Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

7EUcDDmmRE

ELF 32-bit LSB executable, ARM, EABI4 version 1 (GNU/Linux), statically linked, stripped

initial sample

Details

Filetype:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (GNU/Linux), statically linked, stripped
Entropy:	7.94626883299982
Filename:	7EUcDDmmRE
Filesize:	29464
MD5:	ec4637f5d716f29fd464b15e1c499a5a
SHA1:	b02af8052352d60b686b3224192f132be747e331
SHA256:	737429af897437fc5315d8861d92502477a801bcd59526f10f30d78b96d88b0a
SHA512:	378d232e9e4c5834bfb4ce7f9117d83a90f4fcc7abe3d98c58eed05622e54c78e4d71a4e68502e735f1301c1b4b31b9afa8be45004eb877ab4f5fd59bf69be27
SSDEEP:	768:vusHfRavjynNKnjFcZIhQzhKMXgj9q3UEL7v:HRwynNIOQQ1KMwiL7
Preview:	.ELF..............(.........4...........4. ...(......................q...q...............'...'...'..................Q.td...............................OUPX!....................S..........?.E.h;....#..$..1)....tX....K.....E...%.FF..7.\|.l]Z... ._......+.. .

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Uses the "uname" system call to query kernel version information (possible evasion)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

/var/crash/_usr_share_apport_apport-checkreports.1000.crash

ASCII text

dropped

Details

File:	/var/crash/_usr_share_apport_apport-checkreports.1000.crash
Category:	dropped
Dump:	_usr_share_apport_apport-checkreports.1000.crash.14.dr
ID:	dr_0
Target ID:	14
Process:	/usr/share/apport/apport-checkreports
Type:	ASCII text
Entropy:	4.687533212555657
Encrypted:	false
Ssdeep:	96:G8ck5w+6bplfn4RPfnw4AsKaRdfbvD+HPeKS+muJLOuPWEc+PI9d4YXrM:G/ARPfnw4AsDR8PeD+m2PWEc+PILhbM
Size:	14915
Whitelisted:	false
Reputation:	low

/var/crash/_usr_share_apport_apport-gtk.1000.crash

ASCII text

dropped

Details

File:	/var/crash/_usr_share_apport_apport-gtk.1000.crash
Category:	dropped
Dump:	_usr_share_apport_apport-gtk.1000.crash.20.dr
ID:	dr_1
Target ID:	20
Process:	/usr/share/apport/apport-gtk
Type:	ASCII text
Entropy:	4.4957982542122705
Encrypted:	false
Ssdeep:	768:Ki2/4/l/a/J/YYp1a72U7wn4IwxP4MBJ+Cge://l/a/J/bU7FIwxP4MBJ+Cge
Size:	47094
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

/tmp/7EUcDDmmRE

/usr/bin/qemu-arm /tmp/7EUcDDmmRE

/sbin/upstart

n/a

/bin/sh

/bin/sh -e /proc/self/fd/9

/bin/sh

n/a

/bin/date

date

/bin/sh

n/a

/usr/share/apport/apport-checkreports

/usr/bin/python3 /usr/share/apport/apport-checkreports --system

/sbin/upstart

n/a

/bin/sh

/bin/sh -e /proc/self/fd/9

/bin/sh

n/a

/bin/date

date

/bin/sh

n/a

/usr/share/apport/apport-gtk

/usr/bin/python3 /usr/share/apport/apport-gtk

/sbin/upstart

n/a

/bin/sh

/bin/sh -e /proc/self/fd/9

/bin/sh

n/a

/bin/date

date

/bin/sh

n/a

/usr/share/apport/apport-gtk

/usr/bin/python3 /usr/share/apport/apport-gtk

There are 9 hidden processes, click here to show them.

URLs

Name

Malicious

http://upx.sf.net

unknown

Details

Name:	http://upx.sf.net
TargetID:	8
From Memory:	true
Current Path:	/tmp/7EUcDDmmRE
Source:	7EUcDDmmRE
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Sample is packed with UPX	Data Obfuscation	Obfuscated Files or Information
URLs found in memory or binary data	Networking

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOCReport

Files

Processes

URLs