Linux Analysis Report
fbot.sh4.elf

Overview

General Information

Sample name: fbot.sh4.elf
Analysis ID: 1562717
MD5: 10fd378265498116d559a8ccb6479fab
SHA1: 9acb70e4b6bb07c50741795f1093108232ef3cde
SHA256: 2789833c1b0532560dff24b04a14c7e3b2e4675bd8df1b53d5b1245c42b3b5b4
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai, Moobot
Score: 80
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Moobot
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
Name Description Attribution Blogpost URLs Link
MooBot No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: fbot.sh4.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: fbot.sh4.elf ReversingLabs: Detection: 65%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:42416 -> 212.224.107.142:1999
Source: unknown TCP traffic detected without corresponding DNS query: 212.224.107.142
Source: unknown TCP traffic detected without corresponding DNS query: 104.63.224.35
Source: unknown TCP traffic detected without corresponding DNS query: 108.220.160.35
Source: unknown TCP traffic detected without corresponding DNS query: 37.140.200.57
Source: unknown TCP traffic detected without corresponding DNS query: 241.41.148.127
Source: unknown TCP traffic detected without corresponding DNS query: 254.70.202.136
Source: unknown TCP traffic detected without corresponding DNS query: 77.99.56.228
Source: unknown TCP traffic detected without corresponding DNS query: 9.12.253.17
Source: unknown TCP traffic detected without corresponding DNS query: 154.45.168.57
Source: unknown TCP traffic detected without corresponding DNS query: 98.67.94.241
Source: unknown TCP traffic detected without corresponding DNS query: 125.29.217.104
Source: unknown TCP traffic detected without corresponding DNS query: 17.222.78.102
Source: unknown TCP traffic detected without corresponding DNS query: 60.228.66.114
Source: unknown TCP traffic detected without corresponding DNS query: 106.198.199.52
Source: unknown TCP traffic detected without corresponding DNS query: 57.98.211.180
Source: unknown TCP traffic detected without corresponding DNS query: 104.106.162.255
Source: unknown TCP traffic detected without corresponding DNS query: 184.108.182.124
Source: unknown TCP traffic detected without corresponding DNS query: 162.160.229.147
Source: unknown TCP traffic detected without corresponding DNS query: 148.4.133.144
Source: unknown TCP traffic detected without corresponding DNS query: 147.218.147.74
Source: unknown TCP traffic detected without corresponding DNS query: 212.248.150.163
Source: unknown TCP traffic detected without corresponding DNS query: 73.196.133.129
Source: unknown TCP traffic detected without corresponding DNS query: 170.126.170.46
Source: unknown TCP traffic detected without corresponding DNS query: 112.18.82.226
Source: unknown TCP traffic detected without corresponding DNS query: 254.60.35.13
Source: unknown TCP traffic detected without corresponding DNS query: 245.8.155.143
Source: unknown TCP traffic detected without corresponding DNS query: 167.14.230.120
Source: unknown TCP traffic detected without corresponding DNS query: 151.199.11.85
Source: unknown TCP traffic detected without corresponding DNS query: 23.60.119.118
Source: unknown TCP traffic detected without corresponding DNS query: 34.61.36.211
Source: unknown TCP traffic detected without corresponding DNS query: 65.117.246.142
Source: unknown TCP traffic detected without corresponding DNS query: 148.18.189.105
Source: unknown TCP traffic detected without corresponding DNS query: 98.132.37.37
Source: unknown TCP traffic detected without corresponding DNS query: 46.59.226.156
Source: unknown TCP traffic detected without corresponding DNS query: 253.125.80.38
Source: unknown TCP traffic detected without corresponding DNS query: 245.49.147.187
Source: unknown TCP traffic detected without corresponding DNS query: 178.94.1.237
Source: unknown TCP traffic detected without corresponding DNS query: 57.245.179.117
Source: unknown TCP traffic detected without corresponding DNS query: 240.112.124.44
Source: unknown TCP traffic detected without corresponding DNS query: 246.82.14.119
Source: unknown TCP traffic detected without corresponding DNS query: 113.206.247.161
Source: unknown TCP traffic detected without corresponding DNS query: 111.79.60.163
Source: unknown TCP traffic detected without corresponding DNS query: 118.122.173.59
Source: unknown TCP traffic detected without corresponding DNS query: 96.142.54.102
Source: unknown TCP traffic detected without corresponding DNS query: 37.252.192.135
Source: unknown TCP traffic detected without corresponding DNS query: 87.65.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 184.49.25.16
Source: unknown TCP traffic detected without corresponding DNS query: 187.112.57.46
Source: unknown TCP traffic detected without corresponding DNS query: 86.215.12.11
Source: unknown TCP traffic detected without corresponding DNS query: 93.14.46.185
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: fbot.sh4.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: fbot.sh4.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5498.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5498.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5495.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5495.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5508.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5508.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: fbot.sh4.elf PID: 5495, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: fbot.sh4.elf PID: 5495, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: fbot.sh4.elf PID: 5498, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: fbot.sh4.elf PID: 5498, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: fbot.sh4.elf PID: 5508, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: fbot.sh4.elf PID: 5508, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Yara signature match
