IOC Report
shngijernbh.ppc.elf

loading gif

Files

File Path
Type
Category
Malicious
shngijernbh.ppc.elf
initial sample
 malicious
/tmp/qemu-open.oRsFHP (deleted)
ASCII text
dropped

Processes

Path
Cmdline
Malicious
/tmp/shngijernbh.ppc.elf
/tmp/shngijernbh.ppc.elf
/tmp/shngijernbh.ppc.elf
-
/tmp/shngijernbh.ppc.elf
-

URLs

Name
IP
Malicious
143.47.38.152:4258
malicious
http://www.baidu.com/search/spider.html)
unknown
http://www.billybobbot.com/crawler/)
unknown
http://fast.no/support/crawler.asp)
unknown
http://feedback.redkolibri.com/
unknown
http://www.baidu.com/search/spider.htm)
unknown

IPs

IP
Domain
Country
Malicious
143.47.38.152
unknown
Ireland
malicious
109.202.202.202
unknown
Switzerland
91.189.91.43
unknown
United Kingdom
91.189.91.42
unknown
United Kingdom

Memdumps

Base Address
Regiontype
Protect
Malicious
7f5bd0012000
page execute read
 malicious
7f5bd0012000
page execute read
 malicious
7f5bd0028000
page read and write
7ffe3e6ec000
page execute read
7f5cc0021000
page read and write
56437ddc0000
page read and write
7f5cc5a5b000
page read and write
7f5bd0022000
page read and write
56437c3ec000
page execute and read and write
56437a3ee000
page read and write
7f5cc5b84000
page read and write
7ffe3e633000
page read and write
56437c402000
page read and write
7f5bd0028000
page read and write
7f5bd0022000
page read and write
56437a3e6000
page read and write
7f5cc56eb000
page read and write
7f5cc5a5b000
page read and write
7f5cc5b8c000
page read and write
7f5cc509a000
page read and write
7f5cc5b84000
page read and write
7f5cc508c000
page read and write
56437a163000
page execute read
7f5cc5710000
page read and write
7f5cc0021000
page read and write
56437ddc0000
page read and write
7f5cc5329000
page read and write
7f5cc4889000
page read and write
56437c3ec000
page execute and read and write
56437a163000
page execute read
7f5cc5bd1000
page read and write
7f5cc5b8c000
page read and write
7f5cc5bd1000
page read and write
56437a3e6000
page read and write
7f5cc5710000
page read and write
56437c402000
page read and write
7f5cc509a000
page read and write
7f5cc5329000
page read and write
7f5cc0000000
page read and write
7f5cc0000000
page read and write
56437a3ee000
page read and write
7f5cc508c000
page read and write
7ffe3e6ec000
page execute read
7f5cc4889000
page read and write
7f5cc56eb000
page read and write
7ffe3e633000
page read and write
There are 36 hidden memdumps, click here to show them.