Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

x86

ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, stripped

initial sample

Details

Filetype:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, stripped
Entropy:	7.965405452553123
Filename:	x86
Filesize:	42980
MD5:	776097f22f49b5f4c467e2afdee63009
SHA1:	540cb7d95922f31459afb94d6b37827b41bf677e
SHA256:	c817429ed299ec43b67bf47aad81081496d8ab45afe231890bdb564f4bf4db7d
SHA512:	c6d5fc772deae715e61e36aa808314e6acd2c5c7696535cc58e0d4bf6dc12adfd542d8633a685e0527b7111594378f4a6408a1539986deeb9035025550e4e39a
SSDEEP:	768:St/U6LU5Klt+u+ul5BhMGCykxB8kdtObBcedEjUnbcuyD7UGQRjV:q/LhIbykf8ltcedlnouy8GyZ
Preview:	.ELF........................4...........4. ...(.........................................D...Dm..Dm..................Q.td.............................-Z.UPX!....................T..........?..k.I/.j....\.d*nlz.eze {...v..+......R......f.....6..}../..'z.....

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Sample tries to kill many processes (SIGKILL)	System Summary
Yara signature match	System Summary
Sample tries to kill a process (SIGKILL)	System Summary
Executes commands using a shell command-line interpreter	Persistence and Installation Behavior	Scripting Non-Application Layer Protocol Application Layer Protocol
Found detection on Joe Sandbox Cloud Basic with higher score	System Summary
URLs found in memory or binary data	Networking

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

ASCII text

dropped

Details

File:	/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink
Category:	dropped
Dump:	ee49dfd4fa47433baee88884e2d7de7c-default-sink.109.dr
ID:	dr_4
Target ID:	109
Process:	/usr/bin/pulseaudio
Type:	ASCII text
Entropy:	2.9219280948873623
Encrypted:	false
Ssdeep:	3:5bkPn:pkP
Size:	10
Whitelisted:	false
Reputation:	moderate

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

ASCII text

dropped

Details

File:	/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source
Category:	dropped
Dump:	ee49dfd4fa47433baee88884e2d7de7c-default-source.109.dr
ID:	dr_5
Target ID:	109
Process:	/usr/bin/pulseaudio
Type:	ASCII text
Entropy:	3.4613201402110088
Encrypted:	false
Ssdeep:	3:5bkrIZsXvn:pkckv
Size:	18
Whitelisted:	false
Reputation:	moderate

/proc/5368/oom_score_adj

ASCII text

dropped

Details

File:	/proc/5368/oom_score_adj
Category:	dropped
Dump:	oom_score_adj.101.dr
ID:	dr_1
Target ID:	101
Process:	/usr/sbin/sshd
Type:	ASCII text
Entropy:	1.7924812503605778
Encrypted:	false
Ssdeep:	3:ptn:Dn
Size:	6
Whitelisted:	false
Reputation:	high

/run/sshd.pid

ASCII text

dropped

Details

File:	/run/sshd.pid
Category:	dropped
Dump:	sshd.pid.101.dr
ID:	dr_2
Target ID:	101
Process:	/usr/sbin/sshd
Type:	ASCII text
Entropy:	2.321928094887362
Encrypted:	false
Ssdeep:	3:DTdv:Pdv
Size:	5
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Executes the "rm" command used to delete files or directories	Persistence and Installation Behavior	File Deletion

/run/systemd/resolve/stub-resolv.conf

ASCII text

dropped

Details

File:	/run/systemd/resolve/stub-resolv.conf
Category:	dropped
Dump:	stub-resolv.conf.19.dr
ID:	dr_0
Target ID:	19
Process:	/tmp/x86
Type:	ASCII text
Entropy:	3.3918926446809334
Encrypted:	false
Ssdeep:	3:KkZRAkd:KaAu
Size:	38
Whitelisted:	false
Reputation:	moderate

/run/user/1000/pulse/pid

ASCII text

dropped

Details

File:	/run/user/1000/pulse/pid
Category:	dropped
Dump:	pid.109.dr
ID:	dr_3
Target ID:	109
Process:	/usr/bin/pulseaudio
Type:	ASCII text
Entropy:	2.321928094887362
Encrypted:	false
Ssdeep:	3:Eun:Eu
Size:	5
Whitelisted:	false
Reputation:	low

