 192.168.2.15:33176 -> 138.99.32.39:10452
Source: global traffic UDP traffic: 192.168.2.15:50660 -> 177.221.123.161:18580
Source: global traffic UDP traffic: 192.168.2.15:58747 -> 143.137.12.33:12910
Source: global traffic UDP traffic: 192.168.2.15:35197 -> 170.247.21.108:24669
Sample listens on a socket
Source: /tmp/4QuhksnsA6.elf (PID: 5544) Socket: 127.0.0.1::1234 Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5546) Socket: 0.0.0.0::23 Jump to behavior
Source: unknown UDP traffic detected without corresponding DNS query: 130.61.64.122
Source: unknown UDP traffic detected without corresponding DNS query: 162.243.19.47
Source: unknown UDP traffic detected without corresponding DNS query: 45.224.4.218
Source: unknown UDP traffic detected without corresponding DNS query: 45.239.240.196
Source: unknown UDP traffic detected without corresponding DNS query: 138.99.32.39
Source: unknown UDP traffic detected without corresponding DNS query: 177.221.123.161
Source: unknown UDP traffic detected without corresponding DNS query: 143.137.12.33
Source: unknown UDP traffic detected without corresponding DNS query: 45.224.4.218
Source: unknown UDP traffic detected without corresponding DNS query: 138.99.32.39
Source: unknown UDP traffic detected without corresponding DNS query: 170.247.21.108
Source: unknown UDP traffic detected without corresponding DNS query: 45.239.240.196
Source: unknown UDP traffic detected without corresponding DNS query: 177.221.123.161
Source: unknown UDP traffic detected without corresponding DNS query: 143.137.12.33
Source: unknown UDP traffic detected without corresponding DNS query: 45.224.4.218
Source: unknown UDP traffic detected without corresponding DNS query: 170.247.21.108
Source: unknown UDP traffic detected without corresponding DNS query: 138.99.32.39
Source: unknown UDP traffic detected without corresponding DNS query: 45.239.240.196
Source: unknown UDP traffic detected without corresponding DNS query: 177.221.123.161
Source: unknown UDP traffic detected without corresponding DNS query: 143.137.12.33
Source: unknown UDP traffic detected without corresponding DNS query: 170.247.21.108
Source: unknown UDP traffic detected without corresponding DNS query: 45.224.4.218
Source: unknown UDP traffic detected without corresponding DNS query: 138.99.32.39
Source: unknown UDP traffic detected without corresponding DNS query: 45.239.240.196
Source: unknown UDP traffic detected without corresponding DNS query: 143.137.12.33
Source: unknown UDP traffic detected without corresponding DNS query: 177.221.123.161
Source: unknown UDP traffic detected without corresponding DNS query: 170.247.21.108
Source: unknown UDP traffic detected without corresponding DNS query: 45.224.4.218
Source: unknown UDP traffic detected without corresponding DNS query: 138.99.32.39
Source: unknown UDP traffic detected without corresponding DNS query: 45.239.240.196
Source: unknown UDP traffic detected without corresponding DNS query: 177.221.123.161
Source: unknown UDP traffic detected without corresponding DNS query: 143.137.12.33
Source: unknown UDP traffic detected without corresponding DNS query: 45.224.4.218
Source: unknown UDP traffic detected without corresponding DNS query: 138.99.32.39
Source: unknown UDP traffic detected without corresponding DNS query: 170.247.21.108
Source: unknown UDP traffic detected without corresponding DNS query: 45.239.240.196
Source: unknown UDP traffic detected without corresponding DNS query: 177.221.123.161
Source: unknown UDP traffic detected without corresponding DNS query: 143.137.12.33
Source: unknown UDP traffic detected without corresponding DNS query: 170.247.21.108
Source: unknown UDP traffic detected without corresponding DNS query: 45.224.4.218
Source: unknown UDP traffic detected without corresponding DNS query: 138.99.32.39
Source: unknown UDP traffic detected without corresponding DNS query: 45.239.240.196
Source: unknown UDP traffic detected without corresponding DNS query: 143.137.12.33
Source: unknown UDP traffic detected without corresponding DNS query: 177.221.123.161
Source: unknown UDP traffic detected without corresponding DNS query: 170.247.21.108
Source: unknown UDP traffic detected without corresponding DNS query: 45.224.4.218
Source: unknown UDP traffic detected without corresponding DNS query: 138.99.32.39
Source: unknown UDP traffic detected without corresponding DNS query: 45.239.240.196
Source: unknown UDP traffic detected without corresponding DNS query: 177.221.123.161
Source: unknown UDP traffic detected without corresponding DNS query: 143.137.12.33
Source: unknown UDP traffic detected without corresponding DNS query: 170.247.21.108
Source: unknown DNS traffic detected: queries for: pikeyisa.pirate

