IOC Report
boatnet.sh4.elf

loading gif

Processes

Path
Cmdline
Malicious
/usr/bin/dash
-
/usr/bin/rm
rm -f /tmp/tmp.pJ1K70qGTX /tmp/tmp.vhUMLtHevr /tmp/tmp.ctklcOzlGq
/usr/bin/dash
-
/usr/bin/rm
rm -f /tmp/tmp.pJ1K70qGTX /tmp/tmp.vhUMLtHevr /tmp/tmp.ctklcOzlGq
/tmp/boatnet.sh4.elf
/tmp/boatnet.sh4.elf

URLs

Name
IP
Malicious
http://5.181.159.16/wget.sh;
unknown
http://5.181.159.16/idk/home.arm7;chmod
unknown
http://5.181.159.16/w.sh;
unknown
http://5.181.159.16/c.sh;
unknown
http://schemas.xmlsoap.org/soap/encoding/
unknown
http://5.181.159.16/idk/home.mips
unknown
http://5.181.159.16/idk/home.mips;
unknown
http://5.181.159.16/idk/home.x86
unknown
http://schemas.xmlsoap.org/soap/envelope/
unknown

Domains

Name
IP
Malicious
daisy.ubuntu.com
162.213.35.24

Memdumps

Base Address
Regiontype
Protect
Malicious
7f69e0417000
page execute read
malicious
7f6a68179000
page read and write
55a35992e000
page read and write
7f6a6791e000
page read and write
7f69e0428000
page read and write
7f6a67681000
page read and write
55a35b94b000
page read and write
55a359936000
page read and write
7f6a60021000
page read and write
7f6a60000000
page read and write
7ffeca4c6000
page execute read
7f6a67ce0000
page read and write
55a359718000
page execute read
55a35b934000
page execute and read and write
7f6a6768f000
page read and write
7ffeca41b000
page read and write
55a35cc19000
page read and write
7f6a68181000
page read and write
7f6a68050000
page read and write
7f6a66e7e000
page read and write
7f6a67d05000
page read and write
7f6a681c6000
page read and write
7f69e0429000
page read and write
There are 13 hidden memdumps, click here to show them.