/var/log/gpu-manager.log

ASCII text

dropped

Details

File:	/var/log/gpu-manager.log
Category:	dropped
Dump:	gpu-manager.log.157.dr
ID:	dr_7
Target ID:	157
Process:	/usr/bin/gpu-manager
Type:	ASCII text
Entropy:	4.825813629825568
Encrypted:	false
Ssdeep:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555Ro7uRkoT:wPXXXe6vejpeC2HUR5WkpPpcvAdow959
Size:	1515
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Deletes log files	Malware Analysis System Evasion	Indicator Removal on Host
Writes log files to disk	Persistence and Installation Behavior

/var/run/gdm3.pid

ASCII text

dropped

Details

File:	/var/run/gdm3.pid
Category:	dropped
Dump:	gdm3.pid.197.dr
ID:	dr_8
Target ID:	197
Process:	/usr/sbin/gdm3
Type:	ASCII text
Entropy:	1.9219280948873623
Encrypted:	false
Ssdeep:	3:Fd/n:n/n
Size:	5
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Executes the "rm" command used to delete files or directories	Persistence and Installation Behavior	File Deletion

Processes

Path

Cmdline

Malicious

/tmp/x86

n/a

/tmp/x86

n/a

/tmp/x86

n/a

/tmp/x86

n/a

/tmp/x86

n/a

/tmp/x86

n/a

/tmp/x86

n/a

/tmp/x86

n/a

/tmp/x86

n/a

/tmp/x86

n/a

/bin/sh

sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*"

/bin/sh

n/a

/usr/bin/rm

rm -rf /tmp/config-err-dHT8bZ /tmp/dmesgtail.log /tmp/snap.lxd /tmp/ssh-hOQ5FjG2iVgO /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-ModemManager.service-c4RYFi /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-colord.service-gKIF8e /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-fwupd.service-gB0a9f /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-switcheroo-control.service-APWnLg /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-logind.service-IofUpj /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-resolved.service-AfPZzg /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-upower.service-x0xO0i /tmp/vmware-root_721-4290559889 /tmp/x86 /var/backups /var/cache /var/crash /var/lib /var/local /var/lock /var/log /var/mail /var/metrics /var/opt /var/run /var/snap /var/spool /var/tmp /var/run/NetworkManager /var/run/acpid.pid /var/run/acpid.socket /var/run/apport.lock /var/run/avahi-daemon /var/run/blkid /var/run/cloud-init /var/run/console-setup /var/run/crond.pid /var/run/crond.reboot /var/run/cryptsetup /var/run/cups /var/run/dbus /var/run/dmeventd-client /var/run/dmeventd-server /var/run/gdm3 /var/run/gdm3.pid /var/run/initctl /var/run/initramfs /var/run/irqbalance /var/run/lock /var/run/log /var/run/lvm /var/run/mlocate.daily.lock /var/run/mono-xsp4 /var/run/mono-xsp4.pid /var/run/motd.d /var/run/mount /var/run/multipathd.pid /var/run/netns /var/run/network /var/run/screen /var/run/sendsigs.omit.d /var/run/shm /var/run/snapd /var/run/snapd-snap.socket /var/run/snapd.socket /var/run/speech-dispatcher /var/run/spice-vdagentd /var/run/sshd /var/run/sshd.pid /var/run/sudo /var/run/systemd /var/run/tmpfiles.d /var/run/udev /var/run/udisks2 /var/run/unattended-upgrades.lock /var/run/user /var/run/utmp /var/run/uuidd /var/run/vmware /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-ModemManager.service-J6Q1Te /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-colord.service-srP90f /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-fwupd.service-biJ0Gi /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-switcheroo-control.service-1jIxdj /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-logind.service-llmWag /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-resolved.service-X16eHh /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-upower.service-GpSnaf

/tmp/x86

n/a

/bin/sh

sh -c "rm -rf /var/log/wtmp"

/bin/sh

n/a

/usr/bin/rm

rm -rf /var/log/wtmp

/tmp/x86

n/a

/bin/sh

sh -c "rm -rf /tmp/*"

/bin/sh

n/a

/usr/bin/rm

rm -rf /tmp/*

/tmp/x86

n/a

/bin/sh

sh -c "rm -rf /bin/netstat"

/bin/sh

n/a

/usr/bin/rm

rm -rf /bin/netstat

/tmp/x86

n/a

/bin/sh

sh -c "iptables -F"

