Edit tour

Linux Analysis Report
uziTyAHxCX.elf

Overview

General Information

Sample name:	uziTyAHxCX.elf renamed because original name is a hash value
Original sample name:	53c09fc8e5af2ac6ab671c7c08365c47.elf
Analysis ID:	1458303
MD5:	53c09fc8e5af2ac6ab671c7c08365c47
SHA1:	5dc078008975c2b49d4d584de022c327e951329e
SHA256:	9142f4ca03481776592479d595c7c56ea235fc55530d2d3ddad1c6d17755ff89
Tags:	32elfgafgytpowerpc
Infos:

Detection

Mirai, Okiru

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Yara detected Okiru

Connects to many ports of the same IP (likely port scanning)

Contains symbols with names commonly found in malware

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1458303
Start date and time:	2024-06-17 14:29:02 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	uziTyAHxCX.elf renamed because original name is a hash value
Original Sample Name:	53c09fc8e5af2ac6ab671c7c08365c47.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/1025@22/0

Runtime Messages

Command:	/tmp/uziTyAHxCX.elf
PID:	6252
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

uziTyAHxCX.elf (PID: 6252, Parent: 6171, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/uziTyAHxCX.elf

uziTyAHxCX.elf New Fork (PID: 6254, Parent: 6252)

uziTyAHxCX.elf New Fork (PID: 6256, Parent: 6254)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
uziTyAHxCX.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
uziTyAHxCX.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
uziTyAHxCX.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
uziTyAHxCX.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1a97c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aaa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aabc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aad0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aae4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aaf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
uziTyAHxCX.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1a83c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
6252.1.00007f525c001000.00007f525c01e000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
6252.1.00007f525c001000.00007f525c01e000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
6252.1.00007f525c001000.00007f525c01e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6252.1.00007f525c001000.00007f525c01e000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1a97c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aaa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aabc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aad0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aae4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aaf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6252.1.00007f525c001000.00007f525c01e000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1a83c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: uziTyAHxCX.elf PID: 6252	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: uziTyAHxCX.elf PID: 6252	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: uziTyAHxCX.elf PID: 6252	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: uziTyAHxCX.elf PID: 6252	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x9a29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9a3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9a51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9a65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9a79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9a8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9aa1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9ab5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9ac9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9add:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9af1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9b05:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9b19:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9b2d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9b41:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9b55:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9b69:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9b7d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9b91:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9ba5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9bb9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: uziTyAHxCX.elf PID: 6252	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x990f:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 5 entries

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:21.881512
SID:	2030490
Source Port:	54330
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:36.123862
SID:	2030490
Source Port:	54334
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:03.040428
SID:	2030490
Source Port:	52518
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:26.506156
SID:	2030490
Source Port:	54332
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:08.606827
SID:	2030490
Source Port:	54326
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:32:07.597543
SID:	2030490
Source Port:	52560
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:09.937166
SID:	2030490
Source Port:	52542
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:40.604516
SID:	2030490
Source Port:	52532
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:07.153971
SID:	2030490
Source Port:	52540
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:19.576659
SID:	2030490
Source Port:	52544
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:11.504003
SID:	2030490
Source Port:	52522
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:37.045126
SID:	2030490
Source Port:	52550
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:50.414694
SID:	2030490
Source Port:	52554
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:35.981682
SID:	2030490
Source Port:	52530
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:00.534374
SID:	2030490
Source Port:	52538
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:15.237589
SID:	2030490
Source Port:	54328
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:09.879238
SID:	2030490
Source Port:	52520
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:29.363024
SID:	2030490
Source Port:	52528
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:47.784850
SID:	2030490
Source Port:	52552
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:27.418983
SID:	2030490
Source Port:	52548
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:27.736620
SID:	2030490
Source Port:	52526
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:57.972809
SID:	2030490
Source Port:	52558
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:25.203895
SID:	2030490
Source Port:	52546
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:54.906717
SID:	2030490
Source Port:	52536
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:46.280557
SID:	2030490
Source Port:	52534
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:19.593678
SID:	2030490
Source Port:	52524
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:52.346465
SID:	2030490
Source Port:	52556
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: uziTyAHxCX.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: uziTyAHxCX.elf

