IOC Report
na.elf

loading gifFilesProcessesURLsDomainsIPsMemdumps321020102Label

Files

File Path
Type
Category
Malicious
Download
na.elf
ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da, stripped
initial sample
 malicious
/etc/CommId
ASCII text, with no line terminators
dropped
 malicious
/usr/sbin/uplugplay
ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da, stripped
dropped
 malicious
/memfd:snapd-env-generator (deleted)
ASCII text
dropped
/proc/5596/task/5597/comm
ASCII text, with no line terminators
dropped
/proc/5596/task/5598/comm
ASCII text, with no line terminators
dropped
/proc/5596/task/5599/comm
ASCII text, with no line terminators
dropped
/usr/lib/systemd/system/uplugplay.service
ASCII text
dropped

Processes

Path
Cmdline
Malicious
/tmp/na.elf
/tmp/na.elf
/tmp/na.elf
-
/bin/sh
sh -c "pgrep na.elf"
/bin/sh
-
/usr/bin/pgrep
pgrep na.elf
/tmp/na.elf
-
/bin/sh
sh -c "pidof na.elf"
/bin/sh
-
/usr/bin/pidof
pidof na.elf
/tmp/na.elf
-
/bin/sh
sh -c "pgrep uplugplay"
/bin/sh
-
/usr/bin/pgrep
pgrep uplugplay
/tmp/na.elf
-
/bin/sh
sh -c "pidof uplugplay"
/bin/sh
-
/usr/bin/pidof
pidof uplugplay
/tmp/na.elf
-
/bin/sh
sh -c "pgrep upnpsetup"
/bin/sh
-
/usr/bin/pgrep
pgrep upnpsetup
/tmp/na.elf
-
/bin/sh
sh -c "pidof upnpsetup"
/bin/sh
-
/usr/bin/pidof
pidof upnpsetup
/tmp/na.elf
-
/bin/sh
sh -c "systemctl daemon-reload"
/bin/sh
-
/usr/bin/systemctl
systemctl daemon-reload
/tmp/na.elf
-
/bin/sh
sh -c "systemctl enable uplugplay.service"
/bin/sh
-
/usr/bin/systemctl
systemctl enable uplugplay.service
/tmp/na.elf
-
/bin/sh
sh -c "systemctl start uplugplay.service"
/bin/sh
-
/usr/bin/systemctl
systemctl start uplugplay.service
/usr/lib/systemd/systemd
-
/usr/lib/systemd/system-environment-generators/snapd-env-generator
/usr/lib/systemd/system-environment-generators/snapd-env-generator
/usr/lib/systemd/systemd
-
/usr/lib/systemd/system-environment-generators/snapd-env-generator
/usr/lib/systemd/system-environment-generators/snapd-env-generator
/usr/lib/systemd/systemd
-
/usr/sbin/uplugplay
/usr/sbin/uplugplay
/usr/sbin/uplugplay
-
/usr/sbin/uplugplay
-
/bin/sh
sh -c "/usr/sbin/uplugplay -Dcomsvc"
/bin/sh
-
/usr/sbin/uplugplay
/usr/sbin/uplugplay -Dcomsvc
/usr/sbin/uplugplay
-
/bin/sh
sh -c "nslookup p3.feefreepool.net 8.8.8.8"
/bin/sh
-
/usr/bin/nslookup
nslookup p3.feefreepool.net 8.8.8.8
There are 42 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://p3.feefreepool.net/cgi-bin/prometei.cgihttp://dummy.zero/cgi-bin/prometei.cgihttps://gb7ni5rg
unknown
https://bugs.launchpad.net/ubuntu/
unknown
http://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.b32.i2p/cgi-bin/prometei.cgi
unknown
http://p3.feefreepool.net/cgi-bin/prometei.cgi
unknown
https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi
unknown
http://%s/cgi-bin/prometei.cgi
unknown
http://%s/cgi-bin/prometei.cgi?r=0&auth=hash&i=%s&enckey=%shttp://%s/cgi-bin/prometei.cgi%m%d%yxinch
unknown
https://http:///:.onion.i2p.zeroGET
unknown
http://dummy.zero/cgi-bin/prometei.cgi
unknown
http://%s/cgi-bin/prometei.cgi?r=0&auth=hash&i=%s&enckey=%s
unknown

Domains

Name
IP
Malicious
p3.feefreepool.net
88.198.246.242

IPs

IP
Domain
Country
Malicious
88.198.246.242
p3.feefreepool.net
Germany

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
7f6f4526a000
page read and write
 malicious
7f6f444d2000
page execute read
 malicious
7f6fbfdfb000
page execute and read and write
7f6fc37ff000
page execute and read and write
7f6f444e7000
page read and write
7f3e4231f000
page read and write
7f6fc15fe000
page execute and read and write
7fff4480f000
page execute read
7f3e4236c000
page read and write
7f3e3c021000
page read and write
7f3e41645000
page read and write
7f6fcb3dd000
page read and write
7f3e41cc7000
page read and write
7f6fbedf9000
page execute and read and write
7f3e40e3d000
page read and write
7f6fc05fc000
page execute and read and write
5598cb170000
page read and write
7f6f4004a000
page read and write
7f6fcc0a9000
page read and write
5598c915b000
page read and write
7f6fcaa01000
page read and write
7f6fc2ffe000
page execute and read and write
559235bc2000
page execute read
7f6fbddf7000
page execute and read and write
7f6fcaac4000
page read and write
7f6fcbf80000
page read and write
7f6f3c049000
page read and write
7f3e41ca4000
page read and write
7f3e421f6000
page read and write
559237e52000
page execute and read and write
5598c8ec9000
page execute read
7fff44806000
page read and write
7f3e42015000
page read and write
7f6fcb3cf000
page read and write
7f3e3c000000
page read and write
7f6fcbd9f000
page read and write
7ffddcf6e000
page execute read
7f6fcba51000
page read and write
7f6fcaa42000
page read and write
7f6fc4021000
page read and write
7f3e41653000
page read and write
7f6fcba6e000
page read and write
5598cb620000
page read and write
7f3e41903000
page read and write
559235e54000
page read and write
7f6fc4000000
page read and write
7ffddcef1000
page read and write
7f3e41ce4000
page read and write
7f6fc1dff000
page execute and read and write
7f6fcab05000
page read and write
7f6fcb68d000
page read and write
7f6fbe5f8000
page execute and read and write
559238b93000
page read and write
5598cb159000
page execute and read and write
5598c9151000
page read and write
7f6fcaa83000
page read and write
7f6fbf5fa000
page execute and read and write
559237e69000
page read and write
7f6fc2600000
page execute and read and write
7f6fcc0f6000
page read and write
7f3dbd26a000
page read and write
7f3e42327000
page read and write
7f6fcc0b1000
page read and write
7f6fc2621000
page read and write
7f6fc0dfd000
page execute and read and write
7f6fcabc7000
page read and write
7f6fcba2e000
page read and write
559235e4a000
page read and write
There are 58 hidden memdumps, click here to show them.