Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

na.elf

ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped

initial sample

Details

Filetype:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy:	6.419676820561286
Filename:	na.elf
Filesize:	58640
MD5:	72a294f4d8218daac78d35c0b28a65fa
SHA1:	ca5800715586c9cea8658f08de7384a3d0ff0732
SHA256:	954311d415ff6e1f159792b974e1333ef6824907255ecb8582ed66326dcb3d07
SHA512:	5bb27f92b63e71eea36e6bad0a4b50b84011218cc907722d5243ab9b7cddc3c30f40d5ea9ed8e13a36c6d0173f5fdf1f95919f958f0c1382495e4e7446eff288
SSDEEP:	1536:6wQ0PRFSQsr2xhCj32O4yS/LwpfiUjnO7oczYSl/P:nRF/i2xhCjbrc8f7n8FT
Preview:	.ELF....................d...4...........4. ...(.....................<...<....................`...`..@... )..........Q.td............................U..S.......w....h........[]...$.............U......=@c...t..5....$`.....$`......u........t....h<Z..........

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Sample tries to kill a massive number of system processes	System Summary
Machine Learning detection for sample	AV Detection
Sample tries to kill multiple processes (SIGKILL)	System Summary	Service Stop
Found strings indicative of a multi-platform dropper	Spreading	Scripting
Sample tries to kill a process (SIGKILL)	System Summary
Yara signature match	System Summary

/run/systemd/seats/.#seat0hNKJFS

ASCII text

dropped

Details

File:	/run/systemd/seats/.#seat0hNKJFS
Category:	dropped
Dump:	.#seat0hNKJFS.38.dr
ID:	dr_5
Target ID:	38
Process:	/lib/systemd/systemd-logind
Type:	ASCII text
Entropy:	4.921230646592726
Encrypted:	false
Ssdeep:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
Size:	95
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Creates hidden files and/or directories	Persistence and Installation Behavior	Hidden Files and Directories

/run/utmp

data

dropped

Details

File:	/run/utmp
Category:	dropped
Dump:	utmp.172.dr
ID:	dr_27
Target ID:	172
Process:	/sbin/agetty
Type:	data
Entropy:	0.6775035134351416
Encrypted:	false
Ssdeep:	3:Fs1sXlXEWtl/xCl/X:mQ+ylm
Size:	384
Whitelisted:	false
Reputation:	low

/var/log/auth.log

ASCII text

dropped

Details

File:	/var/log/auth.log
Category:	dropped
Dump:	auth.log.32.dr
ID:	dr_4
Target ID:	32
Process:	/usr/sbin/rsyslogd
Type:	ASCII text
Entropy:	4.865218499962382
Encrypted:	false
Ssdeep:	24:xIkwZ4PIkwZegIkK0IkiuIkitIkPbIIkJAvVIkJA2+VbIkiIkbqx:rnvqfVLx
Size:	982
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Writes log files to disk	Persistence and Installation Behavior

/var/log/kern.log

ASCII text

dropped

Details

File:	/var/log/kern.log
Category:	dropped
Dump:	kern.log.126.dr
ID:	dr_21
Target ID:	126
Process:	/usr/sbin/rsyslogd
Type:	ASCII text
Entropy:	4.7338251511586344
Encrypted:	false
Ssdeep:	48:o9s9K+9s5U9HU9zE9b9fD9Z8X9JtJ9p29HKF90cx9T9+9m29LuB47AKyt/uT:oa7u5U6REB9ebfj221xkc24aF
Size:	2186
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Writes log files to disk	Persistence and Installation Behavior

/var/log/syslog

ASCII text

dropped

Details

File:	/var/log/syslog
Category:	dropped
Dump:	syslog.126.dr
ID:	dr_20
Target ID:	126
Process:	/usr/sbin/rsyslogd
Type:	ASCII text
Entropy:	4.987701644701324
Encrypted:	false
Ssdeep:	96:aa7u5U6REB9I9XR/hl3D8nnEeRQRCw3cI/bfjQ8d4j221xkc24a3P:25/phl3D8nnXUTrUldaf
Size:	5330
Whitelisted:	false
Reputation:	low

/var/log/wtmp

data

dropped

Details

File:	/var/log/wtmp
Category:	dropped
Dump:	wtmp.153.dr
ID:	dr_25
Target ID:	153
Process:	/sbin/agetty
Type:	data
Entropy:	0.6722951801018082
Encrypted:	false
Ssdeep:	3:Zs1sXlXEWtl/d+6GZl/ll:SQ+yl460
Size:	384
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

