Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
na.elf

Overview

General Information

Sample name:na.elf
Analysis ID:1589477
MD5:074e0bf7210fbb761c0788b03511d7ce
SHA1:0dcce5c6042f2c7102a927ad9495fe79cc9150fb
SHA256:979bd5b675020cf6696f0a6eef0e581227e30a044f04263fee77242ee22578c1
Tags:elfuser-abuse_ch
Infos:

Detection

Prometei
Score:96
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Prometei
Drops files in suspicious directories
Found Tor onion address
Machine Learning detection for dropped file
Machine Learning detection for sample
Sample deletes itself
Sample is packed with UPX
Creates hidden files and/or directories
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "pgrep" command search for and/or send signals to processes
Executes the "systemctl" command used for controlling the systemd system and service manager
HTTP GET or POST without a user agent
Reads CPU information from /sys indicative of miner or evasive malware
Reads system information from the proc file system
Sample contains only a LOAD segment without any section mappings
Sample listens on a socket
Sample tries to set the executable flag
Suricata IDS alerts with low severity for network traffic
Uses the "uname" system call to query kernel version information (possible evasion)
Writes ELF files to disk
Yara signature match

Classification

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1589477
Start date and time:2025-01-12 16:09:27 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 55s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:na.elf
Detection:MAL
Classification:mal96.troj.evad.linELF@0/5@1/0

Warnings

  • VT rate limit hit for: http://dummy.zero/cgi-bin/prometei.cgi
  • VT rate limit hit for: http://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.b32.i2p/cgi-bin/prometei.cgi
  • VT rate limit hit for: http://p3.feefreepool.net/cgi-bin/prometei.cgi
  • VT rate limit hit for: http://p3.feefreepool.net/cgi-bin/prometei.cgihttp://dummy.zero/cgi-bin/prometei.cgihttps://gb7ni5rg
  • VT rate limit hit for: https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi

Runtime Messages

Command:/tmp/na.elf
PID:5534
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Starting...
System install...OK
Standard Error:Created symlink /etc/systemd/system/multi-user.target.wants/uplugplay.service /lib/systemd/system/uplugplay.service.

Process Tree

  • system is lnxubuntu20
  • na.elf (PID: 5534, Parent: 5451, MD5: 074e0bf7210fbb761c0788b03511d7ce) Arguments: /tmp/na.elf
    • na.elf New Fork (PID: 5537, Parent: 5534)
    • sh (PID: 5537, Parent: 5534, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pgrep na.elf"
      • sh New Fork (PID: 5538, Parent: 5537)
      • pgrep (PID: 5538, Parent: 5537, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pgrep na.elf
    • na.elf New Fork (PID: 5541, Parent: 5534)
    • sh (PID: 5541, Parent: 5534, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pidof na.elf"
      • sh New Fork (PID: 5542, Parent: 5541)
      • pidof (PID: 5542, Parent: 5541, MD5: f58f67968fc50f1497f9ea9e9c22b6e8) Arguments: pidof na.elf
    • na.elf New Fork (PID: 5547, Parent: 5534)
    • sh (PID: 5547, Parent: 5534, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pgrep uplugplay"
      • sh New Fork (PID: 5548, Parent: 5547)
      • pgrep (PID: 5548, Parent: 5547, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pgrep uplugplay
    • na.elf New Fork (PID: 5551, Parent: 5534)
    • sh (PID: 5551, Parent: 5534, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pidof uplugplay"
      • sh New Fork (PID: 5552, Parent: 5551)
      • pidof (PID: 5552, Parent: 5551, MD5: f58f67968fc50f1497f9ea9e9c22b6e8) Arguments: pidof uplugplay
    • na.elf New Fork (PID: 5555, Parent: 5534)
    • sh (PID: 5555, Parent: 5534, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pgrep upnpsetup"
      • sh New Fork (PID: 5556, Parent: 5555)
      • pgrep (PID: 5556, Parent: 5555, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pgrep upnpsetup
    • na.elf New Fork (PID: 5559, Parent: 5534)
    • sh (PID: 5559, Parent: 5534, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl daemon-reload"
      • sh New Fork (PID: 5560, Parent: 5559)
      • systemctl (PID: 5560, Parent: 5559, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl daemon-reload
    • na.elf New Fork (PID: 5564, Parent: 5534)
    • sh (PID: 5564, Parent: 5534, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl enable uplugplay.service"
      • sh New Fork (PID: 5565, Parent: 5564)
      • systemctl (PID: 5565, Parent: 5564, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl enable uplugplay.service
    • na.elf New Fork (PID: 5569, Parent: 5534)
    • sh (PID: 5569, Parent: 5534, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl start uplugplay.service"
      • sh New Fork (PID: 5570, Parent: 5569)
      • systemctl (PID: 5570, Parent: 5569, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl start uplugplay.service
  • systemd New Fork (PID: 5562, Parent: 5561)
  • snapd-env-generator (PID: 5562, Parent: 5561, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator
  • systemd New Fork (PID: 5567, Parent: 5566)
  • snapd-env-generator (PID: 5567, Parent: 5566, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator
  • systemd New Fork (PID: 5571, Parent: 1)
  • uplugplay (PID: 5571, Parent: 1, MD5: 074e0bf7210fbb761c0788b03511d7ce) Arguments: /usr/sbin/uplugplay
    • uplugplay New Fork (PID: 5582, Parent: 5571)
      • sh (PID: 5583, Parent: 5582, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "/usr/sbin/uplugplay -Dcomsvc"
        • sh New Fork (PID: 5584, Parent: 5583)
        • uplugplay (PID: 5584, Parent: 5583, MD5: 074e0bf7210fbb761c0788b03511d7ce) Arguments: /usr/sbin/uplugplay -Dcomsvc
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
PrometeiNo Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.prometei

