IOC Report
na.elf

loading gifFilesProcessesURLsDomainsIPsMemdumps321020102Label

Files

File Path
Type
Category
Malicious
Download
na.elf
ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da, stripped
initial sample
 malicious
/etc/CommId
ASCII text, with no line terminators
dropped
 malicious
/usr/sbin/uplugplay
ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da, stripped
dropped
 malicious
/memfd:snapd-env-generator (deleted)
ASCII text
dropped
/proc/6411/task/6412/comm
ASCII text, with no line terminators
dropped
/proc/6411/task/6413/comm
ASCII text, with no line terminators
dropped
/proc/6411/task/6414/comm
ASCII text, with no line terminators
dropped
/usr/lib/systemd/system/uplugplay.service
ASCII text
dropped

Processes

Path
Cmdline
Malicious
/tmp/na.elf
/tmp/na.elf
/tmp/na.elf
-
/bin/sh
sh -c "pgrep na.elf"
/bin/sh
-
/usr/bin/pgrep
pgrep na.elf
/tmp/na.elf
-
/bin/sh
sh -c "pgrep uplugplay"
/bin/sh
-
/usr/bin/pgrep
pgrep uplugplay
/tmp/na.elf
-
/bin/sh
sh -c "pidof uplugplay"
/bin/sh
-
/usr/bin/pidof
pidof uplugplay
/tmp/na.elf
-
/bin/sh
sh -c "pgrep upnpsetup"
/bin/sh
-
/usr/bin/pgrep
pgrep upnpsetup
/tmp/na.elf
-
/bin/sh
sh -c "pidof upnpsetup"
/bin/sh
-
/usr/bin/pidof
pidof upnpsetup
/tmp/na.elf
-
/bin/sh
sh -c "systemctl daemon-reload"
/bin/sh
-
/usr/bin/systemctl
systemctl daemon-reload
/tmp/na.elf
-
/bin/sh
sh -c "systemctl enable uplugplay.service"
/bin/sh
-
/usr/bin/systemctl
systemctl enable uplugplay.service
/tmp/na.elf
-
/bin/sh
sh -c "systemctl start uplugplay.service"
/bin/sh
-
/usr/bin/systemctl
systemctl start uplugplay.service
/usr/lib/systemd/systemd
-
/usr/lib/systemd/system-environment-generators/snapd-env-generator
/usr/lib/systemd/system-environment-generators/snapd-env-generator
/usr/lib/systemd/systemd
-
/usr/lib/systemd/system-environment-generators/snapd-env-generator
/usr/lib/systemd/system-environment-generators/snapd-env-generator
/usr/lib/systemd/systemd
-
/usr/sbin/uplugplay
/usr/sbin/uplugplay
/usr/sbin/uplugplay
-
/usr/sbin/uplugplay
-
/bin/sh
sh -c "/usr/sbin/uplugplay -Dcomsvc"
/bin/sh
-
/usr/sbin/uplugplay
/usr/sbin/uplugplay -Dcomsvc
/usr/sbin/uplugplay
-
/bin/sh
sh -c "nslookup p3.feefreepool.net 8.8.8.8"
/bin/sh
-
/usr/bin/nslookup
nslookup p3.feefreepool.net 8.8.8.8
/usr/bin/dash
-
/usr/bin/rm
rm -f /tmp/tmp.m5dSB2970R /tmp/tmp.YrBvcwmsHN /tmp/tmp.WJbxXbs2va
/usr/bin/dash
-
/usr/bin/rm
rm -f /tmp/tmp.m5dSB2970R /tmp/tmp.YrBvcwmsHN /tmp/tmp.WJbxXbs2va
There are 42 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://p3.feefreepool.net/cgi-bin/prometei.cgihttp://dummy.zero/cgi-bin/prometei.cgihttps://gb7ni5rg
unknown
https://bugs.launchpad.net/ubuntu/
unknown
http://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.b32.i2p/cgi-bin/prometei.cgi
unknown
http://p3.feefreepool.net/cgi-bin/prometei.cgi
unknown
https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi
unknown
http://%s/cgi-bin/prometei.cgi
unknown
http://%s/cgi-bin/prometei.cgi?r=0&auth=hash&i=%s&enckey=%shttp://%s/cgi-bin/prometei.cgi%m%d%yxinch
unknown
https://http:///:.onion.i2p.zeroGET
unknown
http://dummy.zero/cgi-bin/prometei.cgi
unknown
http://%s/cgi-bin/prometei.cgi?r=0&auth=hash&i=%s&enckey=%s
unknown

Domains

Name
IP
Malicious
p3.feefreepool.net
88.198.246.242

IPs

IP
Domain
Country
Malicious
88.198.246.242
p3.feefreepool.net
Germany
34.249.145.219
unknown
United States
109.202.202.202
unknown
Switzerland
91.189.91.43
unknown
United Kingdom
91.189.91.42
unknown
United Kingdom

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
7fafb926a000
page read and write
 malicious
7fafb84d2000
page execute read
 malicious
7ffa21345000
page read and write
7fb03dcd5000
page read and write
7fb032df9000
page execute and read and write
7fb0345fc000
page execute and read and write
7fb036621000
page read and write
7fb036ffe000
page execute and read and write
7fafb4062000
page read and write
564ee4cc6000
page execute and read and write
7ffa20ce6000
page read and write
7fb03cd07000
page read and write
7fb03d661000
page read and write
7fb03ccc6000
page read and write
7ffa1c021000
page read and write
561c9efe6000
page read and write
7fb038000000
page read and write
564ee4cdd000
page read and write
561c9efdc000
page read and write
7fb0355fe000
page execute and read and write
7ffd83437000
page read and write
7ffa20cf4000
page read and write
7fb0335fa000
page execute and read and write
7fb03dcf2000
page read and write
7ff99d26a000
page read and write
7ffa21a0d000
page read and write
7fb034dfd000
page execute and read and write
561ca0ffb000
page read and write
7fafb84e7000
page read and write
7ffd53cf7000
page execute read
7fb03d911000
page read and write
564ee64e1000
page read and write
7ffd8355b000
page execute read
561ca20a3000
page read and write
7ffa219c0000
page read and write
7fb038021000
page read and write
7fb033dfb000
page execute and read and write
7ffa20fa4000
page read and write
7fb035dff000
page execute and read and write
7fb0377ff000
page execute and read and write
7fb03e023000
page read and write
7fb03ce4b000
page read and write
7fb03dcb2000
page read and write
7fb03e37a000
page read and write
7fb03d653000
page read and write
7fb03cd48000
page read and write
7ffa204de000
page read and write
7ffd53c9c000
page read and write
7ffa21385000
page read and write
7fafb0021000
page read and write
7ffa216b6000
page read and write
564ee2cbe000
page read and write
7fb03e335000
page read and write
564ee2cc8000
page read and write
561c9ed54000
page execute read
7ffa219c8000
page read and write
7fb036600000
page execute and read and write
561ca0fe4000
page execute and read and write
7fb03cd89000
page read and write
564ee2a36000
page execute read
7fb03e32d000
page read and write
7ffa1c000000
page read and write
7ffa21368000
page read and write
7ffa21897000
page read and write
7fb03e204000
page read and write
There are 55 hidden memdumps, click here to show them.