Edit tour

Linux Analysis Report
r0tEgU8WOn.elf

Overview

General Information

Sample name:	r0tEgU8WOn.elf renamed because original name is a hash value
Original sample name:	9ca55c5faa77de7b3d529e14968c02cb.elf
Analysis ID:	1448255
MD5:	9ca55c5faa77de7b3d529e14968c02cb
SHA1:	2fc516e2fe883b81dca94102f9f9873cc0b2c85a
SHA256:	2ddee56033ff0a6f2aa485e73c7425596c22e13b1894f19ffdf66cf5868c6e6d
Tags:	32elfmiraimotorola
Infos:

Detection

Mirai

Score:	84
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Queries the IP of a very long domain name

Sample deletes itself

Sends malformed DNS queries

Detected TCP or UDP traffic on non-standard ports

Sample has stripped symbol table

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1448255
Start date and time:	2024-05-28 06:38:43 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	r0tEgU8WOn.elf renamed because original name is a hash value
Original Sample Name:	9ca55c5faa77de7b3d529e14968c02cb.elf
Detection:	MAL
Classification:	mal84.troj.evad.linELF@0/1@86/0

Runtime Messages

Command:	/tmp/r0tEgU8WOn.elf
PID:	5446
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

r0tEgU8WOn.elf (PID: 5446, Parent: 5362, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/r0tEgU8WOn.elf

r0tEgU8WOn.elf New Fork (PID: 5448, Parent: 5446)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
r0tEgU8WOn.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
r0tEgU8WOn.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x107ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1080a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1081e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10832:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10846:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1085a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1086e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10882:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10896:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1090e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10922:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10936:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1094a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5446.1.00007efb94001000.00007efb94014000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5446.1.00007efb94001000.00007efb94014000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x107ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1080a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1081e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10832:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10846:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1085a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1086e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10882:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10896:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1090e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10922:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10936:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1094a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: r0tEgU8WOn.elf PID: 5446	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: r0tEgU8WOn.elf PID: 5446	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1835:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1849:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1871:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1885:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1899:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1911:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1925:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1939:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1961:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1975:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1989:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x199d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: r0tEgU8WOn.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: r0tEgU8WOn.elf	ReversingLabs: Detection: 39%
Source: r0tEgU8WOn.elf	Virustotal: Detection: 39%			Perma Link

Networking

Queries the IP of a very long domain name

Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]
Source: unknown	DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]

Source: global traffic

TCP traffic: 192.168.2.13:47378 -> 45.131.111.98:33966

Source: global traffic

TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26

Source: global traffic	DNS traffic detected: DNS query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru
Source: global traffic	DNS traffic detected: DNS query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]

Source: unknown

Network traffic detected: HTTP traffic on port 48202 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: r0tEgU8WOn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5446.1.00007efb94001000.00007efb94014000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: r0tEgU8WOn.elf PID: 5446, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: ELF static info symbol of initial sample

.symtab present: no

Source: r0tEgU8WOn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5446.1.00007efb94001000.00007efb94014000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: r0tEgU8WOn.elf PID: 5446, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal84.troj.evad.linELF@0/1@86/0

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/r0tEgU8WOn.elf (PID: 5448)

File: /tmp/r0tEgU8WOn.elf

Jump to behavior

Source: /tmp/r0tEgU8WOn.elf (PID: 5446)

Queries kernel information via 'uname':

Jump to behavior

Source: r0tEgU8WOn.elf, 5446.1.00007ffeeebc7000.00007ffeeebe8000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/r0tEgU8WOn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/r0tEgU8WOn.elf
Source: r0tEgU8WOn.elf, 5446.1.00007ffeeebc7000.00007ffeeebe8000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.TEb6aZ\DX
Source: r0tEgU8WOn.elf, 5446.1.00007ffeeebc7000.00007ffeeebe8000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.TEb6aZ
Source: r0tEgU8WOn.elf, 5446.1.00007ffeeebc7000.00007ffeeebe8000.rw-.sdmp	Binary or memory string: /qemu-open.XXXXX
Source: r0tEgU8WOn.elf, 5446.1.000055a88b1de000.000055a88b263000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: r0tEgU8WOn.elf, 5446.1.00007ffeeebc7000.00007ffeeebe8000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: r0tEgU8WOn.elf, 5446.1.000055a88b1de000.000055a88b263000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: r0tEgU8WOn.elf, type: SAMPLE
Source: Yara match	File source: 5446.1.00007efb94001000.00007efb94014000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: r0tEgU8WOn.elf PID: 5446, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: r0tEgU8WOn.elf, type: SAMPLE
Source: Yara match	File source: 5446.1.00007efb94001000.00007efb94014000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: r0tEgU8WOn.elf PID: 5446, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
r0tEgU8WOn.elf	39%	ReversingLabs	Linux.Trojan.Mirai
r0tEgU8WOn.elf	39%	Virustotal		Browse
r0tEgU8WOn.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru	3%	Virustotal		Browse

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru	45.131.111.98	true	true	3%, Virustotal, Browse	unknown
raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	unknown	unknown	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.131.111.98	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru	Germany		398373	SERVERDESTROYERSUS	true
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
45.131.111.98	LFflqIuOUO.elf	Get hash	malicious	Mirai	Browse
	4xRqOA9UfX.elf	Get hash	malicious	Mirai	Browse
	68GaMPsodL.elf	Get hash	malicious	Mirai	Browse
	5piXlVbnrN.elf	Get hash	malicious	Mirai, Okiru	Browse
	dpStFmgRXi.elf	Get hash	malicious	Mirai, Okiru	Browse
	ZEWVfUNX3v.elf	Get hash	malicious	Mirai	Browse
	UR9IPwN06O.elf	Get hash	malicious	Mirai	Browse
	hAivTqWC2P.elf	Get hash	malicious	Mirai, Okiru	Browse
	hb6HIMj9J2.elf	Get hash	malicious	Mirai, Okiru	Browse
	tLK3zeaMw7.elf	Get hash	malicious	Mirai, Okiru	Browse
185.125.190.26	hb6HIMj9J2.elf	Get hash	malicious	Mirai, Okiru	Browse
	SlVpIUg14p.elf	Get hash	malicious	Okiru	Browse
	l1U28fBk2K.elf	Get hash	malicious	Unknown	Browse
	XEAKpgXJyR.elf	Get hash	malicious	Unknown	Browse
	cmd.arm.elf	Get hash	malicious	Mirai, Moobot	Browse
	4CB2w5yQL3.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	4FeEYSCLXC.elf	Get hash	malicious	Gafgyt	Browse
	lo5hCnF5kA.elf	Get hash	malicious	Mirai, Okiru	Browse
	tfHFYWMUBn.elf	Get hash	malicious	Mirai, Okiru	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru	hAivTqWC2P.elf	Get hash	malicious	Mirai, Okiru	Browse	45.131.111.98

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	68GaMPsodL.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	UR9IPwN06O.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	hb6HIMj9J2.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	tLK3zeaMw7.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	jFKZRvQh4R.elf	Get hash	malicious	Okiru	Browse	91.189.91.42
	SlVpIUg14p.elf	Get hash	malicious	Okiru	Browse	185.125.190.26
	tXgvvzMEUY.elf	Get hash	malicious	Okiru	Browse	91.189.91.42
	iKNw6OUwtY.elf	Get hash	malicious	Okiru	Browse	91.189.91.42
	l1U28fBk2K.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	u4B2cmH10B.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
SERVERDESTROYERSUS	LFflqIuOUO.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	4xRqOA9UfX.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	68GaMPsodL.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	5piXlVbnrN.elf	Get hash	malicious	Mirai, Okiru	Browse	45.131.111.98
	dpStFmgRXi.elf	Get hash	malicious	Mirai, Okiru	Browse	45.131.111.98
	ZEWVfUNX3v.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	UR9IPwN06O.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	hAivTqWC2P.elf	Get hash	malicious	Mirai, Okiru	Browse	45.131.111.98
	hb6HIMj9J2.elf	Get hash	malicious	Mirai, Okiru	Browse	45.131.111.98
	tLK3zeaMw7.elf	Get hash	malicious	Mirai, Okiru	Browse	45.131.111.98

