IOC Report
Okami.sh4.elf

loading gif

Files

File Path
Type
Category
Malicious
Okami.sh4.elf
ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, not stripped
initial sample
 malicious
/run/systemd/resolve/stub-resolv.conf
ASCII text
dropped

Processes

Path
Cmdline
Malicious
/tmp/Okami.sh4.elf
/tmp/Okami.sh4.elf
/tmp/Okami.sh4.elf
-
/tmp/Okami.sh4.elf
-
/tmp/Okami.sh4.elf
-

URLs

Name
IP
Malicious
http://www.billybobbot.com/crawler/)
unknown
 malicious
http://www.baidu.com/search/spider.html)
unknown
http://fast.no/support/crawler.asp)
unknown
http://feedback.redkolibri.com/
unknown
http://www.baidu.com/search/spider.htm)
unknown

Domains

Name
IP
Malicious
daisy.ubuntu.com
162.213.35.24

IPs

IP
Domain
Country
Malicious
93.123.85.246
unknown
Bulgaria

Memdumps

Base Address
Regiontype
Protect
Malicious
7f209440f000
page execute read
 malicious
7f209440f000
page execute read
 malicious
7f209440f000
page execute read
 malicious
560054ac9000
page read and write
560057095000
page read and write
7f2094426000
page read and write
560054ad1000
page read and write
560054ad1000
page read and write
7f2119bcc000
page read and write
7ffff18af000
page read and write
7ffff18af000
page read and write
7f211a22b000
page read and write
7ffff18af000
page read and write
7f211a6c4000
page read and write
7f211a6cc000
page read and write
7f21193c9000
page read and write
5600548b3000
page execute read
7f2094420000
page read and write
7f21193c9000
page read and write
560056acf000
page execute and read and write
560054ac9000
page read and write
560056ae6000
page read and write
7f211a6cc000
page read and write
7ffff19a9000
page execute read
560056acf000
page execute and read and write
560056acf000
page execute and read and write
7f211a711000
page read and write
560057095000
page read and write
7f2114000000
page read and write
7f211a6c4000
page read and write
7f2094420000
page read and write
5600548b3000
page execute read
7f2119e69000
page read and write
7f2119e69000
page read and write
7f211a250000
page read and write
7ffff19a9000
page execute read
7f2119bcc000
page read and write
7f211a22b000
page read and write
7f2114000000
page read and write
7f211a250000
page read and write
7f2119bda000
page read and write
7f2114021000
page read and write
7f2114000000
page read and write
560056ae6000
page read and write
7f211a6cc000
page read and write
7f2114021000
page read and write
7f2114021000
page read and write
5600548b3000
page execute read
560054ac9000
page read and write
7f211a59b000
page read and write
560056ae6000
page read and write
560054ad1000
page read and write
7f211a711000
page read and write
7f21193c9000
page read and write
7f2119bda000
page read and write
7f2119bcc000
page read and write
7f211a711000
page read and write
560057095000
page read and write
7ffff19a9000
page execute read
7f211a22b000
page read and write
7f211a250000
page read and write
7f2094420000
page read and write
7f2094426000
page read and write
7f211a6c4000
page read and write
7f2094426000
page read and write
7f211a59b000
page read and write
7f2119e69000
page read and write
7f211a59b000
page read and write
7f2119bda000
page read and write
There are 59 hidden memdumps, click here to show them.