Edit tour

Linux Analysis Report
na.elf

Overview

General Information

Sample name:	na.elf
Analysis ID:	1531530
MD5:	4be526bed5d4ce71746e1d72644af298
SHA1:	a31b2ef5db47be857c15778ff0a5fa36353cae72
SHA256:	478488b452c97e8d84c2bc875a61b7e4c2641f3c98b4ac22e844fb40aaab58f2
Tags:	elfMiraiuser-abuse_ch
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Connects to many ports of the same IP (likely port scanning)

Sample reads /proc/mounts (often used for finding a writable filesystem)

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Sample has stripped symbol table

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1531530
Start date and time:	2024-10-11 11:08:56 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	na.elf
Detection:	MAL
Classification:	mal64.troj.linELF@0/0@76/0

Warnings

VT rate limit hit for: na.elf

Runtime Messages

Command:	/tmp/na.elf
PID:	6295
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	eshay
Standard Error:

Process Tree

system is lnxubuntu20

na.elf (PID: 6295, Parent: 6208, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/na.elf

na.elf New Fork (PID: 6298, Parent: 6295)

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: na.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: na.elf

ReversingLabs: Detection: 21%

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 154.213.192.29 ports 0,33403,3,4,33410,8,33408
Source: global traffic	TCP traffic: 38.43.93.83 ports 0,33402,33400,3,4,7,33407
Source: global traffic	TCP traffic: 107.161.24.95 ports 0,3,4,5,33408,33405
Source: global traffic	TCP traffic: 81.4.109.41 ports 0,3,4,5,33408,33404,33405

Source: global traffic	TCP traffic: 192.168.2.23:44206 -> 102.200.5.10:24
Source: global traffic	TCP traffic: 192.168.2.23:47854 -> 5.206.227.62:33400
Source: global traffic	TCP traffic: 192.168.2.23:52242 -> 38.43.93.83:33407
Source: global traffic	TCP traffic: 192.168.2.23:54014 -> 81.4.109.41:33405
Source: global traffic	TCP traffic: 192.168.2.23:41044 -> 154.213.192.29:33408
Source: global traffic	TCP traffic: 192.168.2.23:40910 -> 107.161.24.95:33405
Source: global traffic	TCP traffic: 192.168.2.23:41060 -> 185.236.228.87:33410
Source: global traffic	TCP traffic: 192.168.2.23:53056 -> 212.34.155.222:33405

Source: /tmp/na.elf (PID: 6295)

Socket: 127.0.0.1:33337

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 102.200.5.10
Source: unknown	TCP traffic detected without corresponding DNS query: 102.200.5.10
Source: unknown	TCP traffic detected without corresponding DNS query: 102.200.5.10
Source: unknown	TCP traffic detected without corresponding DNS query: 102.200.5.10
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 102.200.5.10
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 102.200.5.10
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: global traffic	DNS traffic detected: DNS query: srv3.pty.su
Source: global traffic	DNS traffic detected: DNS query: srv6.pty.su
Source: global traffic	DNS traffic detected: DNS query: srv4.pty.su
Source: global traffic	DNS traffic detected: DNS query: srv7.pty.su
Source: global traffic	DNS traffic detected: DNS query: srv10.pty.su
Source: global traffic	DNS traffic detected: DNS query: srv9.pty.su
Source: global traffic	DNS traffic detected: DNS query: srv2.pty.su
Source: global traffic	DNS traffic detected: DNS query: srv8.pty.su
Source: global traffic	DNS traffic detected: DNS query: srv5.pty.su

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal64.troj.linELF@0/0@76/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /tmp/na.elf (PID: 6295)

File: /proc/6295/mounts

Jump to behavior

Source: /tmp/na.elf (PID: 6295)

Queries kernel information via 'uname':

Jump to behavior

Source: na.elf, 6295.1.00007ffc247eb000.00007ffc2480c000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 6295.1.0000564b8518a000.0000564b852d8000.rw-.sdmp	Binary or memory string: KV!/etc/qemu-binfmt/arm
Source: na.elf, 6295.1.0000564b8518a000.0000564b852d8000.rw-.sdmp	Binary or memory string: /usr/bin/vmtoolsd
Source: na.elf, 6295.1.0000564b8518a000.0000564b852d8000.rw-.sdmp	Binary or memory string: KV/arm/sr10!/proc/2014/exe0!/proc/721/exe1/sys/class/misc/watchdog0!/proc/2009/exe0!/usr/bin/vmtoolsd1/proc/2281/exe/arm/sr10!/usr/bin/ssh-agent!/proc/759/exe1/proc/2180/exe/arm/ro
Source: na.elf, 6295.1.0000564b8518a000.0000564b852d8000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: na.elf, 6295.1.00007ffc247eb000.00007ffc2480c000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
na.elf	21%	ReversingLabs	Linux.Backdoor.Mirai
na.elf	100%	Avira	EXP/ELF.Mirai.Bot.Hua.d

