Linux Analysis Report
fbot.m68k.elf

Overview

General Information

Sample name: fbot.m68k.elf
Analysis ID: 1562720
MD5: 2bc5e23c6af33f2cc92b0f9749a9c2a0
SHA1: a5bde148bdbdda61f728f9e3d6663563ad05e709
SHA256: 766223d05cd0450a8a6c731fe542865d9e9936825ebe5e7246d4593b4817af29
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai, Moobot
Score: 80
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Moobot
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
Name Description Attribution Blogpost URLs Link
MooBot No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: fbot.m68k.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: fbot.m68k.elf ReversingLabs: Detection: 65%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:42402 -> 212.224.107.142:1999
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443
Source: unknown TCP traffic detected without corresponding DNS query: 212.224.107.142
Source: unknown TCP traffic detected without corresponding DNS query: 65.220.239.103
Source: unknown TCP traffic detected without corresponding DNS query: 114.32.184.89
Source: unknown TCP traffic detected without corresponding DNS query: 222.51.20.96
Source: unknown TCP traffic detected without corresponding DNS query: 111.126.51.223
Source: unknown TCP traffic detected without corresponding DNS query: 45.3.17.114
Source: unknown TCP traffic detected without corresponding DNS query: 43.113.128.105
Source: unknown TCP traffic detected without corresponding DNS query: 189.123.255.28
Source: unknown TCP traffic detected without corresponding DNS query: 153.84.143.248
Source: unknown TCP traffic detected without corresponding DNS query: 122.236.127.50
Source: unknown TCP traffic detected without corresponding DNS query: 209.6.101.101
Source: unknown TCP traffic detected without corresponding DNS query: 126.178.146.8
Source: unknown TCP traffic detected without corresponding DNS query: 219.252.54.175
Source: unknown TCP traffic detected without corresponding DNS query: 40.81.15.96
Source: unknown TCP traffic detected without corresponding DNS query: 73.23.250.36
Source: unknown TCP traffic detected without corresponding DNS query: 187.234.152.159
Source: unknown TCP traffic detected without corresponding DNS query: 142.151.148.192
Source: unknown TCP traffic detected without corresponding DNS query: 42.85.170.14
Source: unknown TCP traffic detected without corresponding DNS query: 142.176.221.240
Source: unknown TCP traffic detected without corresponding DNS query: 252.113.65.193
Source: unknown TCP traffic detected without corresponding DNS query: 195.242.97.130
Source: unknown TCP traffic detected without corresponding DNS query: 240.121.54.38
Source: unknown TCP traffic detected without corresponding DNS query: 17.174.137.98
Source: unknown TCP traffic detected without corresponding DNS query: 9.80.109.64
Source: unknown TCP traffic detected without corresponding DNS query: 154.88.111.133
Source: unknown TCP traffic detected without corresponding DNS query: 109.171.133.117
Source: unknown TCP traffic detected without corresponding DNS query: 14.232.153.236
Source: unknown TCP traffic detected without corresponding DNS query: 117.231.188.249
Source: unknown TCP traffic detected without corresponding DNS query: 216.206.189.167
Source: unknown TCP traffic detected without corresponding DNS query: 93.68.30.119
Source: unknown TCP traffic detected without corresponding DNS query: 23.177.49.219
Source: unknown TCP traffic detected without corresponding DNS query: 108.149.252.107
Source: unknown TCP traffic detected without corresponding DNS query: 146.22.46.231
Source: unknown TCP traffic detected without corresponding DNS query: 38.155.183.174
Source: unknown TCP traffic detected without corresponding DNS query: 9.196.66.133
Source: unknown TCP traffic detected without corresponding DNS query: 160.36.229.207
Source: unknown TCP traffic detected without corresponding DNS query: 149.32.229.48
Source: unknown TCP traffic detected without corresponding DNS query: 206.129.156.196
Source: unknown TCP traffic detected without corresponding DNS query: 83.101.166.216
Source: unknown TCP traffic detected without corresponding DNS query: 208.35.87.9
Source: unknown TCP traffic detected without corresponding DNS query: 111.153.52.208
Source: unknown TCP traffic detected without corresponding DNS query: 91.24.172.135
Source: unknown TCP traffic detected without corresponding DNS query: 71.55.139.225
Source: unknown TCP traffic detected without corresponding DNS query: 66.49.68.196
Source: unknown TCP traffic detected without corresponding DNS query: 181.248.94.155
Source: unknown TCP traffic detected without corresponding DNS query: 160.105.177.22
Source: unknown TCP traffic detected without corresponding DNS query: 108.78.196.120
Source: unknown TCP traffic detected without corresponding DNS query: 208.250.130.69
Source: unknown TCP traffic detected without corresponding DNS query: 244.32.99.1
Source: unknown TCP traffic detected without corresponding DNS query: 113.195.184.210
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: unknown Network traffic detected: HTTP traffic on port 48202 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: fbot.m68k.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: fbot.m68k.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5458.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5458.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5445.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5445.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5448.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5448.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: fbot.m68k.elf PID: 5445, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: fbot.m68k.elf PID: 5445, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: fbot.m68k.elf PID: 5448, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: fbot.m68k.elf PID: 5448, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: fbot.m68k.elf PID: 5458, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: fbot.m68k.elf PID: 5458, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Yara signature match