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
5534.1.0000000000401000.00000000004ed000.r-x.sdmpLinux_Hacktool_Flooder_1a4eb229unknownunknown
  • 0x28a0:$a: F4 8B 45 E8 83 C0 01 89 45 F8 EB 0F 8B 45 E8 83 C0 01 89 45 F4 8B
5534.1.0000000000401000.00000000004ed000.r-x.sdmpLinux_Hacktool_Flooder_f454ec10unknownunknown
  • 0x3fee:$a: 8B 45 EC 48 63 D0 48 8B 45 D0 48 01 D0 0F B6 00 3C 2E 75 4D 8B
Process Memory Space: na.elf PID: 5534JoeSecurity_PrometeiYara detected PrometeiJoe Security

    Suricata Signatures

    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2025-01-12T16:10:51.023281+010020445621A Network Trojan was detected192.168.2.155696488.198.246.24280TCP
    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2025-01-12T16:10:29.640991+010020445611Domain Observed Used for C2 Detected192.168.2.15393868.8.8.853UDP
    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2025-01-12T16:10:51.023281+010028033053Unknown Traffic192.168.2.155696488.198.246.24280TCP

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Multi AV Scanner detection for submitted file
    Source: na.elfVirustotal: Detection: 34%Perma Link
    Source: na.elfReversingLabs: Detection: 44%
    Machine Learning detection for dropped file
    Source: /usr/sbin/uplugplayJoe Sandbox ML: detected
    Machine Learning detection for sample
    Source: na.elfJoe Sandbox ML: detected

    Bitcoin Miner

    barindex
    Yara detected Prometei
    Source: Yara matchFile source: Process Memory Space: na.elf PID: 5534, type: MEMORYSTR
    Source: /usr/bin/pgrep (PID: 5538)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5548)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
    Source: /usr/sbin/uplugplay (PID: 5584)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior

    Networking

    barindex
    Suricata IDS alerts for network traffic
    Source: Network trafficSuricata IDS: 2044561 - Severity 1 - ET MALWARE Prometei Botnet CnC Domain (feefreepool .net) in DNS Lookup : 192.168.2.15:39386 -> 8.8.8.8:53
    Source: Network trafficSuricata IDS: 2044562 - Severity 1 - ET MALWARE Prometei Botnet CnC Checkin : 192.168.2.15:56964 -> 88.198.246.242:80
    Found Tor onion address
    Source: na.elf, 5534.1.0000000000520000.0000000001565000.rw-.sdmpString found in binary or memory: https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi
    Source: na.elf, 5534.1.0000000000520000.0000000001565000.rw-.sdmpString found in binary or memory: Mhttp://p3.feefreepool.net/cgi-bin/prometei.cgihttp://dummy.zero/cgi-bin/prometei.cgihttps://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgihttp://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.b32.i2p/cgi-bin/prometei.cgi/usr/sbin/uplugplay/etc/uplugplay/etc/CommIdcrashed.dump/usr/sbin//etc/msdtcmsdtc2msdtc3/etc/pcc0/etc/pcc1pbdebug
    Source: global trafficHTTP traffic detected: GET /cgi-bin/prometei.cgi?r=9&i=6U5A3B6IQXG40062 HTTP/1.0Host: p3.feefreepool.net
    Source: /usr/sbin/uplugplay (PID: 5584)Socket: 0.0.0.0:88Jump to behavior
    Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.15:56964 -> 88.198.246.242:80
    Source: global trafficHTTP traffic detected: GET /cgi-bin/prometei.cgi?r=9&i=6U5A3B6IQXG40062 HTTP/1.0Host: p3.feefreepool.net
    Source: global trafficDNS traffic detected: DNS query: p3.feefreepool.net
    Source: na.elf, 5534.1.0000000000520000.0000000001565000.rw-.sdmpString found in binary or memory: http://dummy.zero/cgi-bin/prometei.cgi
    Source: na.elf, 5534.1.0000000000520000.0000000001565000.rw-.sdmpString found in binary or memory: http://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.b32.i2p/cgi-bin/prometei.cgi
    Source: na.elf, 5534.1.0000000000520000.0000000001565000.rw-.sdmpString found in binary or memory: http://p3.feefreepool.net/cgi-bin/prometei.cgi
    Source: na.elf, 5534.1.0000000000520000.0000000001565000.rw-.sdmpString found in binary or memory: http://p3.feefreepool.net/cgi-bin/prometei.cgihttp://dummy.zero/cgi-bin/prometei.cgihttps://gb7ni5rg
    Source: na.elf, uplugplay.12.drString found in binary or memory: http://upx.sf.net
    Source: na.elf, 5534.1.0000000000520000.0000000001565000.rw-.sdmpString found in binary or memory: https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi

    System Summary

    barindex
    Malicious sample detected (through community Yara rule)
    Source: 5534.1.0000000000401000.00000000004ed000.r-x.sdmp, type: MEMORYMatched rule: Linux_Hacktool_Flooder_1a4eb229 Author: unknown
    Source: 5534.1.0000000000401000.00000000004ed000.r-x.sdmp, type: MEMORYMatched rule: Linux_Hacktool_Flooder_f454ec10 Author: unknown
    Source: LOAD without section mappingsProgram segment: 0x400000
    Source: 5534.1.0000000000401000.00000000004ed000.r-x.sdmp, type: MEMORYMatched rule: Linux_Hacktool_Flooder_1a4eb229 reference_sample = bf6f3ffaf94444a09b69cbd4c8c0224d7eb98eb41514bdc3f58c1fb90ac0e705, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Hacktool.Flooder, fingerprint = de076ef23c2669512efc00ddfe926ef04f8ad939061c69131a0ef9a743639371, id = 1a4eb229-a194-46a5-8e93-370a40ba999b, last_modified = 2021-09-16
    Source: 5534.1.0000000000401000.00000000004ed000.r-x.sdmp, type: MEMORYMatched rule: Linux_Hacktool_Flooder_f454ec10 severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 0297e1ad6e180af85256a175183102776212d324a2ce0c4f32e8a44a2e2e9dad, license = Elastic License v2, threat_name = Linux.Hacktool.Flooder, fingerprint = 2ae5e2c3190a4ce5d238efdb10ac0520987425fb7af52246b6bf948abd0259da, id = f454ec10-7a67-4717-9e95-fecb7c357566, last_modified = 2022-01-26
    Source: classification engineClassification label: mal96.troj.evad.linELF@0/5@1/0

    Data Obfuscation

    barindex
    Sample is packed with UPX
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Id: UPX 3.95 Copyright (C) 1996-2018 the UPX Team. All Rights Reserved. $
    Source: /usr/bin/pidof (PID: 5542)Directory: //.Jump to behavior
    Source: /usr/bin/pidof (PID: 5552)Directory: //.Jump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/110/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/110/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/231/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/231/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/111/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/111/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/112/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/112/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/233/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/233/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/113/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/113/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/114/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/114/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/235/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/235/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/115/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/115/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/1333/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/1333/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/116/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/116/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/1695/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/1695/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/117/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/117/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/118/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/118/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/119/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/119/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/911/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/911/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/914/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/914/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/10/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/10/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/917/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/917/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/11/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/11/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/12/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/12/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/13/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/13/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/14/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/14/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/15/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/15/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/16/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/16/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/17/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/17/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/18/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/18/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/19/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/19/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/1591/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/1591/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/120/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/120/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/121/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/121/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/1/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/1/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/122/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/122/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/243/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/243/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/2/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/2/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/123/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/123/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/3/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/3/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/124/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/124/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/1588/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/1588/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/125/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/125/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/4/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/4/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/246/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/246/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/126/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/126/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/5/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/5/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/127/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/127/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/6/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/6/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/1585/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/1585/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/128/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/128/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/7/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/7/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/129/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/129/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/8/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/8/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/800/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/800/cmdlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/9/statusJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)File opened: /proc/9/cmdlineJump to behavior
    Source: /tmp/na.elf (PID: 5537)Shell command executed: sh -c "pgrep na.elf"Jump to behavior
    Source: /tmp/na.elf (PID: 5541)Shell command executed: sh -c "pidof na.elf"Jump to behavior
    Source: /tmp/na.elf (PID: 5547)Shell command executed: sh -c "pgrep uplugplay"Jump to behavior
    Source: /tmp/na.elf (PID: 5551)Shell command executed: sh -c "pidof uplugplay"Jump to behavior
    Source: /tmp/na.elf (PID: 5555)Shell command executed: sh -c "pgrep upnpsetup"Jump to behavior
    Source: /tmp/na.elf (PID: 5559)Shell command executed: sh -c "systemctl daemon-reload"Jump to behavior
    Source: /tmp/na.elf (PID: 5564)Shell command executed: sh -c "systemctl enable uplugplay.service"Jump to behavior
    Source: /tmp/na.elf (PID: 5569)Shell command executed: sh -c "systemctl start uplugplay.service"Jump to behavior
    Source: /usr/sbin/uplugplay (PID: 5583)Shell command executed: sh -c "/usr/sbin/uplugplay -Dcomsvc"Jump to behavior
    Source: /bin/sh (PID: 5538)Pgrep executable: /usr/bin/pgrep -> pgrep na.elfJump to behavior
    Source: /bin/sh (PID: 5548)Pgrep executable: /usr/bin/pgrep -> pgrep uplugplayJump to behavior
    Source: /bin/sh (PID: 5556)Pgrep executable: /usr/bin/pgrep -> pgrep upnpsetupJump to behavior
    Source: /bin/sh (PID: 5560)Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reloadJump to behavior
    Source: /bin/sh (PID: 5565)Systemctl executable: /usr/bin/systemctl -> systemctl enable uplugplay.serviceJump to behavior
    Source: /bin/sh (PID: 5570)Systemctl executable: /usr/bin/systemctl -> systemctl start uplugplay.serviceJump to behavior
    Source: /usr/sbin/uplugplay (PID: 5584)Reads from proc file: /proc/statJump to behavior
    Source: /tmp/na.elf (PID: 5534)File: /usr/sbin/uplugplay (bits: -v usr: x grp: x all: r)Jump to behavior
    Source: /tmp/na.elf (PID: 5534)File written: /usr/sbin/uplugplayJump to dropped file
    Source: submitted sampleStderr: Created symlink /etc/systemd/system/multi-user.target.wants/uplugplay.service /lib/systemd/system/uplugplay.service.: exit code = 0

    Hooking and other Techniques for Hiding and Protection

    barindex
    Drops files in suspicious directories
    Source: /tmp/na.elf (PID: 5534)File: /usr/sbin/uplugplayJump to dropped file
    Sample deletes itself
    Source: /tmp/na.elf (PID: 5534)File: /tmp/na.elfJump to behavior
    Source: na.elfSubmission file: segment LOAD with 7.942 entropy (max. 8.0)
    Source: uplugplay.12.drDropped file: segment LOAD with 7.942 entropy (max. 8.0)
    Source: /usr/bin/pgrep (PID: 5538)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5548)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
    Source: /usr/bin/pgrep (PID: 5556)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
    Source: /usr/sbin/uplugplay (PID: 5584)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
    Source: /tmp/na.elf (PID: 5534)Queries kernel information via 'uname': Jump to behavior
    Source: /usr/sbin/uplugplay (PID: 5571)Queries kernel information via 'uname': Jump to behavior
    Source: /usr/sbin/uplugplay (PID: 5584)Queries kernel information via 'uname': Jump to behavior