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.TEb6aZ (deleted)

Download File

Process:	/tmp/r0tEgU8WOn.elf
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	4.348394345536403
Encrypted:	false
SSDEEP:	3:TgFa3AJ5L8HJN:TgraJN
MD5:	093F714FE69077CF3F59FAB1CDB605D3
SHA1:	D9907DD6B793BC67152BC235896FEF87D29A488A
SHA-256:	C928B43D4134F010FE95A0CB4BAEABD9C46D2DF935054BF56C6CF4F8C6B34DBA
SHA-512:	5A16806DA8DF77925E6BC2C42FD88492ED1E7B16497F77E86C6E985001CE4C0D8DCE5EC8885B87E7F64E9EF7335286C3B912063CE2B344F9E001DD7E937E556E
Malicious:	false
Reputation:	low
Preview:	/tmp/r0tEgU8WOn.elf.nwlrbbmqbh

Static File Info

General

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.349509841190828
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	r0tEgU8WOn.elf
File size:	78'264 bytes
MD5:	9ca55c5faa77de7b3d529e14968c02cb
SHA1:	2fc516e2fe883b81dca94102f9f9873cc0b2c85a
SHA256:	2ddee56033ff0a6f2aa485e73c7425596c22e13b1894f19ffdf66cf5868c6e6d
SHA512:	503d612b4c5a711a0841653cbc1f9dd8682a75d11aaedea0c58e3ae8fe778ef2b3f0e9fb1ac23f79d7874095b1d7924dabf2830b116eb4c5853a46d9e3e04c19
SSDEEP:	1536:ThkQnXOAY0f1jfv4x2W8D9XktNrvmoivznxRcx1tshO:TbOAY0lnS2xUrvRQs14O
TLSH:	20734DA5F801CD7CF84BD97A6427490AB931A3D102820F3B57ABFEA37D731653912D85
File Content Preview:	.ELF.......................D...4..0(.....4. ...(......................,8..,8...... .......,<..L<..L<......&....... .dt.Q............................NV..a....da.....N^NuNV..J9..O.f>"y..LT QJ.g.X.#...LTN."y..LT QJ.f.A.....J.g.Hy..,8N.X.......O.N^NuNV..N^NuN

