Linux Analysis Report
fbot.ppc.elf

Overview

General Information

Sample name: fbot.ppc.elf
Analysis ID: 1562719
MD5: a7c91ec7d58d8effd0b32473976d2ddd
SHA1: 2853b78e390162b51c88c758cc97a660bf7e280d
SHA256: 8de18fdc7b7394e88513a7cbd723b4c06e63701bdde146cd23b666dbedd2f184
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai, Moobot
Score: 80
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Moobot
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
Name Description Attribution Blogpost URLs Link
MooBot No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: fbot.ppc.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: fbot.ppc.elf ReversingLabs: Detection: 63%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:59218 -> 212.224.107.142:1999
Source: unknown TCP traffic detected without corresponding DNS query: 212.224.107.142
Source: unknown TCP traffic detected without corresponding DNS query: 166.238.101.66
Source: unknown TCP traffic detected without corresponding DNS query: 136.9.165.64
Source: unknown TCP traffic detected without corresponding DNS query: 37.13.49.66
Source: unknown TCP traffic detected without corresponding DNS query: 150.58.251.51
Source: unknown TCP traffic detected without corresponding DNS query: 42.213.226.193
Source: unknown TCP traffic detected without corresponding DNS query: 75.112.42.164
Source: unknown TCP traffic detected without corresponding DNS query: 89.132.57.205
Source: unknown TCP traffic detected without corresponding DNS query: 91.7.16.10
Source: unknown TCP traffic detected without corresponding DNS query: 101.254.187.198
Source: unknown TCP traffic detected without corresponding DNS query: 220.170.193.21
Source: unknown TCP traffic detected without corresponding DNS query: 148.142.72.143
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.241.151
Source: unknown TCP traffic detected without corresponding DNS query: 19.73.238.241
Source: unknown TCP traffic detected without corresponding DNS query: 53.62.196.171
Source: unknown TCP traffic detected without corresponding DNS query: 174.197.215.243
Source: unknown TCP traffic detected without corresponding DNS query: 27.48.169.185
Source: unknown TCP traffic detected without corresponding DNS query: 115.79.47.123
Source: unknown TCP traffic detected without corresponding DNS query: 248.99.201.12
Source: unknown TCP traffic detected without corresponding DNS query: 189.48.86.140
Source: unknown TCP traffic detected without corresponding DNS query: 19.109.229.207
Source: unknown TCP traffic detected without corresponding DNS query: 201.78.153.170
Source: unknown TCP traffic detected without corresponding DNS query: 243.41.141.122
Source: unknown TCP traffic detected without corresponding DNS query: 105.115.244.50
Source: unknown TCP traffic detected without corresponding DNS query: 97.239.107.157
Source: unknown TCP traffic detected without corresponding DNS query: 204.142.231.130
Source: unknown TCP traffic detected without corresponding DNS query: 194.138.186.26
Source: unknown TCP traffic detected without corresponding DNS query: 141.0.150.121
Source: unknown TCP traffic detected without corresponding DNS query: 202.17.117.44
Source: unknown TCP traffic detected without corresponding DNS query: 65.206.161.233
Source: unknown TCP traffic detected without corresponding DNS query: 147.77.14.52
Source: unknown TCP traffic detected without corresponding DNS query: 118.209.180.34
Source: unknown TCP traffic detected without corresponding DNS query: 159.73.214.91
Source: unknown TCP traffic detected without corresponding DNS query: 105.185.204.28
Source: unknown TCP traffic detected without corresponding DNS query: 183.95.44.127
Source: unknown TCP traffic detected without corresponding DNS query: 213.13.161.33
Source: unknown TCP traffic detected without corresponding DNS query: 186.186.151.246
Source: unknown TCP traffic detected without corresponding DNS query: 9.92.2.159
Source: unknown TCP traffic detected without corresponding DNS query: 122.215.54.232
Source: unknown TCP traffic detected without corresponding DNS query: 91.36.9.52
Source: unknown TCP traffic detected without corresponding DNS query: 79.89.115.196
Source: unknown TCP traffic detected without corresponding DNS query: 180.247.89.6
Source: unknown TCP traffic detected without corresponding DNS query: 116.203.166.175
Source: unknown TCP traffic detected without corresponding DNS query: 77.217.42.202
Source: unknown TCP traffic detected without corresponding DNS query: 179.131.58.157
Source: unknown TCP traffic detected without corresponding DNS query: 192.184.246.129
Source: unknown TCP traffic detected without corresponding DNS query: 111.189.219.255
Source: unknown TCP traffic detected without corresponding DNS query: 166.2.160.199
Source: unknown TCP traffic detected without corresponding DNS query: 155.161.50.231
Source: unknown TCP traffic detected without corresponding DNS query: 155.249.150.247
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: fbot.ppc.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: fbot.ppc.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5575.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5575.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5569.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5569.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5566.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5566.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: fbot.ppc.elf PID: 5566, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: fbot.ppc.elf PID: 5566, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: fbot.ppc.elf PID: 5569, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: fbot.ppc.elf PID: 5569, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: fbot.ppc.elf PID: 5575, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: fbot.ppc.elf PID: 5575, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Yara signature match
