Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Download

na.elf

ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da, stripped

initial sample

Details

Filetype:	ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da, stripped
Entropy:	5.7652824899674195
Filename:	na.elf
Filesize:	920568
MD5:	7e972cfc6c10dda36254fb7bf71fec6d
SHA1:	0ca56566a38d73a79b092093864df439eb38e017
SHA256:	571a31daa55eb0bfd017bf96e3bdbb2a8291748db99289ae1eb17114b666b1ad
SHA512:	0c0a3581248a96a8ef592f0e6419807092b22059a20cb6292281a724bc18d5ab7a4462aab01ef8066271d5eb72624c9aab514998ff8778fef4123f5ad9cab8c7
SSDEEP:	12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplX:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhI
Preview:	.ELF.....................@.....4....p....4. ...(.#."p......X.@.X.@.X................p......p.@.p.@.p.........................@...@........................&..N&..N&...F...V................4.@.4.@.4... ... .................@...@.....$...$..............'..N'

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Drops files in suspicious directories	Hooking and other Techniques for Hiding and Protection	Masquerading
Found Tor onion address	Networking	Proxy
Sample deletes itself	Hooking and other Techniques for Hiding and Protection
Executes commands using a shell command-line interpreter	Persistence and Installation Behavior	Scripting
Sample tries to set the executable flag	Persistence and Installation Behavior	File and Directory Permissions Modification
Uses the "uname" system call to query kernel version information (possible evasion)	Malware Analysis System Evasion	Security Software Discovery
Writes ELF files to disk	Persistence and Installation Behavior
Yara signature match	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion
URLs found in memory or binary data	Networking

/etc/CommId

ASCII text, with no line terminators

dropped

Details

File:	/etc/CommId
Category:	dropped
Dump:	CommId.61.dr
ID:	dr_4
Target ID:	61
Process:	/usr/sbin/uplugplay
Type:	ASCII text, with no line terminators
Entropy:	3.75
Encrypted:	false
Ssdeep:	3:pThnkn:dxk
Size:	16
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Found Tor onion address	Networking	Proxy

/usr/sbin/uplugplay

ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da, stripped

dropped

Details

File:	/usr/sbin/uplugplay
Category:	dropped
Dump:	uplugplay.12.dr
ID:	dr_0
Target ID:	12
Process:	/tmp/na.elf
Type:	ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da, stripped
Entropy:	5.7652824899674195
Encrypted:	false
Ssdeep:	12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplX:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhI
Size:	920568
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Yara detected Prometei	Bitcoin Miner
Yara detected Prometei	Bitcoin Miner
Drops files in suspicious directories	Hooking and other Techniques for Hiding and Protection	Masquerading
Found Tor onion address	Networking	Proxy
Executes commands using a shell command-line interpreter	Persistence and Installation Behavior	Scripting
Sample tries to set the executable flag	Persistence and Installation Behavior	File and Directory Permissions Modification
Writes ELF files to disk	Persistence and Installation Behavior
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery

/memfd:snapd-env-generator (deleted)

ASCII text

dropped

Details

File:	/memfd:snapd-env-generator (deleted)
Category:	dropped
Dump:	memfd_snapd-env-generator (deleted).50.dr
ID:	dr_3
Target ID:	50
Process:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
Type:	ASCII text
Entropy:	3.7627880354948586
Encrypted:	false
Ssdeep:	3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
Size:	76
Whitelisted:	false
Reputation:	high

/proc/6418/task/6419/comm

ASCII text, with no line terminators

dropped

Details

File:	/proc/6418/task/6419/comm
Category:	dropped
Dump:	comm.69.dr
ID:	dr_5
Target ID:	69
Process:	/usr/bin/nslookup
Type:	ASCII text, with no line terminators
Entropy:	3.09306920777189
Encrypted:	false
Ssdeep:	3:XfSPyVd:PSPS
Size:	14
Whitelisted:	false
Reputation:	high

/proc/6418/task/6420/comm

ASCII text, with no line terminators

dropped

Details

File:	/proc/6418/task/6420/comm
Category:	dropped
Dump:	comm0.69.dr
ID:	dr_6
Target ID:	69
Process:	/usr/bin/nslookup
Type:	ASCII text, with no line terminators
Entropy:	2.94770277922009
Encrypted:	false
Ssdeep:	3:XfRJy:P2
Size:	9
Whitelisted:	false
Reputation:	high

