IOC Report
SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

Processes

Path

Cmdline

Malicious

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

-

There are 37 hidden processes, click here to show them.

URLs

Name

IP

Malicious

http://upx.sf.net

unknown

Details

Name:	http://upx.sf.net
TargetID:	12
From Memory:	true
Current Path:	/tmp/SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf
Source:	SecuriteInfo.com.Linux.Siggen.9999.12346.8960.elf

Signature Hits	Behavior Group	Mitre Attack
Sample is packed with UPX	Data Obfuscation	Obfuscated Files or Information
URLs found in memory or binary data	Networking

Domains

Name

IP

Malicious

daisy.ubuntu.com

162.213.35.25

IPs

IP

Domain

Country

Malicious

94.156.71.225

unknown

Bulgaria

Details

IP:	94.156.71.225
TargetID:	-1
Country:	Bulgaria
Countrycode:	BGR
ASN number:	31420
ASN name:	TERASYST-ASBG
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

Memdumps

Base Address

Regiontype

Protect

Malicious

805c000

page execute read

805c000

page execute read

f7f8d000

page execute read

c02000

page execute read

ffbf9000

page read and write

f7f8d000

page execute read

805d000

page read and write

805d000

page read and write

c02000

page execute read

80a4000

page read and write

80a4000

page read and write

ffbf9000

page read and write

There are 2 hidden memdumps, click here to show them.