/tmp/na.elf

/usr/lib/systemd/systemd

/usr/bin/dbus-daemon

/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

/usr/libexec/gvfsd-fuse

/bin/fusermount

fusermount -u -q -z -- /run/user/1000/gvfs

/usr/lib/systemd/systemd

/usr/bin/pulseaudio

/usr/bin/pulseaudio --daemonize=no --log-target=journal

/usr/lib/systemd/systemd

/usr/sbin/rsyslogd

/usr/sbin/rsyslogd -n -iNONE

/usr/lib/systemd/systemd

/usr/bin/dbus-daemon

/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

/usr/lib/systemd/systemd

/usr/sbin/rsyslogd

/usr/sbin/rsyslogd -n -iNONE

/usr/sbin/gdm3

/etc/gdm3/PrimeOff/Default

/usr/lib/systemd/systemd

/lib/systemd/systemd-logind

/usr/sbin/gdm3

/etc/gdm3/PrimeOff/Default

/usr/sbin/gdm3

/etc/gdm3/PrimeOff/Default

/usr/lib/systemd/systemd

/usr/bin/gpu-manager

/usr/bin/gpu-manager --log /var/log/gpu-manager.log

/usr/bin/gpu-manager

/bin/sh

sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

/bin/sh

/usr/lib/systemd/systemd

/sbin/agetty

/sbin/agetty -o "-p -- \\u" --noclear tty2 linux

/usr/lib/systemd/systemd

/usr/share/gdm/generate-config

/usr/bin/pkill

pkill --signal HUP --uid gdm dconf-service

/usr/lib/systemd/systemd

/usr/sbin/rsyslogd

/usr/sbin/rsyslogd -n -iNONE

/usr/lib/systemd/systemd

/sbin/agetty

/sbin/agetty -o "-p -- \\u" --noclear tty2 linux

/usr/lib/systemd/systemd

/usr/sbin/rsyslogd

/usr/sbin/rsyslogd -n -iNONE

/usr/lib/systemd/systemd

/usr/bin/gpu-manager

/usr/bin/gpu-manager --log /var/log/gpu-manager.log

/usr/bin/gpu-manager

/bin/sh

sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

/bin/sh

/usr/bin/grep

grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

/usr/bin/gpu-manager

/bin/sh

sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

/bin/sh

/usr/bin/grep

grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

/usr/bin/gpu-manager

/bin/sh

sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

/bin/sh

/usr/bin/grep

grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

/usr/bin/gpu-manager

/bin/sh

sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

/bin/sh

/usr/bin/grep

grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

/usr/bin/gpu-manager

/bin/sh

sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

/bin/sh

/usr/bin/grep

grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

/usr/bin/gpu-manager

/bin/sh

sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

/bin/sh

/usr/bin/grep

grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

/usr/lib/systemd/systemd

/sbin/agetty

/sbin/agetty -o "-p -- \\u" --noclear tty2 linux

/usr/lib/systemd/systemd

/usr/share/gdm/generate-config

/usr/bin/pkill

pkill --signal HUP --uid gdm dconf-service

/usr/lib/systemd/systemd

/usr/sbin/rsyslogd

/usr/sbin/rsyslogd -n -iNONE

/usr/lib/systemd/systemd

/usr/sbin/rsyslogd

/usr/sbin/rsyslogd -n -iNONE

/usr/lib/systemd/systemd

/sbin/agetty

/sbin/agetty -o "-p -- \\u" --noclear tty2 linux

/usr/lib/systemd/systemd

/usr/bin/gpu-manager

/usr/bin/gpu-manager --log /var/log/gpu-manager.log

/usr/bin/gpu-manager

/bin/sh

sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

/bin/sh

/usr/bin/grep

/usr/bin/gpu-manager

/bin/sh

sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

/bin/sh

/usr/bin/grep

/usr/bin/gpu-manager

/bin/sh

sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

/bin/sh

/usr/bin/grep

/usr/bin/gpu-manager

/bin/sh

sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

/bin/sh

/usr/bin/grep

/usr/bin/gpu-manager

