Joe Sandbox Cloud Pro Analysis Report

Loading ...

Analysis Report

Overview

General Information

Joe Sandbox Version:22.0.0
Analysis ID:570649
Start time:15:04:55
Joe Sandbox Product:Cloud
Start date:31.05.2018
Overall analysis duration:0h 1m 49s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:SYbGPGPJHy
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:CentOS Linux 7.4 x64 (Kernel 3.10.0-693, Firefox 52.6.0, Document Viewer 3.22.1)
Detection:MAL
Classification:mal60.evad.troj.lin@0/0@0/0

Detection

StrategyScoreRangeReportingDetection
Threshold600 - 100Report FP / FNmalicious

Classification

Signature Overview

Click to jump to signature section


AV Detection:

barindex
Antivirus detection for submitted fileShow sources
Source: SYbGPGPJHyAvira: Label: LINUX/VPNFilter.pudcs

Networking:

barindex
Urls found in memory or binary dataShow sources
Source: SYbGPGPJHyString found in binary or memory: http://
Source: SYbGPGPJHyString found in binary or memory: https://
Source: SYbGPGPJHyString found in binary or memory: https://http://

Persistence and Installation Behavior:

barindex
Sample reads /proc/mounts (often used for finding a writable filesystem)Show sources
Source: /tmp/SYbGPGPJHy (PID: 5449)File: /proc/5449/mounts
Tries to open /proc/mtd (commonly found in embedded devices)Show sources
Source: /tmp/SYbGPGPJHy (PID: 5449)File: /proc/mtd

System Summary:

barindex
Sample has stripped symbol tableShow sources
Source: ELF static info symbol of initial sample.symtab present: no
Classification labelShow sources
Source: classification engineClassification label: mal60.evad.troj.lin@0/0@0/0

Hooking and other Techniques for Hiding and Protection:

barindex
Sample deletes itselfShow sources
Source: /tmp/SYbGPGPJHy (PID: 5449)File: /tmp/SYbGPGPJHy


Runtime Messages

Command:/tmp/SYbGPGPJHy
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Standard Error:

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 570649 Sample: SYbGPGPJHy Startdate: 31/05/2018 Architecture: LINUX Score: 60 12 23.23.114.123, 36366, 80 AMAZON-AES-AmazoncomIncUS United States 2->12 14 Antivirus detection for submitted file 2->14 7 SYbGPGPJHy 2->7         started        signatures3 process4 process5 9 SYbGPGPJHy 7->9         started        signatures6 16 Sample deletes itself 9->16 18 Tries to open /proc/mtd (commonly found in embedded devices) 9->18 20 Sample reads /proc/mounts (often used for finding a writable filesystem) 9->20

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Antivirus Detection

Initial Sample

SourceDetectionScannerLabelLink
SYbGPGPJHy100%AviraLINUX/VPNFilter.pudcs

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Startup

  • system is lnxcentos1
  • cleanup

Created / dropped Files

No created / dropped files found

Contacted Domains/Contacted IPs

Contacted Domains

No contacted domains info

Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public

IPCountryFlagASNASN NameMalicious
23.23.114.123United States
14618AMAZON-AES-AmazoncomIncUSfalse

Static File Info

General

File type:ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):6.550877035088508
TrID:
  • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
  • ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:SYbGPGPJHy
File size:296600
MD5:87049e223dd922dc1d8180c83e2fde77
SHA1:8a189f0c6a69efeaed1916860a0ff74e424563f6
SHA256:d6097e942dd0fdc1fb28ec1814780e6ecc169ec6d24f9954e71954eedbc4c70e
SHA512:0d6e0bbbd68af12c9c258d79d9d5286cac732d2f0bf77ce956bd8277b8656e30513df27e4df3369f0aa440402ecb7751a30cf9c830227abc4b7fda3dd9ce414c
File Content Preview:.ELF....................h...4...........4. ...(......................}...}..........................8...d...........Q.td............................U..S.......w....h........[]...$.............U......=@....t..1....$......$.......u........t...$...........@.

Static ELF Info

ELF header

Class:ELF32
Data:2's complement, little endian
Version:1 (current)
Machine:Intel 80386
Version Number:0x1
Type:EXEC (Executable file)
OS/ABI:UNIX - System V
ABI Version:0
Entry Point Address:0x8048168
Flags:0x0
ELF Header Size:52
Program Header Offset:52
Program Header Size:32
Number of Program Headers:3
Section Header Offset:296080
Section Header Size:40
Number of Section Headers:13
Header String Table Index:12

Sections

NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
NULL0x00x00x00x00x0000
.initPROGBITS0x80480940x940x1c0x00x6AX001
.textPROGBITS0x80480b00xb00x3eb240x00x6AX0016
.finiPROGBITS0x8086bd40x3ebd40x170x00x6AX001
.rodataPROGBITS0x8086c000x3ec000x91020x00x2A0032
.eh_framePROGBITS0x808fd040x47d040x40x00x2A004
.ctorsPROGBITS0x80900000x480000x80x00x3WA004
.dtorsPROGBITS0x80900080x480080x80x00x3WA004
.jcrPROGBITS0x80900100x480100x40x00x3WA004
.got.pltPROGBITS0x80900140x480140xc0x40x3WA004
.dataPROGBITS0x80900200x480200x4180x00x3WA0032
.bssNOBITS0x80904400x484380x187240x00x3WA0032
.shstrtabSTRTAB0x00x484380x560x00x0001

Program Segments

TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeFlagsFlags DescriptionAlignProg InterpreterSection Mappings
LOAD0x00x80480000x80480000x47d080x47d080x5R E0x1000.init .text .fini .rodata .eh_frame
LOAD0x480000x80900000x80900000x4380x18b640x6RW 0x1000.ctors .dtors .jcr .got.plt .data .bss
GNU_STACK0x00x00x00x00x00x6RW 0x4

Network Behavior

Network Port Distribution

TCP Packets

TimestampSource PortDest PortSource IPDest IP
May 31, 2018 15:08:39.873014927 CEST3636680192.168.1.10123.23.114.123
May 31, 2018 15:08:39.873183966 CEST803636623.23.114.123192.168.1.101
May 31, 2018 15:08:39.873306990 CEST3636680192.168.1.10123.23.114.123

System Behavior

Analysis Process: SYbGPGPJHy PID: 5447 Parent PID: 5409

General

Start time:15:08:21
Start date:31/05/2018
Path:/tmp/SYbGPGPJHy
Arguments:/tmp/SYbGPGPJHy
File size:0 bytes
MD5 hash:unknown

Chronological Activities

Analysis Process: SYbGPGPJHy PID: 5449 Parent PID: 5447

General

Start time:15:08:21
Start date:31/05/2018
Path:/tmp/SYbGPGPJHy
Arguments:n/a
File size:0 bytes
MD5 hash:unknown

Chronological Activities