Suspicious 86% Download

stub.aarch64_be.elf

Statically linked, direct syscalls, hidden paths

Hidden stage inputs deleted before executionHidden temp stage is made executable
SHA-256833f088369d80122e234f8fcf3bdd42764055e3ea5df9e376a28fd9863066cc4
URLhttps://tria.ge/api/v0/samples/260929-vdhfaazy5q/sample
MaleculeO₃(C₂ErDy)H₅(Cm₂DsF₅OsPo₃)Md₂(Bi₂He)

Evidence

Linux ARM64 direct SVC syscall instruction 0x2c4–0x384
⋯3 more rows
0x2f4020080d2030180d2e81080d2e40700f9................
0x304010000d4007d20d4e00f80528c6e0094.....} ....R.n..
0x3143f2303d5fd7bbfa9fd030091d8ffff97?#...{..........
⋯7 more rows
ELF contains an execve-family syscall 0x1bec8–0x1c088
⋯7 more rows
0x1bf381f2003d51f2003d55f2403d5a81b80d2. ... .._$......
0x1bf48010000d41ffc3fb142000054c0035fd6......?.B..T.._.
0x1bf58a22400141f2003d51f2003d51f2003d5.$... ... ... ..
⋯19 more rows
Three compact hidden temp stage paths 0x6abf0–0x6ade0
⋯7 more rows
0x6ac6001000200000000007262000000000000........rb......
0x6ac702f746d702f2e736b0000000000000000/tmp/.sk........
0x6ac8025327800000000002f746d702f2e7365%2x...../tmp/.se
0x6ac9000000000000000007762000000000000........wb......
0x6aca02f746d702f2e7a00556e657870656374/tmp/.z.Unexpect
0x6acb065642072656c6f63207479706520696eed reloc type in
0x6acc0207374617469632062696e6172792e0a static binary..
0x6acd000000000000000006661696c65642074........failed t
⋯17 more rows
Static executable contains unlink symbol 0xb91e3–0xb93b3
⋯7 more rows
0xb9253005f5f67657474657874706172736500.__gettextparse.
0xb92635f5f756e6c696e6b005f494f5f646566__unlink._IO_def
0xb927361756c745f78737075746e005f5f6d70ault_xsputn.__mp
0xb92836e5f6c7368696674005f5f544d435f45n_lshift.__TMC_E
0xb92934e445f5f005f6e6c5f6c6f61645f6c6fND__._nl_load_lo
0xb92a363616c65005f5f5f7072696e74665f66cale.___printf_f
0xb92b37000657865636c005f5f67657472616ep.execl.__getran
0xb92c3646f6d5f666f726b5f73756270726f63dom_fork_subproc
⋯15 more rows
Static executable contains chmod symbol 0xba1d5–0xba355
⋯7 more rows
0xba24565005f494f5f66696c655f7374617400e._IO_file_stat.
0xba2555f5f63686d6f64005f646c5f73746172__chmod._dl_star
0xba26574005f5f737472746f6c645f696e7465t.__strtold_inte
⋯15 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.