Linux Analysis Report beamer.x86-20211202-2350

ID:	533079
Product:	CloudBasic
Start time:	01:01:18
Start date:	03.12.2021
Sample:	beamer.x86-20211202-2350
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	04e178a6fe92b38222e03a4c2e2303e0
SHA1:	ba0e9885d263093c13e955cb79cf6e86039d4177
SHA256:	1000ab055531e011407b62ff66cc2b122334eb14dc01f56f9487023beeb38f59
Filetype:	ELF Executable and Linkable format (Linux) (4029/14) 50.16%

Name	Type	MD5	SHA1	SHA256

AV Detection:

Multi AV Scanner detection for submitted file

Source: beamer.x86-20211202-2350	Virustotal: Detection: 23%			Perma Link
Source: beamer.x86-20211202-2350	ReversingLabs: Detection: 31%

Machine Learning detection for sample

Source: beamer.x86-20211202-2350

Joe Sandbox ML: detected

Networking:

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:39246 -> 34.249.145.219:443

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.23:52018 -> 45.134.225.20:544

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 39246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 45.134.225.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.134.225.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.134.225.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.134.225.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.134.225.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 45.134.225.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.134.225.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.134.225.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.134.225.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.134.225.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 45.134.225.20
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 45.134.225.20
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 45.134.225.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 45.134.225.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 45.134.225.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.134.225.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.134.225.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.134.225.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.134.225.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.134.225.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.134.225.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.134.225.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.134.225.20

System Summary:

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /proc/%s/maps/tmp/root/mnt/var/run/home/init/usr/bin/usr/sbin/var/wlancont/var/tmp/stainfologinbusyboxdnsrelaybashtelnetdsshdropbearwebhikvisionlibcgi-binconfigdvrappsofia127.0.0.1unknown45.134.225.20lost connection

Classification label

Source: classification engine

Classification label: mal52.linX86-20211202-2350@0/0@0/0

Persistence and Installation Behavior:

Executes the "rm" command used to delete files or directories

Source: /usr/bin/dash (PID: 5253)

Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.AlKkHgaC4m /tmp/tmp.GpcnZvv7fC /tmp/tmp.zmqkJtmHaS

Jump to behavior