IOC Report
na.elf

loading gifFilesProcessesURLsDomainsIPsMemdumps321020102Label

Files

File Path
Type
Category
Malicious
Download
na.elf
ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da, stripped
initial sample
 malicious
/etc/CommId
ASCII text, with no line terminators
dropped
 malicious
/usr/sbin/uplugplay
ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da, stripped
dropped
 malicious
/memfd:snapd-env-generator (deleted)
ASCII text
dropped
/proc/5669/task/5670/comm
ASCII text, with no line terminators
dropped
/proc/5669/task/5671/comm
ASCII text, with no line terminators
dropped
/proc/5669/task/5672/comm
ASCII text, with no line terminators
dropped
/usr/lib/systemd/system/uplugplay.service
ASCII text
dropped

Processes

Path
Cmdline
Malicious
/tmp/na.elf
/tmp/na.elf
/tmp/na.elf
-
/bin/sh
sh -c "pgrep na.elf"
/bin/sh
-
/usr/bin/pgrep
pgrep na.elf
/tmp/na.elf
-
/bin/sh
sh -c "pidof na.elf"
/bin/sh
-
/usr/bin/pidof
pidof na.elf
/tmp/na.elf
-
/bin/sh
sh -c "pgrep uplugplay"
/bin/sh
-
/usr/bin/pgrep
pgrep uplugplay
/tmp/na.elf
-
/bin/sh
sh -c "pgrep upnpsetup"
/bin/sh
-
/usr/bin/pgrep
pgrep upnpsetup
/tmp/na.elf
-
/bin/sh
sh -c "pidof upnpsetup"
/bin/sh
-
/usr/bin/pidof
pidof upnpsetup
/tmp/na.elf
-
/bin/sh
sh -c "systemctl daemon-reload"
/bin/sh
-
/usr/bin/systemctl
systemctl daemon-reload
/tmp/na.elf
-
/bin/sh
sh -c "systemctl enable uplugplay.service"
/bin/sh
-
/usr/bin/systemctl
systemctl enable uplugplay.service
/tmp/na.elf
-
/bin/sh
sh -c "systemctl start uplugplay.service"
/bin/sh
-
/usr/bin/systemctl
systemctl start uplugplay.service
/usr/lib/systemd/systemd
-
/usr/lib/systemd/system-environment-generators/snapd-env-generator
/usr/lib/systemd/system-environment-generators/snapd-env-generator
/usr/lib/systemd/systemd
-
/usr/lib/systemd/system-environment-generators/snapd-env-generator
/usr/lib/systemd/system-environment-generators/snapd-env-generator
/usr/lib/systemd/systemd
-
/usr/sbin/uplugplay
/usr/sbin/uplugplay
/usr/sbin/uplugplay
-
/usr/sbin/uplugplay
-
/bin/sh
sh -c "/usr/sbin/uplugplay -Dcomsvc"
/bin/sh
-
/usr/sbin/uplugplay
/usr/sbin/uplugplay -Dcomsvc
/usr/sbin/uplugplay
-
/bin/sh
sh -c "nslookup p3.feefreepool.net 8.8.8.8"
/bin/sh
-
/usr/bin/nslookup
nslookup p3.feefreepool.net 8.8.8.8
There are 38 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://p3.feefreepool.net/cgi-bin/prometei.cgihttp://dummy.zero/cgi-bin/prometei.cgihttps://gb7ni5rg
unknown
https://bugs.launchpad.net/ubuntu/
unknown
http://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.b32.i2p/cgi-bin/prometei.cgi
unknown
http://p3.feefreepool.net/cgi-bin/prometei.cgi
unknown
https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi
unknown
http://%s/cgi-bin/prometei.cgi
unknown
http://%s/cgi-bin/prometei.cgi?r=0&auth=hash&i=%s&enckey=%shttp://%s/cgi-bin/prometei.cgi%m%d%yxinch
unknown
https://http:///:.onion.i2p.zeroGET
unknown
http://dummy.zero/cgi-bin/prometei.cgi
unknown
http://%s/cgi-bin/prometei.cgi?r=0&auth=hash&i=%s&enckey=%s
unknown

Domains

Name
IP
Malicious
p3.feefreepool.net
88.198.246.242

IPs

IP
Domain
Country
Malicious
88.198.246.242
p3.feefreepool.net
Germany

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
7f0dcd26a000
page read and write
 malicious
7f0dcc4d2000
page execute read
 malicious
7f0e54128000
page read and write
7f3dbaa47000
page read and write
7f0e531bf000
page read and write
563e1fde5000
page read and write
7f3dbaa6a000
page read and write
7f0e47dfb000
page execute and read and write
7ffc0ffad000
page execute read
563e1fdce000
page execute and read and write
7f0e530bb000
page read and write
7f3dbb10f000
page read and write
7f3dbb0ca000
page read and write
7f0e5410b000
page read and write
563e218f7000
page read and write
563e1ddd0000
page read and write
7ffeab5e2000
page execute read
55b62deae000
page read and write
7f0e53a97000
page read and write
7f0e547b0000
page read and write
7f0e4affe000
page execute and read and write
7ffc0ff3b000
page read and write
55b62be8f000
page read and write
7f3dbadb8000
page read and write
7f0e53d47000
page read and write
7f0dcc4e7000
page read and write
7f0e475fa000
page execute and read and write
7f0e4c021000
page read and write
7f0e5313d000
page read and write
7f0dc8021000
page read and write
7f0e5476b000
page read and write
7f3db4021000
page read and write
55b62bc07000
page execute read
7f0e53a89000
page read and write
7f0e48dfd000
page execute and read and write
7f0e46df9000
page execute and read and write
7f0e54459000
page read and write
7f0dc4079000
page read and write
7f3db9be0000
page read and write
7f3dbb0c2000
page read and write
55b62be99000
page read and write
7f3dba3f6000
page read and write
563e1ddc6000
page read and write
7f0e5463a000
page read and write
7f3dbaf99000
page read and write
7f0e4b7ff000
page execute and read and write
7f3dba6a6000
page read and write
7f0e5317e000
page read and write
55b62f743000
page read and write
7ffeab5a8000
page read and write
7f0e4c000000
page read and write
7f3dbaa87000
page read and write
7f0e53281000
page read and write
7f0e54763000
page read and write
7f3d3526a000
page read and write
7f0e530fc000
page read and write
7f0e4a621000
page read and write
563e1db3e000
page execute read
55b62de97000
page execute and read and write
7f0e485fc000
page execute and read and write
7f0e495fe000
page execute and read and write
7f3db4000000
page read and write
7f0e540e8000
page read and write
7f3dba3e8000
page read and write
7f0e49dff000
page execute and read and write
7f0e4a600000
page execute and read and write
There are 56 hidden memdumps, click here to show them.