Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
na.elf

Overview

General Information

Sample name:na.elf
Analysis ID:1527217
MD5:1f9b897e74e63fc4323e172d3bb273b3
SHA1:a95432acdd38ba77f5b6bfdbee1561bace0e18e1
SHA256:8b55ed538747da2c6c4f81f256e6893b8efb7eb3043d9f8603f5afaa97f23022
Tags:elfuser-abuse_ch
Infos:

Detection

Score:52
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Sample contains AV-related strings
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Classification

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1527217
Start date and time:2024-10-06 21:57:29 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 49s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:na.elf
Detection:MAL
Classification:mal52.evad.linELF@0/0@2/0

Warnings

  • VT rate limit hit for: na.elf

Runtime Messages

Command:/tmp/na.elf
PID:5511
Exit Code:139
Exit Code Info:SIGSEGV (11) Segmentation fault invalid memory reference
Killed:False
Standard Output:

Standard Error:

Process Tree

  • system is lnxubuntu20
  • na.elf (PID: 5511, Parent: 5434, MD5: 1f9b897e74e63fc4323e172d3bb273b3) Arguments: /tmp/na.elf
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: na.elfReversingLabs: Detection: 39%
Source: global trafficTCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443
Source: unknownTCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknownTCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
Source: na.elfString found in binary or memory: http://%s.%sSyntax
Source: na.elfString found in binary or memory: http://0day5.com/archives/1173/name:
Source: na.elfString found in binary or memory: http://0day5.com/archives/4249/
Source: na.elfString found in binary or memory: http://118.190.97.19:88/qingy/Web%E5%AE%89%E5%85%A8
Source: na.elfString found in binary or memory: http://127.0.0.1:8080
Source: na.elfString found in binary or memory: http://127.0.0.1:show
Source: na.elfString found in binary or memory: http://127.1.1.1:700
Source: na.elfString found in binary or memory: http://airflow.apache.org/
Source: na.elfString found in binary or memory: http://api.ceye.io/v1/records?token=%s&type=dns&filter=%sssh:
Source: na.elfString found in binary or memory: http://baidu.com/api/v1/targets/?test.yml
Source: na.elfString found in binary or memory: http://blog.o0o.nu/2010/07/cve-2010-1871-jboss-seam-framework.html
Source: na.elfString found in binary or memory: http://ckeditor.com
Source: na.elfString found in binary or memory: http://cve-2018-7600-8-x.vulnet:8080/
Source: na.elfString found in binary or memory: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8770
Source: na.elfString found in binary or memory: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16313
Source: na.elfString found in binary or memory: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9757
Source: na.elfString found in binary or memory: http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html
Source: na.elfString found in binary or memory: http://foreversong.cn/archives/1378
Source: na.elfString found in binary or memory: http://forum.panabit.com/thread-10830-1-1.htmlNCHARNUMBERSB1FLOATNullStrVarNumLONGVARCHARROWIDDATEVa
Source: na.elfString found in binary or memory: http://github.com/hackgov)
Source: na.elfString found in binary or memory: http://localhost/ueditor/net/controller.ashx?action=catchimage&encode=utf-8
Source: na.elfString found in binary or memory: http://luckyzmj.cn/posts/15dff4d3.html
Source: na.elfString found in binary or memory: http://luckyzmj.cn/posts/15dff4d3.htmlname:
Source: na.elfString found in binary or memory: http://print1n.top)
Source: na.elfString found in binary or memory: http://webkiller.cn/)
Source: na.elfString found in binary or memory: http://wiki.peiqi.tech/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E4%B8%89%E
Source: na.elfString found in binary or memory: http://wiki.peiqi.tech/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E8%BF%88%E
Source: na.elfString found in binary or memory: http://wiki.peiqi.tech/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E9%94%90%E
Source: na.elfString found in binary or memory: http://wiki.peiqi.tech/PeiQi_Wiki/CMS%E6%BC%8F%E6%B4%9E/Weiphp/Weiphp5.0%20%E5%89%8D%E5%8F%B0%E6%96%
Source: na.elfString found in binary or memory: http://wiki.peiqi.tech/PeiQi_Wiki/OA%E4%BA%A7%E5%93%81%E6%BC%8F%E6%B4%9E/%E5%B8%86%E8%BD%AFOA/%E5%B8
Source: na.elfString found in binary or memory: http://wiki.peiqi.tech/PeiQi_Wiki/OA%E4%BA%A7%E5%93%81%E6%BC%8F%E6%B4%9E/%E6%B3%9B%E5%BE%AEOA/%E6%B3
Source: na.elfString found in binary or memory: http://wiki.peiqi.tech/PeiQi_Wiki/OA%E4%BA%A7%E5%93%81%E6%BC%8F%E6%B4%9E/%E7%94%A8%E5%8F%8BOA/%E7%94
Source: na.elfString found in binary or memory: http://wiki.peiqi.tech/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E4%B8%AD%E5%88%9B%E8%A7%8
Source: na.elfString found in binary or memory: http://wiki.peiqi.tech/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E5%AE%89%E7%BE%8E%E6%95%B
Source: na.elfString found in binary or memory: http://wiki.peiqi.tech/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E6%B7%B1%E4%BF%A1%E6%9C%8
Source: na.elfString found in binary or memory: http://wiki.peiqi.tech/wiki/iot/HIKVISION/HIKVISION%20%E8%A7%86%E9%A2%91%E7%BC%96%E7%A0%81%E8%AE%BE%
Source: na.elfString found in binary or memory: http://wiki.peiqi.tech/wiki/oa/%E8%87%B4%E8%BF%9COA/%E8%87%B4%E8%BF%9COA%20A8%20status.jsp%20%E4%BF%
Source: na.elfString found in binary or memory: http://wiki.peiqi.tech/wiki/oa/%E9%80%9A%E8%BE%BEOA/%E9%80%9A%E8%BE%BEOA%20v11.6%20insert%20SQL%E6%B
Source: na.elfString found in binary or memory: http://wiki.peiqi.tech/wiki/oa/%E9%80%9A%E8%BE%BEOA/%E9%80%9A%E8%BE%BEOA%20v11.7%20auth_mobi.php%20%
Source: na.elfString found in binary or memory: http://wiki.peiqi.tech/wiki/oa/%E9%80%9A%E8%BE%BEOA/%E9%80%9A%E8%BE%BEOA%20v2017%20action_upload.php
Source: na.elfString found in binary or memory: http://wiki.peiqi.tech/wiki/webapp/AtlassianConfluence/Atlassian%20Confluence%20OGNL%E6%B3%A8%E5%85%
Source: na.elfString found in binary or memory: http://wiki.xypbk.com/IOT%E5%AE%89%E5%85%A8/ZeroShell/ZeroShell%203.9.0%20%E8%BF%9C%E7%A8%8B%E5%91%B
Source: na.elfString found in binary or memory: http://wiki.xypbk.com/Web%E5%AE%89%E5%85%A8/%E7%BD%91%E5%BA%B7%20NS-ASG%E5%AE%89%E5%85%A8%E7%BD%91%E
Source: na.elfString found in binary or memory: http://www-3.ibm.com/services/uddi/inquiryapi
Source: na.elfString found in binary or memory: http://www-3.ibm.com/services/uddi/v2beta/inquiryapi
Source: na.elfString found in binary or memory: http://www.bt.cn/bbs)The
Source: na.elfString found in binary or memory: http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200705-315name:
Source: na.elfString found in binary or memory: http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202003-1728
Source: na.elfString found in binary or memory: http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202003-181
Source: na.elfString found in binary or memory: http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202012-1548
Source: na.elfString found in binary or memory: http://www.cnxunchi.com
Source: na.elfString found in binary or memory: http://www.ctfiot.com/13682.html
Source: na.elfString found in binary or memory: http://www.dedeyuan.com/xueyuan/wenti/1244.html
Source: na.elfString found in binary or memory: http://www.iwantacve.cn/index.php/archives/311/
Source: na.elfString found in binary or memory: http://www.lmxspace.com/)
Source: na.elfString found in binary or memory: http://www.polaris-lab.com/index.php/archives/253/
Source: na.elfString found in binary or memory: http://www.tongda2000.com
Source: na.elfString found in binary or memory: http://www.tp-shop.cn
Source: na.elfString found in binary or memory: http://www.wujunjie.net/index.php/2015/08/02/%E6%96%B9%E7%BB%B4%E5%9B%A2%E8%B4%AD4-3%E6%9C%80%E6%96%
Source: na.elfString found in binary or memory: http://www.xdoa.cn
Source: na.elfString found in binary or memory: http://wx.weaver)(
Source: na.elfString found in binary or memory: http://wy.zone.ci/bug_detail.php?wybug_id=wooyun-2015-0150742
Source: na.elfString found in binary or memory: https://bbs.secnet.cn/post/t-30
Source: na.elfString found in binary or memory: https://blog.51cto.com/13770310/2156663
Source: na.elfString found in binary or memory: https://blog.csdn.net/DFMASTER/article/details/108547352
Source: na.elfString found in binary or memory: https://blog.csdn.net/caiqiiqi/article/details/112005424
Source: na.elfString found in binary or memory: https://blog.csdn.net/dfdhxb995397/article/details/101385340
Source: na.elfString found in binary or memory: https://blog.csdn.net/fnmsd)
Source: na.elfString found in binary or memory: https://blog.csdn.net/fnmsd/article/details/88657083
Source: na.elfString found in binary or memory: https://blog.csdn.net/fnmsd/article/details/89235589name:
Source: na.elfString found in binary or memory: https://blog.csdn.net/ge00111/article/details/72765210name:
Source: na.elfString found in binary or memory: https://blog.csdn.net/god_7z1/article/details/8180454
Source: na.elfString found in binary or memory: https://blog.csdn.net/qq_36374896/article/details/84839891
Source: na.elfString found in binary or memory: https://blog.csdn.net/qq_36923426/article/details/111361158
Source: na.elfString found in binary or memory: https://blog.csdn.net/qq_41503511/article/details/116274406
Source: na.elfString found in binary or memory: https://blog.csdn.net/u012206617/article/details/109107210
Source: na.elfString found in binary or memory: https://blog.csdn.net/weixin_39779975/article/details/111091529
Source: na.elfString found in binary or memory: https://blog.csdn.net/weixin_40709439/article/details/82780606
Source: na.elfString found in binary or memory: https://blog.csdn.net/weixin_42633229/article/details/117070546name:
Source: na.elfString found in binary or memory: https://blog.csdn.net/weixin_44578334/article/details/110917053
Source: na.elfString found in binary or memory: https://blog.csdn.net/xuandao_ahfengren/article/details/111402955
Source: na.elfString found in binary or memory: https://blog.csdn.net/ystyaoshengting/article/details/82734888name:
Source: na.elfString found in binary or memory: https://blog.csdn.net/zy15667076526/article/details/111413979
Source: na.elfString found in binary or memory: https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/
Source: na.elfString found in binary or memory: https://blog.orange.tw/2019/08/attacking-ssl-vpn-part-2-breaking-the-fortigate-ssl-vpn.html
Source: na.elfString found in binary or memory: https://blog.sonarsource.com/gocd-pre-auth-pipeline-takeover
Source: na.elfString found in binary or memory: https://blog.star7th.com/2016/05/2007.htmlname:
Source: na.elfString found in binary or memory: https://blog.unauthorizedaccess.nl/2020/07/07/adventures-in-citrix-security-research.html
Source: na.elfString found in binary or memory: https://buaq.net/go-53721.html
Source: na.elfString found in binary or memory: https://bugs.shuimugan.com/bug/view?bug_no=0108235
Source: na.elfString found in binary or memory: https://cert.360.cn/report/detail?id=b3eaa020cf5c0e9e92136041e4d713bb
Source: na.elfString found in binary or memory: https://cert.360.cn/warning/detail?id=fba518d5fc5c4ed4ebedff1dab24caf2
Source: na.elfString found in binary or memory: https://cloud.tencent.com/developer/article/1472550
Source: na.elfString found in binary or memory: https://cloud.tencent.com/developer/news/312276
Source: na.elfString found in binary or memory: https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html
Source: na.elfString found in binary or memory: https://confluence.atlassian.com/jira/jira-security-advisory-2019-07-10-973486595.html
Source: na.elfString found in binary or memory: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1871name:
Source: na.elfString found in binary or memory: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10736
Source: na.elfString found in binary or memory: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10737
Source: na.elfString found in binary or memory: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10738
Source: na.elfString found in binary or memory: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14179
Source: na.elfString found in binary or memory: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5284name:
Source: na.elfString found in binary or memory: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9376
Source: na.elfString found in binary or memory: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3019
Source: na.elfString found in binary or memory: https://cwiki.apache.org/confluence/display/AMBARI/Quick
Source: na.elfString found in binary or memory: https://darrenmartyn.ie/2021/01/24/visualdoor-sonicwall-ssl-vpn-exploit/
Source: na.elfString found in binary or memory: https://devco.re/blog/2019/01/16/hacking-Jenkins-part1-play-with-dynamic-routing/
Source: na.elfString found in binary or memory: https://dmaasland.github.io/posts/citrix.html
Source: na.elfString found in binary or memory: https://docs.influxdata.com/influxdb/v1.7/tools/api/name:
Source: na.elfString found in binary or memory: https://docs.min.io/cn/
Source: na.elfString found in binary or memory: https://edr.sangfor.com.cn/
Source: na.elfString found in binary or memory: https://exp1orer.github.io
Source: na.elfString found in binary or memory: https://fengchenzxc.github.io/%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6
Source: na.elfString found in binary or memory: https://gist.githubusercontent.com/s00py/a1ba36a3689fa13759ff910e179fc133/raw/fae5e663ffac0e3996fd9d
Source: na.elfString found in binary or memory: https://git.sp0re.sh/sp0re/Nhttpd-exploits
