Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

HgTC70XRum

ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped

initial sample

/var/log/wtmp

data

dropped

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

ASCII text

dropped

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

ASCII text

dropped

/memfd:30-systemd-environment-d-generator (deleted)

ASCII text

dropped

/memfd:user-environment-generators (deleted)

ASCII text

dropped

/proc/5277/oom_score_adj

ASCII text

dropped

/proc/5779/oom_score_adj

very short file (no magic)

dropped

/proc/5847/oom_score_adj

ASCII text

dropped

/proc/6672/oom_score_adj

ASCII text

dropped

/proc/6681/oom_score_adj

very short file (no magic)

dropped

/proc/7082/oom_score_adj

ASCII text

dropped

/proc/7485/oom_score_adj

ASCII text

dropped

/proc/7503/oom_score_adj

very short file (no magic)

dropped

/run/sshd.pid

ASCII text

dropped

/run/systemd/inhibit/.#10ZPzBxH

ASCII text

dropped

/run/systemd/inhibit/.#12nWurb

ASCII text

dropped

/run/systemd/inhibit/.#16hWgQX

ASCII text

dropped

/run/systemd/inhibit/.#1EGlZZP

ASCII text

dropped

/run/systemd/inhibit/.#1RIzkGY

ASCII text

dropped

/run/systemd/inhibit/.#1Re4DeT

ASCII text

dropped

/run/systemd/inhibit/.#1S68Cxb

ASCII text

dropped

/run/systemd/inhibit/.#1b8gRAE

ASCII text

dropped

/run/systemd/inhibit/.#1nh7PmI

ASCII text

dropped

/run/systemd/inhibit/.#1olC5W2

ASCII text

dropped

/run/systemd/inhibit/.#1zJWT43

ASCII text

dropped

/run/systemd/inhibit/.#3tywmCE

ASCII text

dropped

/run/systemd/inhibit/.#430oBeH

ASCII text

dropped

/run/systemd/inhibit/.#471I1xY

ASCII text

dropped

/run/systemd/inhibit/.#4QUeelS

ASCII text

dropped

/run/systemd/inhibit/.#4WFfqZ2

ASCII text

dropped

/run/systemd/inhibit/.#4qAQ4da

ASCII text

dropped

/run/systemd/inhibit/.#5nR6tNF

ASCII text

dropped

/run/systemd/inhibit/.#64bqCRG

ASCII text

dropped

/run/systemd/inhibit/.#7ftr1zH

ASCII text

dropped

/run/systemd/inhibit/.#81EP26G

ASCII text

dropped

/run/systemd/resolve/.#resolv.confBaI8An

ASCII text

dropped

/run/systemd/resolve/.#resolv.confO30xD5

ASCII text

dropped

/run/systemd/resolve/.#resolv.confSX8WU7

ASCII text

dropped

/run/systemd/resolve/.#resolv.confuBqyz6

ASCII text

dropped

/run/systemd/resolve/.#resolv.confxhPTt5

ASCII text

dropped

/run/systemd/resolve/.#stub-resolv.conf66MvJ5

ASCII text

dropped

/run/systemd/resolve/.#stub-resolv.confI4xv33

ASCII text

dropped

/run/systemd/resolve/.#stub-resolv.confPyn415

ASCII text

dropped

/run/systemd/resolve/.#stub-resolv.confsxiLlo

ASCII text

dropped

/run/systemd/resolve/.#stub-resolv.confwDzMga

ASCII text

dropped

/run/systemd/seats/.#seat0AMqo9P

ASCII text

dropped

/run/systemd/seats/.#seat0EN6CMX

ASCII text

dropped

/run/systemd/seats/.#seat0J28c9F

ASCII text

dropped

/run/systemd/seats/.#seat0Nc4xK5

ASCII text

dropped

/run/systemd/seats/.#seat0Pl5WYE

ASCII text

dropped

/run/systemd/seats/.#seat0Rap2Va

ASCII text

dropped

/run/systemd/seats/.#seat0W56IiW

ASCII text

dropped

/run/systemd/seats/.#seat0fl6403

ASCII text

dropped

/run/systemd/users/.#1271RfBJF

ASCII text

dropped

/run/systemd/users/.#1272Ctk1E

ASCII text

dropped

/run/systemd/users/.#127GOTvGV

ASCII text

dropped

/run/systemd/users/.#127HLkUr3

ASCII text

dropped

/run/systemd/users/.#127K2GgTV