Source: fbot.m68k.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: fbot.m68k.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5458.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5458.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5445.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5445.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5448.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5448.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: fbot.m68k.elf PID: 5445, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: fbot.m68k.elf PID: 5445, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: fbot.m68k.elf PID: 5448, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: fbot.m68k.elf PID: 5448, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: fbot.m68k.elf PID: 5458, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: fbot.m68k.elf PID: 5458, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: classification engine Classification label: mal80.troj.linELF@0/0@2/0
Enumerates processes within the "proc" file system
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3122/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3117/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3114/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/914/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/518/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/519/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/917/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/5395/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/5430/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/5431/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3134/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3375/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3132/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3095/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1745/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1866/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1588/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/884/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1982/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/765/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3246/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/767/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/800/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3641/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1906/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/802/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/803/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1748/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/5288/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3420/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1482/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/490/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1480/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1755/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1238/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1875/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/2964/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3413/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1751/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1872/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/2961/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1475/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/656/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/778/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/657/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/658/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/659/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/418/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/936/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/419/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/816/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3811/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1879/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/5570/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1891/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3310/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3153/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/780/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/660/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1921/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/783/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1765/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/2974/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1400/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1884/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3424/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3708/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/2972/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3709/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3147/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/2970/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1881/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3146/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3300/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/5447/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1805/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1925/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1804/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1648/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1922/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3429/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/5460/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/5463/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3442/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3165/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3164/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3163/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3162/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/790/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3161/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/792/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/793/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/672/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1930/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/674/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/795/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3315/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1411/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/2984/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/1410/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/797/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/676/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3434/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/3158/cmdline Jump to behavior
Source: /tmp/fbot.m68k.elf (PID: 5453) File opened: /proc/678/cmdline Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/fbot.m68k.elf (PID: 5445) Queries kernel information via 'uname': Jump to behavior
Source: fbot.m68k.elf, 5445.1.00007ffc20d97000.00007ffc20db8000.rw-.sdmp, fbot.m68k.elf, 5448.1.00007ffc20d97000.00007ffc20db8000.rw-.sdmp, fbot.m68k.elf, 5458.1.00007ffc20d97000.00007ffc20db8000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/fbot.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/fbot.m68k.elf
Source: fbot.m68k.elf, 5445.1.000055b3e6963000.000055b3e69ee000.rw-.sdmp, fbot.m68k.elf, 5448.1.000055b3e6963000.000055b3e69ee000.rw-.sdmp, fbot.m68k.elf, 5458.1.000055b3e6963000.000055b3e69ee000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: fbot.m68k.elf, 5445.1.00007ffc20d97000.00007ffc20db8000.rw-.sdmp, fbot.m68k.elf, 5448.1.00007ffc20d97000.00007ffc20db8000.rw-.sdmp, fbot.m68k.elf, 5458.1.00007ffc20d97000.00007ffc20db8000.rw-.sdmp Binary or memory string: /usr/bin/qemu-m68k
Source: fbot.m68k.elf, 5445.1.000055b3e6963000.000055b3e69ee000.rw-.sdmp, fbot.m68k.elf, 5448.1.000055b3e6963000.000055b3e69ee000.rw-.sdmp, fbot.m68k.elf, 5458.1.000055b3e6963000.000055b3e69ee000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/m68k

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: fbot.m68k.elf, type: SAMPLE
Source: Yara match File source: 5458.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5445.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5448.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: fbot.m68k.elf PID: 5445, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fbot.m68k.elf PID: 5448, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fbot.m68k.elf PID: 5458, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: fbot.m68k.elf, type: SAMPLE
Source: Yara match File source: 5458.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5445.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5448.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: fbot.m68k.elf PID: 5445, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fbot.m68k.elf PID: 5448, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fbot.m68k.elf PID: 5458, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: fbot.m68k.elf, type: SAMPLE
Source: Yara match File source: 5458.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5445.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5448.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: fbot.m68k.elf PID: 5445, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fbot.m68k.elf PID: 5448, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fbot.m68k.elf PID: 5458, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: fbot.m68k.elf, type: SAMPLE
Source: Yara match File source: 5458.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5445.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5448.1.00007f8180001000.00007f8180013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: fbot.m68k.elf PID: 5445, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fbot.m68k.elf PID: 5448, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fbot.m68k.elf PID: 5458, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.115.182.217
 unknown Canada
577 BACOMCA false
87.154.68.52
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
184.223.249.170
 unknown United States
10507 SPCSUS false
77.59.43.7
 unknown Switzerland
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
17.129.6.101
 unknown United States
714 APPLE-ENGINEERINGUS false
47.246.4.240
 unknown United States
24429 TAOBAOZhejiangTaobaoNetworkCoLtdCN false
69.248.152.53
 unknown United States
7922 COMCAST-7922US false
118.230.33.241
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
222.139.226.206
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
240.4.209.255
 unknown Reserved
unknown unknown false
31.62.4.28
 unknown Poland
5617 TPNETPL false