Source: na.elfString found in binary or memory: https://gitee.com/ComsenzDiscuz/DiscuzX/issues/IPRUI
Source: na.elfString found in binary or memory: https://github.com/0x-zmz
Source: na.elfString found in binary or memory: https://github.com/2357000166)
Source: na.elfString found in binary or memory: https://github.com/Aiminsun/CVE-2021-36260
Source: na.elfString found in binary or memory: https://github.com/Aquilao)
Source: na.elfString found in binary or memory: https://github.com/B1anda0)
Source: na.elfString found in binary or memory: https://github.com/CouchCMS/CouchCMS/issues/46
Source: na.elfString found in binary or memory: https://github.com/Facker007)
Source: na.elfString found in binary or memory: https://github.com/FiveAourThe)
Source: na.elfString found in binary or memory: https://github.com/For3stCo1d)
Source: na.elfString found in binary or memory: https://github.com/IsaacQiang)
Source: na.elfString found in binary or memory: https://github.com/Jarcis-cy)
Source: na.elfString found in binary or memory: https://github.com/JcQSteven/blog/issues/18
Source: na.elfString found in binary or memory: https://github.com/JrDw0/)
Source: na.elfString found in binary or memory: https://github.com/LandGrey/SpringBootVulExploit
Source: na.elfString found in binary or memory: https://github.com/LandGrey/flink-unauth-rce
Source: na.elfString found in binary or memory: https://github.com/Loneyers)
Source: na.elfString found in binary or memory: https://github.com/Loneyers/ThinkPHP6_Anyfile_operation_write
Source: na.elfString found in binary or memory: https://github.com/Loneyers/vuldocker/tree/master/next.js
Source: na.elfString found in binary or memory: https://github.com/Loneyers/vuldocker/tree/master/spring/CVE-2019-3799
Source: na.elfString found in binary or memory: https://github.com/MaxSecurity)
Source: na.elfString found in binary or memory: https://github.com/Medicean/VulApps/tree/master/w/wordpress/2
Source: na.elfString found in binary or memory: https://github.com/Mr-xn/spring-core-rce
Source: na.elfString found in binary or memory: https://github.com/Mr-xn/spring-core-rcename:
Source: na.elfString found in binary or memory: https://github.com/MrPointSun)
Source: na.elfString found in binary or memory: https://github.com/NS-Sp4ce/Inspur
Source: na.elfString found in binary or memory: https://github.com/PR3R00T/CVE-2020-8193-Citrix-Scanner/blob/master/scanner.py
Source: na.elfString found in binary or memory: https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E4%B8%87%E6%88%B7OA/%E4%B8%87%E6%8
Source: na.elfString found in binary or memory: https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%B
Source: na.elfString found in binary or memory: https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E9%80%9A%E8%BE%BEOA/%E9%80%9A%E8%B
Source: na.elfString found in binary or memory: https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/webapp/%E6%B7%B1%E4%BF%A1%E6%9C%8D/%E6
Source: na.elfString found in binary or memory: https://github.com/PeiQi0/PeiQi-WIKI-POC/blob/PeiQi/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%
Source: na.elfString found in binary or memory: https://github.com/PeiQi0/PeiQi-WIKI-POC/blob/PeiQi/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%
Source: na.elfString found in binary or memory: https://github.com/PeiQi0/PeiQi-WIKI-POC/blob/b6f8fbfef46ad1c3f8d5715dd19b00ca875341c2/_book/PeiQi_W
Source: na.elfString found in binary or memory: https://github.com/PickledFish)
Source: na.elfString found in binary or memory: https://github.com/Print1n)
Source: na.elfString found in binary or memory: https://github.com/Sndav)
Source: na.elfString found in binary or memory: https://github.com/Soveless)
Source: na.elfString found in binary or memory: https://github.com/Sup3rm4nx0x)
Source: na.elfString found in binary or memory: https://github.com/ThestaRY7/)
Source: na.elfString found in binary or memory: https://github.com/WhiteHSBG)
Source: na.elfString found in binary or memory: https://github.com/Y4er/Y4er.com/blob/15f49973707f9d526a059470a074cb6e38a0e1ba/content/post/weiphp-e
Source: na.elfString found in binary or memory: https://github.com/ab1gale/phpcms-2008-CVE-2018-19127
Source: na.elfString found in binary or memory: https://github.com/abcRosexyz)
Source: na.elfString found in binary or memory: https://github.com/alibaba/druid
Source: na.elfString found in binary or memory: https://github.com/alibaba/nacos/issues/4593
Source: na.elfString found in binary or memory: https://github.com/apachecn/sec-wiki/blob/c73367f88026f165b02a1116fe1f1cd2b8e8ac37/doc/unclassified/
Source: na.elfString found in binary or memory: https://github.com/betta-cyber)
Source: na.elfString found in binary or memory: https://github.com/bufsnake)
Source: na.elfString found in binary or memory: https://github.com/canc3s)
Source: na.elfString found in binary or memory: https://github.com/cc8ci)
Source: na.elfString found in binary or memory: https://github.com/chaosec2021
Source: na.elfString found in binary or memory: https://github.com/dahua966/)
Source: na.elfString found in binary or memory: https://github.com/dem0ns)
Source: na.elfString found in binary or memory: https://github.com/dem0ns/improper
Source: na.elfString found in binary or memory: https://github.com/dem0ns/improper/tree/master/laravel/5_debug
Source: na.elfString found in binary or memory: https://github.com/dreadlocked/Drupalgeddon2
Source: na.elfString found in binary or memory: https://github.com/evi1code/Just-for-fun/issues/2
Source: na.elfString found in binary or memory: https://github.com/ffay/lanproxy/issues/152
Source: na.elfString found in binary or memory: https://github.com/fnmsd)
Source: na.elfString found in binary or memory: https://github.com/fuzz7j)
Source: na.elfString found in binary or memory: https://github.com/goharbor/harbor/issues/8951
Source: na.elfString found in binary or memory: https://github.com/ha9worm)
Source: na.elfString found in binary or memory: https://github.com/hackgov)
Source: na.elfString found in binary or memory: https://github.com/hanxiansheng26)
Source: na.elfString found in binary or memory: https://github.com/harris2015)
Source: na.elfString found in binary or memory: https://github.com/ianxtianxt/Pyspider-webui-poc
Source: na.elfString found in binary or memory: https://github.com/imjdl/CVE-2020-8515-PoC
Source: na.elfString found in binary or memory: https://github.com/immunIT/CVE-2018-11759
Source: na.elfString found in binary or memory: https://github.com/j4ckzh0u)
Source: na.elfString found in binary or memory: https://github.com/jamieparfet/Apache-OFBiz-XXE/blob/master/exploit.py
Source: na.elfString found in binary or memory: https://github.com/jas502n/CVE-2019-11510-1
Source: na.elfString found in binary or memory: https://github.com/jas502n/CVE-2019-6340
Source: na.elfString found in binary or memory: https://github.com/jinqi520
Source: na.elfString found in binary or memory: https://github.com/jujumanman)
Source: na.elfString found in binary or memory: https://github.com/jumpserver/jumpserver/releases/download/v2.6.2/jms_bug_check.sh
Source: na.elfString found in binary or memory: https://github.com/jweny)
Source: na.elfString found in binary or memory: https://github.com/kmahyyg)
Source: na.elfString found in binary or memory: https://github.com/knqyf263/CVE-2019-6340
Source: na.elfString found in binary or memory: https://github.com/kongxin520/DedeCMS/blob/master/DedeCMS_5.7_Bug.mdname:
Source: na.elfString found in binary or memory: https://github.com/kzaopa)
Source: na.elfString found in binary or memory: https://github.com/last0monster)
Source: na.elfString found in binary or memory: https://github.com/masahiro331/CVE-2019-10758
Source: na.elfString found in binary or memory: https://github.com/microsoft/CSS-Exchange/blob/main/Security/http-vuln-cve2021-26855.nse
Source: na.elfString found in binary or memory: https://github.com/mpgn/CVE-2018-11686
Source: na.elfString found in binary or memory: https://github.com/mstxq17/CodeCheck/
Source: na.elfString found in binary or memory: https://github.com/mumu0215)
Source: na.elfString found in binary or memory: https://github.com/neal1991)
Source: na.elfString found in binary or memory: https://github.com/neverendxxxxxx)
Source: na.elfString found in binary or memory: https://github.com/notwhy)
Source: na.elfString found in binary or memory: https://github.com/nu0l)
Source: na.elfString found in binary or memory: https://github.com/nu0l/poc-wiki/blob/main/%E9%87%91%E8%9D%B6OA%20server_file%20%E7%9B%AE%E5%BD%95%E
Source: na.elfString found in binary or memory: https://github.com/opsxcq/exploit-CVE-2014-6271name:
Source: na.elfString found in binary or memory: https://github.com/projectzeroindia/CVE-2019-11510name:
Source: na.elfString found in binary or memory: https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7
Source: na.elfString found in binary or memory: https://github.com/pululin)
Source: na.elfString found in binary or memory: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_ofbiz_
Source: na.elfString found in binary or memory: https://github.com/rapid7/metasploit-framework/pull/13807/files
Source: na.elfString found in binary or memory: https://github.com/rconfig/rconfig/commit/6ea92aa307e20f0918ebd18be9811e93048d5071
Source: na.elfString found in binary or memory: https://github.com/security-kma/EXPLOITING-CVE-2019-14205
Source: na.elfString found in binary or memory: https://github.com/shadown1ng)
Source: na.elfString found in binary or memory: https://github.com/shadown1ng)name:
Source: na.elfString found in binary or memory: https://github.com/shmilylty)
Source: na.elfString found in binary or memory: https://github.com/spring-cloud/spring-cloud-configname:
Source: na.elfString found in binary or memory: https://github.com/star7th/showdoc/pull/1059
Source: na.elfString found in binary or memory: https://github.com/star7th/showdoc/pull/1059name:
Source: na.elfString found in binary or memory: https://github.com/tangxiaofeng7)
Source: na.elfString found in binary or memory: https://github.com/th3gundy/CVE-2019-7192_QNAP_Exploit
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/blob/master/ecshop/xianzhi-2017-02-82239600/README.zh-cn.md
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/blob/master/ecshop/xianzhi-2017-02-82239600/README.zh-cn.mdname:
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/blob/master/kibana/CVE-2018-17246/README.md
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/blob/master/laravel/CVE-2021-3129
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/blob/master/saltstack/CVE-2020-16846/README.zh-cn.md
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/activemq/CVE-2016-3088
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/coldfusion/CVE-2010-2861name:
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/confluence/CVE-2019-3396name:
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/couchdb/CVE-2017-12635
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/discuz/wooyun-2010-080723
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/django/CVE-2018-14574
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/docker/unauthorized-rce
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/drupal/CVE-2014-3704name:
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/ecshop/collection_list-sqli
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2014-3120
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2015-1427name:
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2015-3337
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/flink/CVE-2020-17519
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/gitlist/CVE-2018-1000533name:
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/glassfish/4.1.0name:
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/h2database/h2-console-unacc
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/hadoop/unauthorized-yarn
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/jenkins/CVE-2018-1000861
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/joomla/CVE-2017-8917name:
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/php/CVE-2012-1823name:
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/phpmyadmin/CVE-2018-12613
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/phpmyadmin/WooYun-2016-199433
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/phpunit/CVE-2017-9841name:
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/rails/CVE-2018-3760
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/solr/CVE-2017-12629-XXE
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/solr/CVE-2019-0193
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/spark/unaccAn
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/spring/CVE-2016-4977
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/supervisor/CVE-2017-11610
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/thinkphp/5-rcename:
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/thinkphp/5.0.23-rce
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/uwsgi/CVE-2018-7490name:
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/webmin/CVE-2019-15107
Source: na.elfString found in binary or memory: https://github.com/vulhub/vulhub/tree/master/zabbix/CVE-2016-10134name:
Source: na.elfString found in binary or memory: https://github.com/whami-root)
Source: na.elfString found in binary or memory: https://github.com/whami-rootname:
Source: na.elfString found in binary or memory: https://github.com/whwlsfb)
Source: na.elfString found in binary or memory: https://github.com/wulalalaaa)
Source: na.elfString found in binary or memory: https://github.com/wuzhicms/wuzhicms/issues/184
