IOC Report
na.elf

loading gif

Files

File Path
Type
Category
Malicious
na.elf
ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, not stripped
initial sample
 malicious
/tmp/qemu-open.5OndS9 (deleted)
ASCII text
dropped

Processes

Path
Cmdline
Malicious
/tmp/na.elf
/tmp/na.elf
/tmp/na.elf
-
/tmp/na.elf
-

URLs

Name
IP
Malicious
93.123.85.167:77
malicious
http://www.baidu.com/search/spider.html)
unknown
http://www.billybobbot.com/crawler/)
unknown
http://fast.no/support/crawler.asp)
unknown
http://feedback.redkolibri.com/
unknown
http://www.baidu.com/search/spider.htm)
unknown

IPs

IP
Domain
Country
Malicious
93.123.85.167
unknown
Bulgaria
malicious
109.202.202.202
unknown
Switzerland
91.189.91.43
unknown
United Kingdom
91.189.91.42
unknown
United Kingdom

Memdumps

Base Address
Regiontype
Protect
Malicious
7f9364022000
page execute read
 malicious
7f9364022000
page execute read
 malicious
7f93e9777000
page read and write
7f93e9ea9000
page read and write
7f93e8cd7000
page read and write
5586eecdb000
page read and write
7ffd1e54f000
page execute read
5586eecd3000
page read and write
5586eecd3000
page read and write
7f93e9777000
page read and write
7f93e9fda000
page read and write
7ffd1e54f000
page execute read
5586f0cd9000
page execute and read and write
7f93e9b5e000
page read and write
7f93e4021000
page read and write
7f93e94da000
page read and write
7f93ea01f000
page read and write
7ffd1e4e4000
page read and write
5586eeaa1000
page execute read
7f93e94e8000
page read and write
7f93e4000000
page read and write
7f93e94e8000
page read and write
5586f1651000
page read and write
7f9364024000
page read and write
7f93e9b39000
page read and write
7f936402a000
page read and write
5586f0d70000
page read and write
7f93e4021000
page read and write
7f9364024000
page read and write
7f93e9fda000
page read and write
7f93e9b39000
page read and write
7f93e9ea9000
page read and write
5586f0cd9000
page execute and read and write
5586eecdb000
page read and write
7f93e4000000
page read and write
7f93e8cd7000
page read and write
7ffd1e4e4000
page read and write
5586f1651000
page read and write
5586eeaa1000
page execute read
7f93e9b5e000
page read and write
7f93ea01f000
page read and write
5586f0d70000
page read and write
7f936402a000
page read and write
7f93e9fd2000
page read and write
7f93e9fd2000
page read and write
7f93e94da000
page read and write
There are 36 hidden memdumps, click here to show them.