Source: fbot.ppc.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: fbot.ppc.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5575.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5575.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5569.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5569.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5566.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5566.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: fbot.ppc.elf PID: 5566, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: fbot.ppc.elf PID: 5566, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: fbot.ppc.elf PID: 5569, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: fbot.ppc.elf PID: 5569, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: fbot.ppc.elf PID: 5575, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: fbot.ppc.elf PID: 5575, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: classification engine Classification label: mal80.troj.linELF@0/0@2/0
Enumerates processes within the "proc" file system
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3760/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3761/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/2672/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1583/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3244/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3120/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3361/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3759/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3239/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1577/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1610/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/512/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1299/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3235/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/514/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/519/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/2946/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/917/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3134/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1593/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3011/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3094/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/2955/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3406/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1589/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3129/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1588/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3402/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3125/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3246/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3245/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/767/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/800/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/888/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3762/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/801/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/769/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/803/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/5548/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/5669/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/5549/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/806/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/807/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/928/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/2956/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3420/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/490/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3142/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1635/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1633/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1599/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3139/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1873/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1630/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3412/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/657/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/658/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/659/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/418/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/419/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1639/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1638/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3670/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3398/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1371/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3392/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/780/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/660/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/661/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/782/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1369/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3304/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3425/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/785/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1642/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/940/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/941/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1640/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3147/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3268/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1364/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/548/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/5568/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1647/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/5580/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/2991/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1383/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1382/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1381/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/791/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/671/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/794/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1655/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/2986/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/795/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/674/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1653/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/797/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/2983/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3159/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/678/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/1650/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/3157/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/679/cmdline Jump to behavior
Source: /tmp/fbot.ppc.elf (PID: 5574) File opened: /proc/5577/cmdline Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/fbot.ppc.elf (PID: 5566) Queries kernel information via 'uname': Jump to behavior
Source: fbot.ppc.elf, 5566.1.00005638f1386000.00005638f1436000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: fbot.ppc.elf, 5569.1.00005638f1386000.00005638f1436000.rw-.sdmp, fbot.ppc.elf, 5575.1.00005638f1386000.00005638f1436000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: fbot.ppc.elf, 5566.1.00005638f1386000.00005638f1436000.rw-.sdmp, fbot.ppc.elf, 5569.1.00005638f1386000.00005638f1436000.rw-.sdmp, fbot.ppc.elf, 5575.1.00005638f1386000.00005638f1436000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: fbot.ppc.elf, 5566.1.00007ffe26730000.00007ffe26751000.rw-.sdmp, fbot.ppc.elf, 5569.1.00007ffe26730000.00007ffe26751000.rw-.sdmp, fbot.ppc.elf, 5575.1.00007ffe26730000.00007ffe26751000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc
Source: fbot.ppc.elf, 5566.1.00007ffe26730000.00007ffe26751000.rw-.sdmp, fbot.ppc.elf, 5569.1.00007ffe26730000.00007ffe26751000.rw-.sdmp, fbot.ppc.elf, 5575.1.00007ffe26730000.00007ffe26751000.rw-.sdmp Binary or memory string: 6x86_64/usr/bin/qemu-ppc/tmp/fbot.ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/fbot.ppc.elf

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: fbot.ppc.elf, type: SAMPLE
Source: Yara match File source: 5575.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5569.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5566.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: fbot.ppc.elf PID: 5569, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fbot.ppc.elf PID: 5575, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: fbot.ppc.elf, type: SAMPLE
Source: Yara match File source: 5575.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5569.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5566.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: fbot.ppc.elf PID: 5566, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fbot.ppc.elf PID: 5569, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fbot.ppc.elf PID: 5575, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: fbot.ppc.elf, type: SAMPLE
Source: Yara match File source: 5575.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5569.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5566.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: fbot.ppc.elf PID: 5569, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fbot.ppc.elf PID: 5575, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: fbot.ppc.elf, type: SAMPLE
Source: Yara match File source: 5575.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5569.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5566.1.00007f7080001000.00007f7080012000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: fbot.ppc.elf PID: 5566, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fbot.ppc.elf PID: 5569, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fbot.ppc.elf PID: 5575, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
42.219.241.42
 unknown China
4249 LILLY-ASUS false
19.45.59.242
 unknown United States
3 MIT-GATEWAYSUS false
221.184.196.78
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
248.175.140.196
 unknown Reserved
unknown unknown false
255.84.124.22
 unknown Reserved
unknown unknown false
92.143.167.78
 unknown France
3215 FranceTelecom-OrangeFR false
111.131.173.218
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
87.240.243.14
 unknown Luxembourg
6661 EPT-LUEntreprisedesPetTLuxembourgLU false
190.143.63.118
 unknown Colombia
10620 TelmexColombiaSACO false
125.208.138.107
 unknown Indonesia
4787 ASN-CBNPTCyberindoAditamaID false
9.247.149.127
 unknown United States
3356 LEVEL3US false
115.199.247.14
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
96.179.146.2
 unknown United States
7922 COMCAST-7922US false
114.225.86.212