    Mitre Att&ck Matrix

    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity Information1
    Scripting    		Valid AccountsWindows Management Instrumentation1
    Systemd Service    		1
    Systemd Service    		1
    Masquerading    		1
    OS Credential Dumping    		1
    Security Software Discovery    		Remote ServicesData from Local System1
    Ingress Tool Transfer    		Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault AccountsScheduled Task/Job1
    Scripting    		Boot or Logon Initialization Scripts1
    File and Directory Permissions Modification    		LSASS Memory2
    System Information Discovery    		Remote Desktop ProtocolData from Removable Media2
    Non-Application Layer Protocol    		Exfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
    Hidden Files and Directories    		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
    Application Layer Protocol    		Automated ExfiltrationData Encrypted for Impact
    Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
    Obfuscated Files or Information    		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
    Proxy    		Traffic DuplicationData Destruction
    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
    File Deletion    		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact

    Malware Configuration

    ⊘No configs have been found

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1589477 Sample: na.elf Startdate: 12/01/2025 Architecture: LINUX Score: 96 52 p3.feefreepool.net 88.198.246.242, 56964, 80 HETZNER-ASDE Germany 2->52 54 Suricata IDS alerts for network traffic 2->54 56 Malicious sample detected (through community Yara rule) 2->56 58 Multi AV Scanner detection for submitted file 2->58 60 4 other signatures 2->60 9 na.elf 2->9         started        13 systemd uplugplay 2->13         started        15 systemd snapd-env-generator 2->15         started        17 systemd snapd-env-generator 2->17         started        signatures3 process4 file5 48 /usr/sbin/uplugplay, ELF 9->48 dropped 62 Found Tor onion address 9->62 64 Drops files in suspicious directories 9->64 66 Sample deletes itself 9->66 19 na.elf sh 9->19         started        21 na.elf sh 9->21         started        23 na.elf sh 9->23         started        27 5 other processes 9->27 25 uplugplay 13->25         started        signatures6 process7 process8 29 sh pgrep 19->29         started        31 sh pidof 21->31         started        33 sh pgrep 23->33         started        35 uplugplay sh 25->35         started        37 sh pidof 27->37         started        39 sh pgrep 27->39         started        41 sh systemctl 27->41         started        43 2 other processes 27->43 process9 45 sh uplugplay 35->45         started        file10 50 /etc/CommId, ASCII 45->50 dropped

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    na.elf34%VirustotalBrowse
    na.elf45%ReversingLabsLinux.Trojan.Prometei
    na.elf100%Joe Sandbox ML

    Dropped Files

    SourceDetectionScannerLabelLink
    /usr/sbin/uplugplay100%Joe Sandbox ML
    /usr/sbin/uplugplay45%ReversingLabsLinux.Trojan.Prometei

    Domains

    ⊘No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    http://p3.feefreepool.net/cgi-bin/prometei.cgi100%Avira URL Cloudmalware
    http://dummy.zero/cgi-bin/prometei.cgi0%Avira URL Cloudsafe
    http://p3.feefreepool.net/cgi-bin/prometei.cgihttp://dummy.zero/cgi-bin/prometei.cgihttps://gb7ni5rg100%Avira URL Cloudmalware
    http://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.b32.i2p/cgi-bin/prometei.cgi0%Avira URL Cloudsafe
    https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi0%Avira URL Cloudsafe

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    p3.feefreepool.net
    		88.198.246.242
    		truefalse
      		high

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      http://p3.feefreepool.net/cgi-bin/prometei.cgihttp://dummy.zero/cgi-bin/prometei.cgihttps://gb7ni5rgna.elf, 5534.1.0000000000520000.0000000001565000.rw-.sdmptrue
      • Avira URL Cloud: malware
      		unknown
      http://upx.sf.netna.elf, uplugplay.12.drfalse
        		high
        http://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.b32.i2p/cgi-bin/prometei.cgina.elf, 5534.1.0000000000520000.0000000001565000.rw-.sdmptrue
        • Avira URL Cloud: safe
        		unknown
        http://p3.feefreepool.net/cgi-bin/prometei.cgina.elf, 5534.1.0000000000520000.0000000001565000.rw-.sdmptrue
        • Avira URL Cloud: malware
        		unknown
        https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgina.elf, 5534.1.0000000000520000.0000000001565000.rw-.sdmptrue
        • Avira URL Cloud: safe
        		unknown
        http://dummy.zero/cgi-bin/prometei.cgina.elf, 5534.1.0000000000520000.0000000001565000.rw-.sdmptrue
        • Avira URL Cloud: safe
        		unknown

        World Map of Contacted IPs

        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs

        Public IPs

        IPDomainCountryFlagASNASN NameMalicious
        88.198.246.242
        		p3.feefreepool.netGermany
        		24940HETZNER-ASDEfalse

