Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

C1Dd84tB3n.elf

ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped

initial sample

Details

Filetype:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy:	6.257903473191838
Filename:	C1Dd84tB3n.elf
Filesize:	51264
MD5:	614535d91c815dc05beef2f10224e069
SHA1:	de5eb9772e7bf8087fecebb2c74ee998408be61e
SHA256:	8495237ddf43196df79fcfb9a5d8a7a5fd5a14e2d9012b5d7bee000dad10da75
SHA512:	89ad7001d59fb28a1b46279ef489a6d302f0f18e11b3b5575b65790d045f48bbf3bb6602894f176e94e41ad2dc32bee1b088687f0e6b503edcbfcba6f9d56463
SSDEEP:	768:nHHqmdDSodln8muwq4roeuZ7YvK3VfoRYjGbWnaWUohyye43egkE6I2jvk:HKmdDSodl8mqnZsvIfurWnaEyyOr
Preview:	.ELF..............>.......@.....@...................@.8...@.......................@.......@...............................................P.......P..............1..............Q.td....................................................H...._........H........

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Sample tries to kill multiple processes (SIGKILL)	System Summary	Service Stop
Sample listens on a socket	Networking
Sample tries to kill a process (SIGKILL)	System Summary
Uses the "uname" system call to query kernel version information (possible evasion)	Malware Analysis System Evasion	Security Software Discovery
Yara signature match	System Summary

/run/user/127/dconf/user

very short file (no magic)

dropped

Details

File:	/run/user/127/dconf/user
Category:	dropped
Dump:	user.81.dr
ID:	dr_8
Target ID:	81
Process:	/usr/libexec/gsd-power
Type:	very short file (no magic)
Entropy:	0.0
Encrypted:	false
Ssdeep:	3::
Size:	1
Whitelisted:	false
Reputation:	high

/tmp/server-0.xkm

Compiled XKB Keymap: lsb, version 15

dropped

Details

File:	/tmp/server-0.xkm
Category:	dropped
Dump:	server-0.xkm.95.dr
ID:	dr_10
Target ID:	95
Process:	/usr/bin/xkbcomp
Type:	Compiled XKB Keymap: lsb, version 15
Entropy:	4.8492493153178975
Encrypted:	false
Ssdeep:	192:tDyb2zOmnECQmwTVFfLaSLus4UVcqLkjoqdD//HJeCQ1+JdDx0s2T:tDyAxvYhFf+S6tUzmp7/1MJ
Size:	12060
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Executes commands using a shell command-line interpreter	Persistence and Installation Behavior	Scripting

/var/lib/AccountsService/users/gdm.T77PM2

ASCII text

dropped

Details

File:	/var/lib/AccountsService/users/gdm.T77PM2
Category:	dropped
Dump:	gdm.T77PM2.99.dr
ID:	dr_11
Target ID:	99
Process:	/usr/lib/accountsservice/accounts-daemon
Type:	ASCII text
Entropy:	4.647628037922664
Encrypted:	false
Ssdeep:	3:urCLnT+PzKLrAan4R8AKn:gI+zKLrAa4M
Size:	51
Whitelisted:	false
Reputation:	moderate