System Summary
barindex
Sample tries to kill multiple processes (SIGKILL)
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 917, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 931, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 933, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 3192, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 3249, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 3250, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 3251, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 3252, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 3253, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 3255, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 3272, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 3274, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 3298, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 5569, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 5570, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 5571, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 5572, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 5574, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 5575, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 5649, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 5651, result: successful Jump to behavior
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 917, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 931, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 933, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 3192, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 3249, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 3250, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 3251, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 3252, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 3253, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 3255, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 3272, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 3274, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 3298, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 5569, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 5570, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 5571, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 5572, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 5574, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 5575, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 5649, result: successful Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) SIGKILL sent: pid: 5651, result: successful Jump to behavior
Source: classification engine Classification label: mal64.spre.troj.linELF@0/0@1/0
Enumerates processes within the "proc" file system
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/110/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/231/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/111/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/112/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/233/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/113/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/114/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/235/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/115/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/1333/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/1333/maps Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/116/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/1695/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/1695/maps Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/117/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/118/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/119/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/911/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/914/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/10/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/917/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/917/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/11/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/12/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/13/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/14/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/15/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/16/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/17/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/18/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/19/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/1591/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/1591/maps Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/120/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/121/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/1/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/1/maps Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/122/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/243/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/2/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/123/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/3/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/124/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/1588/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/1588/maps Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/125/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/4/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/246/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/126/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/5/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/127/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/6/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/1585/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/1585/maps Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/128/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/7/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/129/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/8/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/800/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/800/maps Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/9/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/802/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/802/maps Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/803/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/803/maps Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/804/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/804/maps Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/3888/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/3888/maps Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/20/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/21/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/3407/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/3407/maps Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/22/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/23/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/24/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/25/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/26/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/27/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/28/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/29/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/1484/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/1484/maps Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/490/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/490/maps Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/250/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/130/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/251/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/131/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/132/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/133/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/1479/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/1479/maps Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/378/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/258/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/259/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/931/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/931/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/1595/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/1595/maps Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/812/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/812/maps Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/933/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/30/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/3419/cmdline Jump to behavior
Source: /tmp/4QuhksnsA6.elf (PID: 5548) File opened: /proc/3419/maps Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/4QuhksnsA6.elf (PID: 5544) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5572) Queries kernel information via 'uname': Jump to behavior
Source: 4QuhksnsA6.elf, 5544.1.00007ffe3c283000.00007ffe3c2a4000.rw-.sdmp, 4QuhksnsA6.elf, 5649.1.00007ffe3c283000.00007ffe3c2a4000.rw-.sdmp, 4QuhksnsA6.elf, 5651.1.00007ffe3c283000.00007ffe3c2a4000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/4QuhksnsA6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/4QuhksnsA6.elf
Source: 4QuhksnsA6.elf, 5544.1.000055b000b0e000.000055b000c3c000.rw-.sdmp, 4QuhksnsA6.elf, 5649.1.000055b000b0e000.000055b000c3c000.rw-.sdmp, 4QuhksnsA6.elf, 5651.1.000055b000b0e000.000055b000c3c000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: 4QuhksnsA6.elf, 5544.1.000055b000b0e000.000055b000c3c000.rw-.sdmp, 4QuhksnsA6.elf, 5649.1.000055b000b0e000.000055b000c3c000.rw-.sdmp, 4QuhksnsA6.elf, 5651.1.000055b000b0e000.000055b000c3c000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: 4QuhksnsA6.elf, 5544.1.00007ffe3c283000.00007ffe3c2a4000.rw-.sdmp, 4QuhksnsA6.elf, 5649.1.00007ffe3c283000.00007ffe3c2a4000.rw-.sdmp, 4QuhksnsA6.elf, 5651.1.00007ffe3c283000.00007ffe3c2a4000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
177.221.123.161
 unknown Brazil
262789 SimternetTecnologiadaInformacaoLTDABR false
45.224.4.218
 unknown Brazil
267646 PlusMultiplayerTVltdaBR false
143.137.12.33
 unknown Brazil
264024 WnetTelecomeInformaticaEIRELIBR false
138.99.32.39
 unknown Brazil
262582 NetsulInternetBandaLargaLTDABR false
159.89.195.76
 pikeyisa.pirate United States
14061 DIGITALOCEAN-ASNUS true
45.239.240.196
 unknown Brazil
268377 LOCALNETTELECOMLTDABR false
170.247.21.108
 unknown Brazil
263324 NetComServicosdeInformaticaeTelecomunicacoesBR false
130.61.64.122
 unknown United States
31898 ORACLE-BMC-31898US false

Contacted Domains

Name IP Active
pikeyisa.pirate 159.89.195.76 true