        Joe Sandbox View / Context

        IPs

        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        88.198.246.242na.elfGet hashmaliciousPrometeiBrowse
        • p3.feefreepool.net/cgi-bin/prometei.cgi?r=8&i=U5B3T6E4P0AY2IX4
        na.elfGet hashmaliciousPrometeiBrowse
        • p3.feefreepool.net/cgi-bin/prometei.cgi?r=0&i=317J6ADMA50BZ3KC
        na.elfGet hashmaliciousPrometeiBrowse
        • p3.feefreepool.net/cgi-bin/prometei.cgi?r=4&i=BCADD05S0253KFZM
        na.elfGet hashmaliciousPrometeiBrowse
        • p3.feefreepool.net/cgi-bin/prometei.cgi?r=20&i=IH3U3249M154U40B
        wCzxNCXdPhGet hashmaliciousUnknownBrowse
        • p3.feefreepool.net/cgi-bin/prometei.cgi?r=22&i=57206Y026Q0ZQ3NC
        zsvcGet hashmaliciousUnknownBrowse
        • p3.feefreepool.net/cgi-bin/prometei.cgi?r=0&i=271872B6X2BPQ1Z2
        zJ4GNlikawGet hashmaliciousUnknownBrowse
        • p3.feefreepool.net/cgi-bin/prometei.cgi?r=20&i=PG1TCJ8GTFD7733K
        OLzheOx1kwGet hashmaliciousUnknownBrowse
        • p3.feefreepool.net/cgi-bin/prometei.cgi?r=16&i=MF97754VWVW4HRWU
        wH04DSYf6gGet hashmaliciousUnknownBrowse
        • p3.feefreepool.net/cgi-bin/prometei.cgi?r=16&i=3CL80UN6USPBIKPL
        nRlZAbNdJxGet hashmaliciousUnknownBrowse
        • p3.feefreepool.net/cgi-bin/prometei.cgi?r=53&i=5HNN7ZK1006GY32G

        Domains

        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        p3.feefreepool.netna.elfGet hashmaliciousPrometeiBrowse
        • 88.198.246.242
        na.elfGet hashmaliciousPrometeiBrowse
        • 88.198.246.242
        na.elfGet hashmaliciousPrometeiBrowse
        • 88.198.246.242
        na.elfGet hashmaliciousPrometeiBrowse
        • 88.198.246.242
        wCzxNCXdPhGet hashmaliciousUnknownBrowse
        • 88.198.246.242
        zsvcGet hashmaliciousUnknownBrowse
        • 88.198.246.242
        zJ4GNlikawGet hashmaliciousUnknownBrowse
        • 88.198.246.242
        OLzheOx1kwGet hashmaliciousUnknownBrowse
        • 88.198.246.242
        wH04DSYf6gGet hashmaliciousUnknownBrowse
        • 88.198.246.242
        nRlZAbNdJxGet hashmaliciousUnknownBrowse
        • 88.198.246.242

        ASNs

        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        HETZNER-ASDEna.elfGet hashmaliciousPrometeiBrowse
        • 88.198.246.242
        na.elfGet hashmaliciousPrometeiBrowse
        • 88.198.246.242
        na.elfGet hashmaliciousPrometeiBrowse
        • 88.198.246.242
        na.elfGet hashmaliciousPrometeiBrowse
        • 88.198.246.242
        https://talktalk770.weebly.com/Get hashmaliciousHTMLPhisherBrowse
        • 176.9.112.17
        build.exeGet hashmaliciousVidarBrowse
        • 116.203.166.124
        80P.exeGet hashmaliciousI2PRATBrowse
        • 135.181.93.228
        5.elfGet hashmaliciousUnknownBrowse
        • 135.181.142.143
        https://mrohailkhan.com/energyaustralia/auth/auhs1/Get hashmaliciousUnknownBrowse
        • 138.201.222.163
        4p5XLVXJnq.exeGet hashmaliciousFormBookBrowse
        • 136.243.225.5

        JA3 Fingerprints

        ⊘No context

        Dropped Files

        ⊘No context

        Created / dropped Files

        /etc/CommId

        Download File
        Process:/usr/sbin/uplugplay
        File Type:ASCII text, with no line terminators
        Category:dropped
        Size (bytes):16
        Entropy (8bit):3.577819531114783
        Encrypted:false
        SSDEEP:3:YRz:U
        MD5:E60AE1FAAC94E02D6E9098FD37253A66
        SHA1:38830EE13D24AF2D4A9E1AF016F81DF1EAC8EBCD
        SHA-256:5693B12EB8D181A90535A6014A5AA356641E18516691C1FB742801B45F39C102
        SHA-512:B0C6D765DFB5879958E6A5B1646F41BB8839E8B8431B4691BCD58890C1E9B5BCCF6713CDF5C67920EE20C96A45A04BB1B6A8C12DBA852DFCA2460085A302F4B1
        Malicious:true
        Reputation:low
        Preview:6U5A3B6IQXG40062

        /memfd:snapd-env-generator (deleted)

        Download File
        Process:/usr/lib/systemd/system-environment-generators/snapd-env-generator
        File Type:ASCII text
        Category:dropped
        Size (bytes):76
        Entropy (8bit):3.7627880354948586
        Encrypted:false
        SSDEEP:3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
        MD5:D86A1F5765F37989EB0EC3837AD13ECC
        SHA1:D749672A734D9DEAFD61DCA501C6929EC431B83E
        SHA-256:85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
        SHA-512:338C4B776FDCC2D05E869AE1F9DB64E6E7ECC4C621AB45E51DD07C73306BACBAD7882BE8D3ACF472CAEB30D4E5367F8793D3E006694184A68F74AC943A4B7C07
        Malicious:false
        Reputation:moderate, very likely benign file
        Preview:PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin.

