Files
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
/tmp/na.elf
|
/tmp/na.elf
|
||
/tmp/na.elf
|
-
|
||
/bin/sh
|
sh -c "pgrep na.elf"
|
||
/bin/sh
|
-
|
||
/usr/bin/pgrep
|
pgrep na.elf
|
||
/tmp/na.elf
|
-
|
||
/bin/sh
|
sh -c "pgrep uplugplay"
|
||
/bin/sh
|
-
|
||
/usr/bin/pgrep
|
pgrep uplugplay
|
||
/tmp/na.elf
|
-
|
||
/bin/sh
|
sh -c "pidof uplugplay"
|
||
/bin/sh
|
-
|
||
/usr/bin/pidof
|
pidof uplugplay
|
||
/tmp/na.elf
|
-
|
||
/bin/sh
|
sh -c "pgrep upnpsetup"
|
||
/bin/sh
|
-
|
||
/usr/bin/pgrep
|
pgrep upnpsetup
|
||
/tmp/na.elf
|
-
|
||
/bin/sh
|
sh -c "pidof upnpsetup"
|
||
/bin/sh
|
-
|
||
/usr/bin/pidof
|
pidof upnpsetup
|
||
/tmp/na.elf
|
-
|
||
/bin/sh
|
sh -c "systemctl daemon-reload"
|
||
/bin/sh
|
-
|
||
/usr/bin/systemctl
|
systemctl daemon-reload
|
||
/tmp/na.elf
|
-
|
||
/bin/sh
|
sh -c "systemctl enable uplugplay.service"
|
||
/bin/sh
|
-
|
||
/usr/bin/systemctl
|
systemctl enable uplugplay.service
|
||
/tmp/na.elf
|
-
|
||
/bin/sh
|
sh -c "systemctl start uplugplay.service"
|
||
/bin/sh
|
-
|
||
/usr/bin/systemctl
|
systemctl start uplugplay.service
|
||
/usr/lib/systemd/systemd
|
-
|
||
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
||
/usr/lib/systemd/systemd
|
-
|
||
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
||
/usr/lib/systemd/systemd
|
-
|
||
/usr/sbin/uplugplay
|
/usr/sbin/uplugplay
|
||
/usr/sbin/uplugplay
|
-
|
||
/usr/sbin/uplugplay
|
-
|
||
/bin/sh
|
sh -c "/usr/sbin/uplugplay -Dcomsvc"
|
||
/bin/sh
|
-
|
||
/usr/sbin/uplugplay
|
/usr/sbin/uplugplay -Dcomsvc
|
||
/usr/sbin/uplugplay
|
-
|
||
/bin/sh
|
sh -c hostnamectl
|
||
/bin/sh
|
-
|
||
/usr/bin/hostnamectl
|
hostnamectl
|
||
/usr/sbin/uplugplay
|
-
|
||
/bin/sh
|
sh -c hostnamectl
|
||
/bin/sh
|
-
|
||
/usr/bin/hostnamectl
|
hostnamectl
|
||
/usr/sbin/uplugplay
|
-
|
||
/bin/sh
|
sh -c "dmidecode --type baseboard"
|
||
/bin/sh
|
-
|
||
/usr/sbin/dmidecode
|
dmidecode --type baseboard
|
||
/usr/sbin/uplugplay
|
-
|
||
/bin/sh
|
sh -c uptime
|
||
/bin/sh
|
-
|
||
/usr/bin/uptime
|
uptime
|
||
/usr/sbin/uplugplay
|
-
|
||
/bin/sh
|
sh -c dmidecode
|
||
/bin/sh
|
-
|
||
/usr/sbin/dmidecode
|
dmidecode
|
||
/usr/sbin/uplugplay
|
-
|
||
/bin/sh
|
sh -c "uname -a"
|
||
/bin/sh
|
-
|
||
/usr/bin/uname
|
uname -a
|
||
/usr/sbin/uplugplay
|
-
|
||
/bin/sh
|
sh -c uptime
|
||
/bin/sh
|
-
|
||
/usr/bin/uptime
|
uptime
|
||
/usr/sbin/uplugplay
|
-
|
||
/bin/sh
|
sh -c "uname -a"
|
||
/bin/sh
|
-
|
||
/usr/bin/uname
|
uname -a
|
||
/usr/lib/systemd/systemd
|
-
|
||
/lib/systemd/systemd-hostnamed
|
/lib/systemd/systemd-hostnamed
|
There are 68 hidden processes, click here to show them.
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
http://152.36.128.18/cgi-bin/p.cgi?r=13&i=VLGM954F9LCDZMDK
|
152.36.128.18
|
||
http://152.36.128.18/cgi-bin/p.cgi?add=aW5mbyB7DQp2NC4wMlZfVW5peDY0DQpnYWxhc3NpYQ0KDQoyeCBJbnRlbChSKSBYZW9uKFIpIFNpbHZlciA0MjEwIENQVSBAIDIuMjBHSHoNCjMwNjQyOTYga0INCnZtd2FyZQ0KDQoNCg0KVWJ1bnR1ICYgMjAuMDQuMiBMVFMgKEZvY2FsIEZvc3NhKSAgJiBidWxsc2V5ZS9zaWQgJiANCg0KL3Vzci9zYmluLw0KIyBkbWlkZWNvZGUgMy4yfDE3NDUwMjgzMjINCg0KfQ0K&i=VLGM954F9LCDZMDK&h=galassia&enckey=np59thoRUutONl6jXhy8U+3qcDgrjEIKhbTWPxAcyUXK7cjXEuro7XOQVfJdcv9LzBq2wWXMbOYFgC97UJpaJPUuB3fviXiFQ8HKaQf9SsH/Xm/hv6l6ipAZlBDaZfcO/OrCxHQwk77TZ3A0FOkGfjA4y9/i/0MMZDJylhLAxHk=
|
152.36.128.18
|
||
http://152.36.128.18/cgi-bin/p.cgihttp://dummy.zero/cgi-bin/prometei.cgihttps://gb7ni5rgeexdcncj.oni
|
unknown
|
||
http://upx.sf.net
|
unknown
|
||
http://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.b32.i2p/cgi-bin/prometei.cgi
|
unknown
|
||
https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi
|
unknown
|
||
http://xinchaobicfea.net/cgi-bin/p.cgi?r=0&auth=hash&i=VLGM954F9LCDZMDK&enckey=np59thoRUutONl6jXhy8U-3qcDgrjEIKhbTWPxAcyUXK7cjXEuro7XOQVfJdcv9LzBq2wWXMbOYFgC97UJpaJPUuB3fviXiFQ8HKaQf9SsH/Xm/hv6l6ipAZlBDaZfcO/OrCxHQwk77TZ3A0FOkGfjA4y9/i/0MMZDJylhLAxHk_
|
54.170.242.139
|
||
http://152.36.128.18/cgi-bin/p.cgi
|
unknown
|
||
http://dummy.zero/cgi-bin/prometei.cgi
|
unknown
|
||
http://152.36.128
|
unknown
|
Domains
Name
|
IP
|
Malicious
|
|
---|---|---|---|
xinchaobicfea.net
|
54.170.242.139
|
||
xinchaobicfea.com
|
unknown
|
||
xinbicfea.org
|
unknown
|
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
152.36.128.18
|
unknown
|
United States
|
||
54.170.242.139
|
xinchaobicfea.net
|
United States
|
Memdumps
There are 6 hidden memdumps, click here to show them.