Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
na.elf
|
ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da,
stripped
|
initial sample
|
 |
|
|
/etc/CommId
|
ASCII text, with no line terminators
|
dropped
|
|
|
|
/usr/sbin/uplugplay
|
ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=bc565f9f2dafc5618defa8eccf705f85712c87da,
stripped
|
dropped
|
|
|
|
/memfd:snapd-env-generator (deleted)
|
ASCII text
|
dropped
|
||
|
/proc/6408/task/6409/comm
|
ASCII text, with no line terminators
|
dropped
|
||
|
/proc/6408/task/6410/comm
|
ASCII text, with no line terminators
|
dropped
|
||
|
/proc/6408/task/6411/comm
|
ASCII text, with no line terminators
|
dropped
|
||
|
/usr/lib/systemd/system/uplugplay.service
|
ASCII text
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
/tmp/na.elf
|
/tmp/na.elf
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "pgrep na.elf"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/pgrep
|
pgrep na.elf
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "pidof na.elf"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/pidof
|
pidof na.elf
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "pgrep uplugplay"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/pgrep
|
pgrep uplugplay
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "pidof uplugplay"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/pidof
|
pidof uplugplay
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "pgrep upnpsetup"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/pgrep
|
pgrep upnpsetup
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "pidof upnpsetup"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/pidof
|
pidof upnpsetup
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "systemctl daemon-reload"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/systemctl
|
systemctl daemon-reload
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "systemctl enable uplugplay.service"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/systemctl
|
systemctl enable uplugplay.service
|
||
|
/tmp/na.elf
|
-
|
||
|
/bin/sh
|
sh -c "systemctl start uplugplay.service"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/systemctl
|
systemctl start uplugplay.service
|
||
|
/usr/lib/systemd/systemd
|
-
|
||
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
||
|
/usr/lib/systemd/systemd
|
-
|
||
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
||
|
/usr/lib/systemd/systemd
|
-
|
||
|
/usr/sbin/uplugplay
|
/usr/sbin/uplugplay
|
||
|
/usr/sbin/uplugplay
|
-
|
||
|
/usr/sbin/uplugplay
|
-
|
||
|
/bin/sh
|
sh -c "/usr/sbin/uplugplay -Dcomsvc"
|
||
|
/bin/sh
|
-
|
||
|
/usr/sbin/uplugplay
|
/usr/sbin/uplugplay -Dcomsvc
|
||
|
/usr/sbin/uplugplay
|
-
|
||
|
/bin/sh
|
sh -c "nslookup p3.feefreepool.net 8.8.8.8"
|
||
|
/bin/sh
|
-
|
||
|
/usr/bin/nslookup
|
nslookup p3.feefreepool.net 8.8.8.8
|
There are 42 hidden processes, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://p3.feefreepool.net/cgi-bin/prometei.cgihttp://dummy.zero/cgi-bin/prometei.cgihttps://gb7ni5rg
|
unknown
|
||
|
https://bugs.launchpad.net/ubuntu/
|
unknown
|
||
|
http://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.b32.i2p/cgi-bin/prometei.cgi
|
unknown
|
||
|
http://p3.feefreepool.net/cgi-bin/prometei.cgi
|
unknown
|
||
|
https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi
|
unknown
|
||
|
http://%s/cgi-bin/prometei.cgi
|
unknown
|
||
|
http://%s/cgi-bin/prometei.cgi?r=0&auth=hash&i=%s&enckey=%shttp://%s/cgi-bin/prometei.cgi%m%d%yxinch
|
unknown
|
||
|
https://http:///:.onion.i2p.zeroGET
|
unknown
|
||
|
http://dummy.zero/cgi-bin/prometei.cgi