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	77864
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0x10626	0x0	0x6	AX	4
.fini	PROGBITS	0x800106ce	0x106ce	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x800106dc	0x106dc	0x255c	0x0	0x2	A	2
.ctors	PROGBITS	0x80014c3c	0x12c3c	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x80014c44	0x12c44	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x80014c50	0x12c50	0x398	0x0	0x3	WA	4
.bss	NOBITS	0x80014fe8	0x12fe8	0x225c	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x12fe8	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x12c38	0x12c38	6.3815	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0x12c3c	0x80014c3c	0x80014c3c	0x3ac	0x2608	3.3555	0x6	RW	0x2000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 28, 2024 06:39:41.236346006 CEST	47378	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:41.241225958 CEST	33966	47378	45.131.111.98	192.168.2.13
May 28, 2024 06:39:41.241276026 CEST	47378	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:41.241497993 CEST	47378	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:41.246325016 CEST	33966	47378	45.131.111.98	192.168.2.13
May 28, 2024 06:39:41.246371984 CEST	47378	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:41.251205921 CEST	33966	47378	45.131.111.98	192.168.2.13
May 28, 2024 06:39:41.864485025 CEST	33966	47378	45.131.111.98	192.168.2.13
May 28, 2024 06:39:41.864629030 CEST	47378	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:41.864820004 CEST	47378	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:41.928945065 CEST	47380	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:41.933795929 CEST	33966	47380	45.131.111.98	192.168.2.13
May 28, 2024 06:39:41.933862925 CEST	47380	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:41.933957100 CEST	47380	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:41.938751936 CEST	33966	47380	45.131.111.98	192.168.2.13
May 28, 2024 06:39:41.938821077 CEST	47380	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:41.943644047 CEST	33966	47380	45.131.111.98	192.168.2.13
May 28, 2024 06:39:42.549458981 CEST	33966	47380	45.131.111.98	192.168.2.13
May 28, 2024 06:39:42.550308943 CEST	47380	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:42.550308943 CEST	47380	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:42.613501072 CEST	47382	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:42.618349075 CEST	33966	47382	45.131.111.98	192.168.2.13
May 28, 2024 06:39:42.618504047 CEST	47382	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:42.618504047 CEST	47382	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:42.623394012 CEST	33966	47382	45.131.111.98	192.168.2.13
May 28, 2024 06:39:42.623464108 CEST	47382	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:42.628309965 CEST	33966	47382	45.131.111.98	192.168.2.13
May 28, 2024 06:39:43.252860069 CEST	33966	47382	45.131.111.98	192.168.2.13
May 28, 2024 06:39:43.253046989 CEST	47382	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:43.253046989 CEST	47382	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:43.318424940 CEST	47384	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:43.323221922 CEST	33966	47384	45.131.111.98	192.168.2.13
May 28, 2024 06:39:43.323277950 CEST	47384	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:43.323307037 CEST	47384	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:43.328319073 CEST	33966	47384	45.131.111.98	192.168.2.13
May 28, 2024 06:39:43.328373909 CEST	47384	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:43.333240032 CEST	33966	47384	45.131.111.98	192.168.2.13
May 28, 2024 06:39:44.252358913 CEST	33966	47384	45.131.111.98	192.168.2.13
May 28, 2024 06:39:44.252614021 CEST	47384	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:44.252681971 CEST	47384	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:44.318866968 CEST	47386	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:44.323734999 CEST	33966	47386	45.131.111.98	192.168.2.13
May 28, 2024 06:39:44.323817015 CEST	47386	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:44.323851109 CEST	47386	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:44.328744888 CEST	33966	47386	45.131.111.98	192.168.2.13
May 28, 2024 06:39:44.328794003 CEST	47386	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:44.333573103 CEST	33966	47386	45.131.111.98	192.168.2.13
May 28, 2024 06:39:44.947969913 CEST	33966	47386	45.131.111.98	192.168.2.13
May 28, 2024 06:39:44.948235035 CEST	47386	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:44.948316097 CEST	47386	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:45.014496088 CEST	47388	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:45.019468069 CEST	33966	47388	45.131.111.98	192.168.2.13
May 28, 2024 06:39:45.019542933 CEST	47388	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:45.019571066 CEST	47388	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:45.024586916 CEST	33966	47388	45.131.111.98	192.168.2.13
May 28, 2024 06:39:45.024642944 CEST	47388	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:45.029622078 CEST	33966	47388	45.131.111.98	192.168.2.13
May 28, 2024 06:39:45.654103994 CEST	33966	47388	45.131.111.98	192.168.2.13
May 28, 2024 06:39:45.654359102 CEST	47388	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:45.654424906 CEST	47388	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:45.719621897 CEST	47390	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:45.724572897 CEST	33966	47390	45.131.111.98	192.168.2.13
May 28, 2024 06:39:45.724649906 CEST	47390	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:45.724675894 CEST	47390	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:45.729655027 CEST	33966	47390	45.131.111.98	192.168.2.13
May 28, 2024 06:39:45.729722023 CEST	47390	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:45.734639883 CEST	33966	47390	45.131.111.98	192.168.2.13
May 28, 2024 06:39:46.338900089 CEST	33966	47390	45.131.111.98	192.168.2.13
May 28, 2024 06:39:46.339222908 CEST	47390	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:46.339262009 CEST	47390	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:46.410773039 CEST	47392	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:46.415714025 CEST	33966	47392	45.131.111.98	192.168.2.13
May 28, 2024 06:39:46.415811062 CEST	47392	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:46.415832043 CEST	47392	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:46.420756102 CEST	33966	47392	45.131.111.98	192.168.2.13
May 28, 2024 06:39:46.420830965 CEST	47392	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:46.425693989 CEST	33966	47392	45.131.111.98	192.168.2.13
May 28, 2024 06:39:47.063931942 CEST	33966	47392	45.131.111.98	192.168.2.13
May 28, 2024 06:39:47.064302921 CEST	47392	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:47.064395905 CEST	47392	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:47.128985882 CEST	47394	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:47.133991957 CEST	33966	47394	45.131.111.98	192.168.2.13
May 28, 2024 06:39:47.134066105 CEST	47394	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:47.134090900 CEST	47394	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:47.138994932 CEST	33966	47394	45.131.111.98	192.168.2.13
May 28, 2024 06:39:47.139060020 CEST	47394	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:47.143960953 CEST	33966	47394	45.131.111.98	192.168.2.13
May 28, 2024 06:39:47.758594036 CEST	33966	47394	45.131.111.98	192.168.2.13
May 28, 2024 06:39:47.758835077 CEST	47394	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:47.759005070 CEST	47394	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:47.824561119 CEST	47396	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:47.829480886 CEST	33966	47396	45.131.111.98	192.168.2.13
May 28, 2024 06:39:47.829611063 CEST	47396	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:47.829644918 CEST	47396	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:47.834541082 CEST	33966	47396	45.131.111.98	192.168.2.13
May 28, 2024 06:39:47.834636927 CEST	47396	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:47.839656115 CEST	33966	47396	45.131.111.98	192.168.2.13
May 28, 2024 06:39:48.461894035 CEST	33966	47396	45.131.111.98	192.168.2.13
May 28, 2024 06:39:48.462374926 CEST	47396	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:48.462433100 CEST	47396	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:48.525908947 CEST	47398	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:48.530793905 CEST	33966	47398	45.131.111.98	192.168.2.13
May 28, 2024 06:39:48.530870914 CEST	47398	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:48.530891895 CEST	47398	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:48.537117958 CEST	33966	47398	45.131.111.98	192.168.2.13