        /usr/lib/systemd/system/uplugplay.service

        Download File
        Process:/tmp/na.elf
        File Type:ASCII text
        Category:dropped
        Size (bytes):145
        Entropy (8bit):4.769509838572339
        Encrypted:false
        SSDEEP:3:zMZa75X1PxQJqtWA1+DRvBADMikAdIgQ+aQmNJX4ev+sirSkQmWA1+DRvn:z8uXcqtWA4RZAMD+aBNdhTILQmWA4Rv
        MD5:8CA62D1F47880BCE036C2956C9B7B272
        SHA1:3BCC3A5C4FCC5B0D08C4524A59F6B8E113B62060
        SHA-256:C655D3D4E374FAD38313EC4262207B2D7D68A870238F203EF3C33F85E66C8E32
        SHA-512:4CD2D9D67151FA25E833707DEE2442C4A5F752053FC2C36EC73C0E2B734C66CA69C63FCEB47714D9ADD5B9FE2EEE1E45BE5199E2CAE7C26173E766B333877DA6
        Malicious:false
        Reputation:moderate, very likely benign file
        Preview:[Unit].Description=UPlugPlay.After=multi-user.target..[Service].Type=forking.ExecStart=/usr/sbin/uplugplay..[Install].WantedBy=multi-user.target.

        /usr/sbin/uplugplay

        Download File
        Process:/tmp/na.elf
        File Type:ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, no section header
        Category:dropped
        Size (bytes):428272
        Entropy (8bit):7.941785553169317
        Encrypted:false
        SSDEEP:12288:6QIkwT+V+46MTuxN+qpMBUH5kAAxwWVtBeSv:W4/y+qaBUZJAdVtr
        MD5:074E0BF7210FBB761C0788B03511D7CE
        SHA1:0DCCE5C6042F2C7102A927AD9495FE79CC9150FB
        SHA-256:979BD5B675020CF6696F0A6EEF0E581227E30A044F04263FEE77242EE22578C1
        SHA-512:5D343B3596F84FA6D6813440A8DA7A7DCDB985323ED5252DF5758BBF657F1833E07544F52B71EBD4CB5FC96CC4EF22A8E876461D1CB354B916B275E59601A005
        Malicious:true
        Antivirus:
        • Antivirus: Joe Sandbox ML, Detection: 100%
        • Antivirus: ReversingLabs, Detection: 45%
        Reputation:low
        Preview:.ELF..............>.....HwF.....@...................@.8...@.......................@.......@.....c.......c.................................F.......F.............................Q.td....................................................d&..UPX!(........8...8..p............. ..ELF......>....@.w.}...0..'8..........W.3c...[......o...| m.@.......o../.NnbK>...o...=...-.Q.`XO.q..i.m`o..p..@b... ....o..d...D_"x.D...O..r.(.S.td`...OQn......oRO.1XG^...$I....T.P.............y......GNU....'..l......?@..?..N...&..u.. . ..z3~......._....R.%..y...kM./.l../.. .D.0..v!#.../...]`..p7K........_...E.P.L...lH...dG......@...;..._..C2..../.6.\.K...x......po0F^.'h.P.`.2.B..Xpr.b'P/..LH\.'..@..pr1.8?P0.d..o..(.8..N ?p.I...J.$......c...I&.n.......H...H...H..t..."...9.....?..%......D................................}....ume....]U....ME=....5-%..................&..E.t$..T$.<{....%.....H.|$....\9.g...Sd2.OH.. ......kn(...$. 1.H9.`[..t>d....4..u......>2..w..H.. -U.H.=$...o....... ......=.._w.Ru6...k.

        Static File Info

        General

        File type:ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, no section header
        Entropy (8bit):7.941785553169317
        TrID:
        • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
        • ELF Executable and Linkable format (generic) (4004/1) 49.84%
        File name:na.elf
        File size:428'272 bytes
        MD5:074e0bf7210fbb761c0788b03511d7ce
        SHA1:0dcce5c6042f2c7102a927ad9495fe79cc9150fb
        SHA256:979bd5b675020cf6696f0a6eef0e581227e30a044f04263fee77242ee22578c1
        SHA512:5d343b3596f84fa6d6813440a8da7a7dcdb985323ed5252df5758bbf657f1833e07544f52b71ebd4cb5fc96cc4ef22a8e876461d1cb354b916b275e59601a005
        SSDEEP:12288:6QIkwT+V+46MTuxN+qpMBUH5kAAxwWVtBeSv:W4/y+qaBUZJAdVtr
        TLSH:709423F31824B3738A2C3A3EFF609E15D79A573CE559271A1A1FDDEB0F2951209C8A05
        File Content Preview:.ELF..............>.....HwF.....@...................@.8...@.......................@.......@.....c.......c.................................F.......F.............................Q.td....................................................d&..UPX!(........8...8.

        Static ELF Info

        ELF header

        Class:ELF64
        Data:2's complement, little endian
        Version:1 (current)
        Machine:Advanced Micro Devices X86-64
        Version Number:0x1
        Type:EXEC (Executable file)
        OS/ABI:UNIX - System V
        ABI Version:0
        Entry Point Address:0x467748
        Flags:0x0
        ELF Header Size:64
        Program Header Offset:64
        Program Header Size:56
        Number of Program Headers:3
        Section Header Offset:0
        Section Header Size:64
        Number of Section Headers:0
        Header String Table Index:0

        Program Segments

        TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
        LOAD0x00x4000000x4000000x680630x680637.94200x5R E0x1000
        LOAD0x00x4690000x4690000x00x10fb0f80.00000x6RW 0x1000
        GNU_STACK0x00x00x00x00x00.00000x6RW 0x10

        Network Behavior

        Suricata IDS Alerts

        TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
        2025-01-12T16:10:29.640991+01002044561ET MALWARE Prometei Botnet CnC Domain (feefreepool .net) in DNS Lookup1192.168.2.15393868.8.8.853UDP
        2025-01-12T16:10:51.023281+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.155696488.198.246.24280TCP
        2025-01-12T16:10:51.023281+01002044562ET MALWARE Prometei Botnet CnC Checkin1192.168.2.155696488.198.246.24280TCP