Source: fbot.sh4.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: fbot.sh4.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5498.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5498.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5495.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5495.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5508.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5508.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: fbot.sh4.elf PID: 5495, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: fbot.sh4.elf PID: 5495, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: fbot.sh4.elf PID: 5498, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: fbot.sh4.elf PID: 5498, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: fbot.sh4.elf PID: 5508, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: fbot.sh4.elf PID: 5508, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: classification engine Classification label: mal80.troj.linELF@0/0@2/0
Enumerates processes within the "proc" file system
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3122/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3639/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3117/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3114/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/914/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/518/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/519/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/917/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3134/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3375/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3132/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3095/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1745/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1866/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1588/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/884/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1982/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/765/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3246/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/767/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/800/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1906/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/802/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/803/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1748/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/5442/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3420/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1482/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/490/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1480/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1755/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1238/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1875/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/2964/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3413/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1751/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1872/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/2961/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1475/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/656/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/778/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/657/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/658/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/659/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/418/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/936/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/419/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/816/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1879/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1891/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3310/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3153/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/780/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/660/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1921/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/783/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1765/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/2974/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1400/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1884/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3424/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/2972/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3147/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/2970/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1881/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3146/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3300/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1805/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1925/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1804/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1648/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1922/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3429/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/5606/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3442/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3165/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3164/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3163/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3162/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/790/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3161/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/792/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/793/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/672/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1930/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/674/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/795/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3315/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1411/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/2984/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/1410/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/797/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/676/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3434/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3158/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/678/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/679/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3710/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3831/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3711/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/5339/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3712/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3713/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/3170/cmdline Jump to behavior
Source: /tmp/fbot.sh4.elf (PID: 5497) File opened: /proc/5510/cmdline Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/fbot.sh4.elf (PID: 5495) Queries kernel information via 'uname': Jump to behavior
Source: fbot.sh4.elf, 5495.1.00007ffce56b7000.00007ffce56d8000.rw-.sdmp, fbot.sh4.elf, 5498.1.00007ffce56b7000.00007ffce56d8000.rw-.sdmp, fbot.sh4.elf, 5508.1.00007ffce56b7000.00007ffce56d8000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: fbot.sh4.elf, 5495.1.0000558fcb61d000.0000558fcb680000.rw-.sdmp, fbot.sh4.elf, 5498.1.0000558fcb61d000.0000558fcb680000.rw-.sdmp, fbot.sh4.elf, 5508.1.0000558fcb61d000.0000558fcb680000.rw-.sdmp Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: fbot.sh4.elf, 5495.1.0000558fcb61d000.0000558fcb680000.rw-.sdmp, fbot.sh4.elf, 5498.1.0000558fcb61d000.0000558fcb680000.rw-.sdmp, fbot.sh4.elf, 5508.1.0000558fcb61d000.0000558fcb680000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4
Source: fbot.sh4.elf, 5495.1.00007ffce56b7000.00007ffce56d8000.rw-.sdmp, fbot.sh4.elf, 5498.1.00007ffce56b7000.00007ffce56d8000.rw-.sdmp, fbot.sh4.elf, 5508.1.00007ffce56b7000.00007ffce56d8000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/fbot.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/fbot.sh4.elf

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: fbot.sh4.elf, type: SAMPLE
Source: Yara match File source: 5498.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5495.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5508.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: fbot.sh4.elf PID: 5495, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fbot.sh4.elf PID: 5498, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: fbot.sh4.elf, type: SAMPLE
Source: Yara match File source: 5498.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5495.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5508.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: fbot.sh4.elf PID: 5495, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fbot.sh4.elf PID: 5498, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: fbot.sh4.elf, type: SAMPLE
Source: Yara match File source: 5498.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5495.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5508.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: fbot.sh4.elf PID: 5495, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fbot.sh4.elf PID: 5498, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: fbot.sh4.elf, type: SAMPLE
Source: Yara match File source: 5498.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5495.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5508.1.00007f734c400000.00007f734c410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: fbot.sh4.elf PID: 5495, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fbot.sh4.elf PID: 5498, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
92.112.21.143
 unknown Ukraine
6849 UKRTELNETUA false
248.152.22.125
 unknown Reserved
unknown unknown false
87.44.220.55
 unknown Ireland
1213 HEANETIE false
168.219.183.234
 unknown Korea Republic of
6619 SAMSUNGSDS-AS-KRSamsungSDSIncKR false
79.206.149.210
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
223.36.151.206
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
182.3.201.137
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
104.39.39.70
 unknown United States
3999 PENN-STATEUS false
85.119.64.5
 unknown Turkey
15924 BORUSANTELEKOM-ASTR false
75.88.3.19
 unknown United States
7029 WINDSTREAMUS false
76.65.11.41
 unknown Canada
577 BACOMCA false
13.107.240.53
 unknown United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
120.69.247.18
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
160.24.193.43
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
