IOC Report
m68k.elf

loading gif

Files

File Path
Type
Category
Malicious
m68k.elf
ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, with debug_info, not stripped
initial sample
 malicious
/tmp/Infected.log
ASCII text, with CRLF line terminators
dropped
/tmp/qemu-open.KiYzmc (deleted)
ASCII text
dropped

Processes

Path
Cmdline
Malicious
/tmp/m68k.elf
/tmp/m68k.elf
/tmp/m68k.elf
-
/tmp/m68k.elf
-
/tmp/m68k.elf
-

URLs

Name
IP
Malicious
181.214.231.152:96666
malicious
https://developers.google.com/search/docs/advanced/crawling/overview-google-crawlers)
unknown
http://www.spidersoft.com)
unknown
http://help.yahoo.com/help/us/ysearch/slurp)
unknown
http://www.google.com/bot.html)
unknown
http://www.google.com/mobile/adsbot.html)
unknown

Domains

Name
IP
Malicious
daisy.ubuntu.com
162.213.35.24

IPs

IP
Domain
Country
Malicious
181.214.231.152
unknown
Chile
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
7f51c004d000
page execute read
 malicious
7f51c004d000
page execute read
 malicious
7f51c004d000
page execute read
 malicious
56066d0e3000
page read and write
7f5245dc0000
page read and write
7f52452d6000
page read and write
7f51c0050000
page read and write
56066ff3a000
page read and write
56066ff3a000
page read and write
7f5240000000
page read and write
7f5244ac5000
page read and write
7f5245dc8000
page read and write
7f52452c8000
page read and write
7f5244ac5000
page read and write
7f5240021000
page read and write
56066ceb1000
page execute read
56066d0e3000
page read and write
56066f0e9000
page execute and read and write
56066f0e9000
page execute and read and write
7f51c0059000
page read and write
7f5245927000
page read and write
56066ceb1000
page execute read
7f52452c8000
page read and write
56066d0e3000
page read and write
7f5245dc8000
page read and write
7f5245c97000
page read and write
56066d0eb000
page read and write
7f5245dc0000
page read and write
7f5245e0d000
page read and write
7ffe00b8f000
page execute read
7ffe00b8f000
page execute read
56066f0e9000
page execute and read and write
7f5245e0d000
page read and write
7f5244ac5000
page read and write
7f5245927000
page read and write
56066f180000
page read and write
7f52452d6000
page read and write
7f5245e0d000
page read and write
7f51c0050000
page read and write
7f5245dc8000
page read and write
7f5245565000
page read and write
56066ceb1000
page execute read
56066f180000
page read and write
56066f180000
page read and write
7f51c0059000
page read and write
7f5245c97000
page read and write
7f51c0059000
page read and write
56066ff3a000
page read and write
56066d0eb000
page read and write
7f51c0050000
page read and write
7f5240000000
page read and write
7f524594c000
page read and write
7f5240000000
page read and write
7f5245565000
page read and write
7f52452d6000
page read and write
7f5245c97000
page read and write
56066d0eb000
page read and write
7ffe00b51000
page read and write
7f5245dc0000
page read and write
7f524594c000
page read and write
7f5240021000
page read and write
7f524594c000
page read and write
7ffe00b8f000
page execute read
7f5245565000
page read and write
7f5240021000
page read and write
7ffe00b51000
page read and write
7f5245927000
page read and write
7ffe00b51000
page read and write
7f52452c8000
page read and write
There are 59 hidden memdumps, click here to show them.