Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
na.elf
|
ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
|
initial sample
|
 |
|
|
/etc/systemd/system/sbolo.service
|
ASCII text
|
dropped
|
||
|
/memfd:snapd-env-generator (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.NkVkgH (deleted)
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
/tmp/na.elf
|
/tmp/na.elf
|
||
|
/tmp/na.elf
|
-
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "systemctl enable sbolo.service > /dev/null 2>&1"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/systemctl
|
systemctl enable sbolo.service
|
||
|
/tmp/na.elf
|
-
|
||
|
/usr/lib/systemd/systemd
|
-
|
||
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://91.200.103.117/%s
|
unknown
|
||
|
http://91.200.103.117/bolubotnetarm
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
yi0key.heleh.com.vn
|
91.200.103.117
|
|
|
|
daisy.ubuntu.com
|
162.213.35.25
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
91.200.103.117
|
yi0key.heleh.com.vn
|
Germany
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
7fedd8035000
|
page execute read
|
|
||
|
7feedf08b000
|
page read and write
|
|||
|
7feedeb39000
|
page read and write
|
|||
|
7fedd804d000
|
page read and write
|
|||
|
7feedeeaa000
|
page read and write
|
|||
|
7feedf1d8000
|
page read and write
|
|||
|
7feedecc8000
|
page read and write
|
|||
|
5612a6d13000
|
page read and write
|
|||
|
7feede8ce000
|
page read and write
|
|||
|
5612a6d1c000
|
page read and write
|
|||
|
7feed7fff000
|
page read and write
|
|||
|
7ffd161f4000
|
page read and write
|
|||
|
5612a9001000
|
page read and write
|
|||
|
7feedeb5c000
|
page read and write
|
|||
|
5612a6ac2000
|
page execute read
|
|||
|
7fedd8042000
|
page read and write
|
|||
|
7feedf1b4000
|
page read and write
|
|||
|
7feeddcd2000
|
page read and write
|
|||
|
7feed8021000
|
page read and write
|
|||
|
7ffd161fd000
|
page execute read
|
|||
|
7feede56c000
|
page read and write
|
|||
|
5612a8d31000
|
page read and write
|
|||
|
7feede4da000
|
page read and write
|
|||
|
5612a8d1a000
|
page execute and read and write
|
|||
|
7feedf21d000
|
page read and write
|
There are 15 hidden memdumps, click here to show them.