Linux Analysis Report
XHYKEGTtfq.elf

Overview

General Information

Sample name: XHYKEGTtfq.elf
renamed because original name is a hash value
Original sample name: 73b136cb342e7a64855905830cdf0c0b.elf
Analysis ID: 1430906
MD5: 73b136cb342e7a64855905830cdf0c0b
SHA1: 87c0098d9c86435194231c2f5623a7e8c488a861
SHA256: c860d081fb8cfed28d01b054bf1611c295a6d307537563ad02650cc94c280746
Tags: 32elfpowerpc
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Sample deletes itself
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to kill multiple processes (SIGKILL)
Deletes log files
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Executes commands using a shell command-line interpreter
Executes the "grep" command used to find patterns in files or piped streams
Executes the "kill" or "pkill" command typically used to terminate processes
Reads CPU information from /sys indicative of miner or evasive malware
Sample contains only a LOAD segment without any section mappings
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: XHYKEGTtfq.elf Virustotal: Detection: 11% Perma Link
Reads CPU information from /sys indicative of miner or evasive malware
Source: /usr/bin/pkill (PID: 5509) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pkill (PID: 5517) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:42674 -> 212.70.149.14:35342
Sample listens on a socket
Source: /tmp/XHYKEGTtfq.elf (PID: 5432) Socket: 127.0.0.1::8345 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown UDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknown UDP traffic detected without corresponding DNS query: 51.77.149.139
Source: unknown UDP traffic detected without corresponding DNS query: 51.77.149.139
Source: unknown UDP traffic detected without corresponding DNS query: 51.77.149.139
Source: unknown UDP traffic detected without corresponding DNS query: 51.77.149.139
Source: unknown UDP traffic detected without corresponding DNS query: 51.77.149.139
Source: unknown UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown UDP traffic detected without corresponding DNS query: 134.195.4.2
Source: unknown UDP traffic detected without corresponding DNS query: 134.195.4.2
Source: unknown UDP traffic detected without corresponding DNS query: 134.195.4.2
Source: unknown UDP traffic detected without corresponding DNS query: 134.195.4.2
Source: unknown UDP traffic detected without corresponding DNS query: 134.195.4.2
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 51.254.162.59
Source: unknown UDP traffic detected without corresponding DNS query: 51.254.162.59
Source: unknown UDP traffic detected without corresponding DNS query: 51.254.162.59
Source: unknown UDP traffic detected without corresponding DNS query: 51.254.162.59
Source: unknown UDP traffic detected without corresponding DNS query: 51.254.162.59
Source: unknown UDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknown UDP traffic detected without corresponding DNS query: 51.77.149.139
Source: unknown UDP traffic detected without corresponding DNS query: 51.77.149.139
Source: unknown UDP traffic detected without corresponding DNS query: 51.77.149.139
Source: unknown UDP traffic detected without corresponding DNS query: 51.77.149.139
Source: unknown UDP traffic detected without corresponding DNS query: 51.77.149.139
Source: unknown UDP traffic detected without corresponding DNS query: 94.16.114.254
Source: unknown UDP traffic detected without corresponding DNS query: 94.16.114.254

System Summary
barindex
Sample tries to kill multiple processes (SIGKILL)
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 490, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 660, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 726, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 727, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 765, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 767, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 778, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 780, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 783, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 790, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 795, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 800, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 1400, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 1410, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 1411, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 1432, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 1475, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 1565, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 1805, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 2926, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 2935, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 2936, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 2970, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 3069, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 3122, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 3132, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 3772, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5272, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5415, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5416, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5438, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5440, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5441, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5444, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5461, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5478, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5480, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5484, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5485, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5486, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5490, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5491, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5492, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5493, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5494, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5495, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5496, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5497, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5498, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5499, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5502, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5505, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5507, result: no such process Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5508, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5510, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5511, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5512, result: no such process Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5513, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5514, result: no such process Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5515, result: no such process Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5516, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5517, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5518, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5519, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5521, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5522, result: successful Jump to behavior
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x10000000
Sample tries to kill a process (SIGKILL)
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 490, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 660, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 726, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 727, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 765, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 767, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 778, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 780, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 783, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 790, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 795, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 800, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 1400, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 1410, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 1411, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 1432, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 1475, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 1565, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 1805, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 2926, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 2935, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 2936, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 2970, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 3069, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 3122, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 3132, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 3772, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5272, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5415, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5416, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5438, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5440, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5441, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5444, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5461, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5478, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5480, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5484, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5485, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5486, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5490, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5491, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5492, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5493, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5494, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5495, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5496, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5497, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5498, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5499, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5502, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5505, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5507, result: no such process Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5508, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5510, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5511, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5512, result: no such process Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5513, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5514, result: no such process Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5515, result: no such process Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5516, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5517, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5518, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5519, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5521, result: successful Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436) SIGKILL sent: pid: 5522, result: successful Jump to behavior
Source: classification engine Classification label: mal60.spre.troj.evad.linELF@0/0@0/0