Source: na.elfString found in binary or memory: https://hackfun.org/)
Source: na.elfString found in binary or memory: https://help.sonatype.com/learning/repository-manager-3/first-time-installation-and-setup/lesson-1%3
Source: na.elfString found in binary or memory: https://hub.docker.com/r/petergrace/opentsdb-docker
Source: na.elfString found in binary or memory: https://hub.docker.com/r/petergrace/opentsdb-dockername:
Source: na.elfString found in binary or memory: https://idc.wanyunshuju.com/aqld/2123.htmlname:
Source: na.elfString found in binary or memory: https://imlonghao.com/)
Source: na.elfString found in binary or memory: https://infosecdb.wordpress.com/2020/01/05/gilacms-1-11-8-admin-sqlquery-sql-injection/
Source: na.elfString found in binary or memory: https://iryl.info/2020/11/27/exploiting-samsung-router-wlan-ap-wea453e/
Source: na.elfString found in binary or memory: https://jira.atlassian.com/browse/JRASERVER-69793
Source: na.elfString found in binary or memory: https://kb.cert.org/vuls/id/843464name:
Source: na.elfString found in binary or memory: https://lists.apache.org/thread.html/r84ccbfc67bfddd35dced494a1f1cba504f49ac60a2a2ae903c5492c3%40%3C
Source: na.elfString found in binary or memory: https://localhost/index.php/Home/uploadify/fileList?type=.
Source: na.elfString found in binary or memory: https://lorexxar.cn)
Source: na.elfString found in binary or memory: https://max.book118.com/html/2017/0623/117514590.shtmname:
Source: na.elfString found in binary or memory: https://medium.com/
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/0AqdfTrZUVrwTMbKEKresg
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/1t0uglZNoZERMQpXVVjIPwname:
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/3MkN4ZuUYpP2GgPbTzrxbA
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/3bI7v-hv4rMUnCIT0GLkJA
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/3t7r7FCirDEAsXcf2QMomw
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/69cDWCDoVXRhehqaHPgYog
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/6aUrXcnab_EScoc0-6OKfA
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/6phWjDrGG0pCpGuCdLusIg
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/F-M21PT0xn9QOuwoC8llKAname:
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/FjMRJfCqmXfwPzGYq5Vhkw
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/Fl2hSO-y60VsTi5YJFyl0w
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/FvqC1I_G14AEQNztU0zn8A
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/HFug1khyfHmCujhc_Gm_yQ
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/KGRU47o7JtbgOC9xwLJARw
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/KRGKXAJQawXl88RBPTaAeg
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/KgAaFRKarMdycYzETyKS8A
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/R8qw_lWizGyeJS0jOcYXag
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/TkUZXKgfEOVqoHKBr3kNdw
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/Ttpe63H9lQe87Uk0VOyMFw
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/XEnjVwb9I0GPG9RG-v7lHQname:
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/ZwhBEz2ek26Zf3F-csoRgQ
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/b7jyA5sylkDNauQbwZKvBg
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/bHKDSF7HWsAgQi9rTagBQA
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/g4YNI6UBqIQcKL0TRkKWlw
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/jgNyTHSqWA5twyk5tfSQUQ
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/qIAcycsO_L9JKisG5Bgg_w
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/sulJSg0Ru138oASiI5cYAA
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/taEEl6UQ2yi4cqzs2UBfCg
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93gname:
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s/ylOuWc8elD2EtM-1LiJp9g
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s?__biz=MzAxODg1MDMwOQ==&mid=2247489109&idx=1&sn=0c9a3388e4ac1389897b4449fb
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247483972&idx=1&sn=b51678c6206a533330b0279454
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247484117&idx=1&sn=2fdab8cbe4b873f8dd8abb35d9
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247486018&idx=1&sn=d744907475a4ea9ebeb26338c7
Source: na.elfString found in binary or memory: https://mp.weixin.qq.com/s?__biz=MzkxNDAyNTY2NA==&mid=2247488978&idx=1&sn=c0a5369f2b374dcef0bbf61b92
Source: na.elfString found in binary or memory: https://mrxn.net/Infiltration/323.html
Source: na.elfString found in binary or memory: https://my.oschina.net/u/4581879/blog/4753320name:
Source: na.elfString found in binary or memory: https://nifi.apache.org/docs/nifi-docs/rest-api/index.html
Source: na.elfString found in binary or memory: https://nvd.nist.gov/vuln/detail/CVE-2018-17246
Source: na.elfString found in binary or memory: https://nvd.nist.gov/vuln/detail/CVE-2019-16312name:
Source: na.elfString found in binary or memory: https://nvd.nist.gov/vuln/detail/CVE-2019-8442
Source: na.elfString found in binary or memory: https://nvd.nist.gov/vuln/detail/CVE-2020-27986
Source: na.elfString found in binary or memory: https://nvd.nist.gov/vuln/detail/CVE-2020-3452
Source: na.elfString found in binary or memory: https://nvd.nist.gov/vuln/detail/CVE-2020-35736
Source: na.elfString found in binary or memory: https://nvd.nist.gov/vuln/detail/CVE-2020-7980
Source: na.elfString found in binary or memory: https://nvd.nist.gov/vuln/detail/CVE-2020-8209
Source: na.elfString found in binary or memory: https://nvd.nist.gov/vuln/detail/CVE-2021-41773
Source: na.elfString found in binary or memory: https://nvd.nist.gov/vuln/detail/CVE-2022-26134
Source: na.elfString found in binary or memory: https://packetstormsecurity.com/files/144097/Hikvision-IP-Camera-Access-Bypass.html
Source: na.elfString found in binary or memory: https://packetstormsecurity.com/files/164401/Atlassian-Confluence-Server-7.5.1-Arbitrary-File-Read.h
Source: na.elfString found in binary or memory: https://paper.seebug.org/1485/name:
Source: na.elfString found in binary or memory: https://paper.seebug.org/1489
Source: na.elfString found in binary or memory: https://paper.seebug.org/567/
Source: na.elfString found in binary or memory: https://paper.seebug.org/676/name:
Source: na.elfString found in binary or memory: https://phishingkittracker.blogspot.com/2019/08/userphp-ecshop-sql-injection-2017.html
Source: na.elfString found in binary or memory: https://phyb0x.github.io/2018/10/09/seacms%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E5%88%86%E6%9E%90/nam
Source: na.elfString found in binary or memory: https://pivotal.io/security/cve-2020-5405
Source: na.elfString found in binary or memory: https://poc.shuziguanxing.com/#/publicIssueInfo#issueId=4210
Source: na.elfString found in binary or memory: https://print1n.top)
Source: na.elfString found in binary or memory: https://print1n.top/post/Other/TamronOS_IPTV%E7%B3%BB%E7%BB%9F%E5%AD%98%E5%9C%A8%E5%89%8D%E5%8F%B0%E
Source: na.elfString found in binary or memory: https://quake.360.cn/quake/#/vulDetail/QH-202006-1954/checked
Source: na.elfString found in binary or memory: https://s.tencent.com/research/bsafe/1156.html
Source: na.elfString found in binary or memory: https://s.tencent.com/research/bsafe/1228.html
Source: na.elfString found in binary or memory: https://s.tencent.com/research/bsafe/474.htmlname:
Source: na.elfString found in binary or memory: https://s1xhcl.github.io/2021/03/13/%E9%80%9A%E8%BE%BEOA-v11-7-%E5%9C%A8%E7%BA%BF%E7%94%A8%E6%88%B7%
Source: na.elfString found in binary or memory: https://seclists.org/oss-sec/2021/q3/188
Source: na.elfString found in binary or memory: https://securityaffairs.co/wordpress/91689/hacking/unpatched-critical-0-day-vbulletin.html
Source: na.elfString found in binary or memory: https://securitylab.github.com/advisories/GHSL-2020-011-nxrm-sonatype
Source: na.elfString found in binary or memory: https://share.zabbix.com/
Source: na.elfString found in binary or memory: https://shells.systems/pandorafms-v7-0ng-authenticated-remote-code-execution-cve-2019-20224/
Source: na.elfString found in binary or memory: https://shells.systems/rconfig-v3-9-2-authenticated-and-unauthenticated-rce-cve-2019-16663-and-cve-2
Source: na.elfString found in binary or memory: https://ssd-disclosure.com/ssd-advisory-terramaster-os-exportuser-php-remote-code-execution/
Source: na.elfString found in binary or memory: https://support.citrix.com/article/CTX276688
Source: na.elfString found in binary or memory: https://support.f5.com/csp/article/K03009991
Source: na.elfString found in binary or memory: https://support.f5.com/csp/article/K23605346
Source: na.elfString found in binary or memory: https://support.f5.com/csp/article/K52145254
Source: na.elfString found in binary or memory: https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-
Source: na.elfString found in binary or memory: https://suzzz112113.github.io/#blog)
Source: na.elfString found in binary or memory: https://swarm.ptsecurity.com/unauth-rce-vmware/name:
Source: na.elfString found in binary or memory: https://t.co/LfvbyBUhF5
Source: na.elfString found in binary or memory: https://tom0li.github.io/)
Source: na.elfString found in binary or memory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ro-path-KJuQhB
Source: na.elfString found in binary or memory: https://twitter.com/ptswarm/status/1318914772918767619
Source: na.elfString found in binary or memory: https://unit42.paloaltonetworks.com/critical-vulnerability-in-harbor-enables-privilege-escalation-fr
Source: na.elfString found in binary or memory: https://vulhub.org/#/environments/jupyter/notebook-rce/
Source: na.elfString found in binary or memory: https://watchfulip.github.io/2021/09/18/Hikvision-IP-Camera-Unauthenticated-RCE.html
Source: na.elfString found in binary or memory: https://we1x4n.com/)
Source: na.elfString found in binary or memory: https://we1x4n.github.io/)
Source: na.elfString found in binary or memory: https://wooyun.x10sec.org/static/bugs/wooyun-2015-0148227.html
Source: na.elfString found in binary or memory: https://www.anquanke.com/post/id/168991name:
Source: na.elfString found in binary or memory: https://www.anquanke.com/post/id/183241
Source: na.elfString found in binary or memory: https://www.anquanke.com/post/id/187923
Source: na.elfString found in binary or memory: https://www.anquanke.com/post/id/232748
Source: na.elfString found in binary or memory: https://www.anquanke.com/vul/id/1150798name:
Source: na.elfString found in binary or memory: https://www.anquanke.com/vul/id/1674598
Source: na.elfString found in binary or memory: https://www.citrix.com/blogs/2020/07/07/citrix-provides-context-on-security-bulletin-ctx276688/
Source: na.elfString found in binary or memory: https://www.cnblogs.com/-mo-/p/11295400.html
Source: na.elfString found in binary or memory: https://www.cnblogs.com/-qing-/p/10889467.html
Source: na.elfString found in binary or memory: https://www.cnblogs.com/0day-li/p/13650452.html
Source: na.elfString found in binary or memory: https://www.cnblogs.com/0daybug/p/12786036.html
Source: na.elfString found in binary or memory: https://www.cnblogs.com/17bdw/p/11840588.html
Source: na.elfString found in binary or memory: https://www.cnblogs.com/EasonJim/p/6859345.html
Source: na.elfString found in binary or memory: https://www.cnblogs.com/Spec/p/10718046.html
Source: na.elfString found in binary or memory: https://www.cnblogs.com/T0uch/p/14475551.html
Source: na.elfString found in binary or memory: https://www.cnblogs.com/ffx1/p/12653597.html
Source: na.elfString found in binary or memory: https://www.cnblogs.com/jinqi520/p/10202615.html
Source: na.elfString found in binary or memory: https://www.cnblogs.com/jinqi520/p/11596500.html
Source: na.elfString found in binary or memory: https://www.cnblogs.com/magic-zero/p/12641068.html
Source: na.elfString found in binary or memory: https://www.cnblogs.com/milantgh/p/3615986.html
Source: na.elfString found in binary or memory: https://www.cnblogs.com/potatsoSec/p/13437713.html
Source: na.elfString found in binary or memory: https://www.cnblogs.com/rebeyond/p/4951418.html
Source: na.elfString found in binary or memory: https://www.cnblogs.com/sallyzhang/p/12457031.html
Source: na.elfString found in binary or memory: https://www.cnblogs.com/test404/p/7397755.htmlname:
Source: na.elfString found in binary or memory: https://www.cnblogs.com/wishwzp/p/9438658.html
Source: na.elfString found in binary or memory: https://www.cnblogs.com/wyb628/p/8567610.html
Source: na.elfString found in binary or memory: https://www.cnblogs.com/xiaoxiaoleo/p/6360260.html
Source: na.elfString found in binary or memory: https://www.cnblogs.com/xiexiandong/p/12888582.html
Source: na.elfString found in binary or memory: https://www.cnblogs.com/yuzly/p/11255609.html
Source: na.elfString found in binary or memory: https://www.cnvd.org.cn/flaw/show/2025171
Source: na.elfString found in binary or memory: https://www.cnvd.org.cn/flaw/show/CNVD-2006-3205
Source: na.elfString found in binary or memory: https://www.cnvd.org.cn/flaw/show/CNVD-2016-08603name:
Source: na.elfString found in binary or memory: https://www.cnvd.org.cn/flaw/show/CNVD-2019-01348
Source: na.elfString found in binary or memory: https://www.cnvd.org.cn/flaw/show/CNVD-2019-22239
Source: na.elfString found in binary or memory: https://www.cnvd.org.cn/flaw/show/CNVD-2020-57264
Source: na.elfString found in binary or memory: https://www.cnvd.org.cn/flaw/show/CNVD-2020-62422
Source: na.elfString found in binary or memory: https://www.cnvd.org.cn/flaw/show/CNVD-2020-67113
Source: na.elfString found in binary or memory: https://www.cnvd.org.cn/flaw/show/CNVD-2021-04128name:
