IOC Report
ntpd.elf

loading gif

Files

File Path
Type
Category
Malicious
ntpd.elf
ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, not stripped
initial sample
 malicious
/tmp/qemu-open.NCE2hY (deleted)
ASCII text
dropped

Processes

Path
Cmdline
Malicious
/tmp/ntpd.elf
/tmp/ntpd.elf
/tmp/ntpd.elf
-
/tmp/ntpd.elf
-

URLs

Name
IP
Malicious
160.22.160.59:4444
malicious
http://www.baidu.com/search/spider.html)
unknown
http://www.billybobbot.com/crawler/)
unknown
http://fast.no/support/crawler.asp)
unknown
http://feedback.redkolibri.com/
unknown
http://www.baidu.com/search/spider.htm)
unknown

IPs

IP
Domain
Country
Malicious
160.22.160.59
unknown
unknown
malicious
109.202.202.202
unknown
Switzerland
91.189.91.43
unknown
United Kingdom
91.189.91.42
unknown
United Kingdom

Memdumps

Base Address
Regiontype
Protect
Malicious
7fa0a842b000
page execute read
 malicious
7fa0a842b000
page execute read
 malicious
7fa12d2c6000
page read and write
7fa128000000
page read and write
7fa128021000
page read and write
7fa128000000
page read and write
560765739000
page execute read
7fa12e12d000
page read and write
5607679e0000
page read and write
5607679e0000
page read and write
7fa12e7b0000
page read and write
7fa12dace000
page read and write
560765739000
page execute read
7fa0a8444000
page read and write
5607659c1000
page read and write
7fff42c00000
page execute read
7fa12e7a8000
page read and write
7fa12dd8c000
page read and write
7fa12d2c6000
page read and write
7fa12e67f000
page read and write
7fa12e7f5000
page read and write
7fa12e7f5000
page read and write
7fa12e67f000
page read and write
5607679c9000
page execute and read and write
7fa12e7a8000
page read and write
7fa12e16d000
page read and write
56076937b000
page read and write
7fa12e49e000
page read and write
7fa12dadc000
page read and write
7fa0a8444000
page read and write
7fa128021000
page read and write
7fff42c00000
page execute read
7fa0a843c000
page read and write
7fff42bd4000
page read and write
7fa12dace000
page read and write
7fa12dadc000
page read and write
7fa12dd8c000
page read and write
7fa12e16d000
page read and write
56076937b000
page read and write
7fa0a843c000
page read and write
5607679c9000
page execute and read and write
7fa12e49e000
page read and write
7fa12e150000
page read and write
7fff42bd4000
page read and write
7fa12e12d000
page read and write
5607659cb000
page read and write
5607659c1000
page read and write
5607659cb000
page read and write
7fa12e7b0000
page read and write
7fa12e150000
page read and write
There are 40 hidden memdumps, click here to show them.