Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Download

na.elf

ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da, stripped

initial sample

Details

Filetype:	ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da, stripped
Entropy:	5.7652506657487335
Filename:	na.elf
Filesize:	920568
MD5:	5d7953bb54fad3d8e37bd6dfaae2a2ee
SHA1:	4f92cac113be0cf2458aa986033a5b0436458388
SHA256:	bdfa4db449c62055d2a73a2ca35e04c0e3c523317ebe278bb51d7aa9eff99dc0
SHA512:	f78ef2d4f961cdcbc571ec5eeee9b886f6220d6b61f48283d275f55196c6e4c9b43886ec5d3cbeaf9eae44f7768014bf7796a927f2361b913f688f520e347ced
SSDEEP:	12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl3:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh8
Preview:	.ELF.....................@.....4....p....4. ...(.#."p......X.@.X.@.X................p......p.@.p.@.p.........................@...@........................&..N&..N&...F...V................4.@.4.@.4... ... .................@...@.....$...$..............'..N'

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Drops files in suspicious directories	Hooking and other Techniques for Hiding and Protection	Masquerading
Found Tor onion address	Networking	Proxy
Sample deletes itself	Hooking and other Techniques for Hiding and Protection	File Deletion
Executes commands using a shell command-line interpreter	Persistence and Installation Behavior	Scripting
Sample tries to set the executable flag	Persistence and Installation Behavior	File and Directory Permissions Modification
Uses the "uname" system call to query kernel version information (possible evasion)	Malware Analysis System Evasion
Writes ELF files to disk	Persistence and Installation Behavior
Yara signature match	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

/etc/CommId

ASCII text, with no line terminators

dropped

Details

File:	/etc/CommId
Category:	dropped
Dump:	CommId.61.dr
ID:	dr_4
Target ID:	61
Process:	/usr/sbin/uplugplay
Type:	ASCII text, with no line terminators
Entropy:	3.625
Encrypted:	false
Ssdeep:	3:Nb/e:Nq
Size:	16
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Found Tor onion address	Networking	Proxy

/usr/sbin/uplugplay

ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da, stripped

dropped

Details

File:	/usr/sbin/uplugplay
Category:	dropped
Dump:	uplugplay.12.dr
ID:	dr_0
Target ID:	12
Process:	/tmp/na.elf
Type:	ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da, stripped
Entropy:	5.7652506657487335
Encrypted:	false
Ssdeep:	12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl3:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh8
Size:	920568
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Yara detected Prometei	Bitcoin Miner
Yara detected Prometei	Bitcoin Miner
Drops files in suspicious directories	Hooking and other Techniques for Hiding and Protection	Masquerading
Found Tor onion address	Networking	Proxy
Executes commands using a shell command-line interpreter	Persistence and Installation Behavior	Scripting
Sample tries to set the executable flag	Persistence and Installation Behavior	File and Directory Permissions Modification
Writes ELF files to disk	Persistence and Installation Behavior
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery

/memfd:snapd-env-generator (deleted)

ASCII text

dropped

Details

File:	/memfd:snapd-env-generator (deleted)
Category:	dropped
Dump:	memfd_snapd-env-generator (deleted).50.dr
ID:	dr_3
Target ID:	50
Process:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
Type:	ASCII text
Entropy:	3.7627880354948586
Encrypted:	false
Ssdeep:	3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
Size:	76
Whitelisted:	false
Reputation:	high

/proc/6422/task/6423/comm

ASCII text, with no line terminators

dropped

Details

File:	/proc/6422/task/6423/comm
Category:	dropped
Dump:	comm.69.dr
ID:	dr_5
Target ID:	69
Process:	/usr/bin/nslookup
Type:	ASCII text, with no line terminators
Entropy:	3.09306920777189
Encrypted:	false
Ssdeep:	3:XfSPyVd:PSPS
Size:	14
Whitelisted:	false
Reputation:	high

/proc/6422/task/6424/comm

ASCII text, with no line terminators

dropped

Details

File:	/proc/6422/task/6424/comm
Category:	dropped
Dump:	comm0.69.dr
ID:	dr_6
Target ID:	69
Process:	/usr/bin/nslookup
Type:	ASCII text, with no line terminators
Entropy:	2.94770277922009
Encrypted:	false
Ssdeep:	3:XfRJy:P2
Size:	9
Whitelisted:	false
Reputation:	high