ReversingLabs: Detection: 52%

Source: uziTyAHxCX.elf

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt//var/Condi

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54326 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54328 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54330 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54332 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54334 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:52518 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:52520 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:52522 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:52524 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:52526 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:52528 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:52530 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:52532 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:52534 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:52536 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:52538 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:52540 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:52542 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:52544 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:52546 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:52548 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:52550 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:52552 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:52554 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:52556 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:52558 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:52560 -> 146.185.209.82:47925

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: uziTyAHxCX.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: uziTyAHxCX.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6252.1.00007f525c001000.00007f525c01e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6252.1.00007f525c001000.00007f525c01e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: uziTyAHxCX.elf PID: 6252, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: uziTyAHxCX.elf PID: 6252, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_get_opt_str
Source: ELF static info symbol of initial sample	Name: attack_gre_ip
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_kill_all
Source: ELF static info symbol of initial sample	Name: attack_method_nudp
Source: ELF static info symbol of initial sample	Name: attack_ongoing
Source: ELF static info symbol of initial sample	Name: attack_parse

Source: uziTyAHxCX.elf	ELF static info symbol of initial sample: execute_cfa_program
Source: uziTyAHxCX.elf	ELF static info symbol of initial sample: execute_stack_op

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt//var/Condi

Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/6234/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/6233/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/4721/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/6254/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/5840/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/4509/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/4500/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/4503/cmdline	Jump to behavior
Source: /tmp/uziTyAHxCX.elf (PID: 6256)	File opened: /proc/30/cmdline	Jump to behavior

Source: uziTyAHxCX.elf, 6252.1.00007ffe048fc000.00007ffe0491d000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/uziTyAHxCX.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/uziTyAHxCX.elf
Source: uziTyAHxCX.elf, 6252.1.0000564c1e022000.0000564c1e0d2000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: uziTyAHxCX.elf, 6252.1.0000564c1e022000.0000564c1e0d2000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: uziTyAHxCX.elf, 6252.1.00007ffe048fc000.00007ffe0491d000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc

Source: Yara match	File source: uziTyAHxCX.elf, type: SAMPLE
Source: Yara match	File source: 6252.1.00007f525c001000.00007f525c01e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: uziTyAHxCX.elf PID: 6252, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
uziTyAHxCX.elf	53%	ReversingLabs	Linux.Trojan.Mirai
uziTyAHxCX.elf	100%	Avira	EXP/ELF.Mirai.Z.A

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false
146.185.209.82	seyfhg.work.gd	Russian Federation	206233	MATTEOGB	true

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
109.202.202.202	7xn6ihXITM.elf	Get hash	malicious	Mirai, Okiru	Browse
	LcY8bb53Tg.elf	Get hash	malicious	Mirai	Browse
	Y1TyhqLmmr.elf	Get hash	malicious	Mirai	Browse
	qug8D8sYAW.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	f8WDIPwNGH.elf	Get hash	malicious	Unknown	Browse
	RjkHLuzLJH.elf	Get hash	malicious	Mirai	Browse
	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse
	oRABHevHfo.elf	Get hash	malicious	Mirai, Okiru	Browse
91.189.91.43	7xn6ihXITM.elf	Get hash	malicious	Mirai, Okiru	Browse
	LcY8bb53Tg.elf	Get hash	malicious	Mirai	Browse
	Y1TyhqLmmr.elf	Get hash	malicious	Mirai	Browse
	qug8D8sYAW.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	f8WDIPwNGH.elf	Get hash	malicious	Unknown	Browse
	RjkHLuzLJH.elf	Get hash	malicious	Mirai	Browse
	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse
	oRABHevHfo.elf	Get hash	malicious	Mirai, Okiru	Browse
91.189.91.42	7xn6ihXITM.elf	Get hash	malicious	Mirai, Okiru	Browse
	LcY8bb53Tg.elf	Get hash	malicious	Mirai	Browse
	Y1TyhqLmmr.elf	Get hash	malicious	Mirai	Browse
	qug8D8sYAW.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	f8WDIPwNGH.elf	Get hash	malicious	Unknown	Browse
	RjkHLuzLJH.elf	Get hash	malicious	Mirai	Browse
	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse
	oRABHevHfo.elf	Get hash	malicious	Mirai, Okiru	Browse
146.185.209.82	Buj4LG5Eu4.elf	Get hash	malicious	Mirai, Okiru	Browse

