Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

SZAYTvvY9Y

ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped

initial sample

/home/saturnino/.config/autostart/jbxkick.desktop

data

dropped

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

ASCII text

dropped

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

ASCII text

dropped

/proc/5431/oom_score_adj

very short file (no magic)

dropped

/proc/5434/oom_score_adj

very short file (no magic)

dropped

/proc/5436/oom_score_adj

very short file (no magic)

dropped

/proc/5438/oom_score_adj

very short file (no magic)

dropped

/proc/5440/oom_score_adj

very short file (no magic)

dropped

/proc/5442/oom_score_adj

very short file (no magic)

dropped

/proc/5445/oom_score_adj

very short file (no magic)

dropped

/proc/5530/oom_score_adj

very short file (no magic)

dropped

/proc/5560/oom_score_adj

very short file (no magic)

dropped

/proc/5563/oom_score_adj

very short file (no magic)

dropped

/proc/5565/oom_score_adj

very short file (no magic)

dropped

/proc/5567/oom_score_adj

very short file (no magic)

dropped

/proc/5569/oom_score_adj

very short file (no magic)

dropped

/proc/5571/oom_score_adj

very short file (no magic)

dropped

/proc/5574/oom_score_adj

very short file (no magic)

dropped

/proc/5751/oom_score_adj

very short file (no magic)

dropped

/proc/5868/oom_score_adj

very short file (no magic)

dropped

/proc/5875/oom_score_adj

very short file (no magic)

dropped

/proc/5937/oom_score_adj

very short file (no magic)

