Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
na.elf
|
ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da,
stripped
|
initial sample
|
 |
|
|
/etc/CommId
|
ASCII text, with no line terminators
|
dropped
|
|
|
|
/usr/sbin/uplugplay
|
ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da,
stripped
|
dropped
|
|
|
|
/memfd:snapd-env-generator (deleted)
|
ASCII text
|
dropped
|
||
|
/proc/6423/task/6424/comm
|
ASCII text, with no line terminators
|
dropped
|
||
|
/proc/6423/task/6425/comm
|
ASCII text, with no line terminators
|
dropped
|
||
|
/proc/6423/task/6426/comm
|
ASCII text, with no line terminators
|
dropped
|
||
|
/usr/lib/systemd/system/uplugplay.service
|
ASCII text
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/rm
|
rm -f /tmp/tmp.IxF8b80PrJ /tmp/tmp.MxENF9epsP /tmp/tmp.cpiNHxKqd7
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/rm
|
rm -f /tmp/tmp.IxF8b80PrJ /tmp/tmp.MxENF9epsP /tmp/tmp.cpiNHxKqd7
|
||
|
/tmp/na.elf
|
/tmp/na.elf
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "pgrep na.elf"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/pgrep
|
pgrep na.elf
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "pidof na.elf"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/pidof
|
pidof na.elf
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "pgrep uplugplay"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/pgrep
|
pgrep uplugplay
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "pidof uplugplay"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/pidof
|
pidof uplugplay
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "pgrep upnpsetup"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/pgrep
|
pgrep upnpsetup
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "pidof upnpsetup"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/pidof
|
pidof upnpsetup
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "systemctl daemon-reload"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/systemctl
|
systemctl daemon-reload
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "systemctl enable uplugplay.service"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/systemctl
|
systemctl enable uplugplay.service
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "systemctl start uplugplay.service"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/systemctl
|
systemctl start uplugplay.service
|
||
|
/usr/lib/systemd/systemd
|
-
|
||
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
||
|
/usr/lib/systemd/systemd
|
-
|
||
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
||
|
/usr/lib/systemd/systemd
|
-
|
||
|
/usr/sbin/uplugplay
|
/usr/sbin/uplugplay
|
||
|
/usr/sbin/uplugplay
|
-
|
||
|
/usr/sbin/uplugplay
|
-
|
||
|
/bin/sh
|
sh -c "/usr/sbin/uplugplay -Dcomsvc"
|
||
|
/bin/sh
|
-
|
||
|
/usr/sbin/uplugplay
|
/usr/sbin/uplugplay -Dcomsvc
|
||
|
/usr/sbin/uplugplay
|
-
|
||
|
/bin/sh
|
sh -c "nslookup p3.feefreepool.net 8.8.8.8"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/nslookup
|
nslookup p3.feefreepool.net 8.8.8.8
|
There are 46 hidden processes, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://p3.feefreepool.net/cgi-bin/prometei.cgihttp://dummy.zero/cgi-bin/prometei.cgihttps://gb7ni5rg
|
unknown
|
||
|
https://bugs.launchpad.net/ubuntu/
|
unknown
|
||
|
http://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.b32.i2p/cgi-bin/prometei.cgi
|
unknown
|
||
|
http://p3.feefreepool.net/cgi-bin/prometei.cgi
|
unknown
|
||
|
https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi
|
unknown
|
||
|
http://%s/cgi-bin/prometei.cgi
|
unknown
|
||
|
http://%s/cgi-bin/prometei.cgi?r=0&auth=hash&i=%s&enckey=%shttp://%s/cgi-bin/prometei.cgi%m%d%yxinch
