Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
na.elf
|
ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da,
stripped
|
initial sample
|
 |
|
|
/etc/CommId
|
ASCII text, with no line terminators
|
dropped
|
|
|
|
/usr/sbin/uplugplay
|
ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da,
stripped
|
dropped
|
|
|
|
/memfd:snapd-env-generator (deleted)
|
ASCII text
|
dropped
|
||
|
/proc/6415/task/6416/comm
|
ASCII text, with no line terminators
|
dropped
|
||
|
/proc/6415/task/6417/comm
|
ASCII text, with no line terminators
|
dropped
|
||
|
/proc/6415/task/6418/comm
|
ASCII text, with no line terminators
|
dropped
|
||
|
/usr/lib/systemd/system/uplugplay.service
|
ASCII text
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/rm
|
rm -f /tmp/tmp.YxFHt0qX7F /tmp/tmp.KNRFWGMRRn /tmp/tmp.zpobq5Q83F
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/cat
|
cat /tmp/tmp.YxFHt0qX7F
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/head
|
head -n 10
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/tr
|
tr -d \\000-\\011\\013\\014\\016-\\037
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/cut
|
cut -c -80
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/cat
|
cat /tmp/tmp.YxFHt0qX7F
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/head
|
head -n 10
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/tr
|
tr -d \\000-\\011\\013\\014\\016-\\037
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/cut
|
cut -c -80
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/rm
|
rm -f /tmp/tmp.YxFHt0qX7F /tmp/tmp.KNRFWGMRRn /tmp/tmp.zpobq5Q83F
|
||
|
/tmp/na.elf
|
/tmp/na.elf
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "pgrep na.elf"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/pgrep
|
pgrep na.elf
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "pgrep uplugplay"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/pgrep
|
pgrep uplugplay
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "pidof uplugplay"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/pidof
|
pidof uplugplay
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "pgrep upnpsetup"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/pgrep
|
pgrep upnpsetup
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "pidof upnpsetup"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/pidof
|
pidof upnpsetup
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "systemctl daemon-reload"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/systemctl
|
systemctl daemon-reload
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "systemctl enable uplugplay.service"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/systemctl
|
systemctl enable uplugplay.service
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "systemctl start uplugplay.service"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/systemctl
|
systemctl start uplugplay.service
|
||
|
/usr/lib/systemd/systemd
|
-
|
||
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
||
|
/usr/lib/systemd/systemd
|
-
|
||
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
||
|
/usr/lib/systemd/systemd
|
-
|
||
|
/usr/sbin/uplugplay
|
/usr/sbin/uplugplay
|
||
|
/usr/sbin/uplugplay
|
-
|
||
|
/usr/sbin/uplugplay
|
-
|
||
|
/bin/sh
|
sh -c "/usr/sbin/uplugplay -Dcomsvc"
|
||
|
/bin/sh
|
-
|
||
|
/usr/sbin/uplugplay
|
/usr/sbin/uplugplay -Dcomsvc
|
||
|
/usr/sbin/uplugplay
|
-
|
||
|
/bin/sh
|
sh -c "nslookup p3.feefreepool.net 8.8.8.8"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/nslookup
|
nslookup p3.feefreepool.net 8.8.8.8
|
There are 58 hidden processes, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://p3.feefreepool.net/cgi-bin/prometei.cgihttp://dummy.zero/cgi-bin/prometei.cgihttps://gb7ni5rg
|
unknown
|
||
|
https://bugs.launchpad.net/ubuntu/
|
unknown
|
||
|
http://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.b32.i2p/cgi-bin/prometei.cgi
