IOC Report
mJ4CsuZhyr.elf

loading gif

Files

File Path
Type
Category
Malicious
mJ4CsuZhyr.elf
ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
initial sample
 malicious
/tmp/qemu-open.eDFJ3P (deleted)
data
dropped

Processes

Path
Cmdline
Malicious
/tmp/mJ4CsuZhyr.elf
/tmp/mJ4CsuZhyr.elf
/tmp/mJ4CsuZhyr.elf
-
/tmp/mJ4CsuZhyr.elf
-

Domains

Name
IP
Malicious
cnc.voidnet.click
94.156.79.77
 malicious
cnc.voidnet.click.'f!p66a/PV!E(*:5we))'fpNNPV!a/E@7
unknown
 malicious
cnc.voidnet.click.'f66a/PV!E(9O5?)'fZNNPV!a/E@8.@@/.5,.cncvoidnetclickn'f
unknown
 malicious
cnc.voidnet.click.'f66a/PV!E(:+5sp-)'f}NNPV!a/E@7
unknown
 malicious
cnc.voidnet.click.'fm66a/PV!E(G7j6I5o)'f"nNNPV!a/E@7
unknown
 malicious
cnc.voidnet.click.'f66a/PV!E($:}5)'fJJPV!a/E<.@@(^OM^%K|+'f,JJa/PV!E<@6^OM^.,%n9|+'f=-BBPV!a/E4m@@(^OM^%`,
unknown
 malicious

IPs

IP
Domain
Country
Malicious
94.156.79.77
cnc.voidnet.click
Bulgaria
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
561cc9565000
page execute read
7ffe390cd000
page execute read
7eff36383000
page read and write
7eff35a45000
page read and write
7ffe3906f000
page read and write
7efe3002f000
page execute read
561cc97b6000
page read and write
561cc97bf000
page read and write
561ccd734000
page read and write
7eff36564000
page read and write
7eff35da7000
page read and write
7eff366f6000
page read and write
7eff36035000
page read and write
7eff351ab000
page read and write
7eff30021000
page read and write
7eff3668d000
page read and write
7eff361a1000
page read and write
7eff359b3000
page read and write
561ccb7bd000
page execute and read and write
7eff36012000
page read and write
561ccb7d4000
page read and write
7efe3003c000
page read and write
7eff366b1000
page read and write
7efe30037000
page read and write
7eff2ffff000
page read and write
There are 15 hidden memdumps, click here to show them.