Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
na.elf
|
ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da,
stripped
|
initial sample
|
 |
|
|
/etc/CommId
|
ASCII text, with no line terminators
|
dropped
|
|
|
|
/usr/sbin/uplugplay
|
ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da,
stripped
|
dropped
|
|
|
|
/memfd:snapd-env-generator (deleted)
|
ASCII text
|
dropped
|
||
|
/proc/6426/task/6427/comm
|
ASCII text, with no line terminators
|
dropped
|
||
|
/proc/6426/task/6428/comm
|
ASCII text, with no line terminators
|
dropped
|
||
|
/proc/6426/task/6429/comm
|
ASCII text, with no line terminators
|
dropped
|
||
|
/usr/lib/systemd/system/uplugplay.service
|
ASCII text
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/rm
|
rm -f /tmp/tmp.EmGz9aIVic /tmp/tmp.m8CVrcjyzH /tmp/tmp.Y8BW5RFiJd
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/cat
|
cat /tmp/tmp.EmGz9aIVic
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/head
|
head -n 10
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/tr
|
tr -d \\000-\\011\\013\\014\\016-\\037
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/cut
|
cut -c -80
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/cat
|
cat /tmp/tmp.EmGz9aIVic
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/head
|
head -n 10
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/tr
|
tr -d \\000-\\011\\013\\014\\016-\\037
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/cut
|
cut -c -80
|
||
|
/usr/bin/dash
|
-
|
||
|
/usr/bin/rm
|
rm -f /tmp/tmp.EmGz9aIVic /tmp/tmp.m8CVrcjyzH /tmp/tmp.Y8BW5RFiJd
|
||
|
/tmp/na.elf
|
/tmp/na.elf
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "pgrep na.elf"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/pgrep
|
pgrep na.elf
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "pidof na.elf"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/pidof
|
pidof na.elf
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "pgrep uplugplay"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/pgrep
|
pgrep uplugplay
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "pidof uplugplay"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/pidof
|
pidof uplugplay
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "pgrep upnpsetup"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/pgrep
|
pgrep upnpsetup
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "pidof upnpsetup"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/pidof
|
pidof upnpsetup
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "systemctl daemon-reload"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/systemctl
|
systemctl daemon-reload
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "systemctl enable uplugplay.service"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/systemctl
|
systemctl enable uplugplay.service
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "systemctl start uplugplay.service"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/systemctl
|
systemctl start uplugplay.service
|
||
|
/usr/lib/systemd/systemd
|
-
|
||
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
||
|
/usr/lib/systemd/systemd
|
-
|
||
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
||
|
/usr/lib/systemd/systemd
|
-
|
||
|
/usr/sbin/uplugplay
|
/usr/sbin/uplugplay
|
||
|
/usr/sbin/uplugplay
|
-
|
||
|
/usr/sbin/uplugplay
|
-
|
||
|
/bin/sh
|
sh -c "/usr/sbin/uplugplay -Dcomsvc"
|
||
|
/bin/sh
|
-
|
||
|
/usr/sbin/uplugplay
|
/usr/sbin/uplugplay -Dcomsvc
|
||
|
/usr/sbin/uplugplay
|
-
|
||
|
/bin/sh
|
sh -c "nslookup p3.feefreepool.net 8.8.8.8"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/nslookup
|
nslookup p3.feefreepool.net 8.8.8.8
|
There are 62 hidden processes, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://p3.feefreepool.net/cgi-bin/prometei.cgihttp://dummy.zero/cgi-bin/prometei.cgihttps://gb7ni5rg
|
unknown
|
||
|
https://bugs.launchpad.net/ubuntu/
|
unknown
|
||
|
http://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.b32.i2p/cgi-bin/prometei.cgi