/proc/6418/task/6421/comm

ASCII text, with no line terminators

dropped

Details

File:	/proc/6418/task/6421/comm
Category:	dropped
Dump:	comm1.69.dr
ID:	dr_7
Target ID:	69
Process:	/usr/bin/nslookup
Type:	ASCII text, with no line terminators
Entropy:	3.084962500721156
Encrypted:	false
Ssdeep:	3:XfWdvRo:PWno
Size:	12
Whitelisted:	false
Reputation:	high

/usr/lib/systemd/system/uplugplay.service

ASCII text

dropped

Details

File:	/usr/lib/systemd/system/uplugplay.service
Category:	dropped
Dump:	uplugplay.service.12.dr
ID:	dr_1
Target ID:	12
Process:	/tmp/na.elf
Type:	ASCII text
Entropy:	4.769509838572339
Encrypted:	false
Ssdeep:	3:zMZa75X1PxQJqtWA1+DRvBADMikAdIgQ+aQmNJX4ev+sirSkQmWA1+DRvn:z8uXcqtWA4RZAMD+aBNdhTILQmWA4Rv
Size:	145
Whitelisted:	false
Reputation:	high

Processes

Path

Cmdline

Malicious

/tmp/na.elf

/bin/sh

sh -c "pgrep na.elf"

/bin/sh

/usr/bin/pgrep

pgrep na.elf

/tmp/na.elf

/bin/sh

sh -c "pidof na.elf"

/bin/sh

/usr/bin/pidof

pidof na.elf

/tmp/na.elf

/bin/sh

sh -c "pgrep uplugplay"

/bin/sh

/usr/bin/pgrep

pgrep uplugplay

/tmp/na.elf

/bin/sh

sh -c "pidof uplugplay"

/bin/sh

/usr/bin/pidof

pidof uplugplay

/tmp/na.elf

/bin/sh

sh -c "pgrep upnpsetup"

/bin/sh

/usr/bin/pgrep

pgrep upnpsetup

/tmp/na.elf

/bin/sh

sh -c "pidof upnpsetup"

/bin/sh

/usr/bin/pidof

pidof upnpsetup

/tmp/na.elf

/bin/sh

sh -c "systemctl daemon-reload"

/bin/sh

/usr/bin/systemctl

systemctl daemon-reload

/tmp/na.elf

/bin/sh

sh -c "systemctl enable uplugplay.service"

/bin/sh

/usr/bin/systemctl

systemctl enable uplugplay.service

/tmp/na.elf

/bin/sh

sh -c "systemctl start uplugplay.service"

/bin/sh

/usr/bin/systemctl

systemctl start uplugplay.service

/usr/lib/systemd/systemd

/usr/lib/systemd/system-environment-generators/snapd-env-generator

/usr/lib/systemd/systemd

/usr/lib/systemd/system-environment-generators/snapd-env-generator

/usr/lib/systemd/systemd

/usr/sbin/uplugplay

/bin/sh

sh -c "/usr/sbin/uplugplay -Dcomsvc"

/bin/sh

/usr/sbin/uplugplay

/usr/sbin/uplugplay -Dcomsvc

/usr/sbin/uplugplay

/bin/sh

sh -c "nslookup p3.feefreepool.net 8.8.8.8"

/bin/sh

/usr/bin/nslookup

nslookup p3.feefreepool.net 8.8.8.8

/usr/bin/dash

/usr/bin/rm

rm -f /tmp/tmp.xcHQrzuDMU /tmp/tmp.KMipKbsEVZ /tmp/tmp.YDEPSFXP9h

/usr/bin/dash

/usr/bin/rm

rm -f /tmp/tmp.xcHQrzuDMU /tmp/tmp.KMipKbsEVZ /tmp/tmp.YDEPSFXP9h

There are 46 hidden processes, click here to show them.