ASCII text

dropped

/run/systemd/users/.#127TNOwe4

ASCII text

dropped

/run/systemd/users/.#127Ve9lrW

ASCII text

dropped

/run/systemd/users/.#127XwQnm6

ASCII text

dropped

/run/systemd/users/.#127bb9MWH

ASCII text

dropped

/run/systemd/users/.#127f3wNUD

ASCII text

dropped

/run/systemd/users/.#127pForuI

ASCII text

dropped

/run/systemd/users/.#127rB6GJ3

ASCII text

dropped

/run/systemd/users/.#127yIO7w4

ASCII text

dropped

/run/systemd/users/.#127z54BS2

ASCII text

dropped

/run/systemd/users/.#127ze3RqF

ASCII text

dropped

/run/user/1000/pulse/pid

ASCII text

dropped

/run/user/127/pulse/pid

ASCII text

dropped

/run/utmp

data

dropped

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

ASCII text

dropped

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

ASCII text

dropped

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

ASCII text

dropped

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

ASCII text

dropped

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

ASCII text

dropped

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

ASCII text

dropped

/tmp/server-0.xkm

Compiled XKB Keymap: lsb, version 15

dropped

/var/lib/AccountsService/users/gdm.0OSWB1

ASCII text

dropped

/var/lib/AccountsService/users/gdm.IMXXB1

ASCII text

dropped

/var/lib/AccountsService/users/gdm.L6DWB1

ASCII text

dropped

/var/lib/gdm3/.cache/gdm/Xauthority

X11 Xauthority data

dropped

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

very short file (no magic)

dropped

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

very short file (no magic)

dropped

/var/log/Xorg.0.log

ASCII text

dropped

There are 76 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

/tmp/HgTC70XRum

n/a

/tmp/HgTC70XRum

n/a

/tmp/HgTC70XRum

n/a

/tmp/HgTC70XRum

n/a

/tmp/HgTC70XRum

n/a

/tmp/HgTC70XRum

n/a

/tmp/HgTC70XRum

n/a

/tmp/HgTC70XRum

n/a

/tmp/HgTC70XRum

n/a

/usr/lib/systemd/systemd

n/a

/usr/sbin/sshd

/usr/sbin/sshd -t

/usr/lib/systemd/systemd

n/a

/usr/sbin/sshd

/usr/sbin/sshd -D

/usr/lib/systemd/systemd

n/a

/lib/systemd/systemd-resolved

/usr/lib/systemd/systemd

n/a

/lib/systemd/systemd-logind

/usr/lib/systemd/systemd

n/a

/usr/lib/accountsservice/accounts-daemon

n/a

/usr/share/language-tools/language-validate

/usr/share/language-tools/language-validate en_US.UTF-8

/usr/share/language-tools/language-validate

n/a

/usr/share/language-tools/language-options

n/a

/bin/sh

sh -c "locale -a | grep -F .utf8 "

/bin/sh

n/a

/usr/bin/locale

locale -a

/bin/sh

n/a

/usr/bin/grep

grep -F .utf8

/usr/bin/xfce4-session

n/a

/usr/lib/systemd/systemd

n/a

/usr/bin/pulseaudio

/usr/bin/pulseaudio --daemonize=no --log-target=journal

/usr/lib/gdm3/gdm-session-worker

n/a

/etc/gdm3/PostSession/Default

/usr/sbin/gdm3

n/a

/usr/lib/gdm3/gdm-session-worker

"gdm-session-worker [pam/gdm-launch-environment]"

/usr/lib/gdm3/gdm-session-worker

n/a

/usr/lib/gdm3/gdm-x-session

/usr/lib/gdm3/gdm-x-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

/usr/lib/gdm3/gdm-x-session

n/a

/usr/bin/Xorg

/usr/bin/Xorg vt2 -displayfd 3 -auth /var/lib/gdm3/.cache/gdm/Xauthority -background none -noreset -keeptty -verbose 3

/usr/lib/xorg/Xorg.wrap

/usr/lib/xorg/Xorg.wrap vt2 -displayfd 3 -auth /var/lib/gdm3/.cache/gdm/Xauthority -background none -noreset -keeptty -verbose 3

