Play interactive tour
Edit tourLinux Analysis Report wQN5w2558L
Overview
General Information
| Sample Name: | wQN5w2558L |
| Analysis ID: | 1504951 |
| MD5: | 395249d3e6dae1caff6b5b2e1f75bacd |
| SHA1: | 29f16c046a344e0d0adfea80d5d7958d6b6b8cfa |
| SHA256: | ea1872b2835128e3cb49a0bc27e4727ca33c4e6eba1e80422db19b505f965bc4 |
| Infos: | |
Most interesting Screenshot:  | |
Detection
REvil
| Score: | 76 |
| Range: | 0 - 100 |
| Whitelisted: | false |
Signatures
Found malware configuration
Yara detected REvil Linux Ransomware
Creates a notice file (html or txt) to demand a ransom
Found Tor onion address
Modifies the '.bashrc' or '.bash_profile' file typically for persisting actions
Sample reads from .bash_history
Tries to kill VMware ESXi VMs
Creates hidden files and/or directories
Enumerates processes within the "proc" file system
Executes the "hostname" command used to retrieve the computers name
Executes the "kill" or "pkill" command typically used to terminate processes
Reads CPU information from /sys indicative of miner or evasive malware
Sample has stripped symbol table
Sample tries to set the executable flag
Tries to execute "esxcli" command used for VMware ESXi administration
Uses the "uname" system call to query kernel version information (possible evasion)
Writes JavaScript files to disk
Classification
General Information |
|---|
| Joe Sandbox Version: | |
| Analysis ID: | 1504951 |
| Start date: | 01.07.2021 |
| Start time: | 20:56:04 |
| Joe Sandbox Product: | Cloud |
| Overall analysis duration: | 0h 12m 1s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Sample file name: | wQN5w2558L |
| Cookbook file name: | defaultlinuxinteractivecookbook.jbs |
| Analysis system description: | Ubuntu Linux 16.04 x64 (Kernel 4.4.0-116, Firefox 59.0, Document Viewer 3.18.2, LibreOffice 5.1.6.2, OpenJDK 1.8.0_171) |
| Analysis Mode: | default |
| Detection: | MAL |
| Classification: | mal76.rans.spre.evad.lin@0/507@0/0 |
| Warnings: | Show All
|
Process Tree |
|---|
|
Yara Overview |
|---|
Initial Sample |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_REvilLinux | Yara detected REvil Linux Ransomware | Joe Security |
Memory Dumps |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_REvilLinux | Yara detected REvil Linux Ransomware | Joe Security |
Jbx Signature Overview |
|---|
Click to jump to signature section
Show All Signature Results
AV Detection: |   |
|---|
| Found malware configuration | Show sources | ||
| Source: | Malware Configuration Extractor: | ||