16.212.245.100
 unknown United States
unknown unknown false
223.127.93.220
 unknown China
58453 CMI-INT-HKLevel30Tower1HK false
136.122.177.158
 unknown United States
15169 GOOGLEUS false
192.146.21.122
 unknown United States
19239 KLA-TENCORUS false
172.235.101.208
 unknown United States
20940 AKAMAI-ASN1EU false
161.238.17.240
 unknown Chile
396269 BPL-ASNUS false
27.72.118.104
 unknown Viet Nam
7552 VIETEL-AS-APViettelGroupVN false
188.227.187.51
 unknown United Kingdom
20860 IOMART-ASGB false
81.46.107.84
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
245.128.55.142
 unknown Reserved
unknown unknown false
92.163.3.148
 unknown France
3215 FranceTelecom-OrangeFR false
203.187.138.181
 unknown United States
3300 BTNL false
77.100.218.47
 unknown United Kingdom
5089 NTLGB false
255.134.21.236
 unknown Reserved
unknown unknown false
80.166.56.23
 unknown Denmark
3292 TDCTDCASDK false
220.49.6.228
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
204.120.183.75
 unknown United States
40724 DEKALB-COUNTY-GEORGIA-GOVERNMENTUS false
14.242.154.139
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
97.157.240.235
 unknown United States
6167 CELLCO-PARTUS false
58.49.78.182
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
89.139.239.203
 unknown Israel
1680 NV-ASNCELLCOMltdIL false
162.107.20.49
 unknown United States
395660 EDMONTON-CA false
99.64.162.9
 unknown United States
7018 ATT-INTERNET4US false
8.168.190.17
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
180.32.169.37
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
104.185.246.159
 unknown United States
7018 ATT-INTERNET4US false
59.149.34.114
 unknown Hong Kong
9269 HKBN-AS-APHongKongBroadbandNetworkLtdHK false
161.118.20.212
 unknown Japan 13041 CESCA-ACES false
189.186.61.32
 unknown Mexico
8151 UninetSAdeCVMX false
19.244.187.11
 unknown United States
3 MIT-GATEWAYSUS false
135.58.197.186
 unknown United States
18676 AVAYAUS false
181.24.172.242
 unknown Argentina
22927 TelefonicadeArgentinaAR false
205.236.174.144
 unknown Canada
22652 FIBRENOIRE-INTERNETCA false
161.141.173.109
 unknown Canada
17311 ECMC-BGPUS false
16.129.205.40
 unknown United States
unknown unknown false
255.254.31.29
 unknown Reserved
unknown unknown false
112.143.93.124
 unknown Thailand
10010 TOKAITOKAICommunicationsCorporationJP false
129.6.93.244
 unknown United States
49 US-NATIONAL-INSTITUTE-OF-STANDARDS-AND-TECHNOLOGYUS false
163.34.142.161
 unknown Norway
2830 MCI-DUAL-HOMED-CUSTOMERSGB false
108.54.48.150
 unknown United States
701 UUNETUS false
13.255.9.85
 unknown United States
16509 AMAZON-02US false
69.248.152.40
 unknown United States
7922 COMCAST-7922US false
111.132.127.35
 unknown China
24138 CTTNETChinaTieTongTelecommunicationsCorporationCN false
158.224.120.249
 unknown United States
9159 CreditAgricoleFR false
115.186.89.4
 unknown Pakistan
38616 WORLDCALL-AS-KHIWorldcallTelecomLimitedPK false
53.35.96.54
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
32.206.153.138
 unknown United States
2686 ATGS-MMD-ASUS false
203.101.39.219
 unknown India
9498 BBIL-APBHARTIAirtelLtdIN false
94.227.247.129
 unknown Belgium
6848 TELENET-ASBE false
177.59.11.65
 unknown Brazil
22085 ClaroSABR false
245.6.206.138
 unknown Reserved
unknown unknown false
211.60.8.81
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
89.235.255.147
 unknown Estonia
8728 InfonetEE false
105.35.52.140
 unknown Egypt
37069 MOBINILEG false
17.180.201.73
 unknown United States
714 APPLE-ENGINEERINGUS false
197.159.177.27
 unknown Sao Tome and Principe
328191 CST-NET-ASST false
249.24.191.22
 unknown Reserved
unknown unknown false
107.203.254.8
 unknown United States
7018 ATT-INTERNET4US false
70.2.128.156
 unknown United States
10507 SPCSUS false
245.38.41.50
 unknown Reserved
unknown unknown false
8.44.60.26
 unknown United States
13335 CLOUDFLARENETUS false
208.45.0.29
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
168.19.23.239
 unknown United States
3479 PEACHNET-AS1US false
216.138.231.239
 unknown Canada
6407 PRIMUS-AS6407CA false
79.10.129.161
 unknown Italy
3269 ASN-IBSNAZIT false
161.177.87.17
 unknown United States
10695 WAL-MARTUS false
223.113.6.98
 unknown China
56046 CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN false
191.31.52.142
 unknown Brazil
18881 TELEFONICABRASILSABR false
116.84.35.90
 unknown Korea Republic of
23908 AIRPORT-AS-KRIIACKR false
43.48.237.141
 unknown Japan 4249 LILLY-ASUS false
252.14.215.120
 unknown Reserved
unknown unknown false
23.240.15.57
 unknown United States
20001 TWC-20001-PACWESTUS false
126.26.73.10
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
31.90.63.175
 unknown United Kingdom
12576 EELtdGB false
43.92.94.169
 unknown Japan 4249 LILLY-ASUS false
64.27.173.14
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
80.229.241.52
 unknown United Kingdom
6871 PLUSNETUKInternetServiceProviderGB false
86.214.133.176
 unknown France
3215 FranceTelecom-OrangeFR false
91.209.190.225
 unknown Denmark
198452 KONFORM-ASDK false
208.90.131.199
 unknown United States
27020 PRIMET-INET-ASUS false
178.241.78.242
 unknown Turkey
16135 TURKCELL-ASTurkcellASTR false
119.254.208.140
 unknown China
59050 CLOUD-ARKBeijingCloud-ArkTechnologyCoLtdCN false
82.140.33.95
 unknown Germany
8881 VERSATELDE false
122.105.202.154
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
220.185.48.251
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
122.14.142.38
 unknown China
58779 I4HKLIMITED-ASi4HKLimitedHK false
197.251.97.159
 unknown Sudan
37197 SUDRENSD false
100.154.178.233
 unknown United States
21928 T-MOBILE-AS21928US false
2.133.122.128
 unknown Kazakhstan
9198 KAZTELECOM-ASKZ false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.24 true