Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
r0tEgU8WOn.elf
|
ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
|
initial sample
|
 |
|
|
/tmp/qemu-open.TEb6aZ (deleted)
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
/tmp/r0tEgU8WOn.elf
|
/tmp/r0tEgU8WOn.elf
|
||
|
/tmp/r0tEgU8WOn.elf
|
-
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru
|
45.131.111.98
|
|
|
|
raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
|
unknown
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
45.131.111.98
|
raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru
|
Germany
|
|
|
|
185.125.190.26
|
unknown
|
United Kingdom
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
7efb94014000
|
page execute read
|
|
||
|
7efc1955c000
|
page read and write
|
|||
|
7efc18a72000
|
page read and write
|
|||
|
7efb9401a000
|
page read and write
|
|||
|
55a889152000
|
page execute and read and write
|
|||
|
7efc14021000
|
page read and write
|
|||
|
7efc195a9000
|
page read and write
|
|||
|
7efc14000000
|
page read and write
|
|||
|
7efc190e8000
|
page read and write
|
|||
|
7efc18a64000
|
page read and write
|
|||
|
55a88b263000
|
page read and write
|
|||
|
7ffeeebee000
|
page execute read
|
|||
|
7efb94016000
|
page read and write
|
|||
|
55a8891e9000
|
page read and write
|
|||
|
55a88714c000
|
page read and write
|
|||
|
7efc18261000
|
page read and write
|
|||
|
7ffeeebe8000
|
page read and write
|
|||
|
55a886f1a000
|
page execute read
|
|||
|
7efc190c3000
|
page read and write
|
|||
|
7efc19564000
|
page read and write
|
|||
|
7efc18d01000
|
page read and write
|
|||
|
7efc19433000
|
page read and write
|
|||
|
55a887154000
|
page read and write
|
There are 13 hidden memdumps, click here to show them.