Source: na.elfString found in binary or memory: https://www.cnvd.org.cn/flaw/show/CNVD-2021-34568
Source: na.elfString found in binary or memory: https://www.cnvd.org.cn/flaw/show/CNVD-2021-39012name:
Source: na.elfString found in binary or memory: https://www.cnvd.org.cn/patchInfo/show/192993
Source: na.elfString found in binary or memory: https://www.du1x3r12.com
Source: na.elfString found in binary or memory: https://www.exploit-db.com/exploits/38797
Source: na.elfString found in binary or memory: https://www.exploit-db.com/exploits/40211name:
Source: na.elfString found in binary or memory: https://www.exploit-db.com/exploits/43974
Source: na.elfString found in binary or memory: https://www.exploit-db.com/exploits/44160
Source: na.elfString found in binary or memory: https://www.exploit-db.com/exploits/44495/
Source: na.elfString found in binary or memory: https://www.exploit-db.com/exploits/46073
Source: na.elfString found in binary or memory: https://www.exploit-db.com/exploits/46074
Source: na.elfString found in binary or memory: https://www.exploit-db.com/exploits/46227
Source: na.elfString found in binary or memory: https://www.exploit-db.com/exploits/47465
Source: na.elfString found in binary or memory: https://www.exploit-db.com/exploits/47467name:
Source: na.elfString found in binary or memory: https://www.exploit-db.com/exploits/47774
Source: na.elfString found in binary or memory: https://www.exploit-db.com/exploits/48698
Source: na.elfString found in binary or memory: https://www.freebuf.com/column/214946.htmlname:
Source: na.elfString found in binary or memory: https://www.freebuf.com/news/196993.html
Source: na.elfString found in binary or memory: https://www.freebuf.com/vuls/152058.html
Source: na.elfString found in binary or memory: https://www.freebuf.com/vuls/152058.htmlname:
Source: na.elfString found in binary or memory: https://www.freebuf.com/vuls/155753.html
Source: na.elfString found in binary or memory: https://www.freebuf.com/vuls/181814.html
Source: na.elfString found in binary or memory: https://www.freebuf.com/vuls/214767.htmlname:
Source: na.elfString found in binary or memory: https://www.freebuf.com/vuls/217586.html
Source: na.elfString found in binary or memory: https://www.hackbug.net/archives/111.html
Source: na.elfString found in binary or memory: https://www.hacking8.com/bug-web/%E7%94%A8%E5%8F%8B/%E7%94%A8%E5%8F%8B-GRP-u8%E6%B3%A8%E5%85%A5%E6%B
Source: na.elfString found in binary or memory: https://www.hedysx.com/2777.html
Source: na.elfString found in binary or memory: https://www.jianshu.com/p/8d878330a42f
Source: na.elfString found in binary or memory: https://www.kingkk.com/)
Source: na.elfString found in binary or memory: https://www.ld-fcw.com/
Source: na.elfString found in binary or memory: https://www.linuxlz.com/aqld/2309.html
Source: na.elfString found in binary or memory: https://www.nexusdb.com/mantis/bug_view_advanced_page.php?bug_id=2371name:
Source: na.elfString found in binary or memory: https://www.ohlinge.cn)
Source: na.elfString found in binary or memory: https://www.onebug.org/wooyundata/65458.html
Source: na.elfString found in binary or memory: https://www.oracle.com/security-alerts/alert-cve-2020-14750.html
Source: na.elfString found in binary or memory: https://www.pwnwiki.org/index.php?title=H3C_SecParh%E5%A0%A1%E5%A3%98%E6%A9%9F_get_detail_view.php_%
Source: na.elfString found in binary or memory: https://www.ruijie.com.cn/gy/xw-aqtg-gw/86747/
Source: na.elfString found in binary or memory: https://www.runoob.com/mongodb/working-with-rockmongo.htmlname:
Source: na.elfString found in binary or memory: https://www.secpulse.com/archives/107611.htmlname:
Source: na.elfString found in binary or memory: https://www.secpulse.com/archives/39144.html
Source: na.elfString found in binary or memory: https://www.secpulse.com/archives/47690.html
Source: na.elfString found in binary or memory: https://www.secpulse.com/archives/496.htmlname:
Source: na.elfString found in binary or memory: https://www.secquan.org/Prime/1069179name:
Source: na.elfString found in binary or memory: https://www.seebug.org/vuldb/ssvid-91597name:
Source: na.elfString found in binary or memory: https://www.seebug.org/vuldb/ssvid-91762
Source: na.elfString found in binary or memory: https://www.seebug.org/vuldb/ssvid-96562
Source: na.elfString found in binary or memory: https://www.seebug.org/vuldb/ssvid-97265
Source: na.elfString found in binary or memory: https://www.seebug.org/vuldb/ssvid-97266
Source: na.elfString found in binary or memory: https://www.seebug.org/vuldb/ssvid-97267
Source: na.elfString found in binary or memory: https://www.seebug.org/vuldb/ssvid-97268
Source: na.elfString found in binary or memory: https://www.seebug.org/vuldb/ssvid-98364
Source: na.elfString found in binary or memory: https://www.seebug.org/vuldb/ssvid-99075
Source: na.elfString found in binary or memory: https://www.t00ls.net/articles-54436.html
Source: na.elfString found in binary or memory: https://www.t00ls.net/thread-53291-1-1.html
Source: na.elfString found in binary or memory: https://www.tenable.com/cve/CVE-2020-14181
Source: na.elfString found in binary or memory: https://www.tensorflow.org/guide/summaries_and_tensorboard?hl=zh-CN
Source: na.elfString found in binary or memory: https://www.tripwire.com/state-of-security/vert/citrix-netscaler-cve-2019-19781-what-you-need-to-kno
Source: na.elfString found in binary or memory: https://www.trustwave.com/Resources/SpiderLabs-Blog/Joomla-SQL-Injection-Vulnerability-Exploit-Resul
Source: na.elfString found in binary or memory: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabili
Source: na.elfString found in binary or memory: https://www.twilio.com/blog/2017/08/http-requests-in-node-js.htmlname:
Source: na.elfString found in binary or memory: https://www.uedbox.com/post/29340
Source: na.elfString found in binary or memory: https://www.uedbox.com/post/30019/
Source: na.elfString found in binary or memory: https://www.uedbox.com/post/35188/
Source: na.elfString found in binary or memory: https://www.uedbox.com/post/54561/
Source: na.elfString found in binary or memory: https://www.viddler.com/v/test
Source: na.elfString found in binary or memory: https://www.vmware.com/security/advisories/VMSA-2021-0004.html
Source: na.elfString found in binary or memory: https://www.weaver.com.cn/
Source: na.elfString found in binary or memory: https://www.weaver.com.cn/cs/securityDownload.asp
Source: na.elfString found in binary or memory: https://www.weaver.com.cn/cs/securityDownload.aspname:
Source: na.elfString found in binary or memory: https://www.zabbix.com/documentation/3.4/zh/manual/quickstart/login
Source: na.elfString found in binary or memory: https://www.zhihuifly.com/t/topic/3118
Source: na.elfString found in binary or memory: https://xz.aliyun.com/t/2224
Source: na.elfString found in binary or memory: https://xz.aliyun.com/t/2490
Source: na.elfString found in binary or memory: https://xz.aliyun.com/t/2828name:
Source: na.elfString found in binary or memory: https://xz.aliyun.com/t/2941
Source: na.elfString found in binary or memory: https://xz.aliyun.com/t/6103name:
Source: na.elfString found in binary or memory: https://xz.aliyun.com/t/6419
Source: na.elfString found in binary or memory: https://xz.aliyun.com/t/6453
Source: na.elfString found in binary or memory: https://xz.aliyun.com/t/6635name:
Source: na.elfString found in binary or memory: https://xz.aliyun.com/t/6708
Source: na.elfString found in binary or memory: https://xz.aliyun.com/t/7219
Source: na.elfString found in binary or memory: https://xz.aliyun.com/t/7877name:
Source: na.elfString found in binary or memory: https://xz.aliyun.com/t/8478#reply-15684
Source: na.elfString found in binary or memory: https://xz.aliyun.com/t/9016?page=1
Source: na.elfString found in binary or memory: https://y4er.com/post/metinfo7-sql-tips/#sql-injection-1name:
Source: na.elfString found in binary or memory: https://y4er.com/post/metinfo7-sql-tips/#sql-injection-2name:
Source: na.elfString found in binary or memory: https://yq.aliyun.com/articles/616757
Source: na.elfString found in binary or memory: https://yun.scdsjzx.cn/system/notice/detail/399d2dd0-94aa-4914-a8f6-e71f8dc8ac87
Source: na.elfString found in binary or memory: https://zhuanlan.zhihu.com/p/61215662Indicates
Source: na.elfString found in binary or memory: https://zhuanlan.zhihu.com/p/85265552
Source: unknownNetwork traffic detected: HTTP traffic on port 46540 -> 443
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal52.evad.linELF@0/0@2/0
Source: ELF file sectionSubmission: na.elf
Source: na.elfBinary or memory string: JEECMSseeyonweavertongdavmware
Source: na.elfBinary or memory string: path: /ui/h5-vsan/rest/proxy/service/com.vmware.vsan.client.services.capability.VsanCapabilityProvider/getClusterCapabilityData
Source: na.elfBinary or memory string: path: /eam/vib?id=C:\ProgramData\VMware\vCenterServer\cfg\vmware-vpx\vcdb.properties
Source: na.elfBinary or memory string: E-mobileweaver-ebridgeVMware vSphere(nagios admin)(zfoausername)(X-Confluence)reserved_rangeexplicit,tag:1zero parameterneed more dataInstEmptyWidthNegotiateFlag(%v not a Float%v not numericsubtract_int64multiply_int64int64_to_int64string_to_boolbool_to_stringbytes_to_bytesmatches_stringless_timestampgreater_uint64greater_doublegreater_stringLABEL_OPTIONALLABEL_REQUIREDLABEL_REPEATED(line %d:%d): invalid %v: %vinvalid kind: protobuf_oneofXXX_OneofFuncsStack is emptyMatchATN mode LL altSubSets=Not ComparableGREATER_EQUALSconditionalAndprotobuf errorReservedRangesSCRIPT_FILENAMESERVER_SOFTWARESERVER_PROTOCOLtrying RunIcmp2ping -c 1 -w 1 wait connect ok[+] Redis %s %sWindows\win.iniread key failedAccept-Language135,137,139,445Set web timeout: cannot parse ,M3.2.0,M11.1.0476837158203125negative offset is not definedinvalid argSize<invalid Value>not implementedmissing addressunknown networkinvalid paddingAUTH command OKallocmRInternalwrite heap dumpasyncpreemptoffforce gc (idle)sync.Mutex.Lockmalloc deadlockruntime error: elem size wrong with GC prog
Source: na.elfBinary or memory string: - https://www.vmware.com/security/advisories/VMSA-2021-0004.html
Source: na.elfBinary or memory string: failed to construct HKDF label: %shttp2: aborting request body writehttp: persistConn.readLoop exitinghttp: read on closed response bodystream error: stream ID %d; %v; %vframe_settings_window_size_too_bigframe_windowupdate_zero_inc_streamhttp: MultipartReader called twiceunsupported authentication method pocs/CVE-2022-22954-VMware-RCE.ymlpocs/Hotel-Internet-Manage-RCE.ymlpocs/activemq-default-password.ymlpocs/confluence-cve-2021-26084.ymlpocs/dedecms-cve-2018-7700-rce.ymlpocs/discuz-wooyun-2010-080723.ymlpocs/drupal-cve-2014-3704-sqli.ymlpocs/ecology-javabeanshell-rce.ymlpocs/ecology-syncuserinfo-sqli.ymlpocs/f5-tmui-cve-2020-5902-rce.ymlpocs/joomla-cve-2015-7297-sqli.ymlpocs/joomla-cve-2017-8917-sqli.ymlpocs/nsfocus-uts-password-leak.ymlpocs/phpunit-cve-2017-9841-rce.ymlpocs/rabbitmq-default-password.ymlpocs/ruoyi-management-fileread.ymlpocs/seeyon-wooyun-2015-148227.ymlpocs/solarwinds-cve-2020-10148.ymlpocs/spon-ip-intercom-ping-rce.ymlpocs/springboot-cve-2021-21234.ymlpocs/springcloud-cve-2019-3799.ymlpocs/tomcat-cve-2017-12615-rce.ymlpocs/webmin-cve-2019-15107-rce.ymlpocs/yonyou-grp-u8-sqli-to-rce.ymldid not expect port number to be 0flag provided but not defined: -%sin \u hexadecimal character escapeexpected comma after array elementdriver: remove argument from querycan't parse %q as a decimal numbercrypto/des: invalid buffer overlapcrypto/rsa: missing public modulusadding nil Certificate to CertPoolx509: unknown public key algorithmx509: invalid certificate policies%s %q is excluded by constraint %qx509: Ed25519 verification failurex509: unhandled critical extensionmsb not set in last word %#x of %sexpected exactly %d bits of resultRat.GobEncode: numerator too large\(\s*HOST\s*=\s*([A-z0-9._%+-]+)\)ORA-03135: connection lost contactno available servers to connect tounsupported authentication service%s does not contain specific typesinvalid cycle in declaration of %suse of .(type) outside type switchinvalid operation: cannot index %sinvalid operation: cannot slice %sindex expression %v with 0 indices%s implicitly parameterized by %sunderlying type must not be *Namedcannot declare init - must be funccannot declare main - must be funccase/communication clause expectedfallthrough statement out of placeno new variable on left side of :=embedded field type %s has no nameinvalid padding bits in BIT STRINGtls: invalid certificate signaturecrypto/rc4: invalid buffer overlapoverload already has a binding: %sfunction already has a binding: %s(ruoyi/login.js|ruoyi/js/ry-ui.js)
Source: na.elfBinary or memory string: name: poc-yaml-vmware-vcenter-arbitrary-file-read
Source: na.elfBinary or memory string: name: poc-yaml-CVE-2022-22954-VMware-RCE
Source: na.elfBinary or memory string: GSiS(VMware vSphere)IBM-Lotus-Domino
Source: na.elfBinary or memory string: description: "CVE-2022-22954-VMware-RCE by chaosec
Source: na.elfBinary or memory string: description: "vmware vCenter unauth RCE cve-2021-21985"
Source: na.elfBinary or memory string: name: poc-yaml-vmware-vrealize-cve-2021-21975-ssrf
Source: na.elfBinary or memory string: name: poc-yaml-vmware-vcenter-unauthorized-rce-cve-2021-21972
Source: na.elfBinary or memory string: - https://swarm.ptsecurity.com/unauth-rce-vmware/name: poc-yaml-youphptube-encoder-cve-2019-5127
Source: na.elfBinary or memory string: name: poc-yaml-vmware-vcenter-cve-2021-21985-rce
Source: na.elfBinary or memory string: vulnpath: "/ui/h5-vsan/rest/proxy/service/com.vmware.vsan.client.services.capability.VsanCapabilityProvider/getClusterCapabilityData"