/proc/6422/task/6425/comm

ASCII text, with no line terminators

dropped

Details

File:	/proc/6422/task/6425/comm
Category:	dropped
Dump:	comm1.69.dr
ID:	dr_7
Target ID:	69
Process:	/usr/bin/nslookup
Type:	ASCII text, with no line terminators
Entropy:	3.084962500721156
Encrypted:	false
Ssdeep:	3:XfWdvRo:PWno
Size:	12
Whitelisted:	false
Reputation:	high

/usr/lib/systemd/system/uplugplay.service

ASCII text

dropped

Details

File:	/usr/lib/systemd/system/uplugplay.service
Category:	dropped
Dump:	uplugplay.service.12.dr
ID:	dr_1
Target ID:	12
Process:	/tmp/na.elf
Type:	ASCII text
Entropy:	4.769509838572339
Encrypted:	false
Ssdeep:	3:zMZa75X1PxQJqtWA1+DRvBADMikAdIgQ+aQmNJX4ev+sirSkQmWA1+DRvn:z8uXcqtWA4RZAMD+aBNdhTILQmWA4Rv
Size:	145
Whitelisted:	false
Reputation:	high

Processes

Path

Cmdline

Malicious

/tmp/na.elf

/bin/sh

sh -c "pgrep na.elf"

/bin/sh

/usr/bin/pgrep

pgrep na.elf

/tmp/na.elf

/bin/sh

sh -c "pidof na.elf"

/bin/sh

/usr/bin/pidof

pidof na.elf

/tmp/na.elf

/bin/sh

sh -c "pgrep uplugplay"

/bin/sh

/usr/bin/pgrep

pgrep uplugplay

/tmp/na.elf

/bin/sh

sh -c "pidof uplugplay"

/bin/sh

/usr/bin/pidof

pidof uplugplay

/tmp/na.elf

/bin/sh

sh -c "pgrep upnpsetup"

/bin/sh

/usr/bin/pgrep

pgrep upnpsetup

/tmp/na.elf

/bin/sh

sh -c "pidof upnpsetup"

/bin/sh

/usr/bin/pidof

pidof upnpsetup

/tmp/na.elf

/bin/sh

sh -c "systemctl daemon-reload"

/bin/sh

/usr/bin/systemctl

systemctl daemon-reload

/tmp/na.elf

/bin/sh

sh -c "systemctl enable uplugplay.service"

/bin/sh

/usr/bin/systemctl

systemctl enable uplugplay.service

/tmp/na.elf

/bin/sh

sh -c "systemctl start uplugplay.service"

/bin/sh

/usr/bin/systemctl

systemctl start uplugplay.service

/usr/lib/systemd/systemd

/usr/lib/systemd/system-environment-generators/snapd-env-generator

/usr/lib/systemd/systemd

/usr/lib/systemd/system-environment-generators/snapd-env-generator

/usr/lib/systemd/systemd

/usr/sbin/uplugplay

/bin/sh

sh -c "/usr/sbin/uplugplay -Dcomsvc"

/bin/sh

/usr/sbin/uplugplay

/usr/sbin/uplugplay -Dcomsvc

/usr/sbin/uplugplay

/bin/sh

sh -c "nslookup p3.feefreepool.net 8.8.8.8"

/bin/sh

/usr/bin/nslookup

nslookup p3.feefreepool.net 8.8.8.8

/usr/bin/dash

/usr/bin/rm

rm -f /tmp/tmp.Xk7BFuLzG6 /tmp/tmp.TEiVo2Fi2V /tmp/tmp.rdRU7kSlco

/usr/bin/dash

/usr/bin/rm

rm -f /tmp/tmp.Xk7BFuLzG6 /tmp/tmp.TEiVo2Fi2V /tmp/tmp.rdRU7kSlco

There are 46 hidden processes, click here to show them.