Process:	/tmp/uziTyAHxCX.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.221928094887362
Encrypted:	false
SSDEEP:	3:TgX1dm8n:TgX17n
MD5:	E9B4CDF9EB456676F8A7AB3F44B0442B
SHA1:	DE6AE05742BEB6BED4AA8B09E4B28B42C86FA031
SHA-256:	9F54AF77C30A1FC6CD0B9E595F9B512E51CD9D6B570BA09AB80ED058FEDE0E9B
SHA-512:	B23C72FA372206C949CA33A91D780D9FAF9735CF103F933C7D2FF48279B33C0253A3DF6E7336DD45E4F4EF9145038F0C89CEA7D639095160ED2D9EE1A9FB70D7
Malicious:	false
Reputation:	low
Preview:	/tmp/uziTyAHxCX.elf.

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.134390208169131
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	uziTyAHxCX.elf
File size:	224'549 bytes
MD5:	53c09fc8e5af2ac6ab671c7c08365c47
SHA1:	5dc078008975c2b49d4d584de022c327e951329e
SHA256:	9142f4ca03481776592479d595c7c56ea235fc55530d2d3ddad1c6d17755ff89
SHA512:	8a34fd638ab26a1ff282b75d8ece7ba9d814754cf65a1de823da992ee9f0ebc0724564d2ca6269ab4fac5ca2807fcec3d7bd30302a29d365fb77db33e6b0999f
SSDEEP:	3072:Q+XpEgeST/PmqEAOpsTl1WZTT6xEz58m2vrxax8GpB6DiC:QsSBqbEAQsP2sEz58TfO6DiC
TLSH:	BF249E05B3194A57D0A71EB026EF07F0A3BB9CC111A0A20A966EFFD55773AF45902F87
File Content Preview:	.ELF...........................4...8.....4. ...(.......................v...v...............x...x...x...(..`.........................................dt.Q.............................!..\|......$H...H..a...$8!. \|...N.. .!..\|.......?..........P..../...@..`= .

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x10000218
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	192056
Section Header Size:	40
Number of Section Headers:	31
Header String Table Index:	28

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x100000b4	0xb4	0x24	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x100000d8	0xd8	0x1a0b8	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x1001a190	0x1a190	0x20	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1001a1b0	0x1a1b0	0x2cb8	0x0	0x2	A	0	0	8
.gcc_except_table	PROGBITS	0x1001ce68	0x1ce68	0xe	0x0	0x2	A	0	0	1
.eh_frame	PROGBITS	0x1002ce78	0x1ce78	0x8a0	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x1002d718	0x1d718	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x1002d71c	0x1d71c	0x8	0x0	0x403	WAT	0	0	4
.ctors	PROGBITS	0x1002d71c	0x1d71c	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x1002d724	0x1d724	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x1002d72c	0x1d72c	0x4	0x0	0x3	WA	0	0	4
.got2	PROGBITS	0x1002d730	0x1d730	0x44	0x0	0x3	WA	0	0	1
.got	PROGBITS	0x1002d774	0x1d774	0xc	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x1002d780	0x1d780	0x2a8	0x0	0x3	WA	0	0	8
.sdata	PROGBITS	0x1002da28	0x1da28	0x78	0x0	0x3	WA	0	0	4
.sbss	NOBITS	0x1002daa0	0x1daa0	0xb0	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x1002db50	0x1daa0	0x53dc	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x1daa0	0xea0	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1e940	0x60	0x0	0x0		0	0	1
.debug_pubnames	PROGBITS	0x0	0x1e9a0	0x31e	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1ecbe	0x50c3	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x23d81	0xbe2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x24963	0x1612	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x25f78	0xe7c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x26df4	0x1e15	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x28c09	0x503a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x2dc43	0x10e0	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x2ed23	0x113	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x2f310	0x40c0	0x10	0x0		30	394	4
.strtab	STRTAB	0x0	0x333d0	0x3955	0x0	0x0		0	0	1