/usr/lib/xorg/Xorg

/usr/lib/xorg/Xorg vt2 -displayfd 3 -auth /var/lib/gdm3/.cache/gdm/Xauthority -background none -noreset -keeptty -verbose 3

/usr/lib/xorg/Xorg

n/a

/bin/sh

sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

/bin/sh

n/a

/usr/bin/xkbcomp

/usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

/usr/lib/gdm3/gdm-x-session

n/a

/usr/bin/dbus-daemon

dbus-daemon --print-address 4 --session

/usr/bin/dbus-daemon

n/a

/usr/bin/dbus-daemon

n/a

/bin/false

/usr/sbin/gdm3

n/a

/etc/gdm3/PrimeOff/Default

/usr/sbin/gdm3

n/a

/etc/gdm3/PrimeOff/Default

/usr/sbin/gdm3

n/a

/etc/gdm3/PrimeOff/Default

/usr/sbin/gdm3

n/a

/etc/gdm3/PrimeOff/Default

/usr/sbin/gdm3

n/a

/etc/gdm3/PrimeOff/Default

/usr/lib/systemd/systemd

n/a

/usr/sbin/sshd

/usr/sbin/sshd -t

/usr/lib/systemd/systemd

n/a

/lib/systemd/systemd-resolved

/usr/lib/systemd/systemd

n/a

/usr/sbin/sshd

/usr/sbin/sshd -D

/usr/lib/systemd/systemd

n/a

/lib/systemd/systemd-logind

/usr/lib/systemd/systemd

n/a

/usr/lib/accountsservice/accounts-daemon

n/a

/usr/share/language-tools/language-validate

/usr/share/language-tools/language-validate en_US.UTF-8

/usr/share/language-tools/language-validate

n/a

/usr/share/language-tools/language-options

n/a

/bin/sh

sh -c "locale -a | grep -F .utf8 "

/bin/sh

n/a

/usr/bin/locale

locale -a

/bin/sh

n/a

/usr/bin/grep

grep -F .utf8

/usr/sbin/gdm3

n/a

/usr/lib/gdm3/gdm-session-worker

"gdm-session-worker [pam/gdm-launch-environment]"

/usr/lib/gdm3/gdm-session-worker

n/a

/usr/lib/gdm3/gdm-x-session

/usr/lib/gdm3/gdm-x-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

/usr/lib/gdm3/gdm-x-session

n/a

/usr/bin/Xorg

/usr/bin/Xorg vt2 -displayfd 3 -auth /var/lib/gdm3/.cache/gdm/Xauthority -background none -noreset -keeptty -verbose 3

/usr/lib/xorg/Xorg.wrap

/usr/lib/xorg/Xorg.wrap vt2 -displayfd 3 -auth /var/lib/gdm3/.cache/gdm/Xauthority -background none -noreset -keeptty -verbose 3

/usr/lib/xorg/Xorg

/usr/lib/xorg/Xorg vt2 -displayfd 3 -auth /var/lib/gdm3/.cache/gdm/Xauthority -background none -noreset -keeptty -verbose 3