Persistence and Installation Behavior
barindex
Sample reads /proc/mounts (often used for finding a writable filesystem)
Source: /bin/fusermount (PID: 5479) File: /proc/5479/mounts Jump to behavior
Executes commands using a shell command-line interpreter
Source: /usr/bin/gpu-manager (PID: 5506) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5514) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Executes the "grep" command used to find patterns in files or piped streams
Source: /bin/sh (PID: 5507) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 5515) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Executes the "kill" or "pkill" command typically used to terminate processes
Source: /usr/share/gdm/generate-config (PID: 5509) Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5512) Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5517) Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5520) Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5523) Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Sample deletes itself
Source: /tmp/XHYKEGTtfq.elf (PID: 5432) File: /tmp/XHYKEGTtfq.elf Jump to behavior
ELF contains segments with high entropy indicating compressed/encrypted content
Source: XHYKEGTtfq.elf Submission file: segment LOAD with 7.8829 entropy (max. 8.0)
Source: XHYKEGTtfq.elf Submission file: segment LOAD with 7.972 entropy (max. 8.0)
Deletes log files
Source: /usr/bin/gpu-manager (PID: 5505) Truncated file: /var/log/gpu-manager.log Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5510) Truncated file: /var/log/gpu-manager.log Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5513) Truncated file: /var/log/gpu-manager.log Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5521) Truncated file: /var/log/gpu-manager.log Jump to behavior
Reads CPU information from /sys indicative of miner or evasive malware
Source: /usr/bin/pkill (PID: 5509) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pkill (PID: 5517) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/XHYKEGTtfq.elf (PID: 5432) Queries kernel information via 'uname': Jump to behavior
Source: XHYKEGTtfq.elf, 5441.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp Binary or memory string: /ppc/tmp/vmware-root_727-4290690966
Source: XHYKEGTtfq.elf, 5432.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: XHYKEGTtfq.elf, 5441.1.00007f7dac035000.00007f7dac038000.rw-.sdmp Binary or memory string: 1/tmp/vmware-root_727-4290690966
Source: XHYKEGTtfq.elf, 5438.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp, XHYKEGTtfq.elf, 5440.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp, XHYKEGTtfq.elf, 5441.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: XHYKEGTtfq.elf, 5432.1.00007ffe423d8000.00007ffe423f9000.rw-.sdmp, XHYKEGTtfq.elf, 5438.1.00007ffe423d8000.00007ffe423f9000.rw-.sdmp, XHYKEGTtfq.elf, 5440.1.00007ffe423d8000.00007ffe423f9000.rw-.sdmp, XHYKEGTtfq.elf, 5441.1.00007ffe423d8000.00007ffe423f9000.rw-.sdmp Binary or memory string: =x86_64/usr/bin/qemu-ppc/tmp/XHYKEGTtfq.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/XHYKEGTtfq.elf
Source: XHYKEGTtfq.elf, 5441.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp Binary or memory string: U1/tmp/vmware-root_727-4290690966
Source: XHYKEGTtfq.elf, 5432.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp, XHYKEGTtfq.elf, 5438.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp, XHYKEGTtfq.elf, 5440.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp, XHYKEGTtfq.elf, 5441.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: XHYKEGTtfq.elf, 5441.1.00007f7dac02a000.00007f7dac035000.rw-.sdmp Binary or memory string: vmware-root_727-4290690966
Source: XHYKEGTtfq.elf, 5441.1.00007f7dac035000.00007f7dac038000.rw-.sdmp Binary or memory string: 0a/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-colord.service-PB7Ovfa1/tmp/vmware-root_727-4290690966
Source: XHYKEGTtfq.elf, 5432.1.00007ffe423d8000.00007ffe423f9000.rw-.sdmp, XHYKEGTtfq.elf, 5438.1.00007ffe423d8000.00007ffe423f9000.rw-.sdmp, XHYKEGTtfq.elf, 5440.1.00007ffe423d8000.00007ffe423f9000.rw-.sdmp, XHYKEGTtfq.elf, 5441.1.00007ffe423d8000.00007ffe423f9000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc
Source: XHYKEGTtfq.elf, 5441.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp Binary or memory string: /tmp/vmware-root_727-4290690966
Source: XHYKEGTtfq.elf, 5441.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-upower.service-VKEayg
Source: XHYKEGTtfq.elf, 5441.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp Binary or memory string: U/ppc/tmp/vmware-root_727-42906909665425093f40a37100b81c1/tmp/snap-private-tmp/snap.lxd/tmp

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
212.70.149.14
 unknown Bulgaria
208410 INTERNET-HOSTINGBG false