dropped

/run/mount/utab.KpH2dA

ASCII text

dropped

/run/systemd/journal/streams/.#9:74061FwvVq3

ASCII text

dropped

/run/systemd/journal/streams/.#9:74062zCOWc6

ASCII text

dropped

/run/systemd/journal/streams/.#9:74374Zmrke6

ASCII text

dropped

/run/systemd/journal/streams/.#9:744602mcqA5

ASCII text

dropped

/run/systemd/journal/streams/.#9:74665pyuJq3

ASCII text

dropped

/run/systemd/journal/streams/.#9:74666fOFZU3

ASCII text

dropped

/run/systemd/journal/streams/.#9:74732L9yIy5

ASCII text

dropped

/run/systemd/journal/streams/.#9:74733Cdldh6

ASCII text

dropped

/run/systemd/journal/streams/.#9:747347bGeo4

ASCII text

dropped

/run/systemd/journal/streams/.#9:75370JwuCO4

ASCII text

dropped

/run/systemd/journal/streams/.#9:75371M5uFC2

ASCII text

dropped

/run/systemd/journal/streams/.#9:75434knm825

ASCII text

dropped

/run/systemd/journal/streams/.#9:75435FiXYV5

ASCII text

dropped

/run/systemd/journal/streams/.#9:75467GHZZk3

ASCII text

dropped

/run/systemd/journal/streams/.#9:755537yx0J2

ASCII text

dropped

/run/systemd/journal/streams/.#9:75555inBwv2

ASCII text

dropped

/run/systemd/journal/streams/.#9:76160XB3lL6

ASCII text

dropped

/run/systemd/journal/streams/.#9:762248LBt84

ASCII text

dropped

/run/systemd/journal/streams/.#9:76230E1wIP4

ASCII text

dropped

/run/systemd/journal/streams/.#9:763065XzBv6

ASCII text

dropped

/run/systemd/journal/streams/.#9:76308BpVHP3

ASCII text

dropped

/run/systemd/journal/streams/.#9:76330g4YJf4

ASCII text

dropped

/run/systemd/journal/streams/.#9:76332LoY1W4

ASCII text

dropped

/run/systemd/journal/streams/.#9:76334mkGDO2

ASCII text

dropped

/run/systemd/journal/streams/.#9:76335eosKT3

ASCII text

dropped

/run/systemd/journal/streams/.#9:76357xoZyO3

ASCII text

dropped

/run/systemd/journal/streams/.#9:76359NuVYs5

ASCII text

dropped

/run/systemd/journal/streams/.#9:76381auE5A5

ASCII text

dropped

/run/systemd/journal/streams/.#9:763830pQvs6

ASCII text

dropped

/run/systemd/journal/streams/.#9:76385VOTxQ4

ASCII text

dropped

/run/systemd/journal/streams/.#9:76386EziQW3

ASCII text

dropped

/run/systemd/journal/streams/.#9:76408aTPvm4

ASCII text

dropped

/run/systemd/journal/streams/.#9:76410fdAvl4

ASCII text

dropped

/run/systemd/journal/streams/.#9:76432ajFyn3

ASCII text

dropped

/run/systemd/journal/streams/.#9:76434aeX244

ASCII text

dropped

/run/systemd/journal/streams/.#9:76456UCfvN6

ASCII text

dropped

/run/systemd/journal/streams/.#9:76458wvCqi3

ASCII text

dropped

/run/systemd/journal/streams/.#9:76460RqRkg2

ASCII text

dropped

/run/systemd/journal/streams/.#9:76461oocl62

ASCII text

dropped

/run/systemd/journal/streams/.#9:76483ZGiAv2

ASCII text

dropped

/run/systemd/journal/streams/.#9:76485eABpA6

ASCII text

dropped

/run/systemd/journal/streams/.#9:76507TAcBq3

ASCII text

dropped

/run/systemd/journal/streams/.#9:76510yF3hG6

ASCII text

dropped

/run/systemd/journal/streams/.#9:76531EWnHJ4

ASCII text

dropped

/run/systemd/journal/streams/.#9:76534i5VJV3

ASCII text

dropped

/run/systemd/journal/streams/.#9:76557ws54k2

ASCII text

dropped

/run/systemd/journal/streams/.#9:76560x28BZ5

ASCII text

dropped

/run/systemd/journal/streams/.#9:76748i9hEp5

ASCII text

dropped

/run/systemd/journal/streams/.#9:76853YjB3v5

ASCII text

dropped

/run/systemd/journal/streams/.#9:769693YyTV2

ASCII text

dropped

/run/systemd/journal/streams/.#9:76970d4BhP4

ASCII text

dropped

/run/systemd/journal/streams/.#9:78098P3rsq2

ASCII text

dropped

/run/systemd/journal/streams/.#9:78341pQFg34

ASCII text

dropped

/run/systemd/journal/streams/.#9:78493qF5285

ASCII text

dropped

/run/systemd/journal/streams/.#9:78547ifZ413

ASCII text

dropped

/run/systemd/journal/streams/.#9:78549lp0QP3

ASCII text

dropped

/run/systemd/journal/streams/.#9:785806rkdQ2

ASCII text

dropped

/run/systemd/journal/streams/.#9:78581rM4oc2

ASCII text

dropped

/run/user/1000/pulse/pid

ASCII text

dropped

/run/user/127/ICEauthority

data

dropped

/run/user/127/dconf/user

very short file (no magic)

dropped

/run/user/127/gdm/Xauthority

X11 Xauthority data

dropped

/run/user/127/pulse/pid

ASCII text

dropped

/tmp/server-0.xkm

Compiled XKB Keymap: lsb, version 15

dropped

/var/jbx/logs/jbxinit.linux.out.log

ASCII text

dropped

/var/jbxinit.linux.py

data

dropped

/var/jbxkick

data

dropped

/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0

ASCII text

dropped

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

very short file (no magic)

dropped

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

very short file (no magic)