/bin/sh

sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

/bin/sh

/usr/bin/grep

/usr/bin/gpu-manager

/usr/lib/systemd/systemd

/usr/share/gdm/generate-config

/usr/bin/pkill

pkill --signal HUP --uid gdm dconf-service

/usr/lib/systemd/systemd

/usr/sbin/rsyslogd

/usr/sbin/rsyslogd -n -iNONE

/usr/lib/systemd/systemd

/usr/sbin/rsyslogd

/usr/sbin/rsyslogd -n -iNONE

/usr/lib/systemd/systemd

/usr/bin/gpu-manager

/usr/bin/gpu-manager --log /var/log/gpu-manager.log

/usr/bin/gpu-manager

/bin/sh

sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

/bin/sh

/usr/bin/grep

/usr/bin/gpu-manager

/bin/sh

sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

/bin/sh

/usr/bin/grep

/usr/bin/gpu-manager

/bin/sh

sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

/bin/sh

/usr/bin/grep

/usr/lib/systemd/systemd

/sbin/agetty

/sbin/agetty -o "-p -- \\u" --noclear tty2 linux

/usr/lib/systemd/systemd

/usr/share/gdm/generate-config

/usr/bin/pkill

pkill --signal HUP --uid gdm dconf-service

/usr/lib/systemd/systemd

/usr/sbin/rsyslogd

/usr/sbin/rsyslogd -n -iNONE

/usr/lib/systemd/systemd

/usr/sbin/rsyslogd

/usr/sbin/rsyslogd -n -iNONE

/usr/lib/systemd/systemd

/sbin/agetty

/sbin/agetty -o "-p -- \\u" --noclear tty2 linux

/usr/lib/systemd/systemd-udevd

/etc/console-setup/cached_setup_terminal.sh

/etc/console-setup/cached_setup_terminal.sh vcs2

/usr/lib/systemd/systemd

/usr/bin/gpu-manager

/usr/bin/gpu-manager --log /var/log/gpu-manager.log

/usr/bin/gpu-manager

/bin/sh

sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

/bin/sh

/usr/bin/grep

/usr/lib/systemd/systemd

/usr/sbin/rsyslogd

/usr/sbin/rsyslogd -n -iNONE

/usr/lib/systemd/systemd

/usr/share/gdm/generate-config

/usr/bin/pkill

pkill --signal HUP --uid gdm dconf-service

/usr/lib/systemd/systemd

/sbin/agetty

/sbin/agetty -o "-p -- \\u" --noclear tty2 linux

/usr/lib/systemd/systemd

/sbin/agetty

/sbin/agetty -o "-p -- \\u" --noclear tty2 linux

/usr/lib/systemd/systemd

/sbin/agetty

/sbin/agetty -o "-p -- \\u" --noclear tty2 linux

/usr/lib/systemd/systemd

/sbin/agetty

/sbin/agetty -o "-p -- \\u" --noclear tty2 linux

/usr/lib/systemd/systemd-udevd

/etc/console-setup/cached_setup_terminal.sh

/etc/console-setup/cached_setup_terminal.sh vcs2

/usr/lib/systemd/systemd

/sbin/agetty

/sbin/agetty -o "-p -- \\u" --noclear tty2 linux

/usr/lib/systemd/systemd

/usr/bin/gpu-manager

/usr/bin/gpu-manager --log /var/log/gpu-manager.log

/usr/lib/systemd/systemd

/usr/share/gdm/generate-config

/usr/lib/systemd/systemd

/usr/bin/gpu-manager

/usr/bin/gpu-manager --log /var/log/gpu-manager.log

/usr/lib/systemd/systemd

/usr/share/gdm/generate-config

/usr/lib/systemd/systemd

/usr/bin/gpu-manager

/usr/bin/gpu-manager --log /var/log/gpu-manager.log

/usr/lib/systemd/systemd

/usr/share/gdm/generate-config

/usr/lib/systemd/systemd

/usr/bin/gpu-manager

/usr/bin/gpu-manager --log /var/log/gpu-manager.log

/usr/lib/systemd/systemd

/usr/share/gdm/generate-config

/usr/lib/systemd/systemd

/usr/bin/gpu-manager

/usr/bin/gpu-manager --log /var/log/gpu-manager.log

/usr/lib/systemd/systemd

/usr/share/gdm/generate-config

/usr/lib/systemd/systemd

/usr/share/gdm/generate-config

/usr/lib/systemd/systemd

/usr/share/gdm/generate-config

/usr/lib/systemd/systemd

/bin/plymouth

/bin/plymouth quit

/usr/lib/systemd/systemd

/usr/bin/dbus-daemon

/usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

There are 185 hidden processes, click here to show them.

