Sample:
OS ABI: UNIX - System V
CPU class: 32 bit
Persistence (user): No
Persistence (root): No
CPU byte order: 2's complement LSB
File type: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
CPU type: Intel 80386
Entropy: 5.92502070506
Syscalls executed (root): 33943
Syscalls executed (user): 65594
ELF type: Executable file
Class: 32 bit
Data encoding: 2's complement LSB
Operating system ABI: UNIX - System V
Object file type: Executable file
ELF version: 0.1
Machine: Intel 80386
Link: static
Entrypoint: 0x8048467
Number of segments: 4
Number of sections: 16
Program header table offset: 52
Section header table offset: 815716
Program header table - size of entry: 32
Section header table - size of entry: 40
Program header table - entries: 4
Section header table - entries: 16
Section header table - index sections names: 15
Stripped: True
Sections stripped: False
Debug information: False
MD5: 924a1228e3eea786ee7e344e24fcdfd5
SHA1: 21bb6b681527ae4ffe1c24c8db04af78bd904ded
SHA256: d3b035d70a79322302aa57ef0dfdf78ee99a8fdc151fe045d22da6efc2c79f8e
SHA512: ae7b929e667653f4f9f02939c62ae132a5ca644bb089bb0462a46b441d2f8f29416f8facb732b73e5c2eb838b1907a6c4a8ca2d72bed88e2ec87da1ff6b856ab
ssdeep: 24576:xbLz2p4Osc5xwK3jQcOSS4VC6ieSWIrLgY8S+6/93u:dmx5mK3jQcOP4Cfe+Zt
Entropy: 5.92502070506
Max entropy (16KB blocks): 7.21293492028
Unique bytes (0-255): 256
Null bytes: 216446
White spaces: 20273
Printable bytes: 196566
First 16B: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Last 16B: 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00
Byte: 0x0
Offset: 0xa7e92
Length: 121003
Mime type: application/x-executable
File type: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
URL: https://www.virustotal.com/#/file/d3b035d70a79322302aa57ef0dfdf78ee99a8fdc151fe045d22da6efc2c79f8e
Positive: 13
Total AVs: 58
Scan date: 2018-04-21 16:10:46
AVClass: miner
Symantec: Trojan.Gen.NPE
McAfee: RDN/Generic PUP.x
ClamAV: Multios.Trojan.CryptocoinMiner-6448864-1
Fortinet: Riskware/Miner
DrWeb: Tool.Linux.BtcMine.400
ESET-NOD32: a variant of Linux/CoinMiner.AE potentially unwanted
Qihoo-360: Win32/Virus.RiskTool.42d
TrendMicro-HouseCall: TROJ_GEN.R002H0CDK18
Avira: LINUX/BitCoinMiner.ecpqx
Sophos: Linux/Miner-GF
ZoneAlarm: not-a-virus:HEUR:RiskTool.AndroidOS.Miner.b
Kaspersky: not-a-virus:HEUR:RiskTool.AndroidOS.Miner.b
GData: Linux.Application.Agent.NER9OS
Number of functions: 1918
Total size functions [B]: 1985307
Average size a function [B]: 1035.09228363
Percentage of covered .text section: 309.665207748
Percentage of covered LOAD segment: 244.187093418
Standard output:
Standard error:
Standard output:
Standard error:
Unique number: 28
Total number: 65594
Unique number: 1
Total number: 1
Number of processes: 3
Trace lines lost: 0
Max sleep: -1.0
Total: 3
Unlink itself: True
Unique number: 12
Total number: 33943
Unique number: 1
Total number: 1
Number of processes: 3
Trace lines lost: 0
Max sleep: -1.0