Lowering of HIPS / PFW / Operating System Security Settings

barindex
Sample contains AV-related strings
Source: na.elfesets: resetSession
Source: na.elfesets: ResetSession
Source: na.elfesets: unionTypeSets
Source: na.elfesets: ResetServerIndex
Source: na.elfavast: GetJavaStringCheckUtf8
Source: na.elfavast: JavaStringCheckUtf8{protobuf:"varint,27,opt,name=java_string_check_utf8,json=javaStringCheckUtf8,def=0" json:"java_string_check_utf8,omitempty"
Source: na.elfyunsuo: ComodoSucuriYundunYunsuoHarbor
Source: na.elfsafedog: number accept4Floats:AvestanBengaliBrailleCypriotDeseretElbasanElymaicGranthaHanunooKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhuta::ffff:no portnil keyanswersExpiresSubject%03d %sos/execruntimeuser idencryptDISABLEaddressEd25519MD2-RSAMD5-RSAserial:efgEFGv)(HOST=)(USER=)(PORT=AMERICANDK7DECN8PC865HU8CWI2JA16VMSJA16EUCConnectRC4_128RC4_2563DES1123DES168CST6CDTEST5EDTEtc/GMTEtc/UCTEtc/UTCGB-EireIcelandJamaicaMST7MDTNZ-CHATPST8PDT_Ctype__Cfunc_PointerprintlnrecoverAlignofhave %swant %spointerstruct{satisfybuiltinmethod nil typinexactmode %dgo%d.%dloong64ppc64leriscv64sparc64REGPROCPG_TYPEPG_PROCPOLYGONABSTIMERELTIME_CIRCLEMACADDR_BPCHAR_FLOAT4_FLOAT8ACLITEM_TIMETZ_VARBITNUMERICREGOPERREGTYPECSTRINGTRIGGER_RECORD_PG_LSNANYENUMTSQUERYTSRANGEREGROLEsizeof=<input>getDateheadersDenyAllJiasuleSafedogUsp-SecVarnishWallarmxxl-jobTypecho(ns_af)(JBoss)LaravelJenkinsjeesiteStruts2ueditorlandrayyongyoumap keymatchesfixed32fixed64messagepackageSHA-224SHA-256SHA-384SHA-512charsetInstAltInstNopalt -> nop -> any -> Verbose%sErrorignored#intern2.5.4.62.5.4.32.5.4.52.5.4.72.5.4.82.5.4.9extern export %s %s
Source: na.elfyunsuo: finishedexporterLocation data=%q incr=%v ping=%qif-matchlocationhttp/1.1HTTP/2.0boundaryno-cacheContinueAcceptedConflicthijackedNO_ERRORPRIORITYSETTINGSbad instdurationNO_PROXYno_proxyEMT trapArmenianBalineseBopomofoBugineseCherokeeCyrillicDuployanEthiopicGeorgianGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALinear_BMahajaniOl_ChikiPhags_PaTagbanwaTai_ThamTai_VietTifinaghUgariticVithkuqiPriorityClassANYQuestionReceivednet/httpgo/buildx509sha1app nameSHA1-RSADSA-SHA1DNS nameAMERICANUS7ASCIIUS8PC437WE8PC850SF7ASCIIIW7IS960IN8ISCIIWE8PC858BN8BSCIICL8KOI8UEE8PC852RU8PC866RU8BESTARU8PC855TR8PC857WE8PC860IS8PC861BG8MSWINLV8PC8LRCL8KOI8RWE8GCOS7EL8GCOS7D8BS2000F8BS2000E8BS2000S8BS2000EE8MACCEEL8PC737LT8PC772LT8PC774EL8PC869EL8PC851HU8ABMODJA16SJISJA16DBCSKO16DBCSZHS16GBKZHT32EUCZHT16DBTAL32UTF8RedirectInfinityEtc/GMT0Etc/ZuluHongkongPortugalUS/Samoa_Cmacro_additionno valuebuilt-inconstantvariableOffsetofuntyped too many_CMallocno errorfunctionabstractfile[%d]%s %s %suniverseamd64p32mips64lePG_CLASS_REGPROC_VARCHAR_ABSTIME_RELTIME_POLYGON_ACLITEM_MACADDRINTERVAL_NUMERIC_CSTRINGREGCLASS_REGOPER_REGTYPEANYARRAYINTERNALTSVECTOR_TSQUERYANYRANGENUMRANGE_TSRANGE_REGROLEoptionalgetHoursgetMonthBlockDoSStingray(YUNDUN)(yunsuo)
Source: na.elfyunsuo: DOWNGRDfinishedexporterLocation data=%q incr=%v ping=%qif-matchlocationhttp/1.1HTTP/2.0boundaryno-cacheContinueAcceptedConflicthijackedNO_ERRORPRIORITYSETTINGSbad instdurationNO_PROXYno_proxyEMT trapArmenianBalineseBopomofoBugineseCherokeeCyrillicDuployanEthiopicGeorgianGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALinear_BMahajaniOl_ChikiPhags_PaTagbanwaTai_ThamTai_VietTifinaghUgariticVithkuqiPriorityClassANYQuestionReceivednet/httpgo/buildx509sha1app nameSHA1-RSADSA-SHA1DNS nameAMERICANUS7ASCIIUS8PC437WE8PC850SF7ASCIIIW7IS960IN8ISCIIWE8PC858BN8BSCIICL8KOI8UEE8PC852RU8PC866RU8BESTARU8PC855TR8PC857WE8PC860IS8PC861BG8MSWINLV8PC8LRCL8KOI8RWE8GCOS7EL8GCOS7D8BS2000F8BS2000E8BS2000S8BS2000EE8MACCEEL8PC737LT8PC772LT8PC774EL8PC869EL8PC851HU8ABMODJA16SJISJA16DBCSKO16DBCSZHS16GBKZHT32EUCZHT16DBTAL32UTF8RedirectInfinityEtc/GMT0Etc/ZuluHongkongPortugalUS/Samoa_Cmacro_additionno valuebuilt-inconstantvariableOffsetofuntyped too many_CMallocno errorfunctionabstractfile[%d]%s %s %suniverseamd64p32mips64lePG_CLASS_REGPROC_VARCHAR_ABSTIME_RELTIME_POLYGON_ACLITEM_MACADDRINTERVAL_NUMERIC_CSTRINGREGCLASS_REGOPER_REGTYPEANYARRAYINTERNALTSVECTOR_TSQUERYANYRANGENUMRANGE_TSRANGE_REGROLEoptionalgetHoursgetMonthBlockDoSStingray(YUNDUN)(yunsuo)
Source: na.elfsafedog: BDWebGuardDuplicated key 'no such overloadsource_code_infocc_enable_arenascsharp_namespacephp_class_prefixclient_streamingserver_streamingidentifier_valueleading_commentsinvalid type: %Tquoted-printableinvalid encodingInstRuneAnyNotNLuint64_to_uint64double_to_uint64string_to_uint64double_to_doubleuint64_to_doublestring_to_doublestring_to_stringuint64_to_stringdouble_to_stringends_with_stringless_equals_boolgreater_durationSyntax error: %sgoogle/protobuf/%v.%s `oneof=%t`unknown field %vmust be positiveavx512vpclmulqdqset is read-onlypopMode back to Not implemented! to intermediate, ctx dependent=ReportAmbiguity invalid value %s0123456789ABCDEFX0123456789abcdefxreflect.Value.Intillegal hex digitmissing literal %can't scan type: too many operands[-] fcgi %v:%v %vtotalLinesWritten[-] Ms17010 %v %vcron write failedOpen %s error, %vhandshake failureDomainControllersNetBiosDomainNameMessenger Servicehttp://127.0.0.1:show live len topno redis sec testcorrupt zip file fractional second1192092895507812559604644775390625invalid bit size unknown type kind has invalid namereflect: call of reflect.Value.Capreflect.Value.Lenreflect: New(nil)01-02-06 03:04PM2006-01-02 15:04_2 Jan 2006 15:04Directory status.File unavailable.message too shortunexpected familyexec: killing Cmdexec: not startedgoroutine profileAllThreadsSyscallGC assist markingselect (no cases)sync.RWMutex.Lockwait for GC cycleSIGINT: interruptSIGBUS: bus error: missing method notetsleepg on g0bad TinySizeClasskey align too bigruntime: pointer g already scannedmark - bad statusscanobject n == 0swept cached spanmarkBits overflowruntime: summary[runtime: level = , p.searchAddr = runtime/internal/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=cannot secure fdsgp.waiting != nilunknown caller pcstack: frame={sp:runtime: nameOff runtime: typeOff runtime: textOff CHECK_CONSTRAINTStokenReturnStatusSTART TRANSACTIONallowOldPasswordscheckConnLivenessinterpolateParamsError %d (%s): %sUNSIGNED SMALLINTlatin1_german1_cilatin1_swedish_cilatin2_general_cihebrew_general_cigb2312_chinese_cicp1250_general_cilatin5_turkish_cilatin1_german2_cilatin7_general_cilatin7_general_cslatin1_general_cilatin1_general_cscp1251_general_cicp1251_general_cscp1256_general_cicp1257_general_cilatin1_spanish_cicp932_japanese_ciutf8_icelandic_ciutf8_slovenian_ciutf8_esperanto_ciutf8_hungarian_ciutf8mb4_polish_ciutf8mb4_danish_ciutf8mb4_slovak_ciPROXY_CLIENT_NAMEAUTH_SC_DB_DOMAINBegin transactionConnection Closedinvalid timestampbinary_parametersPGCONNECT_TIMEOUTlocator_exceptiondeadlock_detectedinvalid_recursiondatatype_mismatchwrong_object_typeconfig_file_errorfdw_out_of_memorylogger not initedread challengeMsgDecodeDERTRequestTPTK SendFastPathtpkt recvFastPathstart tls failed:start NLA failed:poc-yaml-sql-filerandomInt_int_intstartsWith_stringInvalid Parametercurve25519-sha256resource shortageunknown reason %dssh: empty packetssh: no key founddecryption failedillegal parametermissing extensionunrecognized nameinv
Source: na.elfesets: less_equals_int64_doubleless_equals_int64_uint64less_equals_uint64_int64less_equals_double_int64greater_equals_timestampbindings must be non-nilunsupported constant: %vcould not resolve %q: %vunable to resolve %s: %vunable to resolve %v: %qinvalid field number: %dmismatching enum lengthsGODEBUG sys/cpu: value "streamSafe was not resetstate type %d is invalidclosure at rule stop %s