URLs

Name

Malicious

http://p3.feefreepool.net/cgi-bin/prometei.cgihttp://dummy.zero/cgi-bin/prometei.cgihttps://gb7ni5rg

unknown

https://bugs.launchpad.net/ubuntu/

unknown

http://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.b32.i2p/cgi-bin/prometei.cgi

unknown

http://p3.feefreepool.net/cgi-bin/prometei.cgi

unknown

https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi

unknown

http://%s/cgi-bin/prometei.cgi

unknown

http://%s/cgi-bin/prometei.cgi?r=0&auth=hash&i=%s&enckey=%shttp://%s/cgi-bin/prometei.cgi%m%d%yxinch

unknown

https://http:///:.onion.i2p.zeroGET

unknown

http://dummy.zero/cgi-bin/prometei.cgi

unknown

http://%s/cgi-bin/prometei.cgi?r=0&auth=hash&i=%s&enckey=%s

unknown

Domains

Name

Malicious

p3.feefreepool.net

88.198.246.242

Details

Name:	p3.feefreepool.net
IP:	88.198.246.242
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found Tor onion address	Networking	Proxy
Executes commands using a shell command-line interpreter	Persistence and Installation Behavior	Scripting
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

88.198.246.242

p3.feefreepool.net

Germany

34.249.145.219

unknown

United States

Details

IP:	34.249.145.219
TargetID:	-1
Country:	United States
Countrycode:	USA
ASN number:	16509
ASN name:	AMAZON-02US
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

109.202.202.202

unknown

Switzerland

Details

IP:	109.202.202.202
TargetID:	-1
Country:	Switzerland
Countrycode:	CHE
ASN number:	13030
ASN name:	INIT7CH
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

91.189.91.43

unknown

United Kingdom

Details

IP:	91.189.91.43
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

91.189.91.42

unknown

United Kingdom

Details

IP:	91.189.91.42
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

Memdumps

Base Address

Regiontype

Protect

Malicious

Download

7fced526a000

page read and write

7fced44d2000

page execute read

7f23183a0000

page read and write

7f2318c93000

page read and write

7fcf59185000

page read and write

7fcf59162000

page read and write

55d39144a000

page execute read

7f23180e2000

page read and write

7fcf58176000

page read and write

7f23180f0000

page read and write

7fcf4ddf7000

page execute and read and write

7fcf4edf9000

page execute and read and write

558529932000

page execute and read and write

7fcf596b4000

page read and write

7f2318e09000

page read and write

7fcf582fb000

page read and write

7fff1bc93000

page read and write

7fcf505fc000

page execute and read and write

7fcf5982a000

page read and write

7f2318dbc000

page read and write

7fcf597dd000

page read and write

7f2318741000

page read and write

55d393bdb000

page read and write

7fcf581b7000

page read and write

55852792a000

page read and write

558527934000

page read and write

7fcf515fe000

page execute and read and write

7fcf581f8000

page read and write

7f229126a000

page read and write

55d3916d2000

page read and write

7ffd4af40000

page read and write

7fcf594d3000

page read and write

7fcf4e5f8000

page execute and read and write

7fcf58239000

page read and write

7f23178da000

page read and write

7fcf597e5000

page read and write

7f2310000000

page read and write

7fcf52600000

page execute and read and write

7fcf4f5fa000

page execute and read and write

7fcf52621000

page read and write

7fced44e7000

page read and write

5585276a2000

page execute read

7fcf58dc1000

page read and write

7fcf591a2000

page read and write

7f2318764000

page read and write

558529949000

page read and write

55d3936da000

page execute and read and write

7fcf54000000

page read and write

7fcf54021000

page read and write

7fced0032000

page read and write

7fcf58135000

page read and write

7fcf58b11000

page read and write

7f2318dc4000

page read and write

55d3936f1000

page read and write

7f2310021000

page read and write

7fcf51dff000

page execute and read and write

7fcf58b03000

page read and write

7fcf50dfd000

page execute and read and write

7f2318ab2000

page read and write

7fcf537ff000

page execute and read and write

7fff1bcb4000

page execute read

7f2318781000

page read and write

7ffd4afbd000

page execute read

55852a4b8000

page read and write

7fcf52ffe000

page execute and read and write

7fcf4fdfb000

page execute and read and write

7fcecc062000

page read and write

55d3916dc000

page read and write

There are 58 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
na.elf

Files

Processes

URLs

Domains

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportna.elf

Files

Processes

URLs

Domains

IPs

Memdumps

IOC Report
na.elf