May 28, 2024 06:39:48.537172079 CEST	47398	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:39:48.543329000 CEST	33966	47398	45.131.111.98	192.168.2.13
May 28, 2024 06:39:53.196732044 CEST	48202	443	192.168.2.13	185.125.190.26
May 28, 2024 06:40:03.739118099 CEST	33966	47398	45.131.111.98	192.168.2.13
May 28, 2024 06:40:03.739857912 CEST	47398	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:03.744810104 CEST	33966	47398	45.131.111.98	192.168.2.13
May 28, 2024 06:40:04.805704117 CEST	47400	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:04.810683012 CEST	33966	47400	45.131.111.98	192.168.2.13
May 28, 2024 06:40:04.810795069 CEST	47400	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:04.810879946 CEST	47400	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:04.815663099 CEST	33966	47400	45.131.111.98	192.168.2.13
May 28, 2024 06:40:04.815718889 CEST	47400	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:04.820568085 CEST	33966	47400	45.131.111.98	192.168.2.13
May 28, 2024 06:40:05.443670034 CEST	33966	47400	45.131.111.98	192.168.2.13
May 28, 2024 06:40:05.443905115 CEST	47400	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:05.444026947 CEST	47400	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:05.510966063 CEST	47402	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:05.515914917 CEST	33966	47402	45.131.111.98	192.168.2.13
May 28, 2024 06:40:05.516066074 CEST	47402	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:05.516118050 CEST	47402	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:05.520944118 CEST	33966	47402	45.131.111.98	192.168.2.13
May 28, 2024 06:40:05.521121025 CEST	47402	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:05.526006937 CEST	33966	47402	45.131.111.98	192.168.2.13
May 28, 2024 06:40:06.139041901 CEST	33966	47402	45.131.111.98	192.168.2.13
May 28, 2024 06:40:06.139529943 CEST	47402	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:06.139530897 CEST	47402	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:06.206090927 CEST	47404	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:06.211095095 CEST	33966	47404	45.131.111.98	192.168.2.13
May 28, 2024 06:40:06.211231947 CEST	47404	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:06.211285114 CEST	47404	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:06.216145039 CEST	33966	47404	45.131.111.98	192.168.2.13
May 28, 2024 06:40:06.216232061 CEST	47404	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:06.221122026 CEST	33966	47404	45.131.111.98	192.168.2.13
May 28, 2024 06:40:06.843674898 CEST	33966	47404	45.131.111.98	192.168.2.13
May 28, 2024 06:40:06.843872070 CEST	47404	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:06.843967915 CEST	47404	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:06.908803940 CEST	47406	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:06.913707972 CEST	33966	47406	45.131.111.98	192.168.2.13
May 28, 2024 06:40:06.913778067 CEST	47406	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:07.916531086 CEST	47406	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:07.921608925 CEST	33966	47406	45.131.111.98	192.168.2.13
May 28, 2024 06:40:07.921756983 CEST	47406	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:07.921854019 CEST	47406	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:07.926927090 CEST	33966	47406	45.131.111.98	192.168.2.13
May 28, 2024 06:40:07.927006960 CEST	47406	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:07.932033062 CEST	33966	47406	45.131.111.98	192.168.2.13
May 28, 2024 06:40:08.546241045 CEST	33966	47406	45.131.111.98	192.168.2.13
May 28, 2024 06:40:08.546557903 CEST	47406	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:08.546601057 CEST	47406	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:08.610831022 CEST	47408	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:08.615695953 CEST	33966	47408	45.131.111.98	192.168.2.13
May 28, 2024 06:40:08.615771055 CEST	47408	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:08.615811110 CEST	47408	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:08.621093035 CEST	33966	47408	45.131.111.98	192.168.2.13
May 28, 2024 06:40:08.621149063 CEST	47408	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:08.625952005 CEST	33966	47408	45.131.111.98	192.168.2.13
May 28, 2024 06:40:09.233529091 CEST	33966	47408	45.131.111.98	192.168.2.13
May 28, 2024 06:40:09.233788013 CEST	47408	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:09.234045029 CEST	47408	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:09.299956083 CEST	47410	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:09.304739952 CEST	33966	47410	45.131.111.98	192.168.2.13
May 28, 2024 06:40:09.304815054 CEST	47410	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:09.304907084 CEST	47410	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:09.309787035 CEST	33966	47410	45.131.111.98	192.168.2.13
May 28, 2024 06:40:09.309840918 CEST	47410	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:09.314630032 CEST	33966	47410	45.131.111.98	192.168.2.13
May 28, 2024 06:40:09.919564009 CEST	33966	47410	45.131.111.98	192.168.2.13
May 28, 2024 06:40:09.919728994 CEST	47410	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:09.919836044 CEST	47410	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:09.990386963 CEST	47412	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:09.995229006 CEST	33966	47412	45.131.111.98	192.168.2.13
May 28, 2024 06:40:09.995300055 CEST	47412	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:09.995320082 CEST	47412	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:10.000152111 CEST	33966	47412	45.131.111.98	192.168.2.13
May 28, 2024 06:40:10.000200033 CEST	47412	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:40:10.005417109 CEST	33966	47412	45.131.111.98	192.168.2.13
May 28, 2024 06:40:24.172594070 CEST	48202	443	192.168.2.13	185.125.190.26
May 28, 2024 06:41:10.045036077 CEST	47412	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:41:10.050086021 CEST	33966	47412	45.131.111.98	192.168.2.13
May 28, 2024 06:41:20.055207014 CEST	47412	33966	192.168.2.13	45.131.111.98
May 28, 2024 06:41:20.060467958 CEST	33966	47412	45.131.111.98	192.168.2.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 28, 2024 06:39:41.193212032 CEST	34973	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:41.202967882 CEST	53	34973	8.8.8.8	192.168.2.13
May 28, 2024 06:39:41.203531027 CEST	54059	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:41.210015059 CEST	53	54059	8.8.8.8	192.168.2.13
May 28, 2024 06:39:41.210216999 CEST	40521	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:41.216521978 CEST	53	40521	8.8.8.8	192.168.2.13
May 28, 2024 06:39:41.216639042 CEST	55130	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:41.222837925 CEST	53	55130	8.8.8.8	192.168.2.13
May 28, 2024 06:39:41.222938061 CEST	45725	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:41.229548931 CEST	53	45725	8.8.8.8	192.168.2.13
May 28, 2024 06:39:41.229751110 CEST	49450	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:41.236042023 CEST	53	49450	8.8.8.8	192.168.2.13
May 28, 2024 06:39:41.864913940 CEST	33076	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:41.871484995 CEST	53	33076	8.8.8.8	192.168.2.13
May 28, 2024 06:39:41.871601105 CEST	35407	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:41.877938986 CEST	53	35407	8.8.8.8	192.168.2.13
May 28, 2024 06:39:41.878021955 CEST	36471	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:41.884141922 CEST	53	36471	8.8.8.8	192.168.2.13
May 28, 2024 06:39:41.884218931 CEST	42124	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:41.890337944 CEST	53	42124	8.8.8.8	192.168.2.13
May 28, 2024 06:39:41.890433073 CEST	35151	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:41.896580935 CEST	53	35151	8.8.8.8	192.168.2.13
May 28, 2024 06:39:41.896718025 CEST	33219	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:41.903176069 CEST	53	33219	8.8.8.8	192.168.2.13
May 28, 2024 06:39:41.903261900 CEST	36378	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:41.909483910 CEST	53	36378	8.8.8.8	192.168.2.13
May 28, 2024 06:39:41.909554005 CEST	48452	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:41.915925026 CEST	53	48452	8.8.8.8	192.168.2.13
May 28, 2024 06:39:41.916013002 CEST	44851	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:41.922153950 CEST	53	44851	8.8.8.8	192.168.2.13
May 28, 2024 06:39:41.922277927 CEST	48878	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:41.928738117 CEST	53	48878	8.8.8.8	192.168.2.13
May 28, 2024 06:39:42.549792051 CEST	34730	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:42.556005001 CEST	53	34730	8.8.8.8	192.168.2.13