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report uziTyAHxCX.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.01F4le (deleted)

/tmp/qemu-open.05cvUg (deleted)

/tmp/qemu-open.0CzFPg (deleted)

/tmp/qemu-open.0FBj2f (deleted)

/tmp/qemu-open.0FWYRe (deleted)

/tmp/qemu-open.0GU32d (deleted)

/tmp/qemu-open.0LVPMf (deleted)

/tmp/qemu-open.0Pr1be (deleted)

/tmp/qemu-open.0UPnIf (deleted)

/tmp/qemu-open.0UTA1f (deleted)

/tmp/qemu-open.0XNhDd (deleted)

/tmp/qemu-open.0Y2xAd (deleted)

/tmp/qemu-open.0elRKh (deleted)

/tmp/qemu-open.0f3Dfd (deleted)

/tmp/qemu-open.0lGKBh (deleted)

/tmp/qemu-open.0oJB0d (deleted)

/tmp/qemu-open.0pQ0Zf (deleted)

/tmp/qemu-open.0po5zh (deleted)

/tmp/qemu-open.0tS0kd (deleted)

/tmp/qemu-open.0vuBrh (deleted)

/tmp/qemu-open.0vw8ag (deleted)

/tmp/qemu-open.0wEIgh (deleted)

/tmp/qemu-open.17rNyf (deleted)

/tmp/qemu-open.1DLdWe (deleted)

/tmp/qemu-open.1NCYYe (deleted)

/tmp/qemu-open.1SX1bf (deleted)

/tmp/qemu-open.1UdMQh (deleted)

/tmp/qemu-open.1UjpMf (deleted)

/tmp/qemu-open.1VMhfd (deleted)

/tmp/qemu-open.1YG4Eh (deleted)