dropped

/var/log/Xorg.0.log

ASCII text

dropped

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

data

dropped

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

data

dropped

There are 87 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

/tmp/SZAYTvvY9Y

n/a

/tmp/SZAYTvvY9Y

n/a

/tmp/SZAYTvvY9Y

n/a

/usr/lib/systemd/systemd

n/a

/usr/bin/journalctl

/usr/bin/journalctl --smart-relinquish-var

/usr/lib/systemd/systemd

n/a

/lib/systemd/systemd-journald

/usr/lib/systemd/systemd

n/a

/usr/bin/journalctl

/usr/bin/journalctl --flush

/usr/sbin/gdm3

n/a

/etc/gdm3/PrimeOff/Default

/usr/sbin/gdm3

n/a

/etc/gdm3/PrimeOff/Default

/usr/bin/dash

n/a

/usr/bin/xdotool

xdotool windowminimize

/usr/bin/python2.7

n/a

/usr/bin/srm

srm -fr /var/jbxkick /var/jbxinit.linux.py /home/saturnino/.config/autostart/jbxkick.desktop

/usr/bin/python2.7

n/a

/usr/bin/rm

rm -fr /var/jbxkick /var/jbxinit.linux.py /home/saturnino/.config/autostart/jbxkick.desktop

/usr/bin/python2.7

n/a

/usr/bin/umount

umount -v /var/jbxall

/usr/lib/udisks2/udisksd

n/a

/usr/sbin/dumpe2fs

dumpe2fs -h /dev/sda2

/usr/lib/udisks2/udisksd

n/a

/usr/sbin/dumpe2fs

dumpe2fs -h /dev/dm-0

/usr/lib/systemd/systemd

n/a

/usr/bin/pulseaudio

/usr/bin/pulseaudio --daemonize=no --log-target=journal

/usr/lib/systemd/systemd

n/a

/usr/lib/accountsservice/accounts-daemon

n/a

/usr/share/language-tools/language-validate

/usr/share/language-tools/language-validate en_US.UTF-8

/usr/share/language-tools/language-validate

n/a

/usr/share/language-tools/language-options

n/a

/bin/sh

sh -c "locale -a | grep -F .utf8 "

/bin/sh

n/a

/usr/bin/locale

locale -a

/bin/sh

n/a

/usr/bin/grep

grep -F .utf8

/usr/lib/gdm3/gdm-session-worker

n/a

/etc/gdm3/PostSession/Default

/usr/sbin/gdm3

n/a

/usr/lib/gdm3/gdm-session-worker

"gdm-session-worker [pam/gdm-launch-environment]"

/usr/lib/gdm3/gdm-session-worker

n/a

/usr/lib/gdm3/gdm-wayland-session

/usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

/usr/lib/gdm3/gdm-wayland-session

n/a

/usr/bin/dbus-run-session

dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

/usr/bin/dbus-run-session

n/a

/usr/bin/dbus-daemon

dbus-daemon --nofork --print-address 4 --session

/usr/bin/dbus-daemon

n/a

/usr/bin/dbus-daemon

n/a

/bin/false

/usr/bin/dbus-daemon

n/a

/usr/bin/dbus-daemon

n/a

/bin/false

/usr/bin/dbus-daemon

n/a

/usr/bin/dbus-daemon

n/a

/bin/false

/usr/bin/dbus-daemon

n/a

/usr/bin/dbus-daemon

n/a

/bin/false

/usr/bin/dbus-daemon

n/a

/usr/bin/dbus-daemon

n/a

/bin/false

/usr/bin/dbus-daemon

n/a

/usr/bin/dbus-daemon

n/a

/bin/false

/usr/bin/dbus-daemon

n/a

/usr/bin/dbus-daemon

n/a

/bin/false

/usr/bin/dbus-run-session

n/a

/usr/bin/gnome-session

gnome-session --autostart /usr/share/gdm/greeter/autostart

/usr/libexec/gnome-session-binary

/usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

/usr/libexec/gnome-session-binary

n/a

/usr/bin/session-migration

session-migration

/usr/libexec/gnome-session-binary

n/a

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

/usr/bin/gnome-shell

/usr/sbin/gdm3

n/a

/etc/gdm3/PrimeOff/Default

/usr/sbin/gdm3

n/a

/usr/lib/gdm3/gdm-session-worker

"gdm-session-worker [pam/gdm-launch-environment]"

