IOC Report
na.elf

loading gifFilesProcessesURLsDomainsIPsMemdumps32101032Label

Files

File Path
Type
Category
Malicious
Download
na.elf
ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, no section header
initial sample
malicious
/etc/CommId
ASCII text, with no line terminators
dropped
malicious
/usr/sbin/uplugplay
ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, no section header
dropped
malicious
/memfd:snapd-env-generator (deleted)
ASCII text
dropped
/usr/lib/systemd/system/uplugplay.service
ASCII text
dropped

Processes

Path
Cmdline
Malicious
/tmp/na.elf
/tmp/na.elf
/tmp/na.elf
-
/bin/sh
sh -c "pgrep na.elf"
/bin/sh
-
/usr/bin/pgrep
pgrep na.elf
/tmp/na.elf
-
/bin/sh
sh -c "pgrep uplugplay"
/bin/sh
-
/usr/bin/pgrep
pgrep uplugplay
/tmp/na.elf
-
/bin/sh
sh -c "pidof uplugplay"
/bin/sh
-
/usr/bin/pidof
pidof uplugplay
/tmp/na.elf
-
/bin/sh
sh -c "pgrep upnpsetup"
/bin/sh
-
/usr/bin/pgrep
pgrep upnpsetup
/tmp/na.elf
-
/bin/sh
sh -c "pidof upnpsetup"
/bin/sh
-
/usr/bin/pidof
pidof upnpsetup
/tmp/na.elf
-
/bin/sh
sh -c "systemctl daemon-reload"
/bin/sh
-
/usr/bin/systemctl
systemctl daemon-reload
/tmp/na.elf
-
/bin/sh
sh -c "systemctl enable uplugplay.service"
/bin/sh
-
/usr/bin/systemctl
systemctl enable uplugplay.service
/tmp/na.elf
-
/bin/sh
sh -c "systemctl start uplugplay.service"
/bin/sh
-
/usr/bin/systemctl
systemctl start uplugplay.service
/usr/lib/systemd/systemd
-
/usr/lib/systemd/system-environment-generators/snapd-env-generator
/usr/lib/systemd/system-environment-generators/snapd-env-generator
/usr/lib/systemd/systemd
-
/usr/lib/systemd/system-environment-generators/snapd-env-generator
/usr/lib/systemd/system-environment-generators/snapd-env-generator
/usr/lib/systemd/systemd
-
/usr/sbin/uplugplay
/usr/sbin/uplugplay
/usr/sbin/uplugplay
-
/usr/sbin/uplugplay
-
/bin/sh
sh -c "/usr/sbin/uplugplay -Dcomsvc"
/bin/sh
-
/usr/sbin/uplugplay
/usr/sbin/uplugplay -Dcomsvc
/usr/sbin/uplugplay
-
/bin/sh
sh -c hostnamectl
/bin/sh
-
/usr/bin/hostnamectl
hostnamectl
/usr/sbin/uplugplay
-
/bin/sh
sh -c hostnamectl
/bin/sh
-
/usr/bin/hostnamectl
hostnamectl
/usr/sbin/uplugplay
-
/bin/sh
sh -c "dmidecode --type baseboard"
/bin/sh
-
/usr/sbin/dmidecode
dmidecode --type baseboard
/usr/sbin/uplugplay
-
/bin/sh
sh -c uptime
/bin/sh
-
/usr/bin/uptime
uptime
/usr/sbin/uplugplay
-
/bin/sh
sh -c dmidecode
/bin/sh
-
/usr/sbin/dmidecode
dmidecode
/usr/sbin/uplugplay
-
/bin/sh
sh -c "uname -a"
/bin/sh
-
/usr/bin/uname
uname -a
/usr/sbin/uplugplay
-
/bin/sh
sh -c uptime
/bin/sh
-
/usr/bin/uptime
uptime
/usr/sbin/uplugplay
-
/bin/sh
sh -c "uname -a"
/bin/sh
-
/usr/bin/uname
uname -a
/usr/lib/systemd/systemd
-
/lib/systemd/systemd-hostnamed
/lib/systemd/systemd-hostnamed
There are 68 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://152.36.128.18/cgi-bin/p.cgi?r=9&i=VMQ2U37O09CTEFFA
152.36.128.18
malicious
http://152.36.128.18/cgi-bin/p.cgihttp://dummy.zero/cgi-bin/prometei.cgihttps://gb7ni5rgeexdcncj.oni
unknown
http://upx.sf.net
unknown
http://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.b32.i2p/cgi-bin/prometei.cgi
unknown
https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi
unknown
http://xinchaobicfea.net/cgi-bin/p.cgi?r=0&auth=hash&i=VMQ2U37O09CTEFFA&enckey=uxFVgoK1rV/3EfVujn1Pc60rjkBMtsEHSR74q/qrmQU2DZuNwN/o3YI-lx0eCT-oClptXDKlX2U9PCe0DL75Fjwi5P1kEDhf4UKwiqaR7BUeckkUpnRv6glKNT8uwvU-SwEm2DZ0G/juEtAJIkmLRACKp1J5scrElWaQoIC7Lak_
54.170.242.139
http://152.36.128.18/cgi-bin/p.cgi
unknown
http://dummy.zero/cgi-bin/prometei.cgi
unknown
http://152.36.128
unknown

Domains

Name
IP
Malicious
xinchaobicfea.net
54.170.242.139
xinchaobicfea.com
unknown
xinbicfea.org
unknown

IPs

IP
Domain
Country
Malicious
152.36.128.18
unknown
United States
malicious
54.170.242.139
xinchaobicfea.net
United States

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
7ffe6d9f5000
page execute read
7fcbb77ff000
page read and write
7fcbb8021000
page read and write
1575000
page read and write
7fcbbf334000
page read and write
7fcbbeb33000
page read and write
2101000
page read and write
7fcbbfb35000
page read and write
7fcbbcb2f000
page read and write
7fcbbdb31000
page read and write
7fcbb6ffe000
page read and write
7fcbbe332000
page read and write
7fcbb8000000
page read and write
7ffe6d9eb000
page read and write
4f9000
page execute read
7fcbbd330000
page read and write
There are 6 hidden memdumps, click here to show them.