Linux Analysis Report
uziTyAHxCX.elf

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0x1ce76	0x1ce76	6.3464	0x5	R E	0x10000	.init .text .fini .rodata .gcc_except_table
LOAD	0x1ce78	0x1002ce78	0x1002ce78	0xc28	0x60b4	5.0602	0x6	RW	0x10000	.eh_frame .tdata .tbss .ctors .dtors .jcr .got2 .got .data .sdata .sbss .bss
TLS	0x1d718	0x1002d718	0x1002d718	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 17, 2024 14:30:02.326931953 CEST	43928	443	192.168.2.23	91.189.91.42
Jun 17, 2024 14:30:03.033775091 CEST	52518	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:03.038830042 CEST	47925	52518	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:03.038888931 CEST	52518	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:03.040427923 CEST	52518	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:03.045711994 CEST	47925	52518	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:03.652556896 CEST	47925	52518	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:03.652800083 CEST	52518	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:03.659388065 CEST	47925	52518	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:04.630636930 CEST	42516	80	192.168.2.23	109.202.202.202
Jun 17, 2024 14:30:07.702203989 CEST	42836	443	192.168.2.23	91.189.91.43
Jun 17, 2024 14:30:09.870870113 CEST	52520	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:09.875787020 CEST	47925	52520	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:09.875857115 CEST	52520	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:09.879237890 CEST	52520	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:09.883986950 CEST	47925	52520	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:10.486735106 CEST	47925	52520	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:10.486823082 CEST	52520	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:10.491651058 CEST	47925	52520	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:11.497143984 CEST	52522	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:11.502100945 CEST	47925	52522	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:11.502183914 CEST	52522	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:11.504003048 CEST	52522	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:11.508868933 CEST	47925	52522	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:12.576895952 CEST	47925	52522	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:12.577080011 CEST	52522	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:12.577145100 CEST	47925	52522	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:12.577193975 CEST	52522	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:12.577402115 CEST	47925	52522	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:12.577445030 CEST	52522	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:12.586826086 CEST	47925	52522	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:19.587877035 CEST	52524	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:19.592726946 CEST	47925	52524	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:19.592778921 CEST	52524	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:19.593677998 CEST	52524	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:19.598443031 CEST	47925	52524	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:20.721735001 CEST	47925	52524	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:20.721863031 CEST	52524	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:20.726783991 CEST	47925	52524	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:22.292138100 CEST	43928	443	192.168.2.23	91.189.91.42
Jun 17, 2024 14:30:27.730861902 CEST	52526	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:27.735709906 CEST	47925	52526	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:27.735771894 CEST	52526	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:27.736619949 CEST	52526	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:27.741328001 CEST	47925	52526	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:28.346923113 CEST	47925	52526	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:28.347054005 CEST	52526	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:28.351836920 CEST	47925	52526	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:29.356863976 CEST	52528	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:29.361783981 CEST	47925	52528	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:29.361860991 CEST	52528	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:29.363023996 CEST	52528	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:29.367940903 CEST	47925	52528	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:29.965797901 CEST	47925	52528	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:29.965969086 CEST	52528	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:29.970880032 CEST	47925	52528	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:34.578496933 CEST	42516	80	192.168.2.23	109.202.202.202
Jun 17, 2024 14:30:34.578505039 CEST	42836	443	192.168.2.23	91.189.91.43
Jun 17, 2024 14:30:35.975958109 CEST	52530	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:35.980743885 CEST	47925	52530	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:35.980807066 CEST	52530	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:35.981682062 CEST	52530	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:35.986577034 CEST	47925	52530	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:36.587347031 CEST	47925	52530	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:36.587570906 CEST	52530	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:36.593139887 CEST	47925	52530	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:40.598478079 CEST	52532	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:40.603601933 CEST	47925	52532	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:40.603693008 CEST	52532	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:40.604516029 CEST	52532	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:40.610924006 CEST	47925	52532	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:41.207847118 CEST	47925	52532	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:41.208031893 CEST	52532	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:41.213030100 CEST	47925	52532	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:46.274678946 CEST	52534	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:46.279558897 CEST	47925	52534	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:46.279642105 CEST	52534	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:46.280556917 CEST	52534	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:46.285413980 CEST	47925	52534	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:46.890566111 CEST	47925	52534	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:46.890742064 CEST	52534	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:46.895623922 CEST	47925	52534	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:54.900445938 CEST	52536	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:54.905267000 CEST	47925	52536	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:54.905451059 CEST	52536	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:54.906717062 CEST	52536	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:54.912137032 CEST	47925	52536	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:55.516510963 CEST	47925	52536	146.185.209.82	192.168.2.23
Jun 17, 2024 14:30:55.516664982 CEST	52536	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:30:55.521509886 CEST	47925	52536	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:00.528203964 CEST	52538	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:00.533096075 CEST	47925	52538	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:00.533166885 CEST	52538	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:00.534373999 CEST	52538	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:00.539359093 CEST	47925	52538	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:01.138159037 CEST	47925	52538	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:01.138398886 CEST	52538	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:01.143245935 CEST	47925	52538	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:03.246556044 CEST	43928	443	192.168.2.23	91.189.91.42