/usr/lib/gdm3/gdm-session-worker

n/a

/usr/lib/gdm3/gdm-x-session

/usr/lib/gdm3/gdm-x-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

/usr/lib/gdm3/gdm-x-session

n/a

/usr/bin/Xorg

/usr/bin/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

/usr/lib/xorg/Xorg.wrap

/usr/lib/xorg/Xorg.wrap vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

/usr/lib/xorg/Xorg

/usr/lib/xorg/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

/usr/lib/xorg/Xorg

n/a

/bin/sh

sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

/bin/sh

n/a

/usr/bin/xkbcomp

/usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

/usr/lib/xorg/Xorg

n/a

/bin/sh

n/a

/usr/bin/xkbcomp

/usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

/usr/lib/gdm3/gdm-x-session

n/a

/etc/gdm3/Prime/Default

/usr/lib/gdm3/gdm-x-session

n/a

/usr/bin/dbus-run-session

dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

/usr/bin/dbus-run-session

n/a

/usr/bin/dbus-daemon

dbus-daemon --nofork --print-address 4 --session

/usr/bin/dbus-daemon

n/a

/usr/bin/dbus-daemon

n/a

/usr/libexec/at-spi-bus-launcher

n/a

/usr/bin/dbus-daemon

/usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 3

/usr/bin/dbus-daemon

n/a

/usr/bin/dbus-daemon

n/a

/usr/libexec/at-spi2-registryd

/usr/libexec/at-spi2-registryd --use-gnome-session

/usr/bin/dbus-daemon

n/a

/usr/bin/dbus-daemon

n/a

/bin/false

/usr/bin/dbus-daemon

n/a

/usr/bin/dbus-daemon

n/a

/bin/false

/usr/bin/dbus-daemon

n/a

/usr/bin/dbus-daemon

n/a

/bin/false

/usr/bin/dbus-daemon

n/a

/usr/bin/dbus-daemon

n/a

/bin/false

/usr/bin/dbus-daemon

n/a

/usr/bin/dbus-daemon

n/a

/bin/false

/usr/bin/dbus-daemon

n/a

/usr/bin/dbus-daemon

n/a

/bin/false

/usr/bin/dbus-daemon

n/a

/usr/bin/dbus-daemon

n/a

/bin/false

/usr/bin/dbus-daemon

n/a

/usr/bin/dbus-daemon

n/a

/usr/libexec/ibus-portal

/usr/bin/dbus-daemon

n/a

/usr/bin/dbus-daemon

n/a

/usr/bin/gjs

/usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications

/usr/bin/dbus-daemon

n/a

/usr/bin/dbus-daemon

n/a

/bin/false

/usr/bin/dbus-run-session

n/a

/usr/bin/gnome-session

gnome-session --autostart /usr/share/gdm/greeter/autostart

/usr/libexec/gnome-session-binary

/usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

/usr/libexec/gnome-session-binary

n/a

/usr/libexec/gnome-session-check-accelerated

n/a

/usr/libexec/gnome-session-check-accelerated-gl-helper

/usr/libexec/gnome-session-check-accelerated-gl-helper --print-renderer

/usr/libexec/gnome-session-check-accelerated

n/a

/usr/libexec/gnome-session-check-accelerated-gles-helper

/usr/libexec/gnome-session-check-accelerated-gles-helper --print-renderer

/usr/libexec/gnome-session-binary

n/a

/usr/bin/session-migration

session-migration

/usr/libexec/gnome-session-binary

n/a

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

/usr/bin/gnome-shell

n/a

/usr/bin/ibus-daemon

ibus-daemon --panel disable --xim

/usr/bin/ibus-daemon

n/a

/usr/libexec/ibus-memconf

/usr/bin/ibus-daemon

n/a

/usr/bin/ibus-daemon

n/a

/usr/libexec/ibus-x11

/usr/libexec/ibus-x11 --kill-daemon

/usr/bin/ibus-daemon

n/a

/usr/libexec/ibus-engine-simple

/usr/libexec/gnome-session-binary

n/a

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

/usr/libexec/gsd-sharing

/usr/libexec/gnome-session-binary

n/a

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

/usr/libexec/gsd-wacom

/usr/libexec/gnome-session-binary

n/a

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color

