IOC Report
na.elf

loading gifFilesProcessesURLsDomainsIPsMemdumps321020102Label

Files

File Path
Type
Category
Malicious
Download
na.elf
ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da, stripped
initial sample
 malicious
/etc/CommId
ASCII text, with no line terminators
dropped
 malicious
/usr/sbin/uplugplay
ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da, stripped
dropped
 malicious
/memfd:snapd-env-generator (deleted)
ASCII text
dropped
/proc/5609/task/5612/comm
ASCII text, with no line terminators
dropped
/proc/5609/task/5613/comm
ASCII text, with no line terminators
dropped
/proc/5609/task/5614/comm
ASCII text, with no line terminators
dropped
/usr/lib/systemd/system/uplugplay.service
ASCII text
dropped

Processes

Path
Cmdline
Malicious
/tmp/na.elf
/tmp/na.elf
/tmp/na.elf
-
/bin/sh
sh -c "pgrep na.elf"
/bin/sh
-
/usr/bin/pgrep
pgrep na.elf
/tmp/na.elf
-
/bin/sh
sh -c "pidof na.elf"
/bin/sh
-
/usr/bin/pidof
pidof na.elf
/tmp/na.elf
-
/bin/sh
sh -c "pgrep uplugplay"
/bin/sh
-
/usr/bin/pgrep
pgrep uplugplay
/tmp/na.elf
-
/bin/sh
sh -c "pidof uplugplay"
/bin/sh
-
/usr/bin/pidof
pidof uplugplay
/tmp/na.elf
-
/bin/sh
sh -c "pgrep upnpsetup"
/bin/sh
-
/usr/bin/pgrep
pgrep upnpsetup
/tmp/na.elf
-
/bin/sh
sh -c "pidof upnpsetup"
/bin/sh
-
/usr/bin/pidof
pidof upnpsetup
/tmp/na.elf
-
/bin/sh
sh -c "systemctl daemon-reload"
/bin/sh
-
/usr/bin/systemctl
systemctl daemon-reload
/tmp/na.elf
-
/bin/sh
sh -c "systemctl enable uplugplay.service"
/bin/sh
-
/usr/bin/systemctl
systemctl enable uplugplay.service
/tmp/na.elf
-
/bin/sh
sh -c "systemctl start uplugplay.service"
/bin/sh
-
/usr/bin/systemctl
systemctl start uplugplay.service
/usr/lib/systemd/systemd
-
/usr/lib/systemd/system-environment-generators/snapd-env-generator
/usr/lib/systemd/system-environment-generators/snapd-env-generator
/usr/lib/systemd/systemd
-
/usr/lib/systemd/system-environment-generators/snapd-env-generator
/usr/lib/systemd/system-environment-generators/snapd-env-generator
/usr/lib/systemd/systemd
-
/usr/sbin/uplugplay
/usr/sbin/uplugplay
/usr/sbin/uplugplay
-
/usr/sbin/uplugplay
-
/bin/sh
sh -c "/usr/sbin/uplugplay -Dcomsvc"
/bin/sh
-
/usr/sbin/uplugplay
/usr/sbin/uplugplay -Dcomsvc
/usr/sbin/uplugplay
-
/bin/sh
sh -c "nslookup p3.feefreepool.net 8.8.8.8"
/bin/sh
-
/usr/bin/nslookup
nslookup p3.feefreepool.net 8.8.8.8
There are 42 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://p3.feefreepool.net/cgi-bin/prometei.cgihttp://dummy.zero/cgi-bin/prometei.cgihttps://gb7ni5rg
unknown
https://bugs.launchpad.net/ubuntu/
unknown
http://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.b32.i2p/cgi-bin/prometei.cgi
unknown
http://p3.feefreepool.net/cgi-bin/prometei.cgi
unknown
https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi
unknown
http://%s/cgi-bin/prometei.cgi
unknown
http://%s/cgi-bin/prometei.cgi?r=0&auth=hash&i=%s&enckey=%shttp://%s/cgi-bin/prometei.cgi%m%d%yxinch
unknown
https://http:///:.onion.i2p.zeroGET
unknown
http://dummy.zero/cgi-bin/prometei.cgi
unknown
http://%s/cgi-bin/prometei.cgi?r=0&auth=hash&i=%s&enckey=%s
unknown

Domains

Name
IP
Malicious
p3.feefreepool.net
88.198.246.242

IPs

IP
Domain
Country
Malicious
88.198.246.242
p3.feefreepool.net
Germany

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
7f2e9126a000
page read and write
 malicious
7f2e904d2000
page execute read
 malicious
7f2f17383000
page read and write
7f2f17446000
page read and write
55df88fd9000
page execute read
7f24b67b7000
page read and write
7ffe2d2c5000
page read and write
55acd0e42000
page execute and read and write
7f2f18762000
page read and write
7f2f0bdfb000
page execute and read and write
7f24b67a9000
page read and write
7f2f10021000
page read and write
7f2f18414000
page read and write
7f24b7179000
page read and write
55accee44000
page read and write
7f2f0b5fa000
page execute and read and write
7f2f0a5f8000
page execute and read and write
7f2f10000000
page read and write
7f24b74d0000
page read and write
7f243126a000
page read and write
7f24b748b000
page read and write
7f2f18431000
page read and write
7f2f173c4000
page read and write
55df8926b000
page read and write
7f2f0e621000
page read and write
7f2f18943000
page read and write
7f24b6a67000
page read and write
7f2e8c021000
page read and write
7f2f17d92000
page read and write
7ffe2d3a1000
page execute read
55acd0e59000
page read and write
7f24b7483000
page read and write
7fff13fa9000
page read and write
7f2f0adf9000
page execute and read and write
7f2f0d5fe000
page execute and read and write
7f2f17da0000
page read and write
7f2e904e7000
page read and write
55df89261000
page read and write
55df8b269000
page execute and read and write
7f2e88090000
page read and write
7f2f0effe000
page execute and read and write
7f2f09df7000
page execute and read and write
7f2f0cdfd000
page execute and read and write
7f2f0e600000
page execute and read and write
55acd1f63000
page read and write
7f24b735a000
page read and write
7f24b0021000
page read and write
7f24b5fa1000
page read and write
7f2f18a6c000
page read and write
7f2f17405000
page read and write
55df8c4c1000
page read and write
7f24b6e48000
page read and write
7f24b6e2b000
page read and write
55accebb2000
page execute read
55accee3a000
page read and write
7f24b6e08000
page read and write
7f24b0000000
page read and write
7f2f0ddff000
page execute and read and write
7fff13ffb000
page execute read
7f2f0c5fc000
page execute and read and write
7f2f18a74000
page read and write
55df8b280000
page read and write
7f2f0f7ff000
page execute and read and write
7f2f183f1000
page read and write
7f2f17487000
page read and write
7f2f18ab9000
page read and write
7f2f1758a000
page read and write
7f2f18050000
page read and write
7f2f174c8000
page read and write
There are 59 hidden memdumps, click here to show them.