Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
spc.elf
|
ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
|
initial sample
|
 |
|
|
/tmp/qemu-open.0at0UI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.10mlUK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.18XTOL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.1AJDFH (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.1ASsKJ (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.1WZtOL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.1mnZGK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.23M3JH (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.2BmoxJ (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.2HcrYL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.2haqLI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.2nnKtK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.2uGR9H (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.3UEj8L (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.3bz7xJ (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.3sZngL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.4bWKLH (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.4d3rGH (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.6CroyH (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.6ycWsJ (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.7B6H4H (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.7lK3EL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.8J5yDK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.8KogwL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.8fyOdL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.8nduZI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.98VnaK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.9PVd9K (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.9SiAEL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.9TR2XI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.9Tf53L (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.9g2qlI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.9y8UqJ (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.A32GVL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.ACihiK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.AKdvWL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.AMDSXI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.AjNh8H (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.B399TI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.BZkj0J (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.BbUzyI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.BmkPuK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.CTC1QJ (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.CgWRtH (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.DMTY8J (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.DlX3lJ (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.DrogyH (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.ETNn8H (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.EeOcOJ (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.FQMLDL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.FR0jKH (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.FZmhnI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.FlykRK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.Fm5YTK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.G3Ra5L (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.GKRCWL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.GqyutK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.HP8wtL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.HzZsMH (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.IUHnUH (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.Ilqk1I (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.IqOcEI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.J5IgjL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.JDkRAI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.JeRpGL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.KIv64I (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.KT3OZL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.KdDd2I (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.KmfIWH (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.LCzuLK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.LouWkJ (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.M5aZ7H (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.M6S1HI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.MvtomI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.N2LBNH (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.N59YJI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.NL6mhL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.NVhvnK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.NbTjlL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.Nhmp8H (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.Nzb35I (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.OfkDwH (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.OopdOI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.OzCM1I (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.OzTX1H (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.P7vcpK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.PZV9GL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.PkXqTL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.Q2jntK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.Q7FpJH (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.QHh9CL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.QOc5VL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.SQVdGH (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.SSY8NH (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.SfE0FK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.SryTKJ (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.TCJswH (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.TGGk8K (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.TfpK6L (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.TkiLuJ (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.Tl648J (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.U2UgNK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.U8JBSL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.UKHiwH (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.VB1UsK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.VykeqL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.W0qXAL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.W7kuGL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.WLJJBK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.WTq30J (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.XTpdOH (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.XtkygL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.YHdDMI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.YkpqxI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.Z0mJ0J (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.ZQKqEJ (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.ZXH2nJ (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.ZXmQwK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.Zxmc7K (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.a1goZI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.aL01vJ (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.am1IlL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.bGHduK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.bQJT0K (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.bx5ZcI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.cNXX3L (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.ccB8oK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.dGxJdJ (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.dN9ZZL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.gOnJAI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.ggAUSI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.gxYF9J (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.h6sxAK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.hESiNL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.hRqkDK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.i4wgOL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.iDOz2H (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.irIUWK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.jr0vbJ (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.kc6awL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.kclotK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.lHElxK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.lc4sUJ (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.mKVTqI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.mVsveL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.moeI2L (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.n9kiJK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.nBsrQL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.nhPXcJ (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.oGaxZK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.oGuHwK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.oaRjtH (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.pptO4K (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.qa4mgK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.qzDkqI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.rH4xLL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.s4rGzK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.s5M8hL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.s6WBUI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.s8niOI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.sDKS6I (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.sfdrAH (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.t7rsWK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.tA4u3K (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.tLslfJ (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.txoqGL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.u3MbqI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.uKrFvK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.v0HOwK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.vNY4kL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.vVvN8H (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.wBJysJ (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.wSYlSI (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.wWqGwH (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.wvABXK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.xSfkcJ (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.yUWV2J (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.ysw0rL (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.zD2WVK (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.zVQg4I (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.zbyV7I (deleted)
|
ASCII text
|
dropped
|
There are 172 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
/tmp/spc.elf
|
/tmp/spc.elf
|
||
|
/tmp/spc.elf
|
-
|
||
|
/tmp/spc.elf
|
-
|
||
|
/tmp/spc.elf
|
-
|
||
|
/tmp/spc.elf
|
-
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/rm
|
rm -f /tmp/tmp.mx2OgcVPFY /tmp/tmp.dEaMLCuelD /tmp/tmp.rW26XZ5TQm
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/cat
|
cat /tmp/tmp.mx2OgcVPFY
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/head
|
head -n 10
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/tr
|
tr -d \\000-\\011\\013\\014\\016-\\037
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/cut
|
cut -c -80
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/cat
|
cat /tmp/tmp.mx2OgcVPFY
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/head
|
head -n 10
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/tr
|
tr -d \\000-\\011\\013\\014\\016-\\037
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/cut
|
cut -c -80
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/rm
|
rm -f /tmp/tmp.mx2OgcVPFY /tmp/tmp.dEaMLCuelD /tmp/tmp.rW26XZ5TQm
|
There are 15 hidden processes, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http:///wget.sh
|
unknown
|
||
|
http:///curl.sh
|
unknown
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
7fffb6580000
|
page execute read
|
|||
|
55b791988000
|
page read and write
|
|||
|
55b793986000
|
page execute and read and write
|
|||
|
7f9424630000
|
page read and write
|
|||
|
7fffb6580000
|
page execute read
|
|||
|
7f9424630000
|
page read and write
|
|||
|
7f931c024000
|
page read and write
|
|||
|
55b793e3c000
|
page read and write
|
|||
|
55b791751000
|
page execute read
|
|||
|
7f931c022000
|
page read and write
|
|||
|
7f941c021000
|
page read and write
|
|||
|
7f941c021000
|
page read and write
|
|||
|
7f9424ca6000
|
page read and write
|
|||
|
7fffb64f9000
|
page read and write
|
|||
|
7f9424622000
|
page read and write
|
|||
|
7f931c021000
|
page execute read
|
|||
|
55b79197f000
|
page read and write
|
|||
|
7fffb64f9000
|
page read and write
|
|||
|
55b791988000
|
page read and write
|
|||
|
7f9425122000
|
page read and write
|
|||
|
7f9424ff1000
|
page read and write
|
|||
|
55b79399d000
|
page read and write
|
|||
|
7f9425167000
|
page read and write
|
|||
|
7f9424c81000
|
page read and write
|
|||
|
7f9423e1f000
|
page read and write
|
|||
|
7f9424c81000
|
page read and write
|
|||
|
7f9424622000
|
page read and write
|
|||
|
7f94248bf000
|
page read and write
|
|||
|
55b793e3c000
|
page read and write
|
|||
|
7f942511a000
|
page read and write
|
|||
|
55b79399d000
|
page read and write
|
|||
|
7f9425167000
|
page read and write
|
|||
|
7f9425122000
|
page read and write
|
|||
|
7f942511a000
|
page read and write
|
|||
|
55b79197f000
|
page read and write
|
|||
|
7f931c024000
|
page read and write
|
|||
|
7f941c000000
|
page read and write
|
|||
|
7f9423e1f000
|
page read and write
|
|||
|
7f94248bf000
|
page read and write
|
|||
|
7f941c000000
|
page read and write
|
|||
|
55b791751000
|
page execute read
|
|||
|
7f9424ca6000
|
page read and write
|
|||
|
7f931c022000
|
page read and write
|
|||
|
55b793986000
|
page execute and read and write
|
|||
|
7f931c021000
|
page execute read
|
|||
|
7f9424ff1000
|
page read and write
|
|||
|
7f931c026000
|
page read and write
|
There are 37 hidden memdumps, click here to show them.