/usr/lib/xorg/Xorg

n/a

/bin/sh

n/a

/usr/bin/xkbcomp

/usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

/usr/lib/gdm3/gdm-x-session

n/a

/usr/bin/dbus-daemon

dbus-daemon --print-address 4 --session

/usr/bin/dbus-daemon

n/a

/usr/bin/dbus-daemon

n/a

/bin/false

/usr/lib/systemd/systemd

n/a

/lib/systemd/systemd

/lib/systemd/systemd --user

/lib/systemd/systemd

n/a

/lib/systemd/systemd

n/a

/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

/lib/systemd/systemd

n/a

/bin/systemctl

/bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

/lib/systemd/systemd

n/a

/usr/bin/pulseaudio

/usr/bin/pulseaudio --daemonize=no --log-target=journal

/usr/lib/systemd/systemd

n/a

/lib/systemd/systemd-resolved

/usr/lib/systemd/systemd

n/a

/usr/sbin/sshd

/usr/sbin/sshd -t

/usr/lib/systemd/systemd

n/a

/lib/systemd/systemd-logind

/usr/lib/systemd/systemd

n/a

/usr/sbin/sshd

/usr/sbin/sshd -D

/usr/sbin/gdm3

n/a

/etc/gdm3/PrimeOff/Default

/usr/sbin/gdm3

n/a

/etc/gdm3/PrimeOff/Default

/usr/lib/systemd/systemd

n/a

/lib/systemd/systemd-resolved

/usr/lib/systemd/systemd

n/a

/lib/systemd/systemd-logind

/usr/lib/systemd/systemd

n/a

/sbin/agetty

/sbin/agetty -o "-p -- \\u" --noclear tty2 linux

/usr/lib/systemd/systemd

n/a

/usr/lib/accountsservice/accounts-daemon

n/a

/usr/share/language-tools/language-validate

/usr/share/language-tools/language-validate en_US.UTF-8

/usr/share/language-tools/language-validate

n/a

/usr/share/language-tools/language-options

n/a

/bin/sh

sh -c "locale -a | grep -F .utf8 "

/bin/sh

n/a

/usr/bin/locale

locale -a

/bin/sh

n/a

/usr/bin/grep

grep -F .utf8

/usr/lib/systemd/systemd

n/a

/usr/sbin/sshd

/usr/sbin/sshd -t

/usr/lib/systemd/systemd

n/a

/usr/sbin/sshd

/usr/sbin/sshd -D

/usr/sbin/gdm3

n/a

/usr/lib/gdm3/gdm-session-worker

"gdm-session-worker [pam/gdm-launch-environment]"

/usr/lib/gdm3/gdm-session-worker

n/a

/usr/lib/gdm3/gdm-x-session

/usr/lib/gdm3/gdm-x-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

/usr/lib/gdm3/gdm-x-session

n/a

/usr/bin/Xorg

/usr/bin/Xorg vt3 -displayfd 3 -auth /var/lib/gdm3/.cache/gdm/Xauthority -background none -noreset -keeptty -verbose 3

/usr/lib/xorg/Xorg.wrap

/usr/lib/xorg/Xorg.wrap vt3 -displayfd 3 -auth /var/lib/gdm3/.cache/gdm/Xauthority -background none -noreset -keeptty -verbose 3

/usr/lib/xorg/Xorg

/usr/lib/xorg/Xorg vt3 -displayfd 3 -auth /var/lib/gdm3/.cache/gdm/Xauthority -background none -noreset -keeptty -verbose 3

/usr/lib/xorg/Xorg

n/a

/bin/sh

n/a

/usr/bin/xkbcomp

/usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

/usr/lib/gdm3/gdm-x-session

n/a

/usr/bin/dbus-daemon

dbus-daemon --print-address 4 --session

/usr/bin/dbus-daemon

n/a

/usr/bin/dbus-daemon

n/a

/bin/false

/usr/lib/systemd/systemd

n/a

/lib/systemd/systemd

/lib/systemd/systemd --user

/lib/systemd/systemd

n/a

/lib/systemd/systemd

n/a

/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

/lib/systemd/systemd

n/a

/bin/systemctl

/bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

/lib/systemd/systemd

n/a

/usr/bin/pulseaudio

/usr/bin/pulseaudio --daemonize=no --log-target=journal

/usr/lib/systemd/systemd

n/a

/lib/systemd/systemd-resolved

/usr/lib/systemd/systemd

n/a

/lib/systemd/systemd-logind

/usr/lib/systemd/systemd

n/a

/usr/sbin/sshd

/usr/sbin/sshd -t

/usr/lib/systemd/systemd

n/a

/usr/sbin/sshd

/usr/sbin/sshd -D

/usr/sbin/gdm3

n/a

/etc/gdm3/PrimeOff/Default

/usr/sbin/gdm3

n/a

/etc/gdm3/PrimeOff/Default

There are 170 hidden processes, click here to show them.

URLs

Name

Malicious

http://127.0.0.1:80/tmUnblock.cgi

172.65.215.171

http://23.94.37.59/bins/Tsunami.mips;

unknown

http://23.94.37.59/bins/Tsunami.x86

unknown

http://schemas.xmlsoap.org/soap/encoding//%22%3E

unknown

http://23.94.37.59/bin

unknown

http://schemas.xmlsoap.org/soap/encoding/

unknown

http://wiki.x.org

unknown

http://schemas.xmlsoap.org/soap/envelope//

unknown

http://www.ubuntu.com/support)

unknown

http://23.94.37.59/zyxel.sh;

unknown

http://192.168.0.14:80/cgi-bin/ViewLog.asp

95.110.165.116

http://schemas.xmlsoap.org/soap/envelope/

unknown

There are 2 hidden URLs, click here to show them.

IPs

Domain

Country

Malicious

85.143.199.247

unknown

Russian Federation

42.86.205.9

unknown

China

94.70.69.92

unknown

Greece

172.15.61.142

unknown

United States

112.156.19.179

unknown

Korea Republic of

31.186.168.25

unknown

Netherlands

31.85.14.94

unknown

United Kingdom

197.86.54.125

unknown

South Africa

98.123.237.122

unknown

United States

172.197.166.141

unknown

Australia

172.150.130.143

unknown

United States

184.151.118.125

unknown

Canada

31.136.150.35

unknown

Netherlands

157.182.20.49

unknown

United States

112.97.88.167

unknown

China

210.125.75.11

unknown

Korea Republic of

172.147.85.230

unknown

United States

95.106.122.231

unknown

Russian Federation

94.52.101.0

unknown

Romania

98.117.26.126

unknown

United States

95.6.137.29

unknown

Turkey

172.147.112.193

unknown

United States

98.142.17.46

unknown

United States

98.48.231.148

unknown

United States

85.230.40.164

unknown

Sweden

85.146.193.172

unknown

Netherlands

172.227.134.124

unknown

United States

172.147.112.196

unknown

United States

172.29.49.222

unknown

Reserved

85.22.167.142

unknown

Germany

112.243.121.18

unknown

China

31.195.173.100

unknown

Italy

95.19.24.254

unknown

Spain

62.86.66.122

unknown

Italy

37.35.209.230

unknown

Spain

95.231.17.245

unknown

Italy

85.211.15.176

unknown

United Kingdom

172.12.143.82

unknown

United States

157.251.170.211

unknown

United States

109.48.129.122

unknown

Portugal

62.242.237.55

unknown

Denmark

98.71.213.216

unknown

United States

42.94.84.8

unknown

China

31.100.145.23

unknown

United Kingdom

172.232.64.132

unknown

United States

79.56.176.165

unknown

Italy

94.153.184.213

unknown

Ukraine

95.117.176.77

unknown

Germany

94.78.81.202

unknown

Turkey

184.205.26.70

unknown

United States

94.122.78.64

unknown

Turkey

98.25.94.209

unknown

United States

85.95.179.143

unknown

Russian Federation

94.72.179.78

unknown

Bulgaria

5.75.234.238

unknown

Germany

2.243.0.76

unknown

Germany

98.155.194.67

unknown

United States

95.50.145.214

unknown

Poland

172.75.35.52

unknown

United States

95.76.74.122

unknown

Romania

94.137.178.61

unknown

Georgia

94.35.200.82

unknown

Italy

31.38.6.178

unknown

France

172.132.181.16

unknown

United States

197.141.89.106

unknown

Algeria

172.75.250.68

unknown

United States

197.210.99.198

unknown

Nigeria

184.11.39.229

unknown

United States

98.46.226.92

unknown

United States

42.8.182.129

unknown

Korea Republic of

95.52.196.251

unknown

Russian Federation

95.212.143.38

unknown

Syrian Arab Republic

2.184.242.157

unknown

Iran (ISLAMIC Republic Of)

98.142.17.21

unknown

United States

184.161.229.5

unknown

Canada

172.65.108.232

unknown

United States

62.184.255.131

unknown

European Union

172.125.131.77

unknown

United States

85.48.206.171

unknown

Spain

184.223.3.10

unknown

United States

41.240.121.98

unknown

Sudan

172.197.166.158

unknown

Australia

85.173.96.247

unknown

Russian Federation

62.215.147.66

unknown

Kuwait

31.191.242.132

unknown

Italy

184.239.67.225

unknown

United States

98.69.167.71

unknown

United States

197.70.138.200

unknown

South Africa

172.75.35.39

unknown

United States

85.90.55.74

unknown

United Kingdom

98.142.17.14

unknown

United States

41.186.122.57

unknown

Rwanda

95.253.111.25

unknown

Italy

184.89.200.166

unknown

United States

184.14.58.56

unknown

United States

95.89.255.122

unknown

Germany

95.110.130.123

unknown

Italy

112.101.3.131

unknown

China

98.167.233.126

unknown

United States

94.178.33.141

unknown

Ukraine

There are 90 hidden IPs, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report

Files

Processes

URLs

IPs