/bin/sh

n/a

/usr/sbin/iptables

iptables -F

/tmp/x86

n/a

/bin/sh

sh -c "pkill -9 busybox"

/bin/sh

n/a

/usr/bin/pkill

pkill -9 busybox

/tmp/x86

n/a

/bin/sh

sh -c "pkill -9 perl"

/bin/sh

n/a

/usr/bin/pkill

pkill -9 perl

/tmp/x86

n/a

/bin/sh

sh -c "pkill -9 python"

/bin/sh

n/a

/usr/bin/pkill

pkill -9 python

/tmp/x86

n/a

/bin/sh

sh -c "service iptables stop"

/bin/sh

n/a

/usr/sbin/service

service iptables stop

/usr/sbin/service

n/a

/usr/bin/basename

basename /usr/sbin/service

/usr/sbin/service

n/a

/usr/bin/basename

basename /usr/sbin/service

/usr/sbin/service

n/a

/usr/bin/systemctl

systemctl --quiet is-active multi-user.target

/usr/sbin/service

n/a

/usr/sbin/service

n/a

/usr/bin/systemctl

systemctl list-unit-files --full --type=socket

/usr/sbin/service

n/a

/usr/bin/sed

sed -ne s/\\.socket\\s*[a-z]*\\s*$/.socket/p

/usr/bin/systemctl

systemctl stop iptables.service

/tmp/x86

n/a

/bin/sh

sh -c "/sbin/iptables -F; /sbin/iptables -X"

/bin/sh

n/a

/sbin/iptables

/sbin/iptables -F

/bin/sh

n/a

/sbin/iptables

/sbin/iptables -X

/tmp/x86

n/a

/bin/sh

sh -c "service firewalld stop"

/bin/sh

n/a

/usr/sbin/service

service firewalld stop

/usr/sbin/service

n/a

/usr/bin/basename

basename /usr/sbin/service

/usr/sbin/service

n/a

/usr/bin/basename

basename /usr/sbin/service

/usr/sbin/service

n/a

/usr/bin/systemctl

systemctl --quiet is-active multi-user.target

/usr/sbin/service

n/a

/usr/sbin/service

n/a

/usr/bin/systemctl

systemctl list-unit-files --full --type=socket

/usr/sbin/service

n/a

/usr/bin/sed

sed -ne s/\\.socket\\s*[a-z]*\\s*$/.socket/p

/usr/bin/systemctl

systemctl stop firewalld.service

/tmp/x86

n/a

/bin/sh

sh -c "rm -rf ~/.bash_history"

/bin/sh

n/a

/usr/bin/rm

rm -rf /root/.bash_history

/tmp/x86

n/a

/bin/sh

sh -c "history -c"