May 28, 2024 06:39:42.556132078 CEST	45938	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:42.562268019 CEST	53	45938	8.8.8.8	192.168.2.13
May 28, 2024 06:39:42.562375069 CEST	41990	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:42.568727970 CEST	53	41990	8.8.8.8	192.168.2.13
May 28, 2024 06:39:42.568814039 CEST	34064	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:42.574992895 CEST	53	34064	8.8.8.8	192.168.2.13
May 28, 2024 06:39:42.575092077 CEST	36964	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:42.581286907 CEST	53	36964	8.8.8.8	192.168.2.13
May 28, 2024 06:39:42.581386089 CEST	54686	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:42.587726116 CEST	53	54686	8.8.8.8	192.168.2.13
May 28, 2024 06:39:42.587799072 CEST	58289	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:42.593955040 CEST	53	58289	8.8.8.8	192.168.2.13
May 28, 2024 06:39:42.594038963 CEST	54432	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:42.600263119 CEST	53	54432	8.8.8.8	192.168.2.13
May 28, 2024 06:39:42.600404978 CEST	53061	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:42.606786966 CEST	53	53061	8.8.8.8	192.168.2.13
May 28, 2024 06:39:42.606892109 CEST	44156	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:42.613194942 CEST	53	44156	8.8.8.8	192.168.2.13
May 28, 2024 06:39:43.253140926 CEST	60145	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:43.259274006 CEST	53	60145	8.8.8.8	192.168.2.13
May 28, 2024 06:39:43.259360075 CEST	45976	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:43.265597105 CEST	53	45976	8.8.8.8	192.168.2.13
May 28, 2024 06:39:43.265667915 CEST	47901	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:43.272068977 CEST	53	47901	8.8.8.8	192.168.2.13
May 28, 2024 06:39:43.272140026 CEST	52918	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:43.278323889 CEST	53	52918	8.8.8.8	192.168.2.13
May 28, 2024 06:39:43.278394938 CEST	42610	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:43.284787893 CEST	53	42610	8.8.8.8	192.168.2.13
May 28, 2024 06:39:43.286509991 CEST	33057	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:43.292890072 CEST	53	33057	8.8.8.8	192.168.2.13
May 28, 2024 06:39:43.292952061 CEST	56358	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:43.299127102 CEST	53	56358	8.8.8.8	192.168.2.13
May 28, 2024 06:39:43.299236059 CEST	43900	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:43.305555105 CEST	53	43900	8.8.8.8	192.168.2.13
May 28, 2024 06:39:43.305668116 CEST	44011	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:43.312004089 CEST	53	44011	8.8.8.8	192.168.2.13
May 28, 2024 06:39:43.312072039 CEST	39998	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:43.318342924 CEST	53	39998	8.8.8.8	192.168.2.13
May 28, 2024 06:39:44.252810001 CEST	44783	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:44.259044886 CEST	53	44783	8.8.8.8	192.168.2.13
May 28, 2024 06:39:44.259234905 CEST	55293	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:44.265386105 CEST	53	55293	8.8.8.8	192.168.2.13
May 28, 2024 06:39:44.265466928 CEST	53539	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:44.271795988 CEST	53	53539	8.8.8.8	192.168.2.13
May 28, 2024 06:39:44.271872997 CEST	34410	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:44.278139114 CEST	53	34410	8.8.8.8	192.168.2.13
May 28, 2024 06:39:44.278206110 CEST	46061	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:44.284285069 CEST	53	46061	8.8.8.8	192.168.2.13
May 28, 2024 06:39:44.284385920 CEST	43826	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:44.290549994 CEST	53	43826	8.8.8.8	192.168.2.13
May 28, 2024 06:39:44.290733099 CEST	46571	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:44.296927929 CEST	53	46571	8.8.8.8	192.168.2.13
May 28, 2024 06:39:44.297149897 CEST	35866	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:44.303280115 CEST	53	35866	8.8.8.8	192.168.2.13
May 28, 2024 06:39:44.303360939 CEST	58722	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:44.312272072 CEST	53	58722	8.8.8.8	192.168.2.13
May 28, 2024 06:39:44.312360048 CEST	50506	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:44.318773985 CEST	53	50506	8.8.8.8	192.168.2.13
May 28, 2024 06:39:44.948424101 CEST	57560	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:44.954823971 CEST	53	57560	8.8.8.8	192.168.2.13
May 28, 2024 06:39:44.954937935 CEST	60632	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:44.961448908 CEST	53	60632	8.8.8.8	192.168.2.13
May 28, 2024 06:39:44.961561918 CEST	37597	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:44.967959881 CEST	53	37597	8.8.8.8	192.168.2.13
May 28, 2024 06:39:44.968075991 CEST	55699	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:44.974230051 CEST	53	55699	8.8.8.8	192.168.2.13
May 28, 2024 06:39:44.974330902 CEST	33959	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:44.980536938 CEST	53	33959	8.8.8.8	192.168.2.13
May 28, 2024 06:39:44.981868029 CEST	53050	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:44.988231897 CEST	53	53050	8.8.8.8	192.168.2.13
May 28, 2024 06:39:44.988326073 CEST	51583	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:44.994657040 CEST	53	51583	8.8.8.8	192.168.2.13
May 28, 2024 06:39:44.994748116 CEST	43080	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:45.001029015 CEST	53	43080	8.8.8.8	192.168.2.13
May 28, 2024 06:39:45.001153946 CEST	49198	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:45.007901907 CEST	53	49198	8.8.8.8	192.168.2.13
May 28, 2024 06:39:45.008102894 CEST	57096	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:45.014394999 CEST	53	57096	8.8.8.8	192.168.2.13
May 28, 2024 06:39:45.654512882 CEST	55570	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:45.660768032 CEST	53	55570	8.8.8.8	192.168.2.13
May 28, 2024 06:39:45.660886049 CEST	55594	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:45.667407036 CEST	53	55594	8.8.8.8	192.168.2.13
May 28, 2024 06:39:45.667495012 CEST	54308	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:45.674082041 CEST	53	54308	8.8.8.8	192.168.2.13
May 28, 2024 06:39:45.674146891 CEST	55880	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:45.680608988 CEST	53	55880	8.8.8.8	192.168.2.13
May 28, 2024 06:39:45.680713892 CEST	36959	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:45.687079906 CEST	53	36959	8.8.8.8	192.168.2.13
May 28, 2024 06:39:45.687210083 CEST	50208	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:45.693702936 CEST	53	50208	8.8.8.8	192.168.2.13
May 28, 2024 06:39:45.693795919 CEST	39346	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:45.700192928 CEST	53	39346	8.8.8.8	192.168.2.13
May 28, 2024 06:39:45.700254917 CEST	38497	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:45.706530094 CEST	53	38497	8.8.8.8	192.168.2.13
May 28, 2024 06:39:45.706612110 CEST	47174	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:45.713191986 CEST	53	47174	8.8.8.8	192.168.2.13
May 28, 2024 06:39:45.713253975 CEST	48419	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:45.719535112 CEST	53	48419	8.8.8.8	192.168.2.13
May 28, 2024 06:39:46.339340925 CEST	33313	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:46.345554113 CEST	53	33313	8.8.8.8	192.168.2.13
May 28, 2024 06:39:46.345659018 CEST	36624	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:46.352147102 CEST	53	36624	8.8.8.8	192.168.2.13
May 28, 2024 06:39:46.352263927 CEST	49343	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:46.358577013 CEST	53	49343	8.8.8.8	192.168.2.13
May 28, 2024 06:39:46.358669996 CEST	43127	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:46.365648031 CEST	53	43127	8.8.8.8	192.168.2.13
May 28, 2024 06:39:46.365739107 CEST	43197	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:46.373003960 CEST	53	43197	8.8.8.8	192.168.2.13
May 28, 2024 06:39:46.373112917 CEST	51774	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:46.380919933 CEST	53	51774	8.8.8.8	192.168.2.13
May 28, 2024 06:39:46.381019115 CEST	46843	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:46.390332937 CEST	53	46843	8.8.8.8	192.168.2.13
May 28, 2024 06:39:46.390451908 CEST	49778	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:46.396812916 CEST	53	49778	8.8.8.8	192.168.2.13
May 28, 2024 06:39:46.396924973 CEST	37235	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:46.404366016 CEST	53	37235	8.8.8.8	192.168.2.13
May 28, 2024 06:39:46.404468060 CEST	56547	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:46.410681009 CEST	53	56547	8.8.8.8	192.168.2.13
May 28, 2024 06:39:47.064526081 CEST	46586	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:47.070816994 CEST	53	46586	8.8.8.8	192.168.2.13
May 28, 2024 06:39:47.070950031 CEST	43260	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:47.077385902 CEST	53	43260	8.8.8.8	192.168.2.13
