IOC Report
na.elf

loading gif

Files

File Path
Type
Category
Malicious
na.elf
ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (GNU/Linux), statically linked, no section header
initial sample
 malicious
/home/saturnino/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml.new
XML 1.0 document, ASCII text
dropped

Processes

Path
Cmdline
Malicious
/usr/bin/dash
-
/usr/bin/rm
rm -f /tmp/tmp.p93StxAWxs /tmp/tmp.HsCnpj9K50 /tmp/tmp.BA327CyFUO
/usr/bin/dash
-
/usr/bin/rm
rm -f /tmp/tmp.p93StxAWxs /tmp/tmp.HsCnpj9K50 /tmp/tmp.BA327CyFUO
/tmp/na.elf
/tmp/na.elf
/tmp/na.elf
-
/tmp/na.elf
-
/tmp/na.elf
-
/usr/bin/xfce4-panel
-
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
/usr/bin/xfce4-panel
-
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
/usr/bin/xfce4-panel
-
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
/usr/bin/xfce4-panel
-
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
-
/usr/sbin/xfpm-power-backlight-helper
/usr/sbin/xfpm-power-backlight-helper --get-max-brightness
/usr/bin/xfce4-panel
-
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
/usr/bin/xfce4-panel
-
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
/usr/bin/dbus-daemon
-
/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
/usr/lib/systemd/systemd
-
/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
There are 16 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://upx.sf.net
unknown
 malicious

Domains

Name
IP
Malicious
daisy.ubuntu.com
162.213.35.25

IPs

IP
Domain
Country
Malicious
185.125.190.26
unknown
United Kingdom
188.212.158.45
unknown
Romania

Memdumps

Base Address
Regiontype
Protect
Malicious
7f88ec00d000
page execute read
7f89e3217000
page read and write
7f88ec020000
page read and write
7f89dc000000
page read and write
5617b9152000
page read and write
7f88ec00e000
page execute and read and write
7f89e3a28000
page read and write
7f89e3cb7000
page read and write
7f89e409e000
page read and write
7f89e3217000
page read and write
5617b913c000
page execute and read and write
7f89e451a000
page read and write
5617b713e000
page read and write
5617b9152000
page read and write
7f89e3cb7000
page read and write
7f89e4079000
page read and write
7f89e3a1a000
page read and write
7fff28f29000
page read and write
7f89e3cb7000
page read and write
5617b9217000
page read and write
7fff28f29000
page read and write
5617b913c000
page execute and read and write
7f88ec007000
page execute and read and write
5617b913c000
page execute and read and write
7f88ec00e000
page execute and read and write
7f89dc000000
page read and write
7f89e4079000
page read and write
5617b9152000
page read and write
5617b9217000
page read and write
7f88ec020000
page read and write
7f89e4512000
page read and write
7f89e4512000
page read and write
7f89e43e9000
page read and write
7f89dc021000
page read and write
5617b6eb3000
page execute read
7f89e455f000
page read and write
7f89e3a28000
page read and write
7f89e4512000
page read and write
7fff28fa8000
page execute read
5617b713e000
page read and write
7f89e3217000
page read and write
5617b6eb3000
page execute read
5617b713e000
page read and write
7f88ec00d000
page execute read
7f89e43e9000
page read and write
5617b7136000
page read and write
7f89e3a28000
page read and write
7f88ec002000
page execute read
7f89e455f000
page read and write
7fff28fa8000
page execute read
5617b7136000
page read and write
7f89e409e000
page read and write
7f89e451a000
page read and write
7f88ec020000
page read and write
5617b9217000
page read and write
7f88ec007000
page execute and read and write
5617b6eb3000
page execute read
7f89e455f000
page read and write
5617b7136000
page read and write
7f89e451a000
page read and write
7f89dc021000
page read and write
7f89dc021000
page read and write
7f89e3a1a000
page read and write
7fff28f29000
page read and write
7f89dc000000
page read and write
7f89e4079000
page read and write
7f88ec00e000
page execute and read and write
7fff28fa8000
page execute read
7f88ec002000
page execute read
7f88ec00d000
page execute read
7f88ec007000
page execute and read and write
7f89e43e9000
page read and write
7f89e409e000
page read and write
7f89e3a1a000
page read and write
7f88ec002000
page execute read
There are 65 hidden memdumps, click here to show them.