Linux Analysis Report
3ZTjdgUHOh

Overview

General Information

Sample Name:	3ZTjdgUHOh
Analysis ID:	632623
MD5:	7da508fe8049f5c3650d5194298dacec
SHA1:	4559bb8bb7a317914eb410e0d1f06b034a480e61
SHA256:	cbc502d8cc845a13bde620ad0d88da17c4dfa3e76ec69b57ac4d30dd8054c133
Tags:	32armelfgafgyt
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Contains symbols with names commonly found in malware

Connects to many ports of the same IP (likely port scanning)

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: 3ZTjdgUHOh	Virustotal: Detection: 26%			Perma Link
Source: 3ZTjdgUHOh	ReversingLabs: Detection: 29%

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 149.57.210.157 ports 57468,4,5,6,7,8

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.23:36864 -> 149.57.210.157:57468

Sample listens on a socket

Source: /tmp/3ZTjdgUHOh (PID: 6228)

Socket: 0.0.0.0::57461

Jump to behavior

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43

System Summary

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: attack_checksum

Source: classification engine

Classification label: mal56.troj.lin@0/0@0/0

Source: ELF static info symbol of initial sample	FILE: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ELF static info symbol of initial sample	FILE: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ELF static info symbol of initial sample	FILE: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ELF static info symbol of initial sample	FILE: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ELF static info symbol of initial sample	FILE: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ELF static info symbol of initial sample	FILE: libc/string/arm/memcpy.S
Source: ELF static info symbol of initial sample	FILE: libc/string/arm/memmove.S
Source: ELF static info symbol of initial sample	FILE: libc/string/arm/memset.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/arm/crt1.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/arm/crti.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/arm/crtn.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/arm/sigrestorer.S

Enumerates processes within the "proc" file system

Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2078/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1582/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2033/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2077/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2275/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2195/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1656/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1579/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1699/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1654/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1698/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2226/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/796/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2302/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/3236/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2025/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2146/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/799/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2307/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2080/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1594/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2242/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2285/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2084/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2083/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2281/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1668/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1349/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1623/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1622/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1389/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1664/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2038/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1465/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1586/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2114/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2235/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1463/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1661/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2079/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2156/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1629/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1627/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2637/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2294/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2009/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2129/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1633/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2128/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1632/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1599/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1477/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2289/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1639/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1638/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2208/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2180/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1809/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1890/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1888/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/2018/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1489/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1642/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/789/fd	Jump to behavior
Source: /tmp/3ZTjdgUHOh (PID: 6233)	File opened: /proc/1648/fd	Jump to behavior

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/3ZTjdgUHOh (PID: 6228)

Queries kernel information via 'uname':

Jump to behavior

Source: 3ZTjdgUHOh, 6228.1.00000000f00ee6a3.00000000b2c08bb8.rw-.sdmp	Binary or memory string: #_tLVP%_tLVP"_tLV!/etc/qemu-binfmt/arm
Source: 3ZTjdgUHOh, 6228.1.0000000058c8aedc.000000006a41c927.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/3ZTjdgUHOhSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/3ZTjdgUHOh
Source: 3ZTjdgUHOh, 6228.1.00000000f00ee6a3.00000000b2c08bb8.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: 3ZTjdgUHOh, 6228.1.0000000058c8aedc.000000006a41c927.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Screenshots

No Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.57.210.157	unknown	United States	174	COGENT-174US	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

ID:	632623
Product:	CloudBasic
Start time:	20:43:56
Start date:	23.05.2022
Sample:	3ZTjdgUHOh
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	7da508fe8049f5c3650d5194298dacec
SHA1:	4559bb8bb7a317914eb410e0d1f06b034a480e61
SHA256:	cbc502d8cc845a13bde620ad0d88da17c4dfa3e76ec69b57ac4d30dd8054c133
Filetype:	ELF Executable and Linkable format (generic) (4004/1) 100.00%

Linux Analysis Report
3ZTjdgUHOh

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Linux Analysis Report 3ZTjdgUHOh

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Linux Analysis Report
3ZTjdgUHOh