/usr/lib/systemd/systemd

n/a

/usr/bin/whoopsie

/usr/bin/whoopsie -f

/usr/lib/systemd/systemd

n/a

/usr/sbin/sshd

/usr/sbin/sshd -t

/usr/lib/systemd/systemd

n/a

/usr/sbin/sshd

/usr/sbin/sshd -D

/usr/sbin/gdm3

n/a

/etc/gdm3/PrimeOff/Default

/usr/sbin/gdm3

n/a

/etc/gdm3/PrimeOff/Default

/usr/lib/systemd/systemd

n/a

/usr/lib/accountsservice/accounts-daemon

/usr/lib/systemd/systemd

n/a

/usr/bin/pulseaudio

/usr/bin/pulseaudio --daemonize=no --log-target=journal

/usr/lib/systemd/systemd

n/a

/usr/bin/gpu-manager

/usr/bin/gpu-manager --log /var/log/gpu-manager.log

/usr/bin/gpu-manager

n/a

/bin/sh

sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

/bin/sh

n/a

/usr/bin/grep

grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

/usr/bin/gpu-manager

n/a

/bin/sh

sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

/bin/sh

n/a

/usr/bin/grep

grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

/usr/bin/gpu-manager

n/a

/bin/sh

sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

/bin/sh

n/a

/usr/bin/grep

grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

/usr/bin/gpu-manager

n/a

/bin/sh

sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

/bin/sh

n/a

/usr/bin/grep

grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

/usr/bin/gpu-manager

n/a

/bin/sh

sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

/bin/sh

n/a

/usr/bin/grep

grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

/usr/bin/gpu-manager

n/a

/bin/sh

sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

/bin/sh

n/a

/usr/bin/grep

grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

/usr/bin/gpu-manager

n/a

/bin/sh

sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

/bin/sh

n/a

/usr/bin/grep

grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

/usr/bin/gpu-manager

n/a

/bin/sh

sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

/bin/sh

n/a

/usr/bin/grep

grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

/usr/lib/systemd/systemd

n/a

/usr/share/gdm/generate-config

n/a

/usr/bin/pkill

pkill --signal HUP --uid gdm dconf-service

/usr/lib/systemd/systemd

n/a

/usr/lib/gdm3/gdm-wait-for-drm

/usr/libexec/gvfsd-fuse

n/a

/bin/fusermount

fusermount -u -q -z -- /run/user/1000/gvfs

/usr/lib/systemd/systemd

n/a

/lib/systemd/systemd-user-runtime-dir

/lib/systemd/systemd-user-runtime-dir stop 1000

/usr/lib/systemd/systemd

n/a

/usr/sbin/gdm3

/usr/lib/systemd/systemd

n/a

/usr/bin/gpu-manager

/usr/bin/gpu-manager --log /var/log/gpu-manager.log

/usr/bin/gpu-manager

n/a

/bin/sh

sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

/bin/sh

n/a

/usr/bin/grep

/usr/bin/gpu-manager

n/a

/bin/sh

sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

/bin/sh

n/a

/usr/bin/grep

/usr/bin/gpu-manager

n/a

/bin/sh

sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

/bin/sh

n/a

/usr/bin/grep

/usr/bin/gpu-manager

n/a

/bin/sh

sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

/bin/sh

n/a

/usr/bin/grep

/usr/bin/gpu-manager

n/a

/bin/sh

sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

/bin/sh

n/a

/usr/bin/grep

/usr/bin/gpu-manager

n/a

/bin/sh

sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

/bin/sh

n/a

/usr/bin/grep

/usr/bin/gpu-manager

n/a

/bin/sh

sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

/bin/sh

n/a

/usr/bin/grep

/usr/bin/gpu-manager

n/a

/bin/sh

sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

/bin/sh

n/a

/usr/bin/grep

/usr/lib/systemd/systemd

n/a

/usr/share/gdm/generate-config

n/a

/usr/bin/pkill

pkill --signal HUP --uid gdm dconf-service

/usr/lib/systemd/systemd

n/a

/usr/lib/gdm3/gdm-wait-for-drm

/usr/lib/systemd/systemd

n/a

/usr/sbin/gdm3

There are 178 hidden processes, click here to show them.

URLs

Name

Malicious

http://23.94.186.250/..23091t/mips;

unknown

Details

Name:	http://23.94.186.250/..23091t/mips;
TargetID:	21061
From Memory:	true
Source:	x86, 5245.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for URL or domain	AV Detection
URLs found in memory or binary data	Networking

http://schemas.xmlsoap.org/soap/encoding//%22%3E

unknown

Details

Name:	http://schemas.xmlsoap.org/soap/encoding//%22%3E
TargetID:	21061
From Memory:	true
Source:	x86, 5245.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://upx.sf.net

unknown

Details

Name:	http://upx.sf.net
TargetID:	10
From Memory:	true
Current Path:	/tmp/x86
Source:	x86
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Sample is packed with UPX	Data Obfuscation	Obfuscated Files or Information
URLs found in memory or binary data	Networking

http://schemas.xmlsoap.org/soap/encoding/

unknown

Details

Name:	http://schemas.xmlsoap.org/soap/encoding/
TargetID:	21061
From Memory:	true
Source:	x86, 5245.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

http://schemas.xmlsoap.org/soap/envelope//

unknown

Details

Name:	http://schemas.xmlsoap.org/soap/envelope//
TargetID:	21061
From Memory:	true
Source:	x86, 5245.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://www.cisco.com/go/ciscocp

unknown

Details

Name:	http://www.cisco.com/go/ciscocp
TargetID:	21065
From Memory:	true
Source:	x86, 5249.1.0000000095c93fa5.000000003788d25b.rw-.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://schemas.xmlsoap.org/soap/envelope/

unknown

Details

Name:	http://schemas.xmlsoap.org/soap/envelope/
TargetID:	21061
From Memory:	true
Source:	x86, 5245.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