May 28, 2024 06:39:47.077523947 CEST	57685	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:47.083975077 CEST	53	57685	8.8.8.8	192.168.2.13
May 28, 2024 06:39:47.084076881 CEST	35035	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:47.090341091 CEST	53	35035	8.8.8.8	192.168.2.13
May 28, 2024 06:39:47.090421915 CEST	35430	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:47.096681118 CEST	53	35430	8.8.8.8	192.168.2.13
May 28, 2024 06:39:47.096760035 CEST	53903	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:47.103117943 CEST	53	53903	8.8.8.8	192.168.2.13
May 28, 2024 06:39:47.103187084 CEST	38929	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:47.109581947 CEST	53	38929	8.8.8.8	192.168.2.13
May 28, 2024 06:39:47.109672070 CEST	53337	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:47.116094112 CEST	53	53337	8.8.8.8	192.168.2.13
May 28, 2024 06:39:47.116168976 CEST	60051	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:47.122541904 CEST	53	60051	8.8.8.8	192.168.2.13
May 28, 2024 06:39:47.122623920 CEST	49773	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:47.128890038 CEST	53	49773	8.8.8.8	192.168.2.13
May 28, 2024 06:39:47.759027958 CEST	46704	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:47.765314102 CEST	53	46704	8.8.8.8	192.168.2.13
May 28, 2024 06:39:47.765500069 CEST	55116	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:47.772089005 CEST	53	55116	8.8.8.8	192.168.2.13
May 28, 2024 06:39:47.772218943 CEST	51554	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:47.778657913 CEST	53	51554	8.8.8.8	192.168.2.13
May 28, 2024 06:39:47.778783083 CEST	49702	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:47.785278082 CEST	53	49702	8.8.8.8	192.168.2.13
May 28, 2024 06:39:47.785384893 CEST	54854	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:47.791649103 CEST	53	54854	8.8.8.8	192.168.2.13
May 28, 2024 06:39:47.791766882 CEST	55569	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:47.798109055 CEST	53	55569	8.8.8.8	192.168.2.13
May 28, 2024 06:39:47.798254967 CEST	33625	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:47.804693937 CEST	53	33625	8.8.8.8	192.168.2.13
May 28, 2024 06:39:47.804826975 CEST	49976	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:47.811156034 CEST	53	49976	8.8.8.8	192.168.2.13
May 28, 2024 06:39:47.811271906 CEST	51274	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:47.817563057 CEST	53	51274	8.8.8.8	192.168.2.13
May 28, 2024 06:39:47.817703009 CEST	35254	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:47.824462891 CEST	53	35254	8.8.8.8	192.168.2.13
May 28, 2024 06:39:48.462454081 CEST	35466	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:48.468961000 CEST	53	35466	8.8.8.8	192.168.2.13
May 28, 2024 06:39:48.469115019 CEST	53311	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:48.475353956 CEST	53	53311	8.8.8.8	192.168.2.13
May 28, 2024 06:39:48.475476980 CEST	35025	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:48.481662035 CEST	53	35025	8.8.8.8	192.168.2.13
May 28, 2024 06:39:48.481771946 CEST	52900	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:48.487955093 CEST	53	52900	8.8.8.8	192.168.2.13
May 28, 2024 06:39:48.488063097 CEST	55304	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:48.494205952 CEST	53	55304	8.8.8.8	192.168.2.13
May 28, 2024 06:39:48.494327068 CEST	56703	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:48.500472069 CEST	53	56703	8.8.8.8	192.168.2.13
May 28, 2024 06:39:48.500585079 CEST	33337	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:48.506733894 CEST	53	33337	8.8.8.8	192.168.2.13
May 28, 2024 06:39:48.506844044 CEST	33271	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:48.513099909 CEST	53	33271	8.8.8.8	192.168.2.13
May 28, 2024 06:39:48.513207912 CEST	58340	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:48.519529104 CEST	53	58340	8.8.8.8	192.168.2.13
May 28, 2024 06:39:48.519610882 CEST	39228	53	192.168.2.13	8.8.8.8
May 28, 2024 06:39:48.525799036 CEST	53	39228	8.8.8.8	192.168.2.13
May 28, 2024 06:40:04.741107941 CEST	37543	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:04.747518063 CEST	53	37543	8.8.8.8	192.168.2.13
May 28, 2024 06:40:04.747698069 CEST	40091	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:04.753968000 CEST	53	40091	8.8.8.8	192.168.2.13
May 28, 2024 06:40:04.754065037 CEST	55705	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:04.760458946 CEST	53	55705	8.8.8.8	192.168.2.13
May 28, 2024 06:40:04.760560989 CEST	44078	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:04.766679049 CEST	53	44078	8.8.8.8	192.168.2.13
May 28, 2024 06:40:04.766772985 CEST	44680	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:04.772913933 CEST	53	44680	8.8.8.8	192.168.2.13
May 28, 2024 06:40:04.773057938 CEST	48490	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:04.779254913 CEST	53	48490	8.8.8.8	192.168.2.13
May 28, 2024 06:40:04.779387951 CEST	51660	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:04.785983086 CEST	53	51660	8.8.8.8	192.168.2.13
May 28, 2024 06:40:04.786179066 CEST	45890	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:04.792676926 CEST	53	45890	8.8.8.8	192.168.2.13
May 28, 2024 06:40:04.792785883 CEST	34659	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:04.798988104 CEST	53	34659	8.8.8.8	192.168.2.13
May 28, 2024 06:40:04.799098015 CEST	33882	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:04.805535078 CEST	53	33882	8.8.8.8	192.168.2.13
May 28, 2024 06:40:05.444180012 CEST	39568	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:05.450387001 CEST	53	39568	8.8.8.8	192.168.2.13
May 28, 2024 06:40:05.450551033 CEST	32769	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:05.457083941 CEST	53	32769	8.8.8.8	192.168.2.13
May 28, 2024 06:40:05.457215071 CEST	34852	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:05.463651896 CEST	53	34852	8.8.8.8	192.168.2.13
May 28, 2024 06:40:05.463773966 CEST	38367	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:05.470261097 CEST	53	38367	8.8.8.8	192.168.2.13
May 28, 2024 06:40:05.470432043 CEST	39347	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:05.478454113 CEST	53	39347	8.8.8.8	192.168.2.13
May 28, 2024 06:40:05.478590965 CEST	56790	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:05.484817982 CEST	53	56790	8.8.8.8	192.168.2.13
May 28, 2024 06:40:05.484935045 CEST	42455	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:05.491367102 CEST	53	42455	8.8.8.8	192.168.2.13
May 28, 2024 06:40:05.491492987 CEST	33256	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:05.497709036 CEST	53	33256	8.8.8.8	192.168.2.13
May 28, 2024 06:40:05.497864008 CEST	43539	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:05.504201889 CEST	53	43539	8.8.8.8	192.168.2.13
May 28, 2024 06:40:05.504381895 CEST	59580	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:05.510816097 CEST	53	59580	8.8.8.8	192.168.2.13
May 28, 2024 06:40:06.139698982 CEST	49786	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:06.145956039 CEST	53	49786	8.8.8.8	192.168.2.13
May 28, 2024 06:40:06.146169901 CEST	43956	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:06.152615070 CEST	53	43956	8.8.8.8	192.168.2.13
May 28, 2024 06:40:06.152754068 CEST	53552	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:06.159112930 CEST	53	53552	8.8.8.8	192.168.2.13
May 28, 2024 06:40:06.159305096 CEST	58901	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:06.165559053 CEST	53	58901	8.8.8.8	192.168.2.13
May 28, 2024 06:40:06.165716887 CEST	60341	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:06.172470093 CEST	53	60341	8.8.8.8	192.168.2.13
May 28, 2024 06:40:06.172652006 CEST	51678	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:06.179163933 CEST	53	51678	8.8.8.8	192.168.2.13
May 28, 2024 06:40:06.179317951 CEST	43047	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:06.185686111 CEST	53	43047	8.8.8.8	192.168.2.13
May 28, 2024 06:40:06.185820103 CEST	35652	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:06.192193985 CEST	53	35652	8.8.8.8	192.168.2.13
May 28, 2024 06:40:06.192320108 CEST	58098	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:06.198565006 CEST	53	58098	8.8.8.8	192.168.2.13
May 28, 2024 06:40:06.198755026 CEST	33874	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:06.205882072 CEST	53	33874	8.8.8.8	192.168.2.13
May 28, 2024 06:40:06.844031096 CEST	52036	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:06.850178957 CEST	53	52036	8.8.8.8	192.168.2.13
May 28, 2024 06:40:06.850311041 CEST	43934	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:06.856607914 CEST	53	43934	8.8.8.8	192.168.2.13