        Network Port Distribution

        TCP Packets

        TimestampSource PortDest PortSource IPDest IP
        Jan 12, 2025 16:10:29.649431944 CET5696480192.168.2.1588.198.246.242
        Jan 12, 2025 16:10:29.654355049 CET805696488.198.246.242192.168.2.15
        Jan 12, 2025 16:10:29.654417038 CET5696480192.168.2.1588.198.246.242
        Jan 12, 2025 16:10:29.657277107 CET5696480192.168.2.1588.198.246.242
        Jan 12, 2025 16:10:29.662134886 CET805696488.198.246.242192.168.2.15
        Jan 12, 2025 16:10:51.022068024 CET805696488.198.246.242192.168.2.15
        Jan 12, 2025 16:10:51.023281097 CET5696480192.168.2.1588.198.246.242
        Jan 12, 2025 16:10:51.023612022 CET5696480192.168.2.1588.198.246.242
        Jan 12, 2025 16:10:51.028456926 CET805696488.198.246.242192.168.2.15

        UDP Packets

        TimestampSource PortDest PortSource IPDest IP
        Jan 12, 2025 16:10:29.640990973 CET3938653192.168.2.158.8.8.8
        Jan 12, 2025 16:10:29.647521019 CET53393868.8.8.8192.168.2.15
        Jan 12, 2025 16:10:31.099982977 CET4917780192.168.2.1588.198.246.242
        Jan 12, 2025 16:12:33.207222939 CET4917780192.168.2.1588.198.246.242

        DNS Queries

        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
        Jan 12, 2025 16:10:29.640990973 CET192.168.2.158.8.8.80x15d0Standard query (0)p3.feefreepool.netA (IP address)IN (0x0001)false

        DNS Answers

        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
        Jan 12, 2025 16:10:29.647521019 CET8.8.8.8192.168.2.150x15d0No error (0)p3.feefreepool.net88.198.246.242A (IP address)IN (0x0001)false

        HTTP Request Dependency Graph

        • p3.feefreepool.net

        HTTP Packets

        Session IDSource IPSource PortDestination IPDestination Port
        0192.168.2.155696488.198.246.24280
        TimestampBytes transferredDirectionData
        Jan 12, 2025 16:10:29.657277107 CET99OUTGET /cgi-bin/prometei.cgi?r=9&i=6U5A3B6IQXG40062 HTTP/1.0
        Host: p3.feefreepool.net


        System Behavior

        General

        Start time (UTC):15:10:17
        Start date (UTC):12/01/2025
        Path:/tmp/na.elf
        Arguments:/tmp/na.elf
        File size:428272 bytes
        MD5 hash:074e0bf7210fbb761c0788b03511d7ce

        Chronological Activities


        General

        Start time (UTC):15:10:17
        Start date (UTC):12/01/2025
        Path:/tmp/na.elf
        Arguments:-
        File size:428272 bytes
        MD5 hash:074e0bf7210fbb761c0788b03511d7ce

        Chronological Activities


        General

        Start time (UTC):15:10:17
        Start date (UTC):12/01/2025
        Path:/bin/sh
        Arguments:sh -c "pgrep na.elf"
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):15:10:17
        Start date (UTC):12/01/2025
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):15:10:17
        Start date (UTC):12/01/2025
        Path:/usr/bin/pgrep
        Arguments:pgrep na.elf
        File size:30968 bytes
        MD5 hash:fa96a75a08109d8842e4865b2907d51f

        Chronological Activities


        General

        Start time (UTC):15:10:18
        Start date (UTC):12/01/2025
        Path:/tmp/na.elf
        Arguments:-
        File size:428272 bytes
        MD5 hash:074e0bf7210fbb761c0788b03511d7ce

        Chronological Activities


        General

        Start time (UTC):15:10:18
        Start date (UTC):12/01/2025
        Path:/bin/sh
        Arguments:sh -c "pidof na.elf"
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):15:10:18
        Start date (UTC):12/01/2025
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):15:10:18
        Start date (UTC):12/01/2025
        Path:/usr/bin/pidof
        Arguments:pidof na.elf
        File size:27016 bytes
        MD5 hash:f58f67968fc50f1497f9ea9e9c22b6e8

        Chronological Activities


        General

        Start time (UTC):15:10:20
        Start date (UTC):12/01/2025
        Path:/tmp/na.elf
        Arguments:-
        File size:428272 bytes
        MD5 hash:074e0bf7210fbb761c0788b03511d7ce

        Chronological Activities


        General

        Start time (UTC):15:10:20
        Start date (UTC):12/01/2025
        Path:/bin/sh
        Arguments:sh -c "pgrep uplugplay"
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):15:10:20
        Start date (UTC):12/01/2025
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):15:10:20
        Start date (UTC):12/01/2025
        Path:/usr/bin/pgrep
        Arguments:pgrep uplugplay
        File size:30968 bytes
        MD5 hash:fa96a75a08109d8842e4865b2907d51f

        Chronological Activities


        General

        Start time (UTC):15:10:21
        Start date (UTC):12/01/2025
        Path:/tmp/na.elf
        Arguments:-
        File size:428272 bytes
        MD5 hash:074e0bf7210fbb761c0788b03511d7ce

        Chronological Activities


        General

        Start time (UTC):15:10:21
        Start date (UTC):12/01/2025
        Path:/bin/sh
        Arguments:sh -c "pidof uplugplay"
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):15:10:21
        Start date (UTC):12/01/2025
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):15:10:21
        Start date (UTC):12/01/2025
        Path:/usr/bin/pidof
        Arguments:pidof uplugplay
        File size:27016 bytes
        MD5 hash:f58f67968fc50f1497f9ea9e9c22b6e8