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
71.32.39.76
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
58.79.120.213
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
200.3.102.140
 unknown Argentina
26594 PampaEnergiaSAAR false
202.246.160.124
 unknown Japan 17511 OPTAGEOPTAGEIncJP false
244.239.173.154
 unknown Reserved
unknown unknown false
220.39.206.200
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
71.7.73.0
 unknown United States
7029 WINDSTREAMUS false
107.135.148.114
 unknown United States
7018 ATT-INTERNET4US false
95.173.17.6
 unknown Turkey
20978 TT_MOBILIstanbulTR false
63.166.110.232
 unknown United States
1239 SPRINTLINKUS false
142.168.234.161
 unknown Canada
7122 MTS-ASNCA false
220.226.116.127
 unknown India
18101 RELIANCE-COMMUNICATIONS-INRelianceCommunicationsLtdDAKC false
113.112.224.27
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
201.233.90.7
 unknown Colombia
13489 EPMTelecomunicacionesSAESPCO false
46.61.215.37
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
82.239.194.113
 unknown France
12322 PROXADFR false
194.226.6.54
 unknown Russian Federation
51764 AMTEL-ASRU false
162.69.52.213
 unknown United States
26585 SIAC-SFTIUS false
45.173.189.201
 unknown Brazil
268886 WILLYNETPROVEDORBR false
57.5.138.211
 unknown Belgium
2686 ATGS-MMD-ASUS false
198.173.254.24
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
92.207.237.190
 unknown United Kingdom
31655 ASN-GAMMATELECOMGB false
136.60.79.166
 unknown United States
16591 GOOGLE-FIBERUS false
120.124.103.197
 unknown Taiwan; Republic of China (ROC)
17716 NTU-TWNationalTaiwanUniversityTW false
116.27.58.53
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
190.211.169.231
 unknown Chile
52280 INTERNEXAChileSACL false
80.212.30.56
 unknown Norway
2119 TELENOR-NEXTELTelenorNorgeASNO false
106.142.37.80
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
88.171.45.3
 unknown France
12322 PROXADFR false
117.34.75.15
 unknown China
4835 CHINANET-IDC-SNChinaTelecomGroupCN false
199.56.181.88
 unknown United States
398192 ARDOT-NET-01US false
61.202.60.111
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
74.160.83.167
 unknown United States
10796 TWC-10796-MIDWESTUS false
42.238.240.221
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
1.83.131.160
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
135.23.111.154
 unknown Canada
5645 TEKSAVVYCA false
209.29.180.177
 unknown Canada
852 ASN852CA false
86.191.118.142
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
251.39.219.188
 unknown Reserved
unknown unknown false
81.106.137.104
 unknown United Kingdom
5089 NTLGB false
83.190.23.119
 unknown Sweden
39651 COMHEM-SWEDENSE false
35.51.17.218
 unknown United States
36375 UMICH-AS-5US false
250.152.20.246
 unknown Reserved
unknown unknown false
76.84.217.252
 unknown United States
11427 TWC-11427-TEXASUS false
248.133.183.69
 unknown Reserved
unknown unknown false
195.180.36.82
 unknown Germany
4589 EASYNETEasynetGlobalServicesEU false
156.109.195.5
 unknown United States
36081 STATE-OF-COLORADO-MNT-NETWORKUS false
174.205.104.237
 unknown United States
22394 CELLCOUS false
110.235.232.103
 unknown India
133982 EXCITEL-AS-INExcitelBroadbandPrivateLimitedIN false
110.21.146.180
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
178.46.235.95
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
85.45.13.74
 unknown Italy
3269 ASN-IBSNAZIT false
14.48.209.125
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
14.250.94.172
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
112.68.26.229
 unknown Japan 17511 OPTAGEOPTAGEIncJP false
19.218.96.169
 unknown United States
3 MIT-GATEWAYSUS false
4.89.143.155
 unknown United States
3356 LEVEL3US false
249.170.188.34
 unknown Reserved
unknown unknown false
42.43.42.168
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
176.30.158.32
 unknown Turkey
20978 TT_MOBILIstanbulTR false
241.251.151.182
 unknown Reserved
unknown unknown false
88.7.254.135
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
254.172.199.251
 unknown Reserved
unknown unknown false
163.212.66.156
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
189.6.48.18
 unknown Brazil
28573 CLAROSABR false
104.62.108.126
 unknown United States
7018 ATT-INTERNET4US false
77.159.152.59
 unknown France
15557 LDCOMNETFR false
175.126.217.24
 unknown Korea Republic of
9523 MOKWON-AS-KRMokwonUniversityKR false
211.14.151.77
 unknown Japan 4694 IDCFIDCFrontierIncJP false
171.182.228.185
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
95.39.201.176
 unknown Spain
12357 COMUNITELSPAINES false
117.234.231.7
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
118.252.242.112
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
59.67.103.140
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
217.115.101.188
 unknown Ukraine
25133 MCLAUT-ASUA false
144.13.158.237
 unknown United States
3128 BRUWS-AS3128US false
58.231.117.4
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
247.219.193.200
 unknown Reserved
unknown unknown false
219.159.37.53
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
203.160.213.31
 unknown China
137692 CHINATELECOM-IOT-GUANGDONG-NETWORKIOTGuangdongnetworkCh false
176.150.159.67
 unknown France
5410 BOUYGTEL-ISPFR false
89.7.153.144
 unknown Spain
12430 VODAFONE_ESES false
118.183.4.186
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
111.138.237.153
 unknown China
134810 CMNET-JILIN-AS-APChinaMobileGroupJiLincommunicationsco false
163.103.162.51
 unknown France
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
159.143.61.50
 unknown United States
6105 DENVERWATER-1US false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true