IOC Report
PoJxsiOLh2.elf

loading gif

Processes

Path
Cmdline
Malicious
/tmp/PoJxsiOLh2.elf
/tmp/PoJxsiOLh2.elf
/tmp/PoJxsiOLh2.elf
-
/tmp/PoJxsiOLh2.elf
-
/usr/bin/dash
-
/usr/bin/rm
rm -f /tmp/tmp.anx9yW2ZLu /tmp/tmp.7D95nT4L40 /tmp/tmp.rHp23WAPXo
/usr/bin/dash
-
/usr/bin/cat
cat /tmp/tmp.anx9yW2ZLu
/usr/bin/dash
-
/usr/bin/head
head -n 10
/usr/bin/dash
-
/usr/bin/tr
tr -d \\000-\\011\\013\\014\\016-\\037
/usr/bin/dash
-
/usr/bin/cut
cut -c -80
/usr/bin/dash
-
/usr/bin/cat
cat /tmp/tmp.anx9yW2ZLu
/usr/bin/dash
-
/usr/bin/head
head -n 10
/usr/bin/dash
-
/usr/bin/tr
tr -d \\000-\\011\\013\\014\\016-\\037
/usr/bin/dash
-
/usr/bin/cut
cut -c -80
/usr/bin/dash
-
/usr/bin/rm
rm -f /tmp/tmp.anx9yW2ZLu /tmp/tmp.7D95nT4L40 /tmp/tmp.rHp23WAPXo
There are 13 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://motd.ubuntu.com/
34.243.160.129
http://www.majestic12.co.uk/bot.php?
unknown
http://majestic12.co.uk/bot.php?
unknown
http://wortschatz.uni-leipzig.de/findlinks/)
unknown
http://code.google.com/appengine;
unknown
http://www.brandwatch.net)
unknown
http://www.mojeek.com/bot.html)
unknown

Domains

Name
IP
Malicious
daisy.ubuntu.com
162.213.35.24

IPs

IP
Domain
Country
Malicious
193.35.18.127
unknown
Germany
malicious
34.243.160.129
unknown
United States
54.247.62.1
unknown
United States

Memdumps

Base Address
Regiontype
Protect
Malicious
432000
page execute read
 malicious
432000
page execute read
 malicious
63c000
page read and write
7ffe026f2000
page read and write
7ffe026fa000
page execute read
7ffe026f2000
page read and write
63c000
page read and write
7ffe026fa000
page execute read