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
srv9.pty.su	38.43.93.83	true	true	unknown
srv3.pty.su	212.34.155.222	true	false	unknown
srv6.pty.su	5.206.227.62	true	false	unknown
srv5.pty.su	107.161.24.95	true	true	unknown
srv4.pty.su	81.4.109.41	true	true	unknown
srv8.pty.su	154.213.192.29	true	true	unknown
srv7.pty.su	185.236.228.87	true	false	unknown
srv2.pty.su	unknown	unknown	false	unknown
srv10.pty.su	unknown	unknown	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
212.34.155.222	srv3.pty.su	Spain	20648	RAN-NETWORKSES	false
5.206.227.62	srv6.pty.su	Portugal	49349	DOTSIPT	false
154.213.192.29	srv8.pty.su	Seychelles	132839	POWERLINE-AS-APPOWERLINEDATACENTERHK	true
38.43.93.83	srv9.pty.su	United States	174	COGENT-174US	true
81.4.109.41	srv4.pty.su	Netherlands	198203	ASN-ROUTELABELNL	true
107.161.24.95	srv5.pty.su	United States	3842	RAMNODEUS	true
102.200.5.10	unknown	unknown	36926	CKL1-ASNKE	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false
185.236.228.87	srv7.pty.su	Portugal	197696	EVOLIX-ASFR	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
5.206.227.62	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Mirai	Browse
154.213.192.29	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Mirai	Browse
38.43.93.83	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Mirai	Browse
81.4.109.41	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse
107.161.24.95	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Mirai	Browse
102.200.5.10	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
srv9.pty.su	na.elf	Get hash	malicious	Mirai	Browse	38.43.93.83
	na.elf	Get hash	malicious	Unknown	Browse	38.43.93.83
	na.elf	Get hash	malicious	Unknown	Browse	38.43.93.83
	na.elf	Get hash	malicious	Unknown	Browse	38.43.93.83
	na.elf	Get hash	malicious	Mirai	Browse	38.43.93.83
	na.elf	Get hash	malicious	Mirai	Browse	38.43.93.83
	na.elf	Get hash	malicious	Unknown	Browse	38.43.93.83
	na.elf	Get hash	malicious	Mirai	Browse	38.43.93.83
	na.elf	Get hash	malicious	Mirai	Browse	38.43.93.83
	na.elf	Get hash	malicious	Mirai	Browse	38.43.93.83
srv6.pty.su	na.elf	Get hash	malicious	Mirai	Browse	5.206.227.62
	na.elf	Get hash	malicious	Mirai	Browse	5.206.227.62
	na.elf	Get hash	malicious	Unknown	Browse	5.206.227.62
	na.elf	Get hash	malicious	Mirai	Browse	5.206.227.62
	na.elf	Get hash	malicious	Mirai	Browse	5.206.227.62
	na.elf	Get hash	malicious	Unknown	Browse	5.206.227.62
	na.elf	Get hash	malicious	Mirai	Browse	5.206.227.62
	na.elf	Get hash	malicious	Unknown	Browse	5.206.227.62
	na.elf	Get hash	malicious	Mirai	Browse	5.206.227.62
srv5.pty.su	na.elf	Get hash	malicious	Unknown	Browse	107.161.24.95
	na.elf	Get hash	malicious	Mirai	Browse	107.161.24.95
	na.elf	Get hash	malicious	Unknown	Browse	107.161.24.95
	na.elf	Get hash	malicious	Unknown	Browse	107.161.24.95
	na.elf	Get hash	malicious	Unknown	Browse	107.161.24.95
	na.elf	Get hash	malicious	Mirai	Browse	107.161.24.95
	na.elf	Get hash	malicious	Unknown	Browse	107.161.24.95
	na.elf	Get hash	malicious	Mirai	Browse	107.161.24.95
	na.elf	Get hash	malicious	Mirai	Browse	107.161.24.95
	na.elf	Get hash	malicious	Mirai	Browse	107.161.24.95
srv3.pty.su	na.elf	Get hash	malicious	Mirai	Browse	81.4.109.66
	na.elf	Get hash	malicious	Unknown	Browse	81.4.109.66
	na.elf	Get hash	malicious	Mirai	Browse	81.4.109.66
	na.elf	Get hash	malicious	Mirai	Browse	81.4.109.66
	na.elf	Get hash	malicious	Mirai	Browse	81.4.109.66
	na.elf	Get hash	malicious	Mirai	Browse	81.4.109.66
	na.elf	Get hash	malicious	Unknown	Browse	81.4.109.66
srv4.pty.su	na.elf	Get hash	malicious	Mirai	Browse	81.4.109.41
	na.elf	Get hash	malicious	Mirai	Browse	81.4.109.41
	na.elf	Get hash	malicious	Mirai	Browse	81.4.109.41
	na.elf	Get hash	malicious	Unknown	Browse	81.4.109.41
	na.elf	Get hash	malicious	Mirai	Browse	81.4.109.41
	na.elf	Get hash	malicious	Mirai	Browse	81.4.109.41

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-ROUTELABELNL	na.elf	Get hash	malicious	Mirai	Browse	81.4.109.66
	na.elf	Get hash	malicious	Unknown	Browse	81.4.109.66
	na.elf	Get hash	malicious	Mirai	Browse	81.4.109.66
	na.elf	Get hash	malicious	Mirai	Browse	81.4.109.66
	na.elf	Get hash	malicious	Mirai	Browse	81.4.109.41
	na.elf	Get hash	malicious	Unknown	Browse	81.4.109.41
	na.elf	Get hash	malicious	Mirai	Browse	81.4.109.66
	na.elf	Get hash	malicious	Mirai	Browse	81.4.109.66
	na.elf	Get hash	malicious	Unknown	Browse	81.4.109.66
	RR1h1iO6W2.exe	Get hash	malicious	FormBook	Browse	81.4.100.198
POWERLINE-AS-APPOWERLINEDATACENTERHK	na.elf	Get hash	malicious	Mirai	Browse	154.213.192.29
	na.elf	Get hash	malicious	Mirai	Browse	154.213.192.29
	na.elf	Get hash	malicious	Unknown	Browse	154.213.192.29
	na.elf	Get hash	malicious	Mirai	Browse	154.213.192.29
	na.elf	Get hash	malicious	Mirai	Browse	156.250.157.119
	na.elf	Get hash	malicious	Unknown	Browse	154.213.192.29
	na.elf	Get hash	malicious	Unknown	Browse	154.213.192.29
	na.elf	Get hash	malicious	Mirai	Browse	156.242.206.26
	na.elf	Get hash	malicious	Unknown	Browse	154.213.192.29
	na.elf	Get hash	malicious	Mirai	Browse	154.213.192.29
COGENT-174US	na.elf	Get hash	malicious	Mirai	Browse	38.63.117.247
	na.elf	Get hash	malicious	Mirai	Browse	38.43.93.83
	na.elf	Get hash	malicious	Unknown	Browse	38.43.93.83
	na.elf	Get hash	malicious	Unknown	Browse	38.43.93.83
	EKTEDIR.exe	Get hash	malicious	FormBook	Browse	206.119.82.148
	na.elf	Get hash	malicious	Mirai	Browse	38.212.110.167
	PI-4009832-2024.xlam.xlsx	Get hash	malicious	Unknown	Browse	154.38.187.47
	na.elf	Get hash	malicious	Unknown	Browse	38.43.93.83
	na.elf	Get hash	malicious	Mirai	Browse	38.43.93.83
	na.elf	Get hash	malicious	Mirai	Browse	38.43.93.83
DOTSIPT	na.elf	Get hash	malicious	Mirai	Browse	5.206.227.62
	na.elf	Get hash	malicious	Mirai	Browse	5.206.227.62
	na.elf	Get hash	malicious	Unknown	Browse	5.206.227.62
	na.elf	Get hash	malicious	Mirai	Browse	5.206.227.62
	na.elf	Get hash	malicious	Mirai	Browse	5.206.227.62
	na.elf	Get hash	malicious	Unknown	Browse	5.206.227.62
	na.elf	Get hash	malicious	Mirai	Browse	5.206.227.62
	na.elf	Get hash	malicious	Unknown	Browse	5.206.227.62
	na.elf	Get hash	malicious	Mirai	Browse	5.206.227.62
	na.elf	Get hash	malicious	Mirai	Browse	5.206.227.62
RAN-NETWORKSES	jQ2ryeS5ZP.exe	Get hash	malicious	PureCrypter, Revenge, CyberGate, DCRat, GuLoader, Njrat, PureLog Stealer	Browse	212.34.150.28
	file.exe	Get hash	malicious	PureCrypter, PureLog Stealer, zgRAT	Browse	212.34.150.28
	file.exe	Get hash	malicious	PureCrypter, PureLog Stealer, zgRAT	Browse	212.34.150.28
	file.exe	Get hash	malicious	PureCrypter	Browse	212.34.150.28
	file.exe	Get hash	malicious	PureCrypter, PureLog Stealer, zgRAT	Browse	212.34.150.28
	t9lNEiD3ui.elf	Get hash	malicious	Mirai	Browse	212.34.153.120