Source: na.elfesets: (Script/SmcScript.js?version=)uuid: incorrect UUID format %sA long jump has been executed.A network data fault occurred.A transaction recovery failed.The directory service is busy.The string binding is invalid.The binding handle is invalid.The time-out value is invalid.The object UUID was not found.The RPC server is unavailable.The version option is invalid.The cluster node is not valid.The setting is not registered.The log metadata flush failed.The session has been canceled.The TCP/IP stack is not ready.The injection handle is stale.The classify cannot be pended.crypto/dsa: invalid public keymime: duplicate parameter nametransform: short source bufferno such overload: %s(lhs, rhs)argument must be a simple namemodification of immutable list%s: unable to unmarshal %q: %voverlapping ranges: %v with %vtype mismatch: got %T, want %vinvalid character %q in stringfmt: unknown base; can't happenfailed to tree connect AndX: %sfailed to send large buffer: %sC:\Windows\system32\cmd.exe /c poc full scan,as: shiro 100 keymalformed time zone informationtime: missing unit in duration 11368683772161602973937988281255684341886080801486968994140625pattern contains path separatorreflect: Len of non-array type reflect.MakeSlice: negative lenreflect.MakeSlice: negative cap2006-1-2T15:4:5.999999999Z07:002006-1-2t15:4:5.999999999Z07:00found duplicate %YAML directiveincomplete UTF-8 octet sequencewhile scanning a %TAG directivesotypeToNet unknown socket typeencoding/hex: invalid byte: %#UEntering Extended Passive Mode.Need account for storing files.slice bounds out of range [:%x]slice bounds out of range [%x:]SIGSEGV: segmentation violationcall from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked object/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinning: not a spinning mentersyscallblock inconsistent fatal: bad g in signal handler
Source: na.elfesets: unsafe.String: len out of rangesql: duplicate driverConn closefailed to send RollbackXact: %vFailed to send SqlBatch with %vunknown token type returned: %vInvalid size for USHORTLEN_TYPEcompression not implemented yetWrite Final Packet With Error: set DB timezone to: UTC(+00:00)incorrect format for DBTimeZonecan not assign time to type: %vunexpected Describe response %q ISOLATION LEVEL READ COMMITTEDcould not parse bytea value: %sremote error: handshake failureinvalid connection protocol: %sinvalid_use_of_escape_charactertriggered_data_change_violationinvalid_transaction_terminationinvalid_savepoint_specificationfdw_invalid_use_of_null_pointerUnknown Fast Path PDU type 0x%xPDU recvServerControlGrantedPDUtpkt recvExtendedFastPathHeaderTPTK recvExtendedFastPathHeaderReadServerConnectionConfirm errServer does not support NTLMSSPInvalid NetBIOS Session messagebroken bind ack response formatbroken set info response formatbroken negotiate context formatbroken hash context data formatexpected session id: %v, got %vssh: remote side wrote too muchssh: max packet length exceededssh: DH parameter out of boundsssh: elliptic.Unmarshal failuressh: unsupported ecdsa key sizessh: unhandled elliptic curve: tls: no certificates configuredtls: unsupported public key: %Tfailed to parse certificate: %wTLS: sequence number wraparoundCLIENT_HANDSHAKE_TRAFFIC_SECRETSERVER_HANDSHAKE_TRAFFIC_SECRETtls: failed to sign handshake: bad certificate status responsehttp2: connection error: %v: %vframe_headers_prio_weight_shortPRIORITY frame with stream ID 0too many authentication methodsRequested Range Not SatisfiableRequest Header Fields Too LargeNetwork Authentication Requiredtoo many transfer encodings: %qnet/http: TLS handshake timeoutmergeRuneSets odd length []runepocs/activemq-cve-2016-3088.ymlpocs/couchcms-cve-2018-7662.ymlpocs/couchdb-cve-2017-12635.ymlpocs/dedecms-guestbook-sqli.ymlpocs/gateone-cve-2020-35736.ymlpocs/minio-default-password.ymlpocs/nexus-default-password.ymlpocs/qilin-bastion-host-rce.ymlpocs/rconfig-cve-2019-16663.ymlpocs/resin-cnnvd-200705-315.ymlpocs/seacms-before-v992-rce.ymlpocs/seeyon-a6-test-jsp-sql.ymlpocs/shopxo-cnvd-2021-15822.ymlpocs/thinkadmin-v6-readfile.ymlpocs/thinkphp-v6-file-write.ymlpocs/weblogic-cve-2019-2725.ymljson: invalid number literal %qin literal true (expecting 'r')in literal true (expecting 'u')in literal true (expecting 'e')in literal null (expecting 'u')in literal null (expecting 'l')expected colon after object keyreflect: NumIn of non-func typezone must be a non-empty stringcrypto/rsa: invalid prime valuex509: malformed GeneralizedTimex509: invalid basic constraintsx509: malformed tbs certificatex509: malformed subjectUniqueIDx509: certificate is valid for Rat.GobDecode: buffer too smallsquare root of negative operandunknown or missing protocol: %soracle.security.client.passwordoracle.security.client.usernamecannot use %s as %s value in %simplicit function instantiationgot operand instead of *operandduplicate key %s in map
Source: na.elfesets: ed25519: bad private key length: regexp: unhandled case in compileno encoder registered for name %qencoding: missing byte order markinvalid binary operation %v %s %vinvalid base %d (should be >= %d)expected type '%s' but found '%s'unexpected character, wanted '||'unexpected character, wanted '&&'no support for proto1 MessageSets%s contains irreversible value %qno support for proto1 weak fieldsinvalid SetUnknown on nil MessageGODEBUG sys/cpu: can not enable "could not format value for %v: %vfailed to login with anonymous: %s[-] Hash is error,hex decode error: day-of-year does not match month3552713678800500929355621337890625reflect: Method index out of rangereflect: ChanDir of non-chan type reflect: Field of non-struct type reflect: Field index out of boundsreflect.FuncOf: too many argumentsreflect.StructOf: duplicate field " is anonymous but has PkgPath setreflect: string index out of rangereflect: recv on send-only channelreflect: send on recv-only channelreflect.Value.Grow: slice overflowbytes: Join output length overflowdid not find expected node contentinvalid length of a UTF-8 sequencecontrol characters are not allowedcrypto/aes: invalid buffer overlapillegal base64 data at input byte executable file not found in $PATHslice bounds out of range [:%x:%y]slice bounds out of range [%x:%y:]SIGURG: urgent condition on socketout of memory allocating allArenas/memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedruntime: netpollBreak write failedforEachP: sched.safePointWait != 0schedule: spinning with local workruntime: standard file descriptor runtime: g is running but p is notdoaddtimer: P already set in timersql: expected %d arguments, got %dunpaired removeDep: no deps for %Tserver does not support encryptionunexpected fed auth info opt ID %dunsupported type %T, a slice of %sinvalid operation on closed objectunknown type: %s for parameter: %sunknown response during CopyIn: %qinvalid_xml_processing_instructionprohibited_sql_statement_attemptedfdw_dynamic_parameter_value_neededfdw_unable_to_establish_connectionunsupported Capability type 0x%04xUnhandled saveSessionInfo type 0x%ssh: must Accept or Reject channelsk-ecdsa-sha2-nistp256@openssh.comdiffie-hellman-group-exchange-sha1ssh: private key unexpected lengtharray of non-uint8 in field %d: %Texpected an RSA public key, got %Tconnection doesn't support Ed25519tls: malformed key_share extensionTLS 1.3, server CertificateVerify
Source: na.elfesets: runtime.resetspinning
Source: na.elfesets: regexp.mergeRuneSets
Source: na.elfesets: regexp.mergeRuneSets.func2
Source: na.elfesets: regexp.mergeRuneSets.func1
Source: na.elfesets: database/sql.(*driverConn).resetSession
Source: na.elfesets: database/sql.(*driverConn).resetSession.func1
Source: na.elfesets: github.com/denisenkom/go-mssqldb.(*Conn).ResetSession
Source: na.elfesets: github.com/go-sql-driver/mysql.(*mysqlConn).ResetSession
Source: na.elfesets: github.com/sijms/go-ora/v2/configurations.(*DatabaseInfo).ResetServerIndex
Source: na.elfesets: github.com/sijms/go-ora/v2/configurations.(*ConnectionConfig).ResetServerIndex
Source: na.elfesets: github.com/sijms/go-ora/v2.(*Connection).ResetSession
Source: na.elfesets: github.com/lib/pq.(*conn).ResetSession
Source: na.elfesets: github.com/antlr/antlr4/runtime/Go/antlr.resetSimState
Source: na.elfavast: google.golang.org/protobuf/types/descriptorpb.(*FileOptions).GetJavaStringCheckUtf8
Source: na.elfesets: net/http.(*http2clientConnReadLoop).processResetStream
Source: na.elfesets: go.uber.org/zap.resetSinkRegistry
Source: na.elfesets: go.uber.org/zap.resetSinkRegistry.func1
Source: na.elfavast: javaStringCheckUtf8