|
unknown
|
||
|
https://http:///:.onion.i2p.zeroGET
|
unknown
|
||
|
http://dummy.zero/cgi-bin/prometei.cgi
|
unknown
|
||
|
http://%s/cgi-bin/prometei.cgi?r=0&auth=hash&i=%s&enckey=%s
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
p3.feefreepool.net
|
88.198.246.242
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
88.198.246.242
|
p3.feefreepool.net
|
Germany
|
||
|
109.202.202.202
|
unknown
|
Switzerland
|
||
|
91.189.91.43
|
unknown
|
United Kingdom
|
||
|
91.189.91.42
|
unknown
|
United Kingdom
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
7f5e78451000
|
page execute read
|
|
||
|
7f5e791e9000
|
page read and write
|
|
||
|
55bbcf866000
|
page read and write
|
|||
|
55bbcf5de000
|
page execute read
|
|||
|
7f27aff5e000
|
page read and write
|
|||
|
55c33b0f6000
|
page read and write
|
|||
|
7f5e78466000
|
page read and write
|
|||
|
55bbd186e000
|
page execute and read and write
|
|||
|
7f5efce6f000
|
page read and write
|
|||
|
7f5e70062000
|
page read and write
|
|||
|
7f5ef1d76000
|
page execute and read and write
|
|||
|
7f5efceaf000
|
page read and write
|
|||
|
7f5ef5d7e000
|
page execute and read and write
|
|||
|
7ffcba1d8000
|
page execute read
|
|||
|
55bbd3299000
|
page read and write
|
|||
|
7f5ef2d78000
|
page execute and read and write
|
|||
|
7f272926a000
|
page read and write
|
|||
|
7f5e77e3a000
|
page read and write
|
|||
|
7f5e77ebc000
|
page read and write
|
|||
|
7f5e68032000
|
page read and write
|
|||
|
7f5efd3c1000
|
page read and write
|
|||
|
55bbd1885000
|
page read and write
|
|||
|
7f5e77f7f000
|
page read and write
|
|||
|
7f5e77e7b000
|
page read and write
|
|||
|
7f5ef6f7d000
|
page execute and read and write
|
|||
|
7f5efd4ea000
|
page read and write
|
|||
|
7f5ef557d000
|
page execute and read and write
|
|||
|
7f5ef4d7c000
|
page execute and read and write
|
|||
|
7f5ef8021000
|
page read and write
|
|||
|
55c339462000
|
page execute and read and write
|
|||
|
55c33745a000
|
page read and write
|
|||
|
7f27b1136000
|
page read and write
|
|||
|
7f5efd4f2000
|
page read and write
|
|||
|
7f5efcace000
|
page read and write
|
|||
|
7ffcba196000
|
page read and write
|
|||
|
55c339479000
|
page read and write
|
|||
|
7f27b0e05000
|
page read and write
|
|||
|
7f5efd537000
|
page read and write
|
|||
|
7f5e77efd000
|
page read and write
|
|||
|
7f5efc810000
|
page read and write
|
|||
|
55bbcf870000
|
page read and write
|
|||
|
7f27a8021000
|
page read and write
|
|||
|
7f5ef3d7a000
|
page execute and read and write
|
|||
|
7f27b0de8000
|
page read and write
|
|||
|
7f5ef777e000
|
page execute and read and write
|
|||
|
7f5ef457b000
|
page execute and read and write
|
|||
|
7f27b1448000
|
page read and write
|
|||
|
7f5ef8000000
|
page read and write
|
|||
|
7f5efc81e000
|
page read and write
|
|||
|
7f5ef2577000
|
page execute and read and write
|
|||
|
7f5efd1e0000
|
page read and write
|
|||
|
7f5ef3579000
|
page execute and read and write
|
|||
|
7f27b0774000
|
page read and write
|
|||
|
7f27b148d000
|
page read and write
|
|||
|
7f5e77f3e000
|
page read and write
|
|||
|
7f27b1317000
|
page read and write
|
|||
|
7f27a8000000
|
page read and write
|
|||
|
7f27b0766000
|
page read and write
|
|||
|
55c337464000
|
page read and write
|
|||
|
7f27b1440000
|
page read and write
|
|||
|
7f27b0a24000
|
page read and write
|
|||
|
7ffd76753000
|
page execute read
|
|||
|
7f27b0dc5000
|
page read and write
|
|||
|
7ffd76641000
|
page read and write
|
|||
|
7f5ef65a0000
|
page read and write
|
|||
|
7f5efce92000
|
page read and write
|
|||
|
55c3371d2000
|
page execute read
|
|||
|
7f5ef657f000
|
page execute and read and write
|
There are 58 hidden memdumps, click here to show them.