Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
/tmp/zone.i686.elf
|
/tmp/zone.i686.elf
|
||
|
/tmp/zone.i686.elf
|
-
|
||
|
/tmp/zone.i686.elf
|
/tmp/zone.i686.elf -b
|
||
|
/tmp/zone.i686.elf
|
-
|
||
|
/bin/bash
|
/bin/bash -c uptime
|
||
|
/usr/bin/uptime
|
uptime
|
||
|
/tmp/zone.i686.elf
|
-
|
||
|
/usr/bin/bash
|
bash -c "cat /proc/net/dev |grep ens160 |awk '{print $2}'"
|
||
|
/usr/bin/bash
|
-
|
||
|
/usr/bin/cat
|
cat /proc/net/dev
|
||
|
/usr/bin/bash
|
-
|
||
|
/usr/bin/grep
|
grep ens160
|
||
|
/usr/bin/bash
|
-
|
||
|
/usr/bin/awk
|
awk "{print $2}"
|
||
|
/tmp/zone.i686.elf
|
-
|
||
|
/usr/bin/bash
|
bash -c "cat /proc/net/dev |grep ens160 |awk '{print $10}'"
|
||
|
/usr/bin/bash
|
-
|
||
|
/usr/bin/cat
|
cat /proc/net/dev
|
||
|
/usr/bin/bash
|
-
|
||
|
/usr/bin/grep
|
grep ens160
|
||
|
/usr/bin/bash
|
-
|
||
|
/usr/bin/awk
|
awk "{print $10}"
|
||
|
/tmp/zone.i686.elf
|
-
|
||
|
/usr/bin/bash
|
bash -c "cat /proc/net/dev |grep ens160 |awk '{print $2}'"
|
||
|
/usr/bin/bash
|
-
|
||
|
/usr/bin/cat
|
cat /proc/net/dev
|
||
|
/usr/bin/bash
|
-
|
||
|
/usr/bin/grep
|
grep ens160
|
||
|
/usr/bin/bash
|
-
|
||
|
/usr/bin/awk
|
awk "{print $2}"
|
||
|
/tmp/zone.i686.elf
|
-
|
||
|
/usr/bin/bash
|
bash -c "cat /proc/net/dev |grep ens160 |awk '{print $10}'"
|
||
|
/usr/bin/bash
|
-
|
||
|
/usr/bin/cat
|
cat /proc/net/dev
|
||
|
/usr/bin/bash
|
-
|
||
|
/usr/bin/grep
|
grep ens160
|
||
|
/usr/bin/bash
|
-
|
||
|
/usr/bin/awk
|
awk "{print $10}"
|
||
|
/tmp/zone.i686.elf
|
-
|
||
|
/usr/bin/bash
|
bash -c "cat /proc/net/dev |grep ens160 |awk '{print $2}'"
|
||
|
/usr/bin/bash
|
-
|
||
|
/usr/bin/cat
|
cat /proc/net/dev
|
||
|
/usr/bin/bash
|
-
|
||
|
/usr/bin/grep
|
grep ens160
|
||
|
/usr/bin/bash
|
-
|
||
|
/usr/bin/awk
|
awk "{print $2}"
|
||
|
/tmp/zone.i686.elf
|
-
|
||
|
/usr/bin/bash
|
bash -c "cat /proc/net/dev |grep ens160 |awk '{print $10}'"
|
||
|
/usr/bin/bash
|
-
|
||
|
/usr/bin/cat
|
cat /proc/net/dev
|
||
|
/usr/bin/bash
|
-
|
||
|
/usr/bin/grep
|
grep ens160
|
||
|
/usr/bin/bash
|
-
|
||
|
/usr/bin/awk
|
awk "{print $10}"
|
There are 44 hidden processes, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://upx.sf.net
|
unknown
|
 |
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
38.60.221.177
|
unknown
|
United States
|
||
|
109.202.202.202
|
unknown
|
Switzerland
|
||
|
91.189.91.43
|
unknown
|
United Kingdom
|
||
|
91.189.91.42
|
unknown
|
United Kingdom
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
ef894000
|
page read and write
|
|||
|
ffed9000
|
page read and write
|
|||
|
ef887000
|
page read and write
|
|||
|
ac00000
|
page read and write
|
|||
|
8ea3000
|
page read and write
|
|||
|
f7efc000
|
page read and write
|
|||
|
ef8a9000
|
page read and write
|
|||
|
ef8b6000
|
page read and write
|
|||
|
8487000
|
page execute read
|
|||
|
ef874000
|
page read and write
|
|||
|
ffd22000
|
page read and write
|
|||
|
ef867000
|
page read and write
|
|||
|
8487000
|
page execute read
|
|||
|
f7f0b000
|
page read and write
|
|||
|
f7f0f000
|
page execute read
|
|||
|
f7f09000
|
page read and write
|
|||
|
f7f02000
|
page execute read
|
|||
|
b800000
|
page read and write
|
|||
|
8ea3000
|
page read and write
|
|||
|
f7efe000
|
page read and write
|
There are 10 hidden memdumps, click here to show them.