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.971035876614055
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	na.elf
File size:	115'208 bytes
MD5:	4be526bed5d4ce71746e1d72644af298
SHA1:	a31b2ef5db47be857c15778ff0a5fa36353cae72
SHA256:	478488b452c97e8d84c2bc875a61b7e4c2641f3c98b4ac22e844fb40aaab58f2
SHA512:	17427caf28277284930eaf547d6f16b62516021734923a57121fdf57b1b597d10a499ab940c6066e8fe2aee93c14f023d95034cd4b9c3fcaea481bfd3939d4c2
SSDEEP:	3072:AH9pOGav4dDq4zC9dmeM0oOl6aqqah8mcu:AqgxzAoO4admcu
TLSH:	F0B3D64DE964A72DC7E332FFFA5912CE322A0B9CB7EA71219E304B5137C5A956834121
File Content Preview:	.ELF..............(.........4...`.......4. ...(........p...../.../.................................. ... ...........................$....7..........Q.td..................................-...L..................G.F.G.F.G.F.G.F G.F(G.F0G.F8G.F@G.FHG.FPG.FXG.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x81b0
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	114528
Section Header Size:	40
Number of Section Headers:	17
Header String Table Index:	16

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0
.init	PROGBITS	0x80b4	0xb4	0x10	0x0	0x6	AX	0	4
.text	PROGBITS	0x80d0	0xd0	0x18e10	0x0	0x6	AX	0	16
.fini	PROGBITS	0x20ee0	0x18ee0	0x10	0x0	0x6	AX	0	4
.rodata	PROGBITS	0x20ef0	0x18ef0	0x2008	0x0	0x2	A	0	8
.ARM.extab	PROGBITS	0x22ef8	0x1aef8	0x18	0x0	0x2	A	0	4
.ARM.exidx	ARM_EXIDX	0x22f10	0x1af10	0x10	0x0	0x82	AL	2	4
.eh_frame	PROGBITS	0x2b000	0x1b000	0x4	0x0	0x3	WA	0	4
.init_array	INIT_ARRAY	0x2b004	0x1b004	0x4	0x0	0x3	WA	0	4
.fini_array	FINI_ARRAY	0x2b008	0x1b008	0x4	0x0	0x3	WA	0	4
.jcr	PROGBITS	0x2b00c	0x1b00c	0x4	0x0	0x3	WA	0	4
.got	PROGBITS	0x2b010	0x1b010	0x74	0x4	0x3	WA	0	4
.data	PROGBITS	0x2b084	0x1b084	0x2a0	0x0	0x3	WA	0	4
.bss	NOBITS	0x2b324	0x1b324	0x34b8	0x0	0x3	WA	0	4
.comment	PROGBITS	0x0	0x1b324	0xb9e	0x0	0x0		0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x1bec2	0x10	0x0	0x0		0	1
.shstrtab	STRTAB	0x0	0x1bed2	0x8b	0x0	0x0		0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x1af10	0x22f10	0x22f10	0x10	0x10	2.4056	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x1af20	0x1af20	5.9469	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x1b000	0x2b000	0x2b000	0x324	0x37dc	3.8070	0x6	RW	0x8000	.eh_frame .init_array .fini_array .jcr .got .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 11, 2024 11:10:05.390605927 CEST	44206	24	192.168.2.23	102.200.5.10
Oct 11, 2024 11:10:05.397047043 CEST	24	44206	102.200.5.10	192.168.2.23
Oct 11, 2024 11:10:05.397150040 CEST	44206	24	192.168.2.23	102.200.5.10
Oct 11, 2024 11:10:05.409286022 CEST	44206	24	192.168.2.23	102.200.5.10
Oct 11, 2024 11:10:05.414423943 CEST	24	44206	102.200.5.10	192.168.2.23
Oct 11, 2024 11:10:05.414513111 CEST	44206	24	192.168.2.23	102.200.5.10
Oct 11, 2024 11:10:05.419589996 CEST	24	44206	102.200.5.10	192.168.2.23
Oct 11, 2024 11:10:08.595208883 CEST	42836	443	192.168.2.23	91.189.91.43
Oct 11, 2024 11:10:15.412221909 CEST	44206	24	192.168.2.23	102.200.5.10
Oct 11, 2024 11:10:15.417732000 CEST	24	44206	102.200.5.10	192.168.2.23
Oct 11, 2024 11:10:24.720900059 CEST	43928	443	192.168.2.23	91.189.91.42
Oct 11, 2024 11:10:26.800185919 CEST	24	44206	102.200.5.10	192.168.2.23
Oct 11, 2024 11:10:26.800573111 CEST	44206	24	192.168.2.23	102.200.5.10
Oct 11, 2024 11:10:26.808711052 CEST	24	44206	102.200.5.10	192.168.2.23
Oct 11, 2024 11:10:27.850064993 CEST	47854	33400	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:27.854976892 CEST	33400	47854	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:27.855077982 CEST	47854	33400	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:27.855830908 CEST	47854	33400	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:27.860722065 CEST	33400	47854	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:27.860805988 CEST	47854	33400	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:27.865664005 CEST	33400	47854	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:28.509469032 CEST	33400	47854	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:28.509954929 CEST	47854	33400	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:28.514981031 CEST	33400	47854	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:28.816293001 CEST	42516	80	192.168.2.23	109.202.202.202
Oct 11, 2024 11:10:29.554271936 CEST	47856	33400	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:29.559364080 CEST	33400	47856	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:29.559429884 CEST	47856	33400	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:29.560029030 CEST	47856	33400	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:29.564964056 CEST	33400	47856	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:29.565012932 CEST	47856	33400	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:29.569827080 CEST	33400	47856	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:30.213191032 CEST	33400	47856	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:30.213407993 CEST	47856	33400	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:30.218735933 CEST	33400	47856	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:31.273740053 CEST	47858	33400	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:31.278614044 CEST	33400	47858	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:31.278678894 CEST	47858	33400	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:31.279350042 CEST	47858	33400	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:31.284395933 CEST	33400	47858	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:31.284463882 CEST	47858	33400	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:31.289607048 CEST	33400	47858	