Jun 17, 2024 14:31:07.147859097 CEST	52540	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:07.152831078 CEST	47925	52540	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:07.152940989 CEST	52540	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:07.153970957 CEST	52540	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:07.159030914 CEST	47925	52540	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:07.917974949 CEST	47925	52540	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:07.918122053 CEST	52540	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:08.129853010 CEST	52540	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:08.172848940 CEST	47925	52540	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:08.173012972 CEST	52540	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:08.341839075 CEST	52540	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:08.400504112 CEST	47925	52540	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:08.400552034 CEST	47925	52540	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:08.400650024 CEST	52540	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:08.401113987 CEST	47925	52540	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:08.401165009 CEST	52540	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:09.928862095 CEST	52542	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:09.934161901 CEST	47925	52542	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:09.934250116 CEST	52542	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:09.937165976 CEST	52542	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:09.942147017 CEST	47925	52542	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:10.556940079 CEST	47925	52542	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:10.557147026 CEST	52542	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:10.563456059 CEST	47925	52542	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:19.570590973 CEST	52544	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:19.575556993 CEST	47925	52544	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:19.575608969 CEST	52544	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:19.576658964 CEST	52544	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:19.582585096 CEST	47925	52544	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:20.188488960 CEST	47925	52544	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:20.188658953 CEST	52544	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:20.193444967 CEST	47925	52544	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:25.198043108 CEST	52546	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:25.202979088 CEST	47925	52546	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:25.203044891 CEST	52546	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:25.203895092 CEST	52546	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:25.208709002 CEST	47925	52546	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:25.820358038 CEST	47925	52546	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:25.820542097 CEST	52546	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:25.825612068 CEST	47925	52546	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:27.413371086 CEST	52548	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:27.418313026 CEST	47925	52548	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:27.418370008 CEST	52548	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:27.418982983 CEST	52548	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:27.423747063 CEST	47925	52548	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:28.030610085 CEST	47925	52548	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:28.030806065 CEST	52548	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:28.035804033 CEST	47925	52548	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:37.039398909 CEST	52550	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:37.044471979 CEST	47925	52550	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:37.044523954 CEST	52550	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:37.045125961 CEST	52550	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:37.049925089 CEST	47925	52550	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:37.658524990 CEST	47925	52550	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:37.658695936 CEST	52550	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:37.663537025 CEST	47925	52550	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:47.778572083 CEST	52552	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:47.783658028 CEST	47925	52552	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:47.783716917 CEST	52552	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:47.784849882 CEST	52552	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:47.789652109 CEST	47925	52552	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:48.396637917 CEST	47925	52552	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:48.396840096 CEST	52552	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:48.402651072 CEST	47925	52552	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:50.408874035 CEST	52554	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:50.413842916 CEST	47925	52554	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:50.413904905 CEST	52554	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:50.414694071 CEST	52554	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:50.421686888 CEST	47925	52554	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:51.331161022 CEST	47925	52554	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:51.331315041 CEST	52554	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:51.331634045 CEST	47925	52554	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:51.331671000 CEST	52554	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:51.336570978 CEST	47925	52554	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:52.340889931 CEST	52556	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:52.345696926 CEST	47925	52556	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:52.345746994 CEST	52556	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:52.346465111 CEST	52556	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:52.351211071 CEST	47925	52556	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:52.957159042 CEST	47925	52556	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:52.957362890 CEST	52556	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:52.962215900 CEST	47925	52556	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:57.966788054 CEST	52558	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:57.971801996 CEST	47925	52558	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:57.971867085 CEST	52558	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:57.972809076 CEST	52558	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:57.977617979 CEST	47925	52558	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:58.582684994 CEST	47925	52558	146.185.209.82	192.168.2.23
Jun 17, 2024 14:31:58.582849979 CEST	52558	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:31:58.587769032 CEST	47925	52558	146.185.209.82	192.168.2.23
Jun 17, 2024 14:32:07.591510057 CEST	52560	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:32:07.596400976 CEST	47925	52560	146.185.209.82	192.168.2.23
Jun 17, 2024 14:32:07.596523046 CEST	52560	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:32:07.597543001 CEST	52560	47925	192.168.2.23	146.185.209.82
Jun 17, 2024 14:32:07.602905989 CEST	47925	52560	146.185.209.82	192.168.2.23