May 28, 2024 06:40:06.856725931 CEST	37377	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:06.863198042 CEST	53	37377	8.8.8.8	192.168.2.13
May 28, 2024 06:40:06.863342047 CEST	57142	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:06.869524956 CEST	53	57142	8.8.8.8	192.168.2.13
May 28, 2024 06:40:06.869637966 CEST	32915	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:06.875762939 CEST	53	32915	8.8.8.8	192.168.2.13
May 28, 2024 06:40:06.875894070 CEST	55491	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:06.882390976 CEST	53	55491	8.8.8.8	192.168.2.13
May 28, 2024 06:40:06.882528067 CEST	37366	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:06.888931036 CEST	53	37366	8.8.8.8	192.168.2.13
May 28, 2024 06:40:06.889045000 CEST	51872	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:06.895469904 CEST	53	51872	8.8.8.8	192.168.2.13
May 28, 2024 06:40:06.895601988 CEST	34437	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:06.902089119 CEST	53	34437	8.8.8.8	192.168.2.13
May 28, 2024 06:40:06.902282000 CEST	37291	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:06.908679962 CEST	53	37291	8.8.8.8	192.168.2.13
May 28, 2024 06:40:08.546734095 CEST	43649	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:08.553214073 CEST	53	43649	8.8.8.8	192.168.2.13
May 28, 2024 06:40:08.553366899 CEST	35803	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:08.559668064 CEST	53	35803	8.8.8.8	192.168.2.13
May 28, 2024 06:40:08.559796095 CEST	41209	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:08.566268921 CEST	53	41209	8.8.8.8	192.168.2.13
May 28, 2024 06:40:08.566390038 CEST	57844	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:08.572715044 CEST	53	57844	8.8.8.8	192.168.2.13
May 28, 2024 06:40:08.572809935 CEST	42501	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:08.578938961 CEST	53	42501	8.8.8.8	192.168.2.13
May 28, 2024 06:40:08.579065084 CEST	49601	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:08.585208893 CEST	53	49601	8.8.8.8	192.168.2.13
May 28, 2024 06:40:08.585305929 CEST	54041	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:08.591725111 CEST	53	54041	8.8.8.8	192.168.2.13
May 28, 2024 06:40:08.591819048 CEST	37707	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:08.597920895 CEST	53	37707	8.8.8.8	192.168.2.13
May 28, 2024 06:40:08.598004103 CEST	51533	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:08.604530096 CEST	53	51533	8.8.8.8	192.168.2.13
May 28, 2024 06:40:08.604617119 CEST	43614	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:08.610728979 CEST	53	43614	8.8.8.8	192.168.2.13
May 28, 2024 06:40:09.234205961 CEST	39983	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:09.241022110 CEST	53	39983	8.8.8.8	192.168.2.13
May 28, 2024 06:40:09.241170883 CEST	41804	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:09.248888016 CEST	53	41804	8.8.8.8	192.168.2.13
May 28, 2024 06:40:09.249032021 CEST	54919	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:09.255105972 CEST	53	54919	8.8.8.8	192.168.2.13
May 28, 2024 06:40:09.255215883 CEST	54667	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:09.261605978 CEST	53	54667	8.8.8.8	192.168.2.13
May 28, 2024 06:40:09.261713028 CEST	48774	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:09.267940998 CEST	53	48774	8.8.8.8	192.168.2.13
May 28, 2024 06:40:09.268053055 CEST	51257	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:09.274192095 CEST	53	51257	8.8.8.8	192.168.2.13
May 28, 2024 06:40:09.274285078 CEST	59714	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:09.280456066 CEST	53	59714	8.8.8.8	192.168.2.13
May 28, 2024 06:40:09.280544043 CEST	37235	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:09.286829948 CEST	53	37235	8.8.8.8	192.168.2.13
May 28, 2024 06:40:09.286947012 CEST	49652	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:09.293283939 CEST	53	49652	8.8.8.8	192.168.2.13
May 28, 2024 06:40:09.293436050 CEST	35795	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:09.299833059 CEST	53	35795	8.8.8.8	192.168.2.13
May 28, 2024 06:40:09.919995070 CEST	59875	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:09.926142931 CEST	53	59875	8.8.8.8	192.168.2.13
May 28, 2024 06:40:09.926290989 CEST	48204	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:09.932615995 CEST	53	48204	8.8.8.8	192.168.2.13
May 28, 2024 06:40:09.932723999 CEST	47994	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:09.939071894 CEST	53	47994	8.8.8.8	192.168.2.13
May 28, 2024 06:40:09.939177990 CEST	33900	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:09.945480108 CEST	53	33900	8.8.8.8	192.168.2.13
May 28, 2024 06:40:09.945628881 CEST	36258	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:09.951720953 CEST	53	36258	8.8.8.8	192.168.2.13
May 28, 2024 06:40:09.951850891 CEST	47381	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:09.958103895 CEST	53	47381	8.8.8.8	192.168.2.13
May 28, 2024 06:40:09.958204985 CEST	60499	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:09.964512110 CEST	53	60499	8.8.8.8	192.168.2.13
May 28, 2024 06:40:09.964624882 CEST	51719	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:09.970791101 CEST	53	51719	8.8.8.8	192.168.2.13
May 28, 2024 06:40:09.970909119 CEST	51972	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:09.977292061 CEST	53	51972	8.8.8.8	192.168.2.13
May 28, 2024 06:40:09.983760118 CEST	56798	53	192.168.2.13	8.8.8.8
May 28, 2024 06:40:09.990283966 CEST	53	56798	8.8.8.8	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 28, 2024 06:39:41.193212032 CEST	192.168.2.13	8.8.8.8	0xe830	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru	A (IP address)	IN (0x0001)	false
May 28, 2024 06:39:41.864913940 CEST	192.168.2.13	8.8.8.8	0xd0fd	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	269	false
May 28, 2024 06:39:41.871601105 CEST	192.168.2.13	8.8.8.8	0xd0fd	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	269	false
May 28, 2024 06:39:41.878021955 CEST	192.168.2.13	8.8.8.8	0xd0fd	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	269	false
May 28, 2024 06:39:41.884218931 CEST	192.168.2.13	8.8.8.8	0xd0fd	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	269	false
May 28, 2024 06:39:41.890433073 CEST	192.168.2.13	8.8.8.8	0xd0fd	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	269	false
May 28, 2024 06:39:42.549792051 CEST	192.168.2.13	8.8.8.8	0xc843	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	270	false
May 28, 2024 06:39:42.556132078 CEST	192.168.2.13	8.8.8.8	0xc843	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	270	false
May 28, 2024 06:39:42.562375069 CEST	192.168.2.13	8.8.8.8	0xc843	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	270	false
May 28, 2024 06:39:42.568814039 CEST	192.168.2.13	8.8.8.8	0xc843	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	270	false
May 28, 2024 06:39:42.575092077 CEST	192.168.2.13	8.8.8.8	0xc843	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	270	false
May 28, 2024 06:39:43.253140926 CEST	192.168.2.13	8.8.8.8	0xf73a	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	271	false
May 28, 2024 06:39:43.259360075 CEST	192.168.2.13	8.8.8.8	0xf73a	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	271	false
May 28, 2024 06:39:43.265667915 CEST	192.168.2.13	8.8.8.8	0xf73a	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	271	false
May 28, 2024 06:39:43.272140026 CEST	192.168.2.13	8.8.8.8	0xf73a	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	271	false
May 28, 2024 06:39:43.278394938 CEST	192.168.2.13	8.8.8.8	0xf73a	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	271	false
May 28, 2024 06:39:44.252810001 CEST	192.168.2.13	8.8.8.8	0x6081	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	272	false
May 28, 2024 06:39:44.259234905 CEST	192.168.2.13	8.8.8.8	0x6081	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	272	false
May 28, 2024 06:39:44.265466928 CEST	192.168.2.13	8.8.8.8	0x6081	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	272	false
May 28, 2024 06:39:44.271872997 CEST	192.168.2.13	8.8.8.8	0x6081	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	272	false
May 28, 2024 06:39:44.278206110 CEST	192.168.2.13	8.8.8.8	0x6081	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	272	false
May 28, 2024 06:39:44.948424101 CEST	192.168.2.13	8.8.8.8	0x7168	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	272	false
May 28, 2024 06:39:44.954937935 CEST	192.168.2.13	8.8.8.8	0x7168	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	272	false
May 28, 2024 06:39:44.961561918 CEST	192.168.2.13	8.8.8.8	0x7168	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	272	false
May 28, 2024 06:39:44.968075991 CEST	192.168.2.13	8.8.8.8	0x7168	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	272	false
May 28, 2024 06:39:44.974330902 CEST	192.168.2.13	8.8.8.8	0x7168	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	272	false