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:31.934953928 CEST	33400	47858	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:31.935286045 CEST	47858	33400	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:31.940196037 CEST	33400	47858	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:32.978132010 CEST	47860	33400	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:32.983088017 CEST	33400	47860	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:32.983160973 CEST	47860	33400	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:32.984265089 CEST	47860	33400	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:32.989119053 CEST	33400	47860	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:32.989187956 CEST	47860	33400	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:32.994153023 CEST	33400	47860	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:33.677134991 CEST	33400	47860	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:33.677303076 CEST	47860	33400	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:33.682291031 CEST	33400	47860	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:34.696960926 CEST	52242	33407	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:34.702200890 CEST	33407	52242	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:34.702303886 CEST	52242	33407	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:34.702965975 CEST	52242	33407	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:34.707865000 CEST	33407	52242	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:34.707936049 CEST	52242	33407	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:34.712987900 CEST	33407	52242	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:34.959503889 CEST	42836	443	192.168.2.23	91.189.91.43
Oct 11, 2024 11:10:35.363076925 CEST	33407	52242	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:35.363338947 CEST	52242	33407	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:35.368397951 CEST	33407	52242	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:36.405764103 CEST	52244	33407	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:36.410588026 CEST	33407	52244	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:36.410712957 CEST	52244	33407	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:36.411596060 CEST	52244	33407	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:36.416357994 CEST	33407	52244	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:36.416429043 CEST	52244	33407	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:36.421214104 CEST	33407	52244	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:37.233616114 CEST	33407	52244	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:37.234038115 CEST	52244	33407	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:37.242130995 CEST	33407	52244	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:38.283373117 CEST	52246	33407	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:38.288463116 CEST	33407	52246	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:38.288578033 CEST	52246	33407	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:38.289495945 CEST	52246	33407	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:38.294475079 CEST	33407	52246	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:38.294540882 CEST	52246	33407	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:38.299607992 CEST	33407	52246	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:43.701391935 CEST	33407	52246	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:43.701842070 CEST	52246	33407	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:43.706876040 CEST	33407	52246	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:44.716012001 CEST	49340	33402	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:44.721298933 CEST	33402	49340	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:44.721429110 CEST	49340	33402	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:44.722346067 CEST	49340	33402	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:44.727253914 CEST	33402	49340	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:44.727329969 CEST	49340	33402	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:44.733489037 CEST	33402	49340	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:45.365120888 CEST	33402	49340	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:45.365550995 CEST	49340	33402	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:45.370603085 CEST	33402	49340	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:46.408164024 CEST	49342	33402	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:46.413697958 CEST	33402	49342	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:46.413832903 CEST	49342	33402	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:46.414565086 CEST	49342	33402	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:46.420087099 CEST	33402	49342	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:46.420156956 CEST	49342	33402	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:46.426235914 CEST	33402	49342	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:47.087909937 CEST	33402	49342	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:47.088378906 CEST	49342	33402	192.168.2.23	5.206.227.62
Oct 11, 2024 11:10:47.093310118 CEST	33402	49342	5.206.227.62	192.168.2.23
