Source: unknown |
TCP traffic detected without corresponding DNS query: 54.171.230.55 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 54.171.230.55 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 54.171.230.55 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 54.171.230.55 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 54.171.230.55 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 54.171.230.55 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 54.171.230.55 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 54.171.230.55 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 54.171.230.55 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 54.171.230.55 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.189.91.42 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.189.91.43 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 109.202.202.202 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 152.36.128.18 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 152.36.128.18 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 152.36.128.18 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 152.36.128.18 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 152.36.128.18 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 152.36.128.18 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 152.36.128.18 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 152.36.128.18 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 152.36.128.18 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 152.36.128.18 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 152.36.128.18 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 152.36.128.18 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.189.91.42 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.189.91.43 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 109.202.202.202 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.189.91.42 |
Source: na.elf, uplugplay.32.dr |
String found in binary or memory: http://152.36.128 |
Source: na.elf, 6242.1.000000000052d000.0000000001575000.rw-.sdmp |
String found in binary or memory: http://152.36.128.18/cgi-bin/p.cgi |
Source: na.elf, 6242.1.000000000052d000.0000000001575000.rw-.sdmp |
String found in binary or memory: http://152.36.128.18/cgi-bin/p.cgihttp://dummy.zero/cgi-bin/prometei.cgihttps://gb7ni5rgeexdcncj.oni |
Source: na.elf, 6242.1.000000000052d000.0000000001575000.rw-.sdmp |
String found in binary or memory: http://dummy.zero/cgi-bin/prometei.cgi |
Source: na.elf, 6242.1.000000000052d000.0000000001575000.rw-.sdmp |
String found in binary or memory: http://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.b32.i2p/cgi-bin/prometei.cgi |
Source: na.elf, uplugplay.32.dr |
String found in binary or memory: http://upx.sf.net |
Source: na.elf, 6242.1.000000000052d000.0000000001575000.rw-.sdmp |
String found in binary or memory: https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi |
Source: na.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Dofloo_ac3333d1 severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 04664dc5ea14ddff5301e66c46d6795f1582c148b5cb621248424d015245c95e, license = Elastic License v2, threat_name = Linux.Trojan.Dofloo, fingerprint = a8f360e2a545e65b5f9f2273715c1a5008a0fe4f88f6e14becd6e69158aab409, id = ac3333d1-df88-459b-a411-00b4fc947f3f, last_modified = 2022-01-26 |
Source: 6242.1.0000000000401000.00000000004f9000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Hacktool_Flooder_1a4eb229 reference_sample = bf6f3ffaf94444a09b69cbd4c8c0224d7eb98eb41514bdc3f58c1fb90ac0e705, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Hacktool.Flooder, fingerprint = de076ef23c2669512efc00ddfe926ef04f8ad939061c69131a0ef9a743639371, id = 1a4eb229-a194-46a5-8e93-370a40ba999b, last_modified = 2021-09-16 |
Source: 6242.1.0000000000401000.00000000004f9000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Hacktool_Flooder_f454ec10 severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 0297e1ad6e180af85256a175183102776212d324a2ce0c4f32e8a44a2e2e9dad, license = Elastic License v2, threat_name = Linux.Hacktool.Flooder, fingerprint = 2ae5e2c3190a4ce5d238efdb10ac0520987425fb7af52246b6bf948abd0259da, id = f454ec10-7a67-4717-9e95-fecb7c357566, last_modified = 2022-01-26 |
Source: 6242.1.000000000052d000.0000000001575000.rw-.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Dofloo_ac3333d1 severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 04664dc5ea14ddff5301e66c46d6795f1582c148b5cb621248424d015245c95e, license = Elastic License v2, threat_name = Linux.Trojan.Dofloo, fingerprint = a8f360e2a545e65b5f9f2273715c1a5008a0fe4f88f6e14becd6e69158aab409, id = ac3333d1-df88-459b-a411-00b4fc947f3f, last_modified = 2022-01-26 |
Source: /usr/sbin/uplugplay, type: DROPPED |
Matched rule: Linux_Trojan_Dofloo_ac3333d1 severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 04664dc5ea14ddff5301e66c46d6795f1582c148b5cb621248424d015245c95e, license = Elastic License v2, threat_name = Linux.Trojan.Dofloo, fingerprint = a8f360e2a545e65b5f9f2273715c1a5008a0fe4f88f6e14becd6e69158aab409, id = ac3333d1-df88-459b-a411-00b4fc947f3f, last_modified = 2022-01-26 |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/1582/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/1582/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/3088/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/3088/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/230/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/230/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/110/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/110/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/231/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/231/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/111/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/111/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/232/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/232/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/1579/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/1579/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/112/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/112/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/233/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/233/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/1699/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/1699/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/113/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/113/