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
Disable or Modify Tools		OS Credential Dumping11
Security Software Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
na.elf39%ReversingLabsLinux.Hacktool.Fscan

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
daisy.ubuntu.com
162.213.35.25
truefalse
    		unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://mp.weixin.qq.com/s/XEnjVwb9I0GPG9RG-v7lHQname:na.elffalse
      		unknown
      https://phishingkittracker.blogspot.com/2019/08/userphp-ecshop-sql-injection-2017.htmlna.elffalse
        		unknown
        https://docs.min.io/cn/na.elffalse
          		unknown
          http://wiki.peiqi.tech/wiki/oa/%E9%80%9A%E8%BE%BEOA/%E9%80%9A%E8%BE%BEOA%20v11.7%20auth_mobi.php%20%na.elffalse
            		unknown
            https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3019na.elffalse
              		unknown
              https://github.com/jweny)na.elffalse
                		unknown
                https://www.seebug.org/vuldb/ssvid-97265na.elffalse
                  		unknown
                  https://www.seebug.org/vuldb/ssvid-97267na.elffalse
                    		unknown
                    https://github.com/vulhub/vulhub/tree/master/couchdb/CVE-2017-12635na.elffalse
                      		unknown
                      https://nvd.nist.gov/vuln/detail/CVE-2020-27986na.elffalse
                        		unknown
                        https://www.seebug.org/vuldb/ssvid-97266na.elffalse
                          		unknown
                          https://github.com/jas502n/CVE-2019-6340na.elffalse
                            		unknown
                            https://www.oracle.com/security-alerts/alert-cve-2020-14750.htmlna.elffalse
                              		unknown
                              https://www.seebug.org/vuldb/ssvid-97268na.elffalse
                                		unknown
                                https://github.com/JrDw0/)na.elffalse
                                  		unknown
                                  https://blog.csdn.net/fnmsd/article/details/88657083na.elffalse
                                    		unknown
                                    https://www.cnvd.org.cn/flaw/show/CNVD-2021-34568na.elffalse
                                      		unknown
                                      https://github.com/2357000166)na.elffalse
                                        		unknown
                                        https://github.com/whami-root)na.elffalse
                                          		unknown
                                          https://github.com/neverendxxxxxx)na.elffalse
                                            		unknown
                                            https://wooyun.x10sec.org/static/bugs/wooyun-2015-0148227.htmlna.elffalse
                                              		unknown
                                              https://s.tencent.com/research/bsafe/1228.htmlna.elffalse
                                                		unknown
                                                https://github.com/Print1n)na.elffalse
                                                  		unknown
                                                  https://www.zabbix.com/documentation/3.4/zh/manual/quickstart/loginna.elffalse
                                                    		unknown
                                                    https://yun.scdsjzx.cn/system/notice/detail/399d2dd0-94aa-4914-a8f6-e71f8dc8ac87na.elffalse
                                                      		unknown
                                                      http://www.wujunjie.net/index.php/2015/08/02/%E6%96%B9%E7%BB%B4%E5%9B%A2%E8%B4%AD4-3%E6%9C%80%E6%96%na.elffalse
                                                        		unknown
                                                        https://yq.aliyun.com/articles/616757na.elffalse
                                                          		unknown
                                                          https://github.com/PR3R00T/CVE-2020-8193-Citrix-Scanner/blob/master/scanner.pyna.elffalse
                                                            		unknown
                                                            https://github.com/Sup3rm4nx0x)na.elffalse
                                                              		unknown
                                                              https://mp.weixin.qq.com/s/g4YNI6UBqIQcKL0TRkKWlwna.elffalse
                                                                		unknown
                                                                https://github.com/CouchCMS/CouchCMS/issues/46na.elffalse
                                                                  		unknown
                                                                  https://github.com/kzaopa)na.elffalse
                                                                    		unknown
                                                                    https://www.ohlinge.cn)na.elffalse
                                                                      		unknown
                                                                      https://blog.csdn.net/dfdhxb995397/article/details/101385340na.elffalse
                                                                        		unknown
                                                                        https://hub.docker.com/r/petergrace/opentsdb-dockerna.elffalse
                                                                          		unknown
                                                                          https://cert.360.cn/warning/detail?id=fba518d5fc5c4ed4ebedff1dab24caf2na.elffalse
                                                                            		unknown
                                                                            https://blog.csdn.net/zy15667076526/article/details/111413979na.elffalse
                                                                              		unknown
                                                                              http://wx.weaver)(na.elffalse
                                                                                		unknown
                                                                                https://www.twilio.com/blog/2017/08/http-requests-in-node-js.htmlname:na.elffalse
                                                                                  		unknown
                                                                                  https://s1xhcl.github.io/2021/03/13/%E9%80%9A%E8%BE%BEOA-v11-7-%E5%9C%A8%E7%BA%BF%E7%94%A8%E6%88%B7%na.elffalse
                                                                                    		unknown
                                                                                    https://github.com/goharbor/harbor/issues/8951na.elffalse
                                                                                      		unknown
                                                                                      https://www.cnblogs.com/-mo-/p/11295400.htmlna.elffalse
                                                                                        		unknown
                                                                                        https://github.com/Loneyers/vuldocker/tree/master/next.jsna.elffalse
                                                                                          		unknown
                                                                                          https://mp.weixin.qq.com/s/KgAaFRKarMdycYzETyKS8Ana.elffalse
                                                                                            		unknown
                                                                                            https://github.com/WhiteHSBG)na.elffalse
                                                                                              		unknown
                                                                                              http://wiki.peiqi.tech/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E4%B8%89%Ena.elffalse
                                                                                                		unknown
                                                                                                https://github.com/shadown1ng)na.elffalse
                                                                                                  		unknown
                                                                                                  https://hackfun.org/)na.elffalse
                                                                                                    		unknown
                                                                                                    https://cloud.tencent.com/developer/article/1472550na.elffalse
                                                                                                      		unknown
                                                                                                      https://mp.weixin.qq.com/s/KRGKXAJQawXl88RBPTaAegna.elffalse
                                                                                                        		unknown
                                                                                                        https://github.com/Sndav)na.elffalse
                                                                                                          		unknown
                                                                                                          https://cwiki.apache.org/confluence/display/AMBARI/Quickna.elffalse
                                                                                                            		unknown
                                                                                                            https://kb.cert.org/vuls/id/843464name:na.elffalse
                                                                                                              		unknown
                                                                                                              http://118.190.97.19:88/qingy/Web%E5%AE%89%E5%85%A8na.elffalse
                                                                                                                		unknown
                                                                                                                https://github.com/vulhub/vulhub/tree/master/coldfusion/CVE-2010-2861name:na.elffalse
                                                                                                                  		unknown
                                                                                                                  https://www.seebug.org/vuldb/ssvid-98364na.elffalse
                                                                                                                    		unknown
                                                                                                                    http://wiki.peiqi.tech/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E8%BF%88%Ena.elffalse
                                                                                                                      		unknown
                                                                                                                      https://github.com/masahiro331/CVE-2019-10758na.elffalse
                                                                                                                        		unknown
                                                                                                                        https://medium.com/na.elffalse
                                                                                                                          		unknown
                                                                                                                          https://packetstormsecurity.com/files/144097/Hikvision-IP-Camera-Access-Bypass.htmlna.elffalse
                                                                                                                            		unknown
                                                                                                                            https://github.com/vulhub/vulhub/tree/master/thinkphp/5-rcename:na.elffalse
                                                                                                                              		unknown
                                                                                                                              https://github.com/rconfig/rconfig/commit/6ea92aa307e20f0918ebd18be9811e93048d5071na.elffalse
                                                                                                                                		unknown
                                                                                                                                https://blog.csdn.net/ge00111/article/details/72765210name:na.elffalse
                                                                                                                                  		unknown
                                                                                                                                  https://github.com/tangxiaofeng7)na.elffalse
                                                                                                                                    		unknown
                                                                                                                                    https://t.co/LfvbyBUhF5na.elffalse
                                                                                                                                      		unknown
                                                                                                                                      http://localhost/ueditor/net/controller.ashx?action=catchimage&encode=utf-8na.elffalse
                                                                                                                                        		unknown
                                                                                                                                        http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202012-1548na.elffalse
                                                                                                                                          		unknown
                                                                                                                                          https://www.cnblogs.com/milantgh/p/3615986.htmlna.elffalse
                                                                                                                                            		unknown
                                                                                                                                            https://s.tencent.com/research/bsafe/474.htmlname:na.elffalse
                                                                                                                                              		unknown
                                                                                                                                              https://github.com/vulhub/vulhub/tree/master/solr/CVE-2019-0193na.elffalse
                                                                                                                                                		unknown
                                                                                                                                                https://xz.aliyun.com/t/7219na.elffalse
                                                                                                                                                  		unknown
                                                                                                                                                  https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247486018&idx=1&sn=d744907475a4ea9ebeb26338c7na.elffalse
                                                                                                                                                    		unknown
                                                                                                                                                    https://github.com/vulhub/vulhub/tree/master/spark/unaccAnna.elffalse
                                                                                                                                                      		unknown
                                                                                                                                                      https://www.tenable.com/cve/CVE-2020-14181na.elffalse
                                                                                                                                                        		unknown
                                                                                                                                                        https://github.com/ThestaRY7/)na.elffalse
                                                                                                                                                          		unknown
                                                                                                                                                          https://github.com/notwhy)na.elffalse
                                                                                                                                                            		unknown
                                                                                                                                                            https://nifi.apache.org/docs/nifi-docs/rest-api/index.htmlna.elffalse
                                                                                                                                                              		unknown
                                                                                                                                                              http://www.polaris-lab.com/index.php/archives/253/na.elffalse
                                                                                                                                                                		unknown
                                                                                                                                                                https://github.com/PickledFish)na.elffalse
                                                                                                                                                                  		unknown
                                                                                                                                                                  http://api.ceye.io/v1/records?token=%s&type=dns&filter=%sssh:na.elffalse
                                                                                                                                                                    		unknown
                                                                                                                                                                    https://www.t00ls.net/articles-54436.htmlna.elffalse
                                                                                                                                                                      		unknown
                                                                                                                                                                      https://github.com/whami-rootname:na.elffalse
                                                                                                                                                                        		unknown
                                                                                                                                                                        https://github.com/vulhub/vulhub/tree/master/discuz/wooyun-2010-080723na.elffalse
                                                                                                                                                                          		unknown
                                                                                                                                                                          https://www.secpulse.com/archives/496.htmlname:na.elffalse
                                                                                                                                                                            		unknown
                                                                                                                                                                            https://github.com/Mr-xn/spring-core-rcena.elffalse
                                                                                                                                                                              		unknown
                                                                                                                                                                              https://github.com/FiveAourThe)na.elffalse
                                                                                                                                                                                		unknown
                                                                                                                                                                                https://y4er.com/post/metinfo7-sql-tips/#sql-injection-2name:na.elffalse
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  https://nvd.nist.gov/vuln/detail/CVE-2018-17246na.elffalse
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10738na.elffalse
                                                                                                                                                                                      		unknown
                                                                                                                                                                                      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10736na.elffalse
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10737na.elffalse
                                                                                                                                                                                          		unknown
                                                                                                                                                                                          https://github.com/vulhub/vulhub/blob/master/ecshop/xianzhi-2017-02-82239600/README.zh-cn.mdna.elffalse
                                                                                                                                                                                            		unknown
                                                                                                                                                                                            https://www.cnblogs.com/xiexiandong/p/12888582.htmlna.elffalse
                                                                                                                                                                                              		unknown
                                                                                                                                                                                              https://github.com/vulhub/vulhub/tree/master/drupal/CVE-2014-3704name:na.elffalse
                                                                                                                                                                                                		unknown
                                                                                                                                                                                                https://github.com/B1anda0)na.elffalse
                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                  https://github.com/hackgov)na.elffalse
                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                    https://seclists.org/oss-sec/2021/q3/188na.elffalse
                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                      https://securityaffairs.co/wordpress/91689/hacking/unpatched-critical-0-day-vbulletin.htmlna.elffalse
                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                        https://share.zabbix.com/na.elffalse
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          https://www.cnblogs.com/T0uch/p/14475551.htmlna.elffalse
                                                                                                                                                                                                            		unknown

