Suspicious 91% Download

xnxnxnxnxnxnxnxnaarch64xnxn.elf

UPX packed, stripped, high entropy

Binary contains a UPX packing markerCanonical trailing UPX PackHeader magic
SHA-2569a04188b6ad2333a3b42afa12df8f2c24ba0f3b9d4f611c2b5fb935b4575fe03

Evidence

References own executable procfs path 0xf905–0xf9c5
⋯3 more rows
0xf93567fa6ffc77c1a8e007ffffdb438f2000g.o.w.......C. .
0xf9453d2f70726f632f73656c662f65786500=/proc/self/exe.
0xf9552f7df7ffed6465760d686d00631c0012/}...dev.hm.c...
⋯7 more rows
ELF embeds a cleartext http:// URL 0x1078f–0x1089f
⋯3 more rows
0x107bf010b13000010ecc20f48000000ff0a00.........H......
0x107cf24496e666f3a20546869732066696c65$Info: This file
0x107df206973207061636b6564207769746820 is packed with
0x107ef74686520555058206578656375746162the UPX executab
0x107ff6c65207061636b657220687474703a2fle packer http:/
0x1080f2f7570782e73662e6e657420240a0024/upx.sf.net $..$
0x1081f49643a2055505820352e303220436f70Id: UPX 5.02 Cop
0x1082f7972696768742028432920313939362dyright (C) 1996-
⋯7 more rows
Canonical trailing UPX PackHeader magic 0x1091c–0x1097c
⋯3 more rows
0x1094c47120000000055505821000000000000G.....UPX!......
0x1095c555058210e2a0e0a3a40b1369cd56f92UPX!.*..:@.6..o.
0x1096c900302005c0901009003020052000023....\.......R..#
0x1097cf4000000 ....

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.