Oct 11, 2024 11:10:48.101891994 CEST	41492	33400	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:48.108212948 CEST	33400	41492	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:48.108263016 CEST	41492	33400	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:48.108845949 CEST	41492	33400	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:48.115709066 CEST	33400	41492	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:48.115756989 CEST	41492	33400	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:48.122308969 CEST	33400	41492	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:51.521738052 CEST	33400	41492	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:51.522089005 CEST	41492	33400	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:51.526962996 CEST	33400	41492	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:52.568977118 CEST	41494	33400	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:52.573879004 CEST	33400	41494	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:52.573951006 CEST	41494	33400	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:52.574871063 CEST	41494	33400	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:52.579890013 CEST	33400	41494	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:52.579953909 CEST	41494	33400	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:52.584954977 CEST	33400	41494	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:53.244862080 CEST	33400	41494	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:53.245115995 CEST	41494	33400	192.168.2.23	38.43.93.83
Oct 11, 2024 11:10:53.250123024 CEST	33400	41494	38.43.93.83	192.168.2.23
Oct 11, 2024 11:10:54.275923967 CEST	54014	33405	192.168.2.23	81.4.109.41
Oct 11, 2024 11:10:54.281028032 CEST	33405	54014	81.4.109.41	192.168.2.23
Oct 11, 2024 11:10:54.281222105 CEST	54014	33405	192.168.2.23	81.4.109.41
Oct 11, 2024 11:10:54.282315016 CEST	54014	33405	192.168.2.23	81.4.109.41
Oct 11, 2024 11:10:54.288922071 CEST	33405	54014	81.4.109.41	192.168.2.23
Oct 11, 2024 11:10:54.289001942 CEST	54014	33405	192.168.2.23	81.4.109.41
Oct 11, 2024 11:10:54.300878048 CEST	33405	54014	81.4.109.41	192.168.2.23
Oct 11, 2024 11:10:54.943254948 CEST	33405	54014	81.4.109.41	192.168.2.23
Oct 11, 2024 11:10:54.943646908 CEST	54014	33405	192.168.2.23	81.4.109.41
Oct 11, 2024 11:10:54.948762894 CEST	33405	54014	81.4.109.41	192.168.2.23
Oct 11, 2024 11:10:55.957627058 CEST	41044	33408	192.168.2.23	154.213.192.29
Oct 11, 2024 11:10:55.962605000 CEST	33408	41044	154.213.192.29	192.168.2.23
Oct 11, 2024 11:10:55.962686062 CEST	41044	33408	192.168.2.23	154.213.192.29
Oct 11, 2024 11:10:55.963687897 CEST	41044	33408	192.168.2.23	154.213.192.29
Oct 11, 2024 11:10:55.968569040 CEST	33408	41044	154.213.192.29	192.168.2.23
Oct 11, 2024 11:10:55.968636990 CEST	41044	33408	192.168.2.23	154.213.192.29
Oct 11, 2024 11:10:55.973814964 CEST	33408	41044	154.213.192.29	192.168.2.23
Oct 11, 2024 11:10:56.487663984 CEST	33408	41044	154.213.192.29	192.168.2.23
Oct 11, 2024 11:10:56.487884045 CEST	41044	33408	192.168.2.23	154.213.192.29
Oct 11, 2024 11:10:56.492891073 CEST	33408	41044	154.213.192.29	192.168.2.23
Oct 11, 2024 11:10:57.500704050 CEST	48036	33403	192.168.2.23	154.213.192.29
Oct 11, 2024 11:10:57.505750895 CEST	33403	48036	154.213.192.29	192.168.2.23
Oct 11, 2024 11:10:57.505872011 CEST	48036	33403	192.168.2.23	154.213.192.29
Oct 11, 2024 11:10:57.506824970 CEST	48036	33403	192.168.2.23	154.213.192.29
Oct 11, 2024 11:10:57.511850119 CEST	33403	48036	154.213.192.29	192.168.2.23
Oct 11, 2024 11:10:57.511923075 CEST	48036	33403	192.168.2.23	154.213.192.29
Oct 11, 2024 11:10:57.516793966 CEST	33403	48036	154.213.192.29	192.168.2.23
Oct 11, 2024 11:10:58.041820049 CEST	33403	48036	154.213.192.29	192.168.2.23
Oct 11, 2024 11:10:58.042104006 CEST	48036	33403	192.168.2.23	154.213.192.29
Oct 11, 2024 11:10:58.047291994 CEST	33403	48036	154.213.192.29	192.168.2.23
Oct 11, 2024 11:10:59.071672916 CEST	38956	33404	192.168.2.23	81.4.109.41
Oct 11, 2024 11:10:59.076596975 CEST	33404	38956	81.4.109.41	192.168.2.23
Oct 11, 2024 11:10:59.076642990 CEST	38956	33404	192.168.2.23	81.4.109.41
Oct 11, 2024 11:10:59.077301025 CEST	38956	33404	192.168.2.23	81.4.109.41
Oct 11, 2024 11:10:59.082113981 CEST	33404	38956	81.4.109.41	192.168.2.23
Oct 11, 2024 11:10:59.082155943 CEST	38956	33404	192.168.2.23	81.4.109.41
Oct 11, 2024 11:10:59.087187052 CEST	33404	38956	81.4.109.41	192.168.2.23
Oct 11, 2024 11:10:59.723453045 CEST	33404	38956	81.4.109.41	192.168.2.23
Oct 11, 2024 11:10:59.723730087 CEST	38956	33404	192.168.2.23	81.4.109.41
Oct 11, 2024 11:10:59.728724003 CEST	33404	38956	81.4.109.41	192.168.2.23
Oct 11, 2024 11:11:00.743037939 CEST	40910	33405	192.168.2.23	107.161.24.95
Oct 11, 2024 11:11:00.747988939 CEST	33405	40910	107.161.24.95	192.168.2.23
Oct 11, 2024 11:11:00.748070002 CEST	40910	33405	192.168.2.23	107.161.24.95
Oct 11, 2024 11:11:00.748819113 CEST	40910	33405	192.168.2.23	107.161.24.95
Oct 11, 2024 11:11:00.753762007 CEST	33405	40910	107.161.24.95	192.168.2.23
Oct 11, 2024 11:11:00.753832102 CEST	40910	33405	192.168.2.23	107.161.24.95
Oct 11, 2024 11:11:00.758835077 CEST	33405	40910	107.161.24.95	192.168.2.23
Oct 11, 2024 11:11:05.675235987 CEST	43928	443	192.168.2.23	91.189.91.42
Oct 11, 2024 11:11:14.162147999 CEST	33405	40910	107.161.24.95	192.168.2.23
Oct 11, 2024 11:11:14.162322044 CEST	40910	33405	192.168.2.23	107.161.24.95
Oct 11, 2024 11:11:14.167437077 CEST	33405	40910	107.161.24.95	192.168.2.23
Oct 11, 2024 11:11:15.175168991 CEST	42756	33410	192.168.2.23	154.213.192.29
Oct 11, 2024 11:11:15.180190086 CEST	33410	42756	154.213.192.29	192.168.2.23
Oct 11, 2024 11:11:15.180263042 CEST	42756	33410	192.168.2.23	154.213.192.29
Oct 11, 2024 11:11:15.181231976 CEST	42756	33410	192.168.2.23	154.213.192.29
Oct 11, 2024 11:11:15.186135054 CEST	33410	42756	154.213.192.29	192.168.2.23
Oct 11, 2024 11:11:15.186177969 CEST	42756	33410	192.168.2.23	154.213.192.29
Oct 11, 2024 11:11:15.190992117 CEST	33410	42756	154.213.192.29	192.168.2.23
