IOC Report
lln4e2EfeB.elf

loading gif

Files

File Path
Type
Category
Malicious
lln4e2EfeB.elf
ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, not stripped
initial sample
 malicious
/tmp/qemu-open.pSovwR (deleted)
ASCII text
dropped

Processes

Path
Cmdline
Malicious
/tmp/lln4e2EfeB.elf
/tmp/lln4e2EfeB.elf
/tmp/lln4e2EfeB.elf
-
/tmp/lln4e2EfeB.elf
-

URLs

Name
IP
Malicious
162.215.219.170:4444
malicious
http://www.baidu.com/search/spider.html)
unknown
http://www.billybobbot.com/crawler/)
unknown
http://fast.no/support/crawler.asp)
unknown
http://feedback.redkolibri.com/
unknown
http://www.baidu.com/search/spider.htm)
unknown

IPs

IP
Domain
Country
Malicious
162.215.219.170
unknown
United States
malicious
109.202.202.202
unknown
Switzerland
91.189.91.43
unknown
United Kingdom
91.189.91.42
unknown
United Kingdom

Memdumps

Base Address
Regiontype
Protect
Malicious
7f867c42b000
page execute read
 malicious
7f867c42b000
page execute read
 malicious
7f86fc000000
page read and write
7f870353a000
page read and write
7f87040dd000
page read and write
7f870352c000
page read and write
7fff5b55d000
page execute read
7fff5b55d000
page execute read
7f8704206000
page read and write
557e99c5b000
page read and write
7f867c43c000
page read and write
7fff5b4e1000
page read and write
557e97c3c000
page read and write
7f86fc021000
page read and write
557e99c5b000
page read and write
7f867c43c000
page read and write
557e97c3c000
page read and write
7f87037ea000
page read and write
557e979b4000
page execute read
7f867c444000
page read and write
7f8703bae000
page read and write
7f870420e000
page read and write
557e99c44000
page execute and read and write
7f8703efc000
page read and write
7f8702d24000
page read and write
557e979b4000
page execute read
557e99c44000
page execute and read and write
7f86fc021000
page read and write
557e97c46000
page read and write
7f8704253000
page read and write
7f8704206000
page read and write
7f87037ea000
page read and write
7f8703bcb000
page read and write
557e9afe6000
page read and write
7f870420e000
page read and write
7f870353a000
page read and write
7f8703bcb000
page read and write
557e97c46000
page read and write
7f867c444000
page read and write
7f8703bae000
page read and write
7f8703b8b000
page read and write
7f870352c000
page read and write
7f8702d24000
page read and write
7fff5b4e1000
page read and write
557e9afe6000
page read and write
7f8704253000
page read and write
7f8703b8b000
page read and write
7f8703efc000
page read and write
7f87040dd000
page read and write
7f86fc000000
page read and write
There are 40 hidden memdumps, click here to show them.