Linux Analysis Report
botnt.arm5.elf

Overview

General Information

Sample name: botnt.arm5.elf
Analysis ID: 1502201
MD5: d7daf7738a75e997ebb9c2aca4a4bdfe
SHA1: 1d84958698faa73834f3d83c287b312097c0cffc
SHA256: 5c3cee247a19e0eca63e825fa03d77e8c7b326a1f112e037dd893c640cb637a6
Tags: botntelf
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Sample listens on a socket
Sleeps for long times indicative of sandbox evasion
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: botnt.arm5.elf ReversingLabs: Detection: 13%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.15:43766 -> 92.38.135.247:4444
Sample listens on a socket
Source: /tmp/botnt.arm5.elf (PID: 5592) Socket: 127.0.0.1:2174 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 23.224.130.196
Source: unknown TCP traffic detected without corresponding DNS query: 23.224.130.196
Source: unknown TCP traffic detected without corresponding DNS query: 23.224.130.196
Source: unknown TCP traffic detected without corresponding DNS query: 23.224.130.196
Source: unknown TCP traffic detected without corresponding DNS query: 23.224.130.196
Source: unknown TCP traffic detected without corresponding DNS query: 23.224.130.196
Source: unknown TCP traffic detected without corresponding DNS query: 23.225.63.251
Source: unknown TCP traffic detected without corresponding DNS query: 23.225.63.251
Source: unknown TCP traffic detected without corresponding DNS query: 23.224.130.196
Source: unknown TCP traffic detected without corresponding DNS query: 23.225.63.251
Source: unknown TCP traffic detected without corresponding DNS query: 154.214.7.222
Source: unknown TCP traffic detected without corresponding DNS query: 154.214.7.222
Source: unknown TCP traffic detected without corresponding DNS query: 0.159.99.4
Source: unknown TCP traffic detected without corresponding DNS query: 0.159.99.4
Source: unknown TCP traffic detected without corresponding DNS query: 0.159.99.4
Source: unknown TCP traffic detected without corresponding DNS query: 0.159.99.4
Source: unknown TCP traffic detected without corresponding DNS query: 154.214.7.220
Source: unknown TCP traffic detected without corresponding DNS query: 154.214.7.220
Source: unknown TCP traffic detected without corresponding DNS query: 0.159.99.4
Source: unknown TCP traffic detected without corresponding DNS query: 154.214.7.220
Source: unknown TCP traffic detected without corresponding DNS query: 172.247.148.76
Source: global traffic DNS traffic detected: DNS query: k.parasjha.one
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal48.linELF@0/0@1/0
Source: submitted sample Stderr: Segmentation fault: exit code = 0
Sleeps for long times indicative of sandbox evasion
Source: /tmp/botnt.arm5.elf (PID: 5663) Sleeps longer then 60s: 60.0s Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/botnt.arm5.elf (PID: 5590) Queries kernel information via 'uname': Jump to behavior
Source: botnt.arm5.elf, 5590.1.000055fd7c57e000.000055fd7c6cc000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: botnt.arm5.elf, 5590.1.000055fd7c57e000.000055fd7c6cc000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: botnt.arm5.elf, 5590.1.00007ffd42e6d000.00007ffd42e8e000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: botnt.arm5.elf, 5590.1.00007ffd42e6d000.00007ffd42e8e000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/botnt.arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/botnt.arm5.elf

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
0.159.99.4
 unknown unknown
unknown unknown false
23.225.63.251
 unknown United States
40065 CNSERVERSUS false
172.247.148.76
 unknown United States
40065 CNSERVERSUS false
92.38.135.247
 unknown Austria
199524 GCOREAT false
154.214.7.220
 unknown Seychelles
40065 CNSERVERSUS false
154.214.7.222
 unknown Seychelles
40065 CNSERVERSUS false
23.224.130.196
 unknown United States
40065 CNSERVERSUS false

Contacted Domains

Name IP Active
k.parasjha.one 92.223.30.118 true