May 28, 2024 06:39:45.654512882 CEST	192.168.2.13	8.8.8.8	0x8053	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	273	false
May 28, 2024 06:39:45.660886049 CEST	192.168.2.13	8.8.8.8	0x8053	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	273	false
May 28, 2024 06:39:45.667495012 CEST	192.168.2.13	8.8.8.8	0x8053	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	273	false
May 28, 2024 06:39:45.674146891 CEST	192.168.2.13	8.8.8.8	0x8053	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	273	false
May 28, 2024 06:39:45.680713892 CEST	192.168.2.13	8.8.8.8	0x8053	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	273	false
May 28, 2024 06:39:46.339340925 CEST	192.168.2.13	8.8.8.8	0x2628	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	274	false
May 28, 2024 06:39:46.345659018 CEST	192.168.2.13	8.8.8.8	0x2628	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	274	false
May 28, 2024 06:39:46.352263927 CEST	192.168.2.13	8.8.8.8	0x2628	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	274	false
May 28, 2024 06:39:46.358669996 CEST	192.168.2.13	8.8.8.8	0x2628	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	274	false
May 28, 2024 06:39:46.365739107 CEST	192.168.2.13	8.8.8.8	0x2628	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	274	false
May 28, 2024 06:39:47.064526081 CEST	192.168.2.13	8.8.8.8	0xcdea	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	275	false
May 28, 2024 06:39:47.070950031 CEST	192.168.2.13	8.8.8.8	0xcdea	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	275	false
May 28, 2024 06:39:47.077523947 CEST	192.168.2.13	8.8.8.8	0xcdea	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	275	false
May 28, 2024 06:39:47.084076881 CEST	192.168.2.13	8.8.8.8	0xcdea	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	275	false
May 28, 2024 06:39:47.090421915 CEST	192.168.2.13	8.8.8.8	0xcdea	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	275	false
May 28, 2024 06:39:47.759027958 CEST	192.168.2.13	8.8.8.8	0x8d20	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	275	false
May 28, 2024 06:39:47.765500069 CEST	192.168.2.13	8.8.8.8	0x8d20	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	275	false
May 28, 2024 06:39:47.772218943 CEST	192.168.2.13	8.8.8.8	0x8d20	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	275	false
May 28, 2024 06:39:47.778783083 CEST	192.168.2.13	8.8.8.8	0x8d20	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	275	false
May 28, 2024 06:39:47.785384893 CEST	192.168.2.13	8.8.8.8	0x8d20	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	275	false
May 28, 2024 06:39:48.462454081 CEST	192.168.2.13	8.8.8.8	0x3c47	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	276	false
May 28, 2024 06:39:48.469115019 CEST	192.168.2.13	8.8.8.8	0x3c47	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	276	false
May 28, 2024 06:39:48.475476980 CEST	192.168.2.13	8.8.8.8	0x3c47	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	276	false
May 28, 2024 06:39:48.481771946 CEST	192.168.2.13	8.8.8.8	0x3c47	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	276	false
May 28, 2024 06:39:48.488063097 CEST	192.168.2.13	8.8.8.8	0x3c47	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	276	false
May 28, 2024 06:40:04.741107941 CEST	192.168.2.13	8.8.8.8	0xb95c	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	292	false
May 28, 2024 06:40:04.747698069 CEST	192.168.2.13	8.8.8.8	0xb95c	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	292	false
May 28, 2024 06:40:04.754065037 CEST	192.168.2.13	8.8.8.8	0xb95c	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	292	false
May 28, 2024 06:40:04.760560989 CEST	192.168.2.13	8.8.8.8	0xb95c	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	292	false
May 28, 2024 06:40:04.766772985 CEST	192.168.2.13	8.8.8.8	0xb95c	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	292	false
May 28, 2024 06:40:05.444180012 CEST	192.168.2.13	8.8.8.8	0x3b1b	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	293	false
May 28, 2024 06:40:05.450551033 CEST	192.168.2.13	8.8.8.8	0x3b1b	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	293	false
May 28, 2024 06:40:05.457215071 CEST	192.168.2.13	8.8.8.8	0x3b1b	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	293	false
May 28, 2024 06:40:05.463773966 CEST	192.168.2.13	8.8.8.8	0x3b1b	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	293	false
May 28, 2024 06:40:05.470432043 CEST	192.168.2.13	8.8.8.8	0x3b1b	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	293	false
May 28, 2024 06:40:06.139698982 CEST	192.168.2.13	8.8.8.8	0xda02	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	294	false
May 28, 2024 06:40:06.146169901 CEST	192.168.2.13	8.8.8.8	0xda02	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	294	false
May 28, 2024 06:40:06.152754068 CEST	192.168.2.13	8.8.8.8	0xda02	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	294	false
May 28, 2024 06:40:06.159305096 CEST	192.168.2.13	8.8.8.8	0xda02	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	294	false
May 28, 2024 06:40:06.165716887 CEST	192.168.2.13	8.8.8.8	0xda02	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	294	false
May 28, 2024 06:40:06.844031096 CEST	192.168.2.13	8.8.8.8	0x31b5	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	294	false
May 28, 2024 06:40:06.850311041 CEST	192.168.2.13	8.8.8.8	0x31b5	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	294	false
May 28, 2024 06:40:06.856725931 CEST	192.168.2.13	8.8.8.8	0x31b5	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	294	false
May 28, 2024 06:40:06.863342047 CEST	192.168.2.13	8.8.8.8	0x31b5	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	294	false
May 28, 2024 06:40:06.869637966 CEST	192.168.2.13	8.8.8.8	0x31b5	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	294	false
May 28, 2024 06:40:08.546734095 CEST	192.168.2.13	8.8.8.8	0x552a	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	296	false
May 28, 2024 06:40:08.553366899 CEST	192.168.2.13	8.8.8.8	0x552a	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	296	false
May 28, 2024 06:40:08.559796095 CEST	192.168.2.13	8.8.8.8	0x552a	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	296	false
May 28, 2024 06:40:08.566390038 CEST	192.168.2.13	8.8.8.8	0x552a	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	296	false
May 28, 2024 06:40:08.572809935 CEST	192.168.2.13	8.8.8.8	0x552a	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	296	false
May 28, 2024 06:40:09.234205961 CEST	192.168.2.13	8.8.8.8	0xb4eb	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	297	false
May 28, 2024 06:40:09.241170883 CEST	192.168.2.13	8.8.8.8	0xb4eb	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	297	false
May 28, 2024 06:40:09.249032021 CEST	192.168.2.13	8.8.8.8	0xb4eb	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	297	false
May 28, 2024 06:40:09.255215883 CEST	192.168.2.13	8.8.8.8	0xb4eb	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	297	false
May 28, 2024 06:40:09.261713028 CEST	192.168.2.13	8.8.8.8	0xb4eb	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	297	false
May 28, 2024 06:40:09.919995070 CEST	192.168.2.13	8.8.8.8	0xf86d	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	297	false
May 28, 2024 06:40:09.926290989 CEST	192.168.2.13	8.8.8.8	0xf86d	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	297	false
May 28, 2024 06:40:09.932723999 CEST	192.168.2.13	8.8.8.8	0xf86d	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	297	false
May 28, 2024 06:40:09.939177990 CEST	192.168.2.13	8.8.8.8	0xf86d	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	297	false
May 28, 2024 06:40:09.945628881 CEST	192.168.2.13	8.8.8.8	0xf86d	Standard query (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed]	256	297	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 28, 2024 06:39:41.202967882 CEST	8.8.8.8	192.168.2.13	0xe830	No error (0)	raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru		45.131.111.98	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: r0tEgU8WOn.elf PID: 5446, Parent PID: 5362

General

Start time (UTC):	04:39:40
Start date (UTC):	28/05/2024
Path:	/tmp/r0tEgU8WOn.elf
Arguments:	/tmp/r0tEgU8WOn.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: r0tEgU8WOn.elf PID: 5448, Parent PID: 5446

General

Start time (UTC):	04:39:40
Start date (UTC):	28/05/2024
Path:	/tmp/r0tEgU8WOn.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report r0tEgU8WOn.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.TEb6aZ (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: r0tEgU8WOn.elf PID: 5446, Parent PID: 5362

General

Chronological Activities

Analysis Process: r0tEgU8WOn.elf PID: 5448, Parent PID: 5446

General

Chronological Activities

Linux Analysis Report
r0tEgU8WOn.elf