Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
dlr.arm7.elf
|
ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
|
initial sample
|
 |
|
|
/tmp/byte
|
ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
/tmp/dlr.arm7.elf
|
/tmp/dlr.arm7.elf
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
154.216.16.39
|
unknown
|
Seychelles
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
7fa351ead000
|
page read and write
|
|||
|
7fa34c021000
|
page read and write
|
|||
|
7fa3521db000
|
page read and write
|
|||
|
55baa17c9000
|
page execute read
|
|||
|
7ffe6fdf0000
|
page execute read
|
|||
|
7fa35156f000
|
page read and write
|
|||
|
7fa352220000
|
page read and write
|
|||
|
7fa3518d1000
|
page read and write
|
|||
|
7fa3521b7000
|
page read and write
|
|||
|
7fa350cd5000
|
page read and write
|
|||
|
55baa1a1a000
|
page read and write
|
|||
|
7fa3514dd000
|
page read and write
|
|||
|
7fa351b5f000
|
page read and write
|
|||
|
55baa1a23000
|
page read and write
|
|||
|
7fa24c020000
|
page read and write
|
|||
|
7fa35208e000
|
page read and write
|
|||
|
55baa3a21000
|
page execute and read and write
|
|||
|
55baa3a38000
|
page read and write
|
|||
|
7ffe6fdbc000
|
page read and write
|
|||
|
7fa34bfff000
|
page read and write
|
|||
|
7fa351b3c000
|
page read and write
|
|||
|
7fa351ccb000
|
page read and write
|
|||
|
55baa537f000
|
page read and write
|
|||
|
7fa24c018000
|
page execute read
|
There are 14 hidden memdumps, click here to show them.