IOC Report
na.elf

loading gif

Files

File Path
Type
Category
Malicious
na.elf
ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
initial sample
 malicious
/run/systemd/resolve/stub-resolv.conf
ASCII text
dropped

Processes

Path
Cmdline
Malicious
/tmp/na.elf
/tmp/na.elf
/tmp/na.elf
-
/tmp/na.elf
-
/tmp/na.elf
-
/tmp/na.elf
-
/tmp/na.elf
-
/tmp/na.elf
-
/tmp/na.elf
-

URLs

Name
IP
Malicious
http://www.baidu.com/search/spider.html)
unknown
http://www.billybobbot.com/crawler/)
unknown
http://fast.no/support/crawler.asp)
unknown
http://feedback.redkolibri.com/
unknown
http://www.baidu.com/search/spider.htm)
unknown

Domains

Name
IP
Malicious
daisy.ubuntu.com
162.213.35.25

IPs

IP
Domain
Country
Malicious
154.213.187.206
unknown
Seychelles

Memdumps

Base Address
Regiontype
Protect
Malicious
7fa05801a000
page execute read
 malicious
564218fe9000
page execute read
7fa14fa41000
page read and write
7fa14fa86000
page read and write
7fa148021000
page read and write
564219274000
page read and write
7fa14f5c5000
page read and write
7fa14fa39000
page read and write
7fa14f910000
page read and write
56421cf8c000
page read and write
7fa05802b000
page read and write
56421926c000
page read and write
7fa14e73e000
page read and write
7fa14f5a0000
page read and write
7fa14ef4f000
page read and write
7ffcb2301000
page read and write
7fa148000000
page read and write
7ffcb2326000
page execute read
7fa14ef41000
page read and write
7fa14f1de000
page read and write
7fa058031000
page read and write
56421b288000
page read and write
56421b272000
page execute and read and write
There are 13 hidden memdumps, click here to show them.