|
unknown
|
||
|
http://p3.feefreepool.net/cgi-bin/prometei.cgi
|
unknown
|
||
|
https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi
|
unknown
|
||
|
http://%s/cgi-bin/prometei.cgi
|
unknown
|
||
|
http://%s/cgi-bin/prometei.cgi?r=0&auth=hash&i=%s&enckey=%shttp://%s/cgi-bin/prometei.cgi%m%d%yxinch
|
unknown
|
||
|
https://http:///:.onion.i2p.zeroGET
|
unknown
|
||
|
http://dummy.zero/cgi-bin/prometei.cgi
|
unknown
|
||
|
http://%s/cgi-bin/prometei.cgi?r=0&auth=hash&i=%s&enckey=%s
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
p3.feefreepool.net
|
88.198.246.242
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
88.198.246.242
|
p3.feefreepool.net
|
Germany
|
||
|
109.202.202.202
|
unknown
|
Switzerland
|
||
|
91.189.91.43
|
unknown
|
United Kingdom
|
||
|
91.189.91.42
|
unknown
|
United Kingdom
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
7fa47c4d2000
|
page execute read
|
|
||
|
7fa47d26a000
|
page read and write
|
|
||
|
7fa50247e000
|
page read and write
|
|||
|
7fa4fc000000
|
page read and write
|
|||
|
7f39c1c2b000
|
page read and write
|
|||
|
7fa4f95fe000
|
page execute and read and write
|
|||
|
7fa4fb7ff000
|
page execute and read and write
|
|||
|
55b0cdeca000
|
page execute read
|
|||
|
55a532598000
|
page read and write
|
|||
|
7f39c22bc000
|
page read and write
|
|||
|
7f39c1415000
|
page read and write
|
|||
|
7fa50281f000
|
page read and write
|
|||
|
55b0d015a000
|
page execute and read and write
|
|||
|
7fa4f6df9000
|
page execute and read and write
|
|||
|
7fa502b90000
|
page read and write
|
|||
|
7f39c229f000
|
page read and write
|
|||
|
7ffd50eda000
|
page execute read
|
|||
|
7fa5021ce000
|
page read and write
|
|||
|
7f39c27ce000
|
page read and write
|
|||
|
7fa4f75fa000
|
page execute and read and write
|
|||
|
7fa5018b5000
|
page read and write
|
|||
|
7f39bc021000
|
page read and write
|
|||
|
55a533b38000
|
page read and write
|
|||
|
55a5302f1000
|
page execute read
|
|||
|
7fa4f7dfb000
|
page execute and read and write
|
|||
|
7fa50285f000
|
page read and write
|
|||
|
55a532581000
|
page execute and read and write
|
|||
|
7f39c2944000
|
page read and write
|
|||
|
7fa502ea2000
|
page read and write
|
|||
|
7fa4f85fc000
|
page execute and read and write
|
|||
|
7fa4f8dfd000
|
page execute and read and write
|
|||
|
55b0ce152000
|
page read and write
|
|||
|
7fa47c4e7000
|
page read and write
|
|||
|
7ffe75c6c000
|
page execute read
|
|||
|
7f39c28ff000
|
page read and write
|
|||
|
7fa502d71000
|
page read and write
|
|||
|
55a530583000
|
page read and write
|
|||
|
7fa4faffe000
|
page execute and read and write
|
|||
|
55a530579000
|
page read and write
|
|||
|
55b0ce15c000
|
page read and write
|
|||
|
7f393d26a000
|
page read and write
|
|||
|
7fa478062000
|
page read and write
|
|||
|
7f39c1c1d000
|
page read and write
|
|||
|
7f39c227c000
|
page read and write
|
|||
|
7f39bc000000
|
page read and write
|
|||
|
7fa5018f6000
|
page read and write
|
|||
|
7f39c28f7000
|
page read and write
|
|||
|
7fa4fa621000
|
page read and write
|
|||
|
55b0d218e000
|
page read and write
|
|||
|
7fa502842000
|
page read and write
|
|||
|
7fa474021000
|
page read and write
|
|||
|
7fa5019b8000
|
page read and write
|
|||
|
7fa502e9a000
|
page read and write
|
|||
|
7f39c25ed000
|
page read and write
|
|||
|
7ffe75c24000
|
page read and write
|
|||
|
7ffd50e02000
|
page read and write
|
|||
|
7fa4fc021000
|
page read and write
|
|||
|
55b0d0171000
|
page read and write
|
|||
|
7fa501833000
|
page read and write
|
|||
|
7fa502ee7000
|
page read and write
|
|||
|
7fa4f9dff000
|
page execute and read and write
|
|||
|
7fa5021c0000
|
page read and write
|
|||
|
7fa501874000
|
page read and write
|
|||
|
7fa4fa600000
|
page execute and read and write
|
|||
|
7f39c1edb000
|
page read and write
|
There are 55 hidden memdumps, click here to show them.