        Chronological Activities


        General

        Start time (UTC):15:10:23
        Start date (UTC):12/01/2025
        Path:/tmp/na.elf
        Arguments:-
        File size:428272 bytes
        MD5 hash:074e0bf7210fbb761c0788b03511d7ce

        Chronological Activities


        General

        Start time (UTC):15:10:23
        Start date (UTC):12/01/2025
        Path:/bin/sh
        Arguments:sh -c "pgrep upnpsetup"
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):15:10:23
        Start date (UTC):12/01/2025
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):15:10:23
        Start date (UTC):12/01/2025
        Path:/usr/bin/pgrep
        Arguments:pgrep upnpsetup
        File size:30968 bytes
        MD5 hash:fa96a75a08109d8842e4865b2907d51f

        Chronological Activities


        General

        Start time (UTC):15:10:26
        Start date (UTC):12/01/2025
        Path:/tmp/na.elf
        Arguments:-
        File size:428272 bytes
        MD5 hash:074e0bf7210fbb761c0788b03511d7ce

        Chronological Activities


        General

        Start time (UTC):15:10:26
        Start date (UTC):12/01/2025
        Path:/bin/sh
        Arguments:sh -c "systemctl daemon-reload"
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):15:10:26
        Start date (UTC):12/01/2025
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):15:10:26
        Start date (UTC):12/01/2025
        Path:/usr/bin/systemctl
        Arguments:systemctl daemon-reload
        File size:996584 bytes
        MD5 hash:4deddfb6741481f68aeac522cc26ff4b

        Chronological Activities


        General

        Start time (UTC):15:10:26
        Start date (UTC):12/01/2025
        Path:/tmp/na.elf
        Arguments:-
        File size:428272 bytes
        MD5 hash:074e0bf7210fbb761c0788b03511d7ce

        Chronological Activities


        General

        Start time (UTC):15:10:26
        Start date (UTC):12/01/2025
        Path:/bin/sh
        Arguments:sh -c "systemctl enable uplugplay.service"
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):15:10:26
        Start date (UTC):12/01/2025
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):15:10:26
        Start date (UTC):12/01/2025
        Path:/usr/bin/systemctl
        Arguments:systemctl enable uplugplay.service
        File size:996584 bytes
        MD5 hash:4deddfb6741481f68aeac522cc26ff4b

        Chronological Activities


        General

        Start time (UTC):15:10:27
        Start date (UTC):12/01/2025
        Path:/tmp/na.elf
        Arguments:-
        File size:428272 bytes
        MD5 hash:074e0bf7210fbb761c0788b03511d7ce

        Chronological Activities


        General

        Start time (UTC):15:10:27
        Start date (UTC):12/01/2025
        Path:/bin/sh
        Arguments:sh -c "systemctl start uplugplay.service"
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):15:10:27
        Start date (UTC):12/01/2025
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):15:10:27
        Start date (UTC):12/01/2025
        Path:/usr/bin/systemctl
        Arguments:systemctl start uplugplay.service
        File size:996584 bytes
        MD5 hash:4deddfb6741481f68aeac522cc26ff4b

        Chronological Activities


        General

        Start time (UTC):15:10:26
        Start date (UTC):12/01/2025
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):15:10:26
        Start date (UTC):12/01/2025
        Path:/usr/lib/systemd/system-environment-generators/snapd-env-generator
        Arguments:/usr/lib/systemd/system-environment-generators/snapd-env-generator
        File size:22760 bytes
        MD5 hash:3633b075f40283ec938a2a6a89671b0e

        Chronological Activities


        General

        Start time (UTC):15:10:27
        Start date (UTC):12/01/2025
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):15:10:27
        Start date (UTC):12/01/2025
        Path:/usr/lib/systemd/system-environment-generators/snapd-env-generator
        Arguments:/usr/lib/systemd/system-environment-generators/snapd-env-generator
        File size:22760 bytes
        MD5 hash:3633b075f40283ec938a2a6a89671b0e

        Chronological Activities


        General

        Start time (UTC):15:10:28
        Start date (UTC):12/01/2025
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):15:10:28
        Start date (UTC):12/01/2025
        Path:/usr/sbin/uplugplay
        Arguments:/usr/sbin/uplugplay
        File size:428272 bytes
        MD5 hash:074e0bf7210fbb761c0788b03511d7ce

        Chronological Activities


        General

        Start time (UTC):15:10:28
        Start date (UTC):12/01/2025
        Path:/usr/sbin/uplugplay
        Arguments:-
        File size:428272 bytes
        MD5 hash:074e0bf7210fbb761c0788b03511d7ce

        Chronological Activities


        General

        Start time (UTC):15:10:28
        Start date (UTC):12/01/2025
        Path:/usr/sbin/uplugplay
        Arguments:-
        File size:428272 bytes
        MD5 hash:074e0bf7210fbb761c0788b03511d7ce

        Chronological Activities


        General

        Start time (UTC):15:10:28
        Start date (UTC):12/01/2025
        Path:/bin/sh
        Arguments:sh -c "/usr/sbin/uplugplay -Dcomsvc"
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):15:10:28
        Start date (UTC):12/01/2025
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):15:10:28
        Start date (UTC):12/01/2025
        Path:/usr/sbin/uplugplay
        Arguments:/usr/sbin/uplugplay -Dcomsvc
        File size:428272 bytes
        MD5 hash:074e0bf7210fbb761c0788b03511d7ce

        Chronological Activities