URLs

Name

Malicious

https://www.rsyslog.com

unknown

Domains

Name

Malicious

byte-mirai.kro.kr

154.216.20.119

Details

Name:	byte-mirai.kro.kr
IP:	154.216.20.119
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Found strings indicative of a multi-platform dropper	Spreading	Scripting
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable	System Summary
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

209.28.118.159

unknown

United States

220.112.128.103

unknown

China

42.251.164.109

unknown

China

81.251.170.14

unknown

France

14.48.63.131

unknown

Korea Republic of

196.122.235.75

unknown

Morocco

187.202.33.19

unknown

Mexico

20.239.176.93

unknown

United States

77.34.139.158

unknown

Russian Federation

118.16.102.226

unknown

Japan

122.55.219.226

unknown

Philippines

142.224.225.13

unknown

Canada

195.199.133.13

unknown

Hungary

13.71.38.141

unknown

United States

48.8.237.251

unknown

United States

62.198.53.99

unknown

Denmark

130.225.89.238

unknown

Denmark

35.94.247.159

unknown

United States

110.38.1.126

unknown

Pakistan

178.69.143.147

unknown

Russian Federation

222.16.182.11

unknown

China

69.122.191.204

unknown

United States

42.85.18.254

unknown

China

60.179.184.179

unknown

China

78.16.135.38

unknown

Ireland

60.109.253.157

unknown

Japan

135.73.117.225

unknown

United States

149.20.37.16

unknown

United States

124.55.105.213

unknown

Korea Republic of

125.193.138.124

unknown

Japan

185.155.11.154

unknown

Iran (ISLAMIC Republic Of)

102.21.168.174

unknown

104.30.121.93

unknown

United States

206.99.173.188

unknown

United States

146.24.28.221

unknown

United States

176.149.9.226

unknown

France

157.252.45.11

unknown

United States

34.96.170.47

unknown

United States

19.77.137.140

unknown

United States

59.165.111.89

unknown

India

95.117.176.80

unknown

Germany

107.221.210.249

unknown

United States

42.3.137.205

unknown

Hong Kong

220.235.156.18

unknown

Australia

52.122.36.6

unknown

United States

81.89.1.16

unknown

Romania

213.40.160.111

unknown

United Kingdom

205.201.209.89

unknown

United States

135.83.183.48

unknown

United States

124.165.74.206

unknown

China

145.40.240.25

unknown

Netherlands

173.48.189.163

unknown

United States

89.221.130.80

unknown

Italy

155.167.154.236

unknown

United States

159.38.64.77

unknown

Sweden

195.163.128.14

unknown

Sweden

78.86.61.95

unknown

United Kingdom

132.184.214.53

unknown

Peru

204.62.25.217

unknown

United States

37.251.110.134

unknown

Netherlands

73.151.20.231

unknown

United States

54.122.159.217

unknown

United States

42.201.110.127

unknown

China

167.146.23.57

unknown

United States

19.38.174.239

unknown

United States

103.107.91.136

unknown

India

218.127.133.200

unknown

Japan

74.30.218.216

unknown

United States

159.168.18.227

unknown

Switzerland

155.48.59.65

unknown

United States

187.18.188.136

unknown

Brazil

1.169.152.18

unknown

Taiwan; Republic of China (ROC)

125.226.158.61

unknown

Taiwan; Republic of China (ROC)

36.194.65.147

unknown

China

165.148.31.67

unknown

South Africa

46.201.252.63

unknown

Ukraine

59.211.95.93

unknown

China

78.119.187.138

unknown

France

159.246.182.45

unknown

United States

49.157.91.254

unknown

Philippines

115.38.202.86

unknown

Japan

119.153.180.207

unknown

Pakistan

165.56.131.227

unknown

Zambia

85.90.55.72

unknown

United Kingdom

1.71.43.37

unknown

China

68.189.209.139

unknown

United States

139.103.227.204

unknown

Canada

37.202.175.94

unknown

Iran (ISLAMIC Republic Of)

183.80.206.1

unknown

Viet Nam

118.80.234.145

unknown

China

70.46.105.190

unknown

United States

193.76.218.183

unknown

Italy

157.136.166.7

unknown

France

197.4.29.87

unknown

Tunisia

137.148.127.167

unknown

United States

183.73.81.117

unknown

Japan

122.238.49.27

unknown

China

110.17.77.118

unknown

China

131.199.228.82

unknown

United States

173.115.55.70

unknown

United States

There are 90 hidden IPs, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

8056000

page execute read

8056000

page execute read

8056000

page execute read

8059000

page read and write

ffe71000

page read and write

86f0000

page read and write

86f0000

page read and write

f7f9b000

page execute read

86f0000

page read and write

ffe71000

page read and write

ffe71000

page read and write

8059000

page read and write

f7f9b000

page execute read

8057000

page read and write

8057000

page read and write

8057000

page read and write

f7f9b000

page execute read

8059000

page read and write

There are 8 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
na.elf

Files

Processes

URLs

Domains

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportna.elf

Files

Processes

URLs

Domains

IPs

Memdumps

IOC Report
na.elf