202.246.160.124
 unknown Japan 17511 OPTAGEOPTAGEIncJP false
149.242.29.227
 unknown Germany
35391 HAUNI-ASDE false
46.154.217.76
 unknown Turkey
15897 VODAFONETURKEYTR false
109.102.109.91
 unknown Romania
9050 RTDBucharestRomaniaRO false
44.78.82.150
 unknown United States
7377 UCSDUS false
77.71.176.4
 unknown Malta
12709 MELITACABLEMT false
59.43.13.102
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
124.148.253.202
 unknown Australia
4739 INTERNODE-ASInternodePtyLtdAU false
67.218.148.151
 unknown Canada
25820 IT7NETCA false
192.49.248.150
 unknown Finland
375 TIETOTIE-ASPOBox38FI-00441HelsinkiFinlandEU false
88.180.232.151
 unknown France
12322 PROXADFR false
148.69.70.40
 unknown Portugal
12353 VODAFONE-PTVodafonePortugalPT false
252.243.72.151
 unknown Reserved
unknown unknown false
123.218.157.73
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
63.82.212.96
 unknown United States
22530 DLKCOREUS false
211.253.49.222
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
223.211.45.202
 unknown China
7497 CSTNET-AS-APComputerNetworkInformationCenterCN false
250.1.13.198
 unknown Reserved
unknown unknown false
36.37.121.145
 unknown Indonesia
4800 LINTASARTA-AS-APNetworkAccessProviderandInternetServic false
92.68.240.13
 unknown Netherlands
1136 KPNKPNNationalEU false
210.255.255.17
 unknown Japan 23775 TAMATELE-NETTamashimaTVIncJP false
19.197.116.80
 unknown United States
3 MIT-GATEWAYSUS false
68.73.144.140
 unknown United States
7018 ATT-INTERNET4US false
125.203.45.173
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
170.174.174.64
 unknown United States
11685 HNBCOL-ASUS false
62.82.0.216
 unknown Spain
6739 ONO-ASCableuropa-ONOES false
31.71.147.50
 unknown United Kingdom
12576 EELtdGB false
177.224.246.22
 unknown Mexico
13999 MegaCableSAdeCVMX false
151.18.176.132
 unknown Italy
1267 ASN-WINDTREIUNETEU false
207.29.45.229
 unknown United States
20330 NYS-UNIFIED-COURTSUS false
76.99.108.59
 unknown United States
7922 COMCAST-7922US false
202.24.151.224
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
170.166.226.5
 unknown United States
19739 COUNTY-SANBERNARDINOUS false
141.14.194.207
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
76.207.47.214
 unknown United States
7018 ATT-INTERNET4US false
189.137.210.57
 unknown Mexico
8151 UninetSAdeCVMX false
32.149.99.180
 unknown United States
2686 ATGS-MMD-ASUS false
186.15.71.88
 unknown Costa Rica
52228 CableTicaCR false
62.249.174.123
 unknown Norway
2119 TELENOR-NEXTELTelenorNorgeASNO false
140.243.98.194
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
154.104.69.47
 unknown Tunisia
37693 TUNISIANATN false
69.224.57.45
 unknown United States
7018 ATT-INTERNET4US false
174.111.25.145
 unknown United States
11426 TWC-11426-CAROLINASUS false
189.174.154.114
 unknown Mexico
8151 UninetSAdeCVMX false
146.203.47.207
 unknown United States
11452 MOUNT-SINAIUS false
172.209.54.221
 unknown United States
18747 IFX18747US false
105.50.251.187
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
180.160.249.56
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
110.117.196.172
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
192.180.126.245
 unknown United States
10796 TWC-10796-MIDWESTUS false
115.91.80.184
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
199.60.217.228
 unknown Canada
11105 SFU-ASCA false
78.208.47.204
 unknown France
12322 PROXADFR false
145.188.131.75
 unknown Netherlands
59524 KPN-IAASNL false
98.252.105.163
 unknown United States
7922 COMCAST-7922US false
37.204.179.208
 unknown Russian Federation
42610 NCNET-ASRU false
168.78.78.160
 unknown Korea Republic of
18300 KEPRI-AS-KRKEPCOKR false
80.193.176.128
 unknown United Kingdom
5089 NTLGB false
153.20.142.113
 unknown Singapore
9877 NGEEANN-POLY-AS-APNgeeAnnPolytechnicComputerCenterSG false
76.56.115.30
 unknown United States
18494 CENTURYLINK-LEGACY-EMBARQ-WRBGUS false
179.118.135.185
 unknown Brazil
26599 TELEFONICABRASILSABR false
250.51.149.19
 unknown Reserved
unknown unknown false
240.76.62.126
 unknown Reserved
unknown unknown false
125.151.146.139
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
216.172.193.117
 unknown United States
22948 WVUSDUS false
184.225.199.59
 unknown United States
10507 SPCSUS false
19.251.105.174
 unknown United States
3 MIT-GATEWAYSUS false
255.129.33.160
 unknown Reserved
unknown unknown false
70.83.224.120
 unknown Canada
5769 VIDEOTRONCA false
136.5.159.141
 unknown United States
60311 ONEFMCH false
204.142.152.149
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
98.241.109.41
 unknown United States
7922 COMCAST-7922US false
122.41.131.142
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
75.102.236.226
 unknown United States
20130 DEPAULUS false
66.41.52.187
 unknown United States
7922 COMCAST-7922US false
81.241.97.146
 unknown Belgium
5432 PROXIMUS-ISP-ASBE false
104.74.189.123
 unknown United States
20940 AKAMAI-ASN1EU false
38.57.189.73
 unknown United States
174 COGENT-174US false
8.83.115.119
 unknown United States
3356 LEVEL3US false
170.71.234.156
 unknown United States
10420 BancodeMexicoMX false
84.202.185.150
 unknown Norway
2119 TELENOR-NEXTELTelenorNorgeASNO false
195.175.102.108
 unknown Turkey
9121 TTNETTR false
165.127.39.0
 unknown United States
36081 STATE-OF-COLORADO-MNT-NETWORKUS false
207.218.162.49
 unknown United States
30452 FIRST-NATIONAL-TECHNOLOGY-SOLUTONSUS false
123.109.219.209
 unknown Korea Republic of
38095 QRIXNETSDM-AS-KRTBroadKR false
86.206.118.176
 unknown France
3215 FranceTelecom-OrangeFR false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true