|
unknown
|
||
|
http://p3.feefreepool.net/cgi-bin/prometei.cgi
|
unknown
|
||
|
https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi
|
unknown
|
||
|
http://%s/cgi-bin/prometei.cgi
|
unknown
|
||
|
http://%s/cgi-bin/prometei.cgi?r=0&auth=hash&i=%s&enckey=%shttp://%s/cgi-bin/prometei.cgi%m%d%yxinch
|
unknown
|
||
|
https://http:///:.onion.i2p.zeroGET
|
unknown
|
||
|
http://dummy.zero/cgi-bin/prometei.cgi
|
unknown
|
||
|
http://%s/cgi-bin/prometei.cgi?r=0&auth=hash&i=%s&enckey=%s
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
p3.feefreepool.net
|
88.198.246.242
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
88.198.246.242
|
p3.feefreepool.net
|
Germany
|
||
|
109.202.202.202
|
unknown
|
Switzerland
|
||
|
91.189.91.43
|
unknown
|
United Kingdom
|
||
|
91.189.91.42
|
unknown
|
United Kingdom
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
7f0e5126a000
|
page read and write
|
|
||
|
7f0e504d2000
|
page execute read
|
|
||
|
559689ddd000
|
page execute read
|
|||
|
7f0e4802f000
|
page read and write
|
|||
|
55968c67a000
|
page read and write
|
|||
|
7f0ecbdfb000
|
page execute and read and write
|
|||
|
7f0ed4e44000
|
page read and write
|
|||
|
7f0ed61e2000
|
page read and write
|
|||
|
55968a06f000
|
page read and write
|
|||
|
7fafa0e61000
|
page read and write
|
|||
|
7f0ed0000000
|
page read and write
|
|||
|
7ffccefee000
|
page read and write
|
|||
|
7f0ed5e94000
|
page read and write
|
|||
|
7f0ed64ec000
|
page read and write
|
|||
|
7f0ecd5fe000
|
page execute and read and write
|
|||
|
561dc7eca000
|
page read and write
|
|||
|
7fafa0b4f000
|
page read and write
|
|||
|
7fafa043d000
|
page read and write
|
|||
|
7f0ece600000
|
page execute and read and write
|
|||
|
7f0ed5820000
|
page read and write
|
|||
|
7f0e504e7000
|
page read and write
|
|||
|
7faf98000000
|
page read and write
|
|||
|
7f0eceffe000
|
page execute and read and write
|
|||
|
7f0ed4e85000
|
page read and write
|
|||
|
7f0ed4f48000
|
page read and write
|
|||
|
561dc3f96000
|
page read and write
|
|||
|
7fffdea03000
|
page read and write
|
|||
|
7f0ed6539000
|
page read and write
|
|||
|
7faf1926a000
|
page read and write
|
|||
|
7f0ed0021000
|
page read and write
|
|||
|
7f0e4c061000
|
page read and write
|
|||
|
7ffcceff6000
|
page execute read
|
|||
|
7f0ed5812000
|
page read and write
|
|||
|
561dc5f9e000
|
page execute and read and write
|
|||
|
7f0ecb5fa000
|
page execute and read and write
|
|||
|
55968c06d000
|
page execute and read and write
|
|||
|
7f0ecf7ff000
|
page execute and read and write
|
|||
|
561dc3d0e000
|
page execute read
|
|||
|
7fafa0ea6000
|
page read and write
|
|||
|
7f0ed5eb1000
|
page read and write
|
|||
|
7f0eccdfd000
|
page execute and read and write
|
|||
|
7fafa07de000
|
page read and write
|
|||
|
7f0ed4f07000
|
page read and write
|
|||
|
7f0ecddff000
|
page execute and read and write
|
|||
|
7fafa081e000
|
page read and write
|
|||
|
7fafa0d30000
|
page read and write
|
|||
|
55968c084000
|
page read and write
|
|||
|
7f0eca5f8000
|
page execute and read and write
|
|||
|
7faf98021000
|
page read and write
|
|||
|
7f0ed5ad0000
|
page read and write
|
|||
|
7fafa017f000
|
page read and write
|
|||
|
7faf9f977000
|
page read and write
|
|||
|
7f0ed4ec6000
|
page read and write
|
|||
|
7f0ecc5fc000
|
page execute and read and write
|
|||
|
7f0ed63c3000
|
page read and write
|
|||
|
7f0ec9df7000
|
page execute and read and write
|
|||
|
7fafa0801000
|
page read and write
|
|||
|
7f0ecadf9000
|
page execute and read and write
|
|||
|
561dc5fb5000
|
page read and write
|
|||
|
7fffdea75000
|
page execute read
|
|||
|
7fafa018d000
|
page read and write
|
|||
|
7f0ed500a000
|
page read and write
|
|||
|
7f0ed5e71000
|
page read and write
|
|||
|
55968a065000
|
page read and write
|
|||
|
7f0ece621000
|
page read and write
|
|||
|
7f0ed64f4000
|
page read and write
|
|||
|
7fafa0e59000
|
page read and write
|
|||
|
561dc3fa0000
|
page read and write
|
There are 58 hidden memdumps, click here to show them.