URLs

Name

Malicious

http://p3.feefreepool.net/cgi-bin/prometei.cgihttp://dummy.zero/cgi-bin/prometei.cgihttps://gb7ni5rg

unknown

https://bugs.launchpad.net/ubuntu/

unknown

http://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.b32.i2p/cgi-bin/prometei.cgi

unknown

http://p3.feefreepool.net/cgi-bin/prometei.cgi

unknown

https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi

unknown

http://%s/cgi-bin/prometei.cgi

unknown

http://%s/cgi-bin/prometei.cgi?r=0&auth=hash&i=%s&enckey=%shttp://%s/cgi-bin/prometei.cgi%m%d%yxinch

unknown

https://http:///:.onion.i2p.zeroGET

unknown

http://dummy.zero/cgi-bin/prometei.cgi

unknown

http://%s/cgi-bin/prometei.cgi?r=0&auth=hash&i=%s&enckey=%s

unknown

Domains

Name

Malicious

p3.feefreepool.net

88.198.246.242

Details

Name:	p3.feefreepool.net
IP:	88.198.246.242
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found Tor onion address	Networking	Proxy
Executes commands using a shell command-line interpreter	Persistence and Installation Behavior	Scripting
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

88.198.246.242

p3.feefreepool.net

Germany

34.249.145.219

unknown

United States

Details

IP:	34.249.145.219
TargetID:	-1
Country:	United States
Countrycode:	USA
ASN number:	16509
ASN name:	AMAZON-02US
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

109.202.202.202

unknown

Switzerland

Details

IP:	109.202.202.202
TargetID:	-1
Country:	Switzerland
Countrycode:	CHE
ASN number:	13030
ASN name:	INIT7CH
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

91.189.91.43

unknown

United Kingdom

Details

IP:	91.189.91.43
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

91.189.91.42

unknown

United Kingdom

Details

IP:	91.189.91.42
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

Memdumps

Base Address

Regiontype

Protect

Malicious

Download

7fddad26a000

page read and write

7fddac4d2000

page execute read

7fbb64000000

page read and write

55896fb06000

page execute read

7fde2affe000

page execute and read and write

7fde33cee000

page read and write

7fde3274a000

page read and write

7fde265f8000

page execute and read and write

5616710cf000

page execute read

7fde33bc5000

page read and write

7ffcc9c21000

page read and write

7fde28dfd000

page execute and read and write

7fde33696000

page read and write

7fbb6c391000

page read and write

558971dad000

page read and write

7fbb6d0aa000

page read and write

7fde33673000

page read and write

7fbb6ca22000

page read and write

7fde326c8000

page read and write

561673376000

page read and write

5616752a2000

page read and write

7fde33022000

page read and write

7ffe0fd46000

page execute read

7fbb6c641000

page read and write

561671361000

page read and write

7fbb6cd53000

page read and write

7fddac4e7000

page read and write

7fde2c000000

page read and write

55896fd8e000

page read and write

7fde2a600000

page execute and read and write

7fde32687000

page read and write

7fdda8032000

page read and write

56167335f000

page execute and read and write

7fde26df9000

page execute and read and write

7fde33d3b000

page read and write

561671357000

page read and write

7ffe0fc8a000

page read and write

7fde2c021000

page read and write

7fde32646000

page read and write

7fde339e4000

page read and write

7fde332d2000

page read and write

7fde3280c000

page read and write

7fde29dff000

page execute and read and write

7fde33014000

page read and write

7fbb6c383000

page read and write

7fbb6d05d000

page read and write

7fde33cf6000

page read and write

7fde25df7000

page execute and read and write

7fbb6ca05000

page read and write

558972b26000

page read and write

7fdda4062000

page read and write

7fde32709000

page read and write

7fbb6c9e2000

page read and write

55896fd98000

page read and write

558971d96000

page execute and read and write

7fde27dfb000

page execute and read and write

7fbb6d065000

page read and write

7fbb6cf34000

page read and write

7fde336b3000

page read and write

7fde285fc000

page execute and read and write

7fde2a621000

page read and write

7fbae526a000

page read and write

7fbb6bb7b000

page read and write

7fbb64021000

page read and write

7fde2b7ff000

page execute and read and write

7fde295fe000

page execute and read and write

7ffcc9c9a000

page execute read

7fde275fa000

page execute and read and write

There are 58 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
na.elf

Files

Processes

URLs

Domains

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportna.elf

Files

Processes

URLs

Domains

IPs

Memdumps

IOC Report
na.elf