Oct 11, 2024 11:11:15.709544897 CEST	33410	42756	154.213.192.29	192.168.2.23
Oct 11, 2024 11:11:15.709806919 CEST	42756	33410	192.168.2.23	154.213.192.29
Oct 11, 2024 11:11:15.714689970 CEST	33410	42756	154.213.192.29	192.168.2.23
Oct 11, 2024 11:11:16.752002954 CEST	42758	33410	192.168.2.23	154.213.192.29
Oct 11, 2024 11:11:16.757101059 CEST	33410	42758	154.213.192.29	192.168.2.23
Oct 11, 2024 11:11:16.757234097 CEST	42758	33410	192.168.2.23	154.213.192.29
Oct 11, 2024 11:11:16.758147001 CEST	42758	33410	192.168.2.23	154.213.192.29
Oct 11, 2024 11:11:16.763107061 CEST	33410	42758	154.213.192.29	192.168.2.23
Oct 11, 2024 11:11:16.763174057 CEST	42758	33410	192.168.2.23	154.213.192.29
Oct 11, 2024 11:11:16.768542051 CEST	33410	42758	154.213.192.29	192.168.2.23
Oct 11, 2024 11:11:17.419989109 CEST	33410	42758	154.213.192.29	192.168.2.23
Oct 11, 2024 11:11:17.420345068 CEST	42758	33410	192.168.2.23	154.213.192.29
Oct 11, 2024 11:11:17.425266027 CEST	33410	42758	154.213.192.29	192.168.2.23
Oct 11, 2024 11:11:18.434731007 CEST	41060	33410	192.168.2.23	185.236.228.87
Oct 11, 2024 11:11:18.439707994 CEST	33410	41060	185.236.228.87	192.168.2.23
Oct 11, 2024 11:11:18.439785004 CEST	41060	33410	192.168.2.23	185.236.228.87
Oct 11, 2024 11:11:18.440530062 CEST	41060	33410	192.168.2.23	185.236.228.87
Oct 11, 2024 11:11:18.445399046 CEST	33410	41060	185.236.228.87	192.168.2.23
Oct 11, 2024 11:11:18.445574045 CEST	41060	33410	192.168.2.23	185.236.228.87
Oct 11, 2024 11:11:18.450495958 CEST	33410	41060	185.236.228.87	192.168.2.23
Oct 11, 2024 11:11:19.105283976 CEST	33410	41060	185.236.228.87	192.168.2.23
Oct 11, 2024 11:11:19.105602980 CEST	41060	33410	192.168.2.23	185.236.228.87
Oct 11, 2024 11:11:19.110716105 CEST	33410	41060	185.236.228.87	192.168.2.23
Oct 11, 2024 11:11:20.123647928 CEST	44356	33408	192.168.2.23	81.4.109.41
Oct 11, 2024 11:11:20.128835917 CEST	33408	44356	81.4.109.41	192.168.2.23
Oct 11, 2024 11:11:20.128947973 CEST	44356	33408	192.168.2.23	81.4.109.41
Oct 11, 2024 11:11:20.129620075 CEST	44356	33408	192.168.2.23	81.4.109.41
Oct 11, 2024 11:11:20.134644032 CEST	33408	44356	81.4.109.41	192.168.2.23
Oct 11, 2024 11:11:20.134718895 CEST	44356	33408	192.168.2.23	81.4.109.41
Oct 11, 2024 11:11:20.139847040 CEST	33408	44356	81.4.109.41	192.168.2.23
Oct 11, 2024 11:11:20.785492897 CEST	33408	44356	81.4.109.41	192.168.2.23
Oct 11, 2024 11:11:20.785799980 CEST	44356	33408	192.168.2.23	81.4.109.41
Oct 11, 2024 11:11:20.790838957 CEST	33408	44356	81.4.109.41	192.168.2.23
Oct 11, 2024 11:11:21.839662075 CEST	44358	33408	192.168.2.23	81.4.109.41
Oct 11, 2024 11:11:21.844729900 CEST	33408	44358	81.4.109.41	192.168.2.23
Oct 11, 2024 11:11:21.844819069 CEST	44358	33408	192.168.2.23	81.4.109.41
Oct 11, 2024 11:11:21.847529888 CEST	44358	33408	192.168.2.23	81.4.109.41
Oct 11, 2024 11:11:21.852427006 CEST	33408	44358	81.4.109.41	192.168.2.23
Oct 11, 2024 11:11:21.852480888 CEST	44358	33408	192.168.2.23	81.4.109.41
Oct 11, 2024 11:11:21.857434034 CEST	33408	44358	81.4.109.41	192.168.2.23
Oct 11, 2024 11:11:22.485681057 CEST	33408	44358	81.4.109.41	192.168.2.23
Oct 11, 2024 11:11:22.485999107 CEST	44358	33408	192.168.2.23	81.4.109.41
Oct 11, 2024 11:11:22.491142035 CEST	33408	44358	81.4.109.41	192.168.2.23
Oct 11, 2024 11:11:23.500524998 CEST	46890	33402	192.168.2.23	38.43.93.83
Oct 11, 2024 11:11:23.505762100 CEST	33402	46890	38.43.93.83	192.168.2.23
Oct 11, 2024 11:11:23.505826950 CEST	46890	33402	192.168.2.23	38.43.93.83
Oct 11, 2024 11:11:23.506850004 CEST	46890	33402	192.168.2.23	38.43.93.83
Oct 11, 2024 11:11:23.511810064 CEST	33402	46890	38.43.93.83	192.168.2.23
Oct 11, 2024 11:11:23.511868954 CEST	46890	33402	192.168.2.23	38.43.93.83
Oct 11, 2024 11:11:23.516916037 CEST	33402	46890	38.43.93.83	192.168.2.23
Oct 11, 2024 11:11:24.166917086 CEST	33402	46890	38.43.93.83	192.168.2.23
Oct 11, 2024 11:11:24.167171001 CEST	46890	33402	192.168.2.23	38.43.93.83
Oct 11, 2024 11:11:24.172216892 CEST	33402	46890	38.43.93.83	192.168.2.23
Oct 11, 2024 11:11:25.197321892 CEST	41182	33408	192.168.2.23	107.161.24.95
Oct 11, 2024 11:11:25.202351093 CEST	33408	41182	107.161.24.95	192.168.2.23
Oct 11, 2024 11:11:25.202472925 CEST	41182	33408	192.168.2.23	107.161.24.95
Oct 11, 2024 11:11:25.203233004 CEST	41182	33408	192.168.2.23	107.161.24.95
Oct 11, 2024 11:11:25.208208084 CEST	33408	41182	107.161.24.95	192.168.2.23
Oct 11, 2024 11:11:25.208280087 CEST	41182	33408	192.168.2.23	107.161.24.95
Oct 11, 2024 11:11:25.213182926 CEST	33408	41182	107.161.24.95	192.168.2.23
Oct 11, 2024 11:11:46.595374107 CEST	33408	41182	107.161.24.95	192.168.2.23
Oct 11, 2024 11:11:46.596121073 CEST	41182	33408	192.168.2.23	107.161.24.95
Oct 11, 2024 11:11:46.601134062 CEST	33408	41182	107.161.24.95	192.168.2.23
Oct 11, 2024 11:11:47.609680891 CEST	53056	33405	192.168.2.23	212.34.155.222
Oct 11, 2024 11:11:47.614612103 CEST	33405	53056	212.34.155.222	192.168.2.23
Oct 11, 2024 11:11:47.614727020 CEST	53056	33405	192.168.2.23	212.34.155.222
Oct 11, 2024 11:11:47.615767002 CEST	53056	33405	192.168.2.23	212.34.155.222
Oct 11, 2024 11:11:47.620691061 CEST	33405	53056	212.34.155.222	192.168.2.23
Oct 11, 2024 11:11:47.620790958 CEST	53056	33405	192.168.2.23	212.34.155.222
Oct 11, 2024 11:11:47.625735044 CEST	33405	53056	212.34.155.222	192.168.2.23
Oct 11, 2024 11:12:07.627491951 CEST	53056	33405	192.168.2.23	212.34.155.222
Oct 11, 2024 11:12:07.632539034 CEST	33405	53056	212.34.155.222	192.168.2.23
Oct 11, 2024 11:12:09.011584044 CEST	33405	53056	212.34.155.222	192.168.2.23
Oct 11, 2024 11:12:09.011864901 CEST	53056	33405	192.168.2.23	212.34.155.222
Oct 11, 2024 11:12:09.016773939 CEST	33405	53056	212.34.155.222	192.168.2.23

