Linux Analysis Report
KzUyRGzaDZ

ID:	635053
Product:	CloudBasic
Start time:	11:51:08
Start date:	27.05.2022
Sample:	KzUyRGzaDZ
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	9d8c6e23c4a6d55edf8849401f32ca4c
SHA1:	2995d242ea96d0e0ee2980369e8d687e92e78e0a
SHA256:	13cdc7b6231e4ddb3f3e062def4919fde078d9751b007a1f4e105ed4d0961fe6
Filetype:	ELF Executable and Linkable format (generic) (4004/1) 100.00%

Name	Type	MD5	SHA1	SHA256

Spreading

Source: /tmp/KzUyRGzaDZ (PID: 6230)

Opens: /proc/net/route

Jump to behavior

Networking

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: KzUyRGzaDZ

String found in binary or memory: http://upx.sf.net

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43

System Summary

Source: LOAD without section mappings

Program segment: 0x100000

Source: KzUyRGzaDZ, type: SAMPLE

Matched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, reference = Internal Research, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4

Source: classification engine

Classification label: mal56.spre.troj.evad.lin@0/0@0/0

Data Obfuscation

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Stealing of Sensitive Information

Source: Yara match	File source: 6230.1.00000000a0bbd638.00000000abc4abe9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6232.1.00000000a0bbd638.00000000abc4abe9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6231.1.00000000a0bbd638.00000000abc4abe9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6233.1.00000000a0bbd638.00000000abc4abe9.r-x.sdmp, type: MEMORY

Remote Access Functionality

Source: Yara match	File source: 6230.1.00000000a0bbd638.00000000abc4abe9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6232.1.00000000a0bbd638.00000000abc4abe9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6231.1.00000000a0bbd638.00000000abc4abe9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6233.1.00000000a0bbd638.00000000abc4abe9.r-x.sdmp, type: MEMORY