Domains

Name

Malicious

daisy.ubuntu.com

162.213.33.108

Details

Name:	daisy.ubuntu.com
IP:	162.213.33.108
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

59.165.159.36

unknown

India

156.158.98.14

unknown

Tanzania United Republic of

126.139.65.215

unknown

Japan

41.102.150.109

unknown

Algeria

145.30.21.7

unknown

Netherlands

197.116.172.19

unknown

Algeria

32.81.194.163

unknown

United States

67.241.131.148

unknown

United States

41.57.232.57

unknown

Ghana

156.246.150.168

unknown

Seychelles

156.134.83.77

unknown

United States

155.167.205.84

unknown

United States

156.48.59.142

unknown

United Kingdom

197.153.12.90

unknown

Morocco

198.10.206.121

unknown

United States

156.154.241.62

unknown

United States

96.205.253.26

unknown

United States

216.47.150.26

unknown

United States

135.222.165.169

unknown

United States

197.181.96.243

unknown

Kenya

4.131.82.38

unknown

United States

175.106.189.22

unknown

China

156.49.135.42

unknown

Sweden

132.208.44.133

unknown

Canada

197.53.167.23

unknown

Egypt

201.138.200.133

unknown

Mexico

41.198.255.152

unknown

South Africa

185.188.72.147

unknown

Germany

41.42.142.158

unknown

Egypt

156.235.45.185

unknown

Seychelles

80.31.124.83

unknown

Spain

221.160.166.162

unknown

Korea Republic of

178.157.234.78

unknown

Denmark

156.154.241.72

unknown

United States

156.22.182.88

unknown

Australia

156.235.189.160

unknown

Seychelles

197.237.113.178

unknown

Kenya

157.244.145.111

unknown

Canada

156.72.230.178

unknown

United States

197.130.137.73

unknown

Morocco

41.60.37.68

unknown

Mauritius

60.25.152.140

unknown

China

72.79.77.130

unknown

United States

197.114.121.159

unknown

Algeria

197.143.173.219

unknown

Algeria

41.215.59.59

unknown

Kenya

119.189.161.217

unknown

China

48.202.227.50

unknown

United States

41.199.209.17

unknown

Egypt

83.223.101.1

unknown

United Kingdom

197.66.206.25

unknown

South Africa

156.197.151.2

unknown

Egypt

101.254.64.50

unknown

China

156.197.234.78

unknown

Egypt

140.178.218.215

unknown

United States

156.147.203.94

unknown

Korea Republic of

156.230.199.6

unknown

Seychelles

95.107.112.141

unknown

Russian Federation

186.52.71.22

unknown

Uruguay

149.78.207.23

unknown

United States

94.55.185.136

unknown

Turkey

158.99.140.160

unknown

Spain

197.237.248.156

unknown

Kenya

91.84.192.4

unknown

United Kingdom

205.133.146.227

unknown

United States

197.192.154.251

unknown

Egypt

165.139.176.150

unknown

United States

171.148.60.101

unknown

United States

88.144.36.106

unknown

United Kingdom

197.210.170.3

unknown

Nigeria

95.231.65.178

unknown

Italy

156.215.141.76

unknown

Egypt

156.231.181.95

unknown

Seychelles

41.202.62.185

unknown

South Africa

197.131.5.169

unknown

Morocco

42.116.150.58

unknown

Viet Nam

156.78.164.220

unknown

United States

197.87.110.25

unknown

South Africa

16.156.166.198

unknown

United States

156.203.180.103

unknown

Egypt

156.55.39.63

unknown

United States

156.158.25.75

unknown

Tanzania United Republic of

156.183.78.33

unknown

Egypt

156.7.184.118

unknown

United States

188.19.223.167

unknown

Russian Federation

200.185.26.94

unknown

Brazil

218.245.176.103

unknown

China

148.115.69.203

unknown

United States

2.202.172.128

unknown

Germany

74.112.91.25

unknown

Canada

197.165.92.222

unknown

Egypt

197.86.54.155

unknown

South Africa

156.102.62.18

unknown

United States

98.105.91.27

unknown

United States

73.161.162.133

unknown

United States

41.113.157.210

unknown

South Africa

156.63.125.78

unknown

United States

179.247.28.58

unknown

Brazil

62.150.83.78

unknown

Kuwait

41.4.60.87

unknown

South Africa

There are 90 hidden IPs, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report

Files

Processes

URLs

Domains

IPs