Linux Analysis Report
EG4I1Przgq

Overview

General Information

Sample Name: EG4I1Przgq
Analysis ID: 626619
MD5: 97e27b840c2c54655ed1894da03f8f5b
SHA1: 70a19ece13bdec070090c0892b46a96392a51fe5
SHA256: a2fd969df550f26d35b46a40c7c3bb2a513c01c42ba3d96d0de736d01cdc54ec
Tags: 32elfmiraimotorola
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Uses the "uname" system call to query kernel version information (possible evasion)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample has stripped symbol table

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: EG4I1Przgq Virustotal: Detection: 44% Perma Link
Source: EG4I1Przgq ReversingLabs: Detection: 41%
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:44600 -> 103.136.40.176:8985
Sample listens on a socket
Source: /tmp/EG4I1Przgq (PID: 6225) Socket: 127.0.0.1::9473 Jump to behavior
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 103.136.40.176
Source: unknown TCP traffic detected without corresponding DNS query: 103.136.40.176
Source: unknown TCP traffic detected without corresponding DNS query: 103.136.40.176
Source: unknown TCP traffic detected without corresponding DNS query: 103.136.40.176
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 103.136.40.176
Source: unknown TCP traffic detected without corresponding DNS query: 103.136.40.176
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 103.136.40.176
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 103.136.40.176
Source: unknown TCP traffic detected without corresponding DNS query: 103.136.40.176
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 103.136.40.176
Source: unknown TCP traffic detected without corresponding DNS query: 103.136.40.176
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 103.136.40.176
Source: unknown TCP traffic detected without corresponding DNS query: 103.136.40.176
Source: unknown TCP traffic detected without corresponding DNS query: 103.136.40.176
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal48.lin@0/0@0/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/EG4I1Przgq (PID: 6225) Queries kernel information via 'uname': Jump to behavior
Source: EG4I1Przgq, 6225.1.00000000224adb7b.00000000a892d5d3.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/EG4I1PrzgqSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/EG4I1Przgq
Source: EG4I1Przgq, 6225.1.00000000437dcf39.00000000639f456b.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: EG4I1Przgq, 6225.1.00000000224adb7b.00000000a892d5d3.rw-.sdmp Binary or memory string: /usr/bin/qemu-m68k
Source: EG4I1Przgq, 6225.1.00000000437dcf39.00000000639f456b.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/m68k

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
103.136.40.176
 unknown India
139884 AGPL-AS-APApeironGlobalPvtLtdIN false
109.202.202.202
 unknown Switzerland
13030 INIT7CH false
91.189.91.43
 unknown United Kingdom
41231 CANONICAL-ASGB false
91.189.91.42
 unknown United Kingdom
41231 CANONICAL-ASGB false