/usr/libexec/gsd-color

/usr/libexec/gnome-session-binary

n/a

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

/usr/libexec/gsd-keyboard

/usr/libexec/gnome-session-binary

n/a

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

/usr/libexec/gsd-print-notifications

n/a

/usr/libexec/gsd-print-notifications

n/a

/usr/libexec/gsd-printer

/usr/libexec/gnome-session-binary

n/a

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

/usr/libexec/gsd-rfkill

/usr/libexec/gnome-session-binary

n/a

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard

/usr/libexec/gsd-smartcard

/usr/libexec/gnome-session-binary

n/a

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-datetime

/usr/libexec/gsd-datetime

/usr/libexec/gnome-session-binary

n/a

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

/usr/libexec/gsd-media-keys

/usr/libexec/gnome-session-binary

n/a

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy

/usr/libexec/gsd-screensaver-proxy

/usr/libexec/gnome-session-binary

n/a

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound

/usr/libexec/gsd-sound

/usr/libexec/gnome-session-binary

n/a

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings

/usr/libexec/gsd-a11y-settings

/usr/libexec/gnome-session-binary

n/a

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

/usr/libexec/gsd-housekeeping

/usr/libexec/gnome-session-binary

n/a

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

/usr/libexec/gsd-power

/usr/libexec/gnome-session-binary

n/a

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/spice-vdagent

/usr/bin/spice-vdagent

/usr/libexec/gnome-session-binary

n/a

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh xbrlapi -q

/usr/bin/xbrlapi

xbrlapi -q

/usr/sbin/gdm3

n/a

/etc/gdm3/PrimeOff/Default

/usr/sbin/gdm3

n/a

/etc/gdm3/PrimeOff/Default

/usr/libexec/gvfsd-fuse

n/a

/bin/fusermount

fusermount -u -q -z -- /run/user/1000/gvfs

/usr/lib/systemd/systemd

n/a

/lib/systemd/systemd-user-runtime-dir

/lib/systemd/systemd-user-runtime-dir stop 1000

/usr/lib/systemd/systemd

n/a

/lib/systemd/systemd-localed

/usr/lib/systemd/systemd

n/a

/usr/bin/pulseaudio

/usr/bin/pulseaudio --daemonize=no --log-target=journal

/usr/lib/systemd/systemd

n/a

/usr/libexec/geoclue

/usr/lib/systemd/systemd

n/a

/lib/systemd/systemd-hostnamed

/usr/lib/systemd/systemd

n/a

/lib/systemd/systemd-localed

/usr/lib/systemd/systemd

n/a

/usr/libexec/fprintd

There are 225 hidden processes, click here to show them.

URLs

Name

Malicious

http://wiki.x.org

unknown

Details

Name:	http://wiki.x.org
TargetID:	106
From Memory:	true
Current Path:	/usr/lib/xorg/Xorg
Source:	Xorg.0.log.106.dr
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://www.ubuntu.com/support)

unknown

Details

Name:	http://www.ubuntu.com/support)
TargetID:	106
From Memory:	true
Current Path:	/usr/lib/xorg/Xorg
Source:	Xorg.0.log.106.dr
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

47.114.175.86

unknown

China

9.207.27.19

unknown

United States

69.142.48.73

unknown

United States

146.26.119.14

unknown

United States

104.15.73.51

unknown

United States

195.10.52.220

unknown

United Kingdom

186.56.181.240

unknown

Argentina

218.215.222.106

unknown

Australia

209.123.159.201

unknown

United States

169.192.248.17

unknown

United States

53.139.99.46

unknown

Germany

25.140.116.154

unknown

United Kingdom

197.3.63.189

unknown

Tunisia

80.250.244.54

unknown

Slovakia (SLOVAK Republic)