|
unknown
|
||
|
http://%s/cgi-bin/prometei.cgi?r=0&auth=hash&i=%s&enckey=%s
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
p3.feefreepool.net
|
88.198.246.242
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
88.198.246.242
|
p3.feefreepool.net
|
Germany
|
||
|
109.202.202.202
|
unknown
|
Switzerland
|
||
|
91.189.91.43
|
unknown
|
United Kingdom
|
||
|
91.189.91.42
|
unknown
|
United Kingdom
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
7fadb44d2000
|
page execute read
|
|
||
|
7fadb526a000
|
page read and write
|
|
||
|
7fae3c86a000
|
page read and write
|
|||
|
7fae34000000
|
page read and write
|
|||
|
7fadac062000
|
page read and write
|
|||
|
7f4874d67000
|
page read and write
|
|||
|
7ffed9449000
|
page read and write
|
|||
|
7f4874a10000
|
page read and write
|
|||
|
7f4874d22000
|
page read and write
|
|||
|
7fae3c1cb000
|
page read and write
|
|||
|
558986f7b000
|
page read and write
|
|||
|
7fae3c82a000
|
page read and write
|
|||
|
7fae32621000
|
page read and write
|
|||
|
558986ce9000
|
page execute read
|
|||
|
55fe69103000
|
page read and write
|
|||
|
7f486c000000
|
page read and write
|
|||
|
7ffe46bbc000
|
page read and write
|
|||
|
7fae305fc000
|
page execute and read and write
|
|||
|
7f4873838000
|
page read and write
|
|||
|
7fae3b901000
|
page read and write
|
|||
|
7fae337ff000
|
page execute and read and write
|
|||
|
7fae3cead000
|
page read and write
|
|||
|
558986f71000
|
page read and write
|
|||
|
7fae32600000
|
page execute and read and write
|
|||
|
7fae34021000
|
page read and write
|
|||
|
7f48746c2000
|
page read and write
|
|||
|
7fae3b87f000
|
page read and write
|
|||
|
7fae2f5fa000
|
page execute and read and write
|
|||
|
7f4874040000
|
page read and write
|
|||
|
7fadb44e7000
|
page read and write
|
|||
|
7fae2e5f8000
|
page execute and read and write
|
|||
|
7fae2ddf7000
|
page execute and read and write
|
|||
|
55fe6b10b000
|
page execute and read and write
|
|||
|
7f486c021000
|
page read and write
|
|||
|
558988f79000
|
page execute and read and write
|
|||
|
7fae3c1d9000
|
page read and write
|
|||
|
7fae3c489000
|
page read and write
|
|||
|
7f48742fe000
|
page read and write
|
|||
|
7fae3cd7c000
|
page read and write
|
|||
|
7fae3cea5000
|
page read and write
|
|||
|
7f4874d1a000
|
page read and write
|
|||
|
7fae3b83e000
|
page read and write
|
|||
|
7ffed95cb000
|
page execute read
|
|||
|
7fae30dfd000
|
page execute and read and write
|
|||
|
7fae3b7fd000
|
page read and write
|
|||
|
7f487469f000
|
page read and write
|
|||
|
7ffe46bf6000
|
page execute read
|
|||
|
7f487404e000
|
page read and write
|
|||
|
7fae3cb9b000
|
page read and write
|
|||
|
7fae3b9c3000
|
page read and write
|
|||
|
7fae3b8c0000
|
page read and write
|
|||
|
7fae3c84d000
|
page read and write
|
|||
|
55fe6b6a7000
|
page read and write
|
|||
|
7f48746df000
|
page read and write
|
|||
|
7fae3cef2000
|
page read and write
|
|||
|
55fe68e7b000
|
page execute read
|
|||
|
558988f90000
|
page read and write
|
|||
|
7fadb0032000
|
page read and write
|
|||
|
55898a388000
|
page read and write
|
|||
|
7fae31dff000
|
page execute and read and write
|
|||
|
7fae2fdfb000
|
page execute and read and write
|
|||
|
55fe6910d000
|
page read and write
|
|||
|
55fe6b122000
|
page read and write
|
|||
|
7fae315fe000
|
page execute and read and write
|
|||
|
7fae2edf9000
|
page execute and read and write
|
|||
|
7f4874bf1000
|
page read and write
|
|||
|
7f47ed26a000
|
page read and write
|
|||
|
7fae32ffe000
|
page execute and read and write
|
There are 58 hidden memdumps, click here to show them.