Processes

Path

Cmdline

Malicious

/tmp/C1Dd84tB3n.elf

/usr/lib/udisks2/udisksd

/usr/sbin/dumpe2fs

dumpe2fs -h /dev/dm-0

/usr/libexec/gnome-session-binary

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

/usr/libexec/gsd-wacom

/usr/lib/udisks2/udisksd

/usr/sbin/dumpe2fs

dumpe2fs -h /dev/dm-0

/usr/lib/systemd/systemd

/usr/lib/upower/upowerd

/usr/bin/xfce4-panel

/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0

/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

/usr/libexec/gnome-session-binary

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

/usr/libexec/gsd-keyboard

/usr/bin/xfce4-panel

/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0

/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

/usr/bin/xfce4-panel

/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0

/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

/usr/libexec/gnome-session-binary

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard

/usr/libexec/gsd-smartcard

/usr/bin/xfce4-panel

/usr/lib/udisks2/udisksd

/usr/sbin/dumpe2fs

dumpe2fs -h /dev/dm-0

/usr/libexec/gnome-session-binary

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

/usr/libexec/gsd-sharing

/usr/libexec/gnome-session-binary

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

/usr/libexec/gsd-rfkill

/usr/lib/gdm3/gdm-session-worker

/etc/gdm3/PostSession/Default

/usr/libexec/gnome-session-binary

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

/usr/libexec/gsd-media-keys

/usr/sbin/gdm3

/etc/gdm3/PrimeOff/Default

/usr/libexec/gnome-session-binary

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

/usr/libexec/gsd-print-notifications

/usr/libexec/gsd-printer

/usr/libexec/gnome-session-binary

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color

/usr/libexec/gsd-color

/usr/libexec/gnome-session-binary

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy

/usr/libexec/gsd-screensaver-proxy

/usr/lib/udisks2/udisksd

/usr/sbin/dumpe2fs

dumpe2fs -h /dev/dm-0

/usr/libexec/gnome-session-binary

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings

/usr/libexec/gsd-a11y-settings

/usr/libexec/gnome-session-binary

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

/usr/libexec/gsd-housekeeping

/usr/libexec/gnome-session-binary

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound

/usr/libexec/gsd-sound

/usr/libexec/gnome-session-binary

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

/usr/libexec/gsd-power

/usr/lib/xorg/Xorg

/bin/sh

sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

/bin/sh

/usr/bin/xkbcomp

/usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

/usr/lib/systemd/systemd

/lib/systemd/systemd-hostnamed

/usr/lib/systemd/systemd

/lib/systemd/systemd-user-runtime-dir

/lib/systemd/systemd-user-runtime-dir stop 1000

/usr/bin/dbus-daemon

/bin/false

/usr/lib/xorg/Xorg

/bin/sh

/usr/bin/xkbcomp

/usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

/usr/lib/systemd/systemd

/usr/libexec/colord

/usr/libexec/colord-sane

/usr/lib/systemd/systemd

/usr/lib/accountsservice/accounts-daemon

/usr/share/language-tools/language-validate

/usr/share/language-tools/language-validate en_US.UTF-8

/usr/share/language-tools/language-validate

/usr/share/language-tools/language-options

/bin/sh

sh -c "locale -a | grep -F .utf8 "

/bin/sh

/usr/bin/locale

locale -a

/bin/sh

/usr/bin/grep

grep -F .utf8

/usr/lib/systemd/systemd

/lib/systemd/systemd-localed

/usr/sbin/gdm3

/etc/gdm3/PrimeOff/Default

/usr/sbin/gdm3

/etc/gdm3/PrimeOff/Default

/usr/lib/systemd/systemd

/lib/systemd/systemd-user-runtime-dir

/lib/systemd/systemd-user-runtime-dir stop 127

There are 94 hidden processes, click here to show them.

Domains

Name

Malicious

fdh32fsdfhs.shop

185.196.9.5

Details

Name:	fdh32fsdfhs.shop
IP:	185.196.9.5
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Connects to many ports of the same IP (likely port scanning)	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

daisy.ubuntu.com

162.213.35.25

IPs

Domain

Country

Malicious

185.196.9.5

fdh32fsdfhs.shop

Switzerland

Details

IP:	185.196.9.5
TargetID:	-1
Country:	Switzerland
Countrycode:	CHE
ASN number:	42624
ASN name:	SIMPLECARRIERCH
Private:	false
Domain:	fdh32fsdfhs.shop

Signature Hits	Behavior Group	Mitre Attack
Connects to many ports of the same IP (likely port scanning)	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port

185.125.190.26

unknown

United Kingdom

Details

IP:	185.125.190.26
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)	Networking
Connects to IPs without corresponding DNS lookups	Networking

Memdumps

Base Address

Regiontype

Protect

Malicious

7ffff83d3000

page read and write

7ffff83d3000

page read and write

7ffff83ec000

page execute read

50d000

page read and write

50d000

page read and write

7ffff83d3000

page read and write

fbb000

page read and write

40d000

page execute read

7ffff83ec000

page execute read

7ffff83ec000

page execute read

40d000

page execute read

fbb000

page read and write

fbb000

page read and write

50d000

page read and write

510000

page read and write

40d000

page execute read

510000

page read and write

510000

page read and write

There are 8 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
C1Dd84tB3n.elf

Files

Processes

Domains

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportC1Dd84tB3n.elf

Files

Processes

Domains

IPs

Memdumps

IOC Report
C1Dd84tB3n.elf