IOC Report
4QuhksnsA6.elf

loading gif

Processes

Path
Cmdline
Malicious
/tmp/4QuhksnsA6.elf
/tmp/4QuhksnsA6.elf
/tmp/4QuhksnsA6.elf
-
/tmp/4QuhksnsA6.elf
-
/tmp/4QuhksnsA6.elf
-
/tmp/4QuhksnsA6.elf
-
/usr/bin/xfce4-panel
-
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
/usr/bin/xfce4-panel
-
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
/usr/bin/xfce4-panel
-
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
/usr/bin/xfce4-panel
-
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
/usr/bin/xfce4-panel
-
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
/usr/bin/xfce4-panel
-
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
There are 7 hidden processes, click here to show them.

Domains

Name
IP
Malicious
pikeyisa.pirate
159.89.195.76
malicious

IPs

IP
Domain
Country
Malicious
159.89.195.76
pikeyisa.pirate
United States
malicious
177.221.123.161
unknown
Brazil
45.224.4.218
unknown
Brazil
143.137.12.33
unknown
Brazil
138.99.32.39
unknown
Brazil
45.239.240.196
unknown
Brazil
170.247.21.108
unknown
Brazil
130.61.64.122
unknown
United States

Memdumps

Base Address
Regiontype
Protect
Malicious
7f134f064000
page read and write
55affd2d3000
page read and write
7f134e3b3000
page read and write
7f134e321000
page read and write
7f134ecf1000
page read and write
7f1347fff000
page read and write
55afff2f1000
page read and write
7f134f01f000
page read and write
55affd2dc000
page read and write
7f1248031000
page read and write
7f134e9a3000
page read and write
7f1248032000
page read and write
55afff2da000
page execute and read and write
7f1348021000
page read and write
7f1248031000
page read and write
55affd082000
page execute read
7ffe3c2fd000
page execute read
7f134e9a3000
page read and write
7f1348021000
page read and write
55affd2d3000
page read and write
7f134e3b3000
page read and write
7f1347fff000
page read and write
7ffe3c2a4000
page read and write
7f134eed2000
page read and write
7f134f064000
page read and write
7f134e715000
page read and write
7f1248024000
page execute read
7f134eed2000
page read and write
7f134eb0f000
page read and write
7f124802c000
page read and write
7f1248024000
page execute read
7f134eb0f000
page read and write
55affd2dc000
page read and write
7f134e3b3000
page read and write
55b000c3c000
page read and write
55affd2dc000
page read and write
55b000c3c000
page read and write
7ffe3c2a4000
page read and write
7ffe3c2fd000
page execute read
7f134db19000
page read and write
7f124802c000
page read and write
7f1348021000
page read and write
7f134eb0f000
page read and write
7f134eed2000
page read and write
7f134e980000
page read and write
55afff2f1000
page read and write
7f1248024000
page execute read
7f134f064000
page read and write
7f134e321000
page read and write
7f134effb000
page read and write
55afff2f1000
page read and write
7f134effb000
page read and write
7f1248032000
page read and write
55affd2d3000
page read and write
55afff2da000
page execute and read and write
7f1347fff000
page read and write
7f134f01f000
page read and write
7f1248098000
page read and write
7f1248031000
page read and write
7ffe3c2fd000
page execute read
7f134e715000
page read and write
7f134ecf1000
page read and write
7f134effb000
page read and write
7f134db19000
page read and write
55afff2da000
page execute and read and write
7f134db19000
page read and write
7f134ecf1000
page read and write
7f134e715000
page read and write
55b000c3c000
page read and write
7f134e9a3000
page read and write
7ffe3c2a4000
page read and write
7f134e321000
page read and write
55affd082000
page execute read
55affd082000
page execute read
7f124802c000
page read and write
7f134e980000
page read and write
7f134f01f000
page read and write
7f134e980000
page read and write
There are 68 hidden memdumps, click here to show them.