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/234/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/234/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/1335/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/1335/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/1698/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/1698/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/114/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/114/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/235/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/235/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/1334/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/1334/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/1576/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/1576/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/2302/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/2302/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/115/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/115/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/236/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/236/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/116/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/116/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/237/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/237/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/117/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/117/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/118/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/118/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/910/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/910/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/119/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/119/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/912/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/912/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/10/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/10/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/2307/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/2307/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/11/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/11/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/918/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/918/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/12/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/12/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/13/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/13/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/14/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/14/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/6242/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/6242/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/15/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/15/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/6245/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/6245/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/16/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/16/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/17/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/17/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/18/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/18/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/1594/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/1594/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/120/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/120/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/121/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/121/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/1349/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/1349/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/1/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/1/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/122/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/122/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/243/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/243/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/123/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/123/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/2/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/2/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/124/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/124/cmdline |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/3/status |
Jump to behavior |
Source: /usr/bin/pgrep (PID: 6254) |
File opened: /proc/3/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 6245) |
Shell command executed: sh -c "pgrep na.elf" |
Jump to behavior |
Source: /tmp/na.elf (PID: 6249) |
Shell command executed: sh -c "pidof na.elf" |
Jump to behavior |
Source: /tmp/na.elf (PID: 6253) |
Shell command executed: sh -c "pgrep uplugplay" |
Jump to behavior |
Source: /tmp/na.elf (PID: 6259) |
Shell command executed: sh -c "pidof uplugplay" |
Jump to behavior |
Source: /tmp/na.elf (PID: 6263) |
Shell command executed: sh -c "pgrep upnpsetup" |
Jump to behavior |
Source: /tmp/na.elf (PID: 6265) |
Shell command executed: sh -c "systemctl daemon-reload" |
Jump to behavior |
Source: /tmp/na.elf (PID: 6281) |
Shell command executed: sh -c "systemctl enable uplugplay.service" |
Jump to behavior |
Source: /tmp/na.elf (PID: 6288) |
Shell command executed: sh -c "systemctl start uplugplay.service" |
Jump to behavior |
Source: /usr/sbin/uplugplay (PID: 6292) |
Shell command executed: sh -c "/usr/sbin/uplugplay -Dcomsvc" |
Jump to behavior |
Source: /usr/sbin/uplugplay (PID: 6297) |
Shell command executed: sh -c hostnamectl |
Jump to behavior |
Source: /usr/sbin/uplugplay (PID: 6302) |
Shell command executed: sh -c hostnamectl |
Jump to behavior |
Source: /usr/sbin/uplugplay (PID: 6439) |
Shell command executed: sh -c "dmidecode --type baseboard" |
Jump to behavior |
Source: /usr/sbin/uplugplay (PID: 6442) |
Shell command executed: sh -c uptime |
Jump to behavior |
Source: /usr/sbin/uplugplay (PID: 6447) |
Shell command executed: sh -c dmidecode |
Jump to behavior |
Source: /usr/sbin/uplugplay (PID: 6451) |
Shell command executed: sh -c "uname -a" |
Jump to behavior |
Source: /usr/sbin/uplugplay (PID: 6455) |
Shell command executed: sh -c uptime |
Jump to behavior |
Source: /usr/sbin/uplugplay (PID: 6460) |
Shell command executed: sh -c "uname -a" |
Jump to behavior |