5.236.134.237

unknown

Iran (ISLAMIC Republic Of)

170.155.48.13

unknown

Argentina

34.173.106.181

unknown

United States

150.240.17.42

unknown

United States

88.52.104.178

unknown

Italy

95.76.26.248

unknown

Romania

75.177.252.219

unknown

United States

220.246.216.123

unknown

Hong Kong

14.171.11.141

unknown

Viet Nam

135.93.130.159

unknown

United States

34.11.101.203

unknown

United States

118.48.111.61

unknown

Korea Republic of

95.6.137.33

unknown

Turkey

217.155.41.147

unknown

United Kingdom

83.106.12.197

unknown

United Kingdom

80.108.189.170

unknown

Austria

108.13.86.230

unknown

United States

161.247.27.64

unknown

United States

217.162.249.202

unknown

Switzerland

132.214.230.219

unknown

Canada

34.81.11.77

unknown

United States

206.33.185.11

unknown

United States

72.67.239.16

unknown

United States

120.150.226.5

unknown

Australia

137.250.128.90

unknown

Germany

139.8.196.153

unknown

Germany

142.219.199.121

unknown

Canada

48.88.173.154

unknown

United States

128.18.204.181

unknown

United States

77.60.19.67

unknown

Netherlands

119.48.25.145

unknown

China

32.71.25.105

unknown

United States

188.160.154.140

unknown

Syrian Arab Republic

88.73.217.63

unknown

Germany

182.0.0.137

unknown

Indonesia

2.222.184.187

unknown

United Kingdom

220.161.193.24

unknown

China

34.45.16.132

unknown

United States

80.122.167.237

unknown

Austria

108.194.245.80

unknown

United States

117.11.224.254

unknown

China

111.63.96.99

unknown

China

173.124.66.194

unknown

United States

220.161.2.122

unknown

China

20.74.1.43

unknown

United States

183.62.106.32

unknown

China

9.55.228.101

unknown

United States

157.213.201.203

unknown

United States

173.188.30.6

unknown

United States

88.41.34.69

unknown

Italy

118.140.192.85

unknown

Hong Kong

145.233.36.105

unknown

United Kingdom

145.4.3.12

unknown

Netherlands

218.124.61.47

unknown

Japan

146.74.25.222

unknown

United States

4.93.103.173

unknown

United States

141.200.191.152

unknown

Germany

121.226.187.124

unknown

China

123.211.111.178

unknown

Australia

182.8.245.166

unknown

Indonesia

188.242.132.208

unknown

Russian Federation

77.145.164.187

unknown

France

52.187.247.165

unknown

United States

41.216.51.182

unknown

Benin

126.28.125.143

unknown

Japan

121.170.84.79

unknown

Korea Republic of

37.223.25.192

unknown

Spain

154.134.179.153

unknown

Egypt

53.20.182.103

unknown

Germany

14.36.212.117

unknown

Korea Republic of

152.131.33.86

unknown

United States

5.214.242.236

unknown

Iran (ISLAMIC Republic Of)

18.251.67.211

unknown

United States

27.6.83.212

unknown

India

25.138.160.44

unknown

United Kingdom

53.92.73.63

unknown

Germany

79.188.24.154

unknown

Poland

123.36.202.109

unknown

Korea Republic of

132.170.28.40

unknown

United States

175.94.80.106

unknown

China

171.6.101.90

unknown

Thailand

38.16.79.218

unknown

United States

54.254.156.131

unknown

United States

133.74.96.232

unknown

Japan

65.3.68.26

unknown

United States

101.166.215.220

unknown

Australia

There are 90 hidden IPs, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report

Files

Processes

URLs

IPs