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 17, 2024 14:30:03.024947882 CEST	49537	53	192.168.2.23	8.8.8.8
Jun 17, 2024 14:30:03.031960011 CEST	53	49537	8.8.8.8	192.168.2.23
Jun 17, 2024 14:30:09.734321117 CEST	52543	53	192.168.2.23	8.8.8.8
Jun 17, 2024 14:30:09.870088100 CEST	53	52543	8.8.8.8	192.168.2.23
Jun 17, 2024 14:30:11.489305973 CEST	41851	53	192.168.2.23	8.8.8.8
Jun 17, 2024 14:30:11.496382952 CEST	53	41851	8.8.8.8	192.168.2.23
Jun 17, 2024 14:30:19.580235958 CEST	58349	53	192.168.2.23	8.8.8.8
Jun 17, 2024 14:30:19.587120056 CEST	53	58349	8.8.8.8	192.168.2.23
Jun 17, 2024 14:30:27.723130941 CEST	57457	53	192.168.2.23	8.8.8.8
Jun 17, 2024 14:30:27.730163097 CEST	53	57457	8.8.8.8	192.168.2.23
Jun 17, 2024 14:30:29.349082947 CEST	54477	53	192.168.2.23	8.8.8.8
Jun 17, 2024 14:30:29.356277943 CEST	53	54477	8.8.8.8	192.168.2.23
Jun 17, 2024 14:30:35.968200922 CEST	58858	53	192.168.2.23	8.8.8.8
Jun 17, 2024 14:30:35.975337029 CEST	53	58858	8.8.8.8	192.168.2.23
Jun 17, 2024 14:30:40.589664936 CEST	34559	53	192.168.2.23	8.8.8.8
Jun 17, 2024 14:30:40.597996950 CEST	53	34559	8.8.8.8	192.168.2.23
Jun 17, 2024 14:30:46.209741116 CEST	52264	53	192.168.2.23	8.8.8.8
Jun 17, 2024 14:30:46.274039984 CEST	53	52264	8.8.8.8	192.168.2.23
Jun 17, 2024 14:30:54.892458916 CEST	36789	53	192.168.2.23	8.8.8.8
Jun 17, 2024 14:30:54.899753094 CEST	53	36789	8.8.8.8	192.168.2.23
Jun 17, 2024 14:31:00.518946886 CEST	55616	53	192.168.2.23	8.8.8.8
Jun 17, 2024 14:31:00.527601004 CEST	53	55616	8.8.8.8	192.168.2.23
Jun 17, 2024 14:31:07.140664101 CEST	60014	53	192.168.2.23	8.8.8.8
Jun 17, 2024 14:31:07.147190094 CEST	53	60014	8.8.8.8	192.168.2.23
Jun 17, 2024 14:31:09.920934916 CEST	56231	53	192.168.2.23	8.8.8.8
Jun 17, 2024 14:31:09.928097010 CEST	53	56231	8.8.8.8	192.168.2.23
Jun 17, 2024 14:31:19.558178902 CEST	57126	53	192.168.2.23	8.8.8.8
Jun 17, 2024 14:31:19.570102930 CEST	53	57126	8.8.8.8	192.168.2.23
Jun 17, 2024 14:31:25.190610886 CEST	34045	53	192.168.2.23	8.8.8.8
Jun 17, 2024 14:31:25.197603941 CEST	53	34045	8.8.8.8	192.168.2.23
Jun 17, 2024 14:31:26.822400093 CEST	48697	53	192.168.2.23	8.8.8.8
Jun 17, 2024 14:31:27.412677050 CEST	53	48697	8.8.8.8	192.168.2.23
Jun 17, 2024 14:31:37.031757116 CEST	56946	53	192.168.2.23	8.8.8.8
Jun 17, 2024 14:31:37.038995028 CEST	53	56946	8.8.8.8	192.168.2.23
Jun 17, 2024 14:31:47.661422014 CEST	52892	53	192.168.2.23	8.8.8.8
Jun 17, 2024 14:31:47.777743101 CEST	53	52892	8.8.8.8	192.168.2.23
Jun 17, 2024 14:31:50.399293900 CEST	36946	53	192.168.2.23	8.8.8.8
Jun 17, 2024 14:31:50.406965971 CEST	53	36946	8.8.8.8	192.168.2.23
Jun 17, 2024 14:31:52.333204985 CEST	36876	53	192.168.2.23	8.8.8.8
Jun 17, 2024 14:31:52.340358973 CEST	53	36876	8.8.8.8	192.168.2.23
Jun 17, 2024 14:31:57.959157944 CEST	39315	53	192.168.2.23	8.8.8.8
Jun 17, 2024 14:31:57.966159105 CEST	53	39315	8.8.8.8	192.168.2.23
Jun 17, 2024 14:32:07.584017992 CEST	34861	53	192.168.2.23	8.8.8.8
Jun 17, 2024 14:32:07.591064930 CEST	53	34861	8.8.8.8	192.168.2.23

Start time (UTC):	12:30:01
Start date (UTC):	17/06/2024
Path:	/tmp/uziTyAHxCX.elf
Arguments:	/tmp/uziTyAHxCX.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	12:30:02
Start date (UTC):	17/06/2024
Path:	/tmp/uziTyAHxCX.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre