× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: d4f677f570047fc1bb57cc0dfca19155c3504c72c3ff34b9ab7986c9c216fb90
File name: crond64
Detection ratio: 13 / 55
Analysis date: 2016-01-12 02:56:21 UTC ( 1 year, 7 months ago ) View latest
Antivirus Result Update
Avast ELF:Snessik-A [Trj] 20160112
AVG Linux/BackDoor_c.EW 20160112
Comodo UnclassifiedMalware 20160112
DrWeb Linux.BackDoor.Snessik.1 20160112
ESET-NOD32 a variant of Linux/Agent.K 20160112
GData Linux.Trojan.Agent.3F676N 20160112
Ikarus Trojan.Linux.Agent 20160112
Jiangmin Backdoor/Linux.kw 20160112
Kaspersky HEUR:Backdoor.Linux.Snessik.a 20160112
Qihoo-360 Win32/Trojan.1ee 20160112
Sophos AV Mal/Generic-S 20160112
Symantec Linux.Spalooki 20160111
Tencent Linux.Backdoor.Snessik.Sxnw 20160112
Ad-Aware 20160112
AegisLab 20160111
Yandex 20160111
AhnLab-V3 20160111
Alibaba 20160111
ALYac 20160112
Antiy-AVL 20160111
Arcabit 20160112
Avira (no cloud) 20160112
AVware 20160111
Baidu-International 20160111
BitDefender 20160112
Bkav 20160111
ByteHero 20160112
CAT-QuickHeal 20160111
ClamAV 20160111
CMC 20160111
Cyren 20160112
Emsisoft 20160112
F-Prot 20160111
F-Secure 20160112
Fortinet 20160111
K7AntiVirus 20160111
K7GW 20160111
Malwarebytes 20160112
McAfee 20160112
McAfee-GW-Edition 20160112
Microsoft 20160112
eScan 20160112
NANO-Antivirus 20160112
nProtect 20160111
Panda 20160111
Rising 20160111
SUPERAntiSpyware 20160112
TheHacker 20160107
TrendMicro 20160112
TrendMicro-HouseCall 20160112
VBA32 20160111
VIPRE 20160112
ViRobot 20160112
Zillya 20160112
Zoner 20160111
The file being studied is an ELF! More specifically, it is a EXEC (Executable file) ELF for Unix systems running on Advanced Micro Devices X86-64 machines.
ELF Header
Class ELF64
Data 2's complement, little endian
Header version 1 (current)
OS ABI UNIX - System V
ABI version 0
Object file type EXEC (Executable file)
Required architecture Advanced Micro Devices X86-64
Object file version 0x1
Program headers 8
Section headers 31
ELF sections
ELF Segments
Segment without sections
.interp
.interp
.note.ABI-tag
.note.gnu.build-id
.gnu.hash
.dynsym
.dynstr
.gnu.version
.gnu.version_r
.rela.dyn
.rela.plt
.init
.plt
.text
.fini
.rodata
.eh_frame_hdr
.eh_frame
.gcc_except_table
.ctors
.dtors
.jcr
.dynamic
.got
.got.plt
.data
.bss
.dynamic
.note.ABI-tag
.note.gnu.build-id
.eh_frame_hdr
Segment without sections
Shared libraries
Imported symbols
Exported symbols
ExifTool file metadata
MIMEType
application/octet-stream

CPUByteOrder
Little endian

CPUArchitecture
64 bit

FileType
ELF executable

ObjectFileType
Executable file

CPUType
AMD x86-64

Compressed bundles
File identification
MD5 cb0477445fef9c5f1a5b6689bbfb941e
SHA1 b959383cebfc86a5c227851c3f29e0cd15e4e298
SHA256 d4f677f570047fc1bb57cc0dfca19155c3504c72c3ff34b9ab7986c9c216fb90
ssdeep
1536:NKzbqSZCnhG60X+S40GT11cjp5LuLrYc4EGew:NKzbqSw8X+XT11+p5Le+

File size 51.3 KB ( 52515 bytes )
File type ELF
Magic literal
ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.18, not stripped

TrID ELF Executable and Linkable format (Linux) (50.1%)
ELF Executable and Linkable format (generic) (49.8%)
Tags
64bits elf

VirusTotal metadata
First submission 2015-08-07 21:02:13 UTC ( 2 years ago )
Last submission 2016-02-03 23:05:05 UTC ( 1 year, 6 months ago )
File names crond64
e1a32738bcd318c69bb872ff9f12911a31d84f4d
crond
5rIvX.tar.bz2
LDfq_z2m0.xdp
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!