                                                                                                                                                                                                            World Map of Contacted IPs

                                                                                                                                                                                                            • No. of IPs < 25%
                                                                                                                                                                                                            • 25% < No. of IPs < 50%
                                                                                                                                                                                                            • 50% < No. of IPs < 75%
                                                                                                                                                                                                            • 75% < No. of IPs

                                                                                                                                                                                                            Public IPs

                                                                                                                                                                                                            IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                            185.125.190.26
                                                                                                                                                                                                            		unknownUnited Kingdom
                                                                                                                                                                                                            		41231CANONICAL-ASGBfalse

                                                                                                                                                                                                            Joe Sandbox View / Context

                                                                                                                                                                                                            IPs

                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                            185.125.190.26na.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                              na.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                na.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  na.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                                    na.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      arm7.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                        cayo.arm7.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                                                                                                                                                                          SecuriteInfo.com.Linux.Siggen.9999.5706.5318.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                            roze.mipsel.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                                                                                                                                                                              cayo.i686.elfGet hashmaliciousMirai, GafgytBrowse

                                                                                                                                                                                                                                Domains

                                                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                daisy.ubuntu.comna.elfGet hashmaliciousSliverBrowse
                                                                                                                                                                                                                                • 162.213.35.25
                                                                                                                                                                                                                                na.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                • 162.213.35.24
                                                                                                                                                                                                                                na.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                • 162.213.35.25
                                                                                                                                                                                                                                na.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                • 162.213.35.24
                                                                                                                                                                                                                                na.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                • 162.213.35.25
                                                                                                                                                                                                                                na.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                • 162.213.35.25
                                                                                                                                                                                                                                na.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                • 162.213.35.25
                                                                                                                                                                                                                                na.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                • 162.213.35.25
                                                                                                                                                                                                                                na.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                • 162.213.35.24
                                                                                                                                                                                                                                na.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                • 162.213.35.24

                                                                                                                                                                                                                                ASNs

                                                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                CANONICAL-ASGBna.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                                                • 91.189.91.42
                                                                                                                                                                                                                                na.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                • 91.189.91.42
                                                                                                                                                                                                                                na.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                                                • 91.189.91.42
                                                                                                                                                                                                                                na.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                • 91.189.91.42
                                                                                                                                                                                                                                na.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                                                • 91.189.91.42
                                                                                                                                                                                                                                na.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                                                • 185.125.190.26
                                                                                                                                                                                                                                na.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                                                • 91.189.91.42
                                                                                                                                                                                                                                na.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                • 185.125.190.26
                                                                                                                                                                                                                                na.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                • 91.189.91.42
                                                                                                                                                                                                                                na.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                • 185.125.190.26

                                                                                                                                                                                                                                JA3 Fingerprints

                                                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                                                Dropped Files

                                                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                                                Created / dropped Files

                                                                                                                                                                                                                                ⊘No created / dropped files found

                                                                                                                                                                                                                                Static File Info

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                File type:ELF 64-bit LSB executable, x86-64, version 1 (FreeBSD), statically linked, for FreeBSD 12.3, FreeBSD-style, Go BuildID=Z3vfhz9xSYUH_vw_rDUQ/sRNk37Pi__yo9UfMCJ0N/tnEpoz9qShVz8-dvtY-Q/u5UQD4aGd0Tk3zSV9aui, stripped
                                                                                                                                                                                                                                Entropy (8bit):5.080995853609015
                                                                                                                                                                                                                                TrID:
                                                                                                                                                                                                                                • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
                                                                                                                                                                                                                                • ELF Executable and Linkable format (generic) (4004/1) 49.84%
                                                                                                                                                                                                                                File name:na.elf
                                                                                                                                                                                                                                File size:34'574'336 bytes
                                                                                                                                                                                                                                MD5:1f9b897e74e63fc4323e172d3bb273b3
                                                                                                                                                                                                                                SHA1:a95432acdd38ba77f5b6bfdbee1561bace0e18e1
                                                                                                                                                                                                                                SHA256:8b55ed538747da2c6c4f81f256e6893b8efb7eb3043d9f8603f5afaa97f23022
                                                                                                                                                                                                                                SHA512:6e8ed6ea5804653e8d4ba3b280304f10dd9dfb39bd5babb8a14d2b93822947e7c39fefb3069a8df807b3eec4466ccd996b5cbe26a5cb3802968867a601ca19d5
                                                                                                                                                                                                                                SSDEEP:196608:ZI5kmA1hw4gnossonCcNwFx8u0IAFly8mE8jPlfzJoffnOpHpeOwPtmBVMG/oVPS:g9AbfV2OwWV5sKRjOe
                                                                                                                                                                                                                                TLSH:37773923B9A6C1D4D0999130C265D6D7BAB17C864B2413C73BDCAF2F2F72AD0A57A701
                                                                                                                                                                                                                                File Content Preview:.ELF..............>.....`.F.....@...................@.8...@.............@.......@.@.....@.@...............................................@.......@.....H.......H.......................T.......T.@.....T.@.....d.......d.................................@....

                                                                                                                                                                                                                                Static ELF Info

                                                                                                                                                                                                                                ELF header

                                                                                                                                                                                                                                Class:ELF64
                                                                                                                                                                                                                                Data:2's complement, little endian
                                                                                                                                                                                                                                Version:1 (current)
                                                                                                                                                                                                                                Machine:Advanced Micro Devices X86-64
                                                                                                                                                                                                                                Version Number:0x1
                                                                                                                                                                                                                                Type:EXEC (Executable file)
                                                                                                                                                                                                                                OS/ABI:UNIX - FreeBSD
                                                                                                                                                                                                                                ABI Version:0
                                                                                                                                                                                                                                Entry Point Address:0x46ac60
                                                                                                                                                                                                                                Flags:0x0
                                                                                                                                                                                                                                ELF Header Size:64
                                                                                                                                                                                                                                Program Header Offset:64
                                                                                                                                                                                                                                Program Header Size:56
                                                                                                                                                                                                                                Number of Program Headers:7
                                                                                                                                                                                                                                Section Header Offset:456
                                                                                                                                                                                                                                Section Header Size:64
                                                                                                                                                                                                                                Number of Section Headers:15
                                                                                                                                                                                                                                Header String Table Index:3

                                                                                                                                                                                                                                Sections

                                                                                                                                                                                                                                NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                                                                                                                                                                                                NULL0x00x00x00x00x0000
                                                                                                                                                                                                                                .textPROGBITS0x4010000x10000x85d88b0x00x6AX0032
                                                                                                                                                                                                                                .rodataPROGBITS0xc5f0000x85f0000x129da000x00x2A0032
                                                                                                                                                                                                                                .shstrtabSTRTAB0x00x1afca000xa20x00x0001
                                                                                                                                                                                                                                .typelinkPROGBITS0x1efcac00x1afcac00x5f9c0x00x2A0032
                                                                                                                                                                                                                                .itablinkPROGBITS0x1f02a600x1b02a600x2cc00x00x2A0032
                                                                                                                                                                                                                                .gosymtabPROGBITS0x1f057200x1b057200x00x00x2A001
                                                                                                                                                                                                                                .gopclntabPROGBITS0x1f057200x1b057200x57d3700x00x2A0032
                                                                                                                                                                                                                                .go.buildinfoPROGBITS0x24830000x20830000xee00x00x3WA0016
                                                                                                                                                                                                                                .noptrdataPROGBITS0x2483ee00x2083ee00x57e8a0x00x3WA0032
                                                                                                                                                                                                                                .dataPROGBITS0x24dbd800x20dbd800x1c8200x00x3WA0032
                                                                                                                                                                                                                                .bssNOBITS0x24f85a00x20f85a00x326d80x00x3WA0032
                                                                                                                                                                                                                                .noptrbssNOBITS0x252ac800x212ac800x160f00x00x3WA0032
                                                                                                                                                                                                                                .note.tagNOTE0x400fb80xfb80x480x00x2A004
                                                                                                                                                                                                                                .note.go.buildidNOTE0x400f540xf540x640x00x2A004

                                                                                                                                                                                                                                Program Segments

                                                                                                                                                                                                                                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                                                                                                                                                                                                PHDR0x400x4000400x4000400x1880x1881.84110x4R 0x1000
                                                                                                                                                                                                                                NOTE0xfb80x400fb80x400fb80x480x482.58420x4R 0x4.note.tag
                                                                                                                                                                                                                                NOTE0xf540x400f540x400f540x640x645.25590x4R 0x4.note.go.buildid
                                                                                                                                                                                                                                LOAD0x00x4000000x4000000x85e88b0x85e88b6.12170x5R E0x1000.text .note.tag .note.go.buildid
                                                                                                                                                                                                                                LOAD0x85f0000xc5f0000xc5f0000x1823a900x1823a904.28850x4R 0x1000.rodata .typelink .itablink .gosymtab .gopclntab
                                                                                                                                                                                                                                LOAD0x20830000x24830000x24830000x755a00xbdd705.61610x6RW 0x1000.go.buildinfo .noptrdata .data .bss .noptrbss
                                                                                                                                                                                                                                GNU_STACK0x00x00x00x00x00.00000x6RW 0x8

                                                                                                                                                                                                                                Network Behavior

                                                                                                                                                                                                                                Network Port Distribution

                                                                                                                                                                                                                                TCP Packets

                                                                                                                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                Oct 6, 2024 21:58:21.636790991 CEST46540443192.168.2.14185.125.190.26
                                                                                                                                                                                                                                Oct 6, 2024 21:58:51.587501049 CEST46540443192.168.2.14185.125.190.26

                                                                                                                                                                                                                                UDP Packets

                                                                                                                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                Oct 6, 2024 21:58:12.383286953 CEST3399053192.168.2.141.1.1.1
                                                                                                                                                                                                                                Oct 6, 2024 21:58:12.383419991 CEST5838553192.168.2.141.1.1.1
                                                                                                                                                                                                                                Oct 6, 2024 21:58:12.391042948 CEST53583851.1.1.1192.168.2.14
                                                                                                                                                                                                                                Oct 6, 2024 21:58:12.391629934 CEST53339901.1.1.1192.168.2.14

                                                                                                                                                                                                                                DNS Queries

                                                                                                                                                                                                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                                Oct 6, 2024 21:58:12.383286953 CEST192.168.2.141.1.1.10x789aStandard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 6, 2024 21:58:12.383419991 CEST192.168.2.141.1.1.10xe34dStandard query (0)daisy.ubuntu.com28IN (0x0001)false

                                                                                                                                                                                                                                DNS Answers

                                                                                                                                                                                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                                Oct 6, 2024 21:58:12.391629934 CEST1.1.1.1192.168.2.140x789aNo error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 6, 2024 21:58:12.391629934 CEST1.1.1.1192.168.2.140x789aNo error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

                                                                                                                                                                                                                                System Behavior

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Start time (UTC):19:58:10
                                                                                                                                                                                                                                Start date (UTC):06/10/2024
                                                                                                                                                                                                                                Path:/tmp/na.elf
                                                                                                                                                                                                                                Arguments:/tmp/na.elf
                                                                                                                                                                                                                                File size:34574336 bytes
                                                                                                                                                                                                                                MD5 hash:1f9b897e74e63fc4323e172d3bb273b3