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 11, 2024 11:10:05.302380085 CEST	34205	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:05.322132111 CEST	53	34205	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:05.328303099 CEST	57124	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:05.335818052 CEST	53	57124	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:05.345319986 CEST	42577	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:05.351923943 CEST	53	42577	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:05.363879919 CEST	45781	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:05.376066923 CEST	53	45781	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:05.376754999 CEST	52871	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:05.388961077 CEST	53	52871	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:27.803333044 CEST	52742	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:27.810636044 CEST	53	52742	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:27.811378956 CEST	44019	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:27.819020033 CEST	53	44019	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:27.820108891 CEST	46162	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:27.827598095 CEST	53	46162	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:27.828731060 CEST	36280	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:27.835900068 CEST	53	36280	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:27.836724997 CEST	39997	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:27.849344015 CEST	53	39997	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:29.511820078 CEST	41433	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:29.519875050 CEST	53	41433	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:29.520720959 CEST	39677	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:29.527420044 CEST	53	39677	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:29.528485060 CEST	49200	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:29.539429903 CEST	53	49200	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:29.540142059 CEST	58691	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:29.546540976 CEST	53	58691	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:29.547338009 CEST	58572	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:29.553844929 CEST	53	58572	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:31.215521097 CEST	51603	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:31.222666025 CEST	53	51603	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:31.223721981 CEST	59391	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:31.237154007 CEST	53	59391	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:31.238282919 CEST	38188	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:31.250011921 CEST	53	38188	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:31.250996113 CEST	36011	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:31.264478922 CEST	53	36011	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:31.265340090 CEST	44063	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:31.273111105 CEST	53	44063	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:32.937838078 CEST	41875	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:32.945327997 CEST	53	41875	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:32.946450949 CEST	58086	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:32.953526020 CEST	53	58086	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:32.954616070 CEST	41589	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:32.961198092 CEST	53	41589	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:32.962198019 CEST	55151	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:32.969264984 CEST	53	55151	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:32.970335007 CEST	52456	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:32.977608919 CEST	53	52456	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:34.678932905 CEST	54829	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:34.696485043 CEST	53	54829	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:36.365720987 CEST	38861	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:36.373621941 CEST	53	38861	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:36.374690056 CEST	36725	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:36.381308079 CEST	53	36725	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:36.382208109 CEST	32936	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:36.389405012 CEST	53	32936	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:36.390327930 CEST	44176	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:36.397808075 CEST	53	44176	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:36.398742914 CEST	44902	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:36.405296087 CEST	53	44902	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:38.236628056 CEST	45490	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:38.245836020 CEST	53	45490	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:38.246876001 CEST	33029	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:38.256211042 CEST	53	33029	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:38.257206917 CEST	46560	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:38.267462015 CEST	53	46560	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:38.268124104 CEST	33858	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:38.274931908 CEST	53	33858	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:38.275599003 CEST	60522	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:38.283015966 CEST	53	60522	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:44.704413891 CEST	48256	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:44.715337992 CEST	53	48256	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:46.367456913 CEST	43666	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:46.373843908 CEST	53	43666	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:46.374593019 CEST	48146	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:46.382100105 CEST	53	48146	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:46.382901907 CEST	57525	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:46.391176939 CEST	53	57525	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:46.391916037 CEST	33655	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:46.399625063 CEST	53	33655	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:46.400279999 CEST	36503	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:46.407774925 CEST	53	36503	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:48.091028929 CEST	60204	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:48.101484060 CEST	53	60204	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:52.524279118 CEST	39825	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:52.531909943 CEST	53	39825	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:52.532807112 CEST	57204	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:52.539655924 CEST	53	57204	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:52.540643930 CEST	58941	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:52.552670002 CEST	53	58941	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:52.553797007 CEST	33172	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:52.560967922 CEST	53	33172	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:52.561994076 CEST	52085	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:52.568576097 CEST	53	52085	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:54.247493982 CEST	50498	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:54.254653931 CEST	53	50498	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:54.255953074 CEST	58969	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:54.263442039 CEST	53	58969	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:54.264465094 CEST	43834	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:54.275247097 CEST	53	43834	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:55.946420908 CEST	53482	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:55.956954956 CEST	53	53482	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:57.490240097 CEST	60988	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:57.500330925 CEST	53	60988	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:59.044226885 CEST	52804	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:59.051625013 CEST	53	52804	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:59.052342892 CEST	48767	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:59.059514999 CEST	53	48767	8.8.8.8	192.168.2.23
Oct 11, 2024 11:10:59.060261011 CEST	34327	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:10:59.071285963 CEST	53	34327	8.8.8.8	192.168.2.23
Oct 11, 2024 11:11:00.731739998 CEST	37245	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:11:00.742403984 CEST	53	37245	8.8.8.8	192.168.2.23
Oct 11, 2024 11:11:15.164429903 CEST	60231	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:11:15.174535990 CEST	53	60231	8.8.8.8	192.168.2.23
Oct 11, 2024 11:11:16.712450981 CEST	48547	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:11:16.719293118 CEST	53	48547	8.8.8.8	192.168.2.23
Oct 11, 2024 11:11:16.720369101 CEST	47206	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:11:16.727113008 CEST	53	47206	8.8.8.8	192.168.2.23
Oct 11, 2024 11:11:16.728074074 CEST	45648	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:11:16.734662056 CEST	53	45648	8.8.8.8	192.168.2.23
Oct 11, 2024 11:11:16.735622883 CEST	34106	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:11:16.743151903 CEST	53	34106	8.8.8.8	192.168.2.23
Oct 11, 2024 11:11:16.744359016 CEST	59496	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:11:16.751512051 CEST	53	59496	8.8.8.8	192.168.2.23
Oct 11, 2024 11:11:18.422621965 CEST	52379	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:11:18.433969975 CEST	53	52379	8.8.8.8	192.168.2.23
Oct 11, 2024 11:11:20.107495070 CEST	46123	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:11:20.115202904 CEST	53	46123	8.8.8.8	192.168.2.23
Oct 11, 2024 11:11:20.116096020 CEST	40911	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:11:20.123261929 CEST	53	40911	8.8.8.8	192.168.2.23
Oct 11, 2024 11:11:21.788614988 CEST	44920	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:11:21.795494080 CEST	53	44920	8.8.8.8	192.168.2.23
Oct 11, 2024 11:11:21.798367023 CEST	42240	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:11:21.805358887 CEST	53	42240	8.8.8.8	192.168.2.23
Oct 11, 2024 11:11:21.811645985 CEST	59065	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:11:21.818614006 CEST	53	59065	8.8.8.8	192.168.2.23
Oct 11, 2024 11:11:21.821078062 CEST	59939	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:11:21.827721119 CEST	53	59939	8.8.8.8	192.168.2.23
Oct 11, 2024 11:11:21.830563068 CEST	40379	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:11:21.837656975 CEST	53	40379	8.8.8.8	192.168.2.23
Oct 11, 2024 11:11:23.488281965 CEST	42501	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:11:23.499970913 CEST	53	42501	8.8.8.8	192.168.2.23
Oct 11, 2024 11:11:25.169538021 CEST	41621	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:11:25.177103043 CEST	53	41621	8.8.8.8	192.168.2.23
Oct 11, 2024 11:11:25.177948952 CEST	39652	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:11:25.185162067 CEST	53	39652	8.8.8.8	192.168.2.23
Oct 11, 2024 11:11:25.185939074 CEST	55362	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:11:25.196763992 CEST	53	55362	8.8.8.8	192.168.2.23
Oct 11, 2024 11:11:47.599112988 CEST	52587	53	192.168.2.23	8.8.8.8
Oct 11, 2024 11:11:47.609041929 CEST	53	52587	8.8.8.8	192.168.2.23

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 11, 2024 11:10:05.302380085 CEST	192.168.2.23	8.8.8.8	0x83b6	Standard query (0)	srv3.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:05.328303099 CEST	192.168.2.23	8.8.8.8	0x83b6	Standard query (0)	srv3.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:05.345319986 CEST	192.168.2.23	8.8.8.8	0x83b6	Standard query (0)	srv3.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:05.363879919 CEST	192.168.2.23	8.8.8.8	0x83b6	Standard query (0)	srv3.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:05.376754999 CEST	192.168.2.23	8.8.8.8	0x83b6	Standard query (0)	srv3.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:27.803333044 CEST	192.168.2.23	8.8.8.8	0xe64c	Standard query (0)	srv6.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:27.811378956 CEST	192.168.2.23	8.8.8.8	0xe64c	Standard query (0)	srv6.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:27.820108891 CEST	192.168.2.23	8.8.8.8	0xe64c	Standard query (0)	srv6.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:27.828731060 CEST	192.168.2.23	8.8.8.8	0xe64c	Standard query (0)	srv6.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:27.836724997 CEST	192.168.2.23	8.8.8.8	0xe64c	Standard query (0)	srv6.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:29.511820078 CEST	192.168.2.23	8.8.8.8	0xc3b2	Standard query (0)	srv4.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:29.520720959 CEST	192.168.2.23	8.8.8.8	0xc3b2	Standard query (0)	srv4.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:29.528485060 CEST	192.168.2.23	8.8.8.8	0xc3b2	Standard query (0)	srv4.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:29.540142059 CEST	192.168.2.23	8.8.8.8	0xc3b2	Standard query (0)	srv4.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:29.547338009 CEST	192.168.2.23	8.8.8.8	0xc3b2	Standard query (0)	srv4.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:31.215521097 CEST	192.168.2.23	8.8.8.8	0x64df	Standard query (0)	srv7.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:31.223721981 CEST	192.168.2.23	8.8.8.8	0x64df	Standard query (0)	srv7.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:31.238282919 CEST	192.168.2.23	8.8.8.8	0x64df	Standard query (0)	srv7.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:31.250996113 CEST	192.168.2.23	8.8.8.8	0x64df	Standard query (0)	srv7.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:31.265340090 CEST	192.168.2.23	8.8.8.8	0x64df	Standard query (0)	srv7.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:32.937838078 CEST	192.168.2.23	8.8.8.8	0x9ff7	Standard query (0)	srv10.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:32.946450949 CEST	192.168.2.23	8.8.8.8	0x9ff7	Standard query (0)	srv10.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:32.954616070 CEST	192.168.2.23	8.8.8.8	0x9ff7	Standard query (0)	srv10.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:32.962198019 CEST	192.168.2.23	8.8.8.8	0x9ff7	Standard query (0)	srv10.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:32.970335007 CEST	192.168.2.23	8.8.8.8	0x9ff7	Standard query (0)	srv10.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:34.678932905 CEST	192.168.2.23	8.8.8.8	0x6fc8	Standard query (0)	srv9.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:36.365720987 CEST	192.168.2.23	8.8.8.8	0xacf5	Standard query (0)	srv2.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:36.374690056 CEST	192.168.2.23	8.8.8.8	0xacf5	Standard query (0)	srv2.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:36.382208109 CEST	192.168.2.23	8.8.8.8	0xacf5	Standard query (0)	srv2.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:36.390327930 CEST	192.168.2.23	8.8.8.8	0xacf5	Standard query (0)	srv2.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:36.398742914 CEST	192.168.2.23	8.8.8.8	0xacf5	Standard query (0)	srv2.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:38.236628056 CEST	192.168.2.23	8.8.8.8	0xa188	Standard query (0)	srv2.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:38.246876001 CEST	192.168.2.23	8.8.8.8	0xa188	Standard query (0)	srv2.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:38.257206917 CEST	192.168.2.23	8.8.8.8	0xa188	Standard query (0)	srv2.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:38.268124104 CEST	192.168.2.23	8.8.8.8	0xa188	Standard query (0)	srv2.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:38.275599003 CEST	192.168.2.23	8.8.8.8	0xa188	Standard query (0)	srv2.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:44.704413891 CEST	192.168.2.23	8.8.8.8	0xe90d	Standard query (0)	srv6.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:46.367456913 CEST	192.168.2.23	8.8.8.8	0x6591	Standard query (0)	srv2.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:46.374593019 CEST	192.168.2.23	8.8.8.8	0x6591	Standard query (0)	srv2.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:46.382901907 CEST	192.168.2.23	8.8.8.8	0x6591	Standard query (0)	srv2.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:46.391916037 CEST	192.168.2.23	8.8.8.8	0x6591	Standard query (0)	srv2.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:46.400279999 CEST	192.168.2.23	8.8.8.8	0x6591	Standard query (0)	srv2.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:48.091028929 CEST	192.168.2.23	8.8.8.8	0x296d	Standard query (0)	srv9.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:52.524279118 CEST	192.168.2.23	8.8.8.8	0xf06b	Standard query (0)	srv3.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:52.532807112 CEST	192.168.2.23	8.8.8.8	0xf06b	Standard query (0)	srv3.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:52.540643930 CEST	192.168.2.23	8.8.8.8	0xf06b	Standard query (0)	srv3.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:52.553797007 CEST	192.168.2.23	8.8.8.8	0xf06b	Standard query (0)	srv3.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:52.561994076 CEST	192.168.2.23	8.8.8.8	0xf06b	Standard query (0)	srv3.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:54.247493982 CEST	192.168.2.23	8.8.8.8	0x8f65	Standard query (0)	srv4.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:54.255953074 CEST	192.168.2.23	8.8.8.8	0x8f65	Standard query (0)	srv4.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:54.264465094 CEST	192.168.2.23	8.8.8.8	0x8f65	Standard query (0)	srv4.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:55.946420908 CEST	192.168.2.23	8.8.8.8	0x8412	Standard query (0)	srv8.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:57.490240097 CEST	192.168.2.23	8.8.8.8	0xd165	Standard query (0)	srv8.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:59.044226885 CEST	192.168.2.23	8.8.8.8	0x73a9	Standard query (0)	srv4.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:59.052342892 CEST	192.168.2.23	8.8.8.8	0x73a9	Standard query (0)	srv4.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:59.060261011 CEST	192.168.2.23	8.8.8.8	0x73a9	Standard query (0)	srv4.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:00.731739998 CEST	192.168.2.23	8.8.8.8	0x5aae	Standard query (0)	srv5.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:15.164429903 CEST	192.168.2.23	8.8.8.8	0xc1e8	Standard query (0)	srv8.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:16.712450981 CEST	192.168.2.23	8.8.8.8	0x15ae	Standard query (0)	srv10.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:16.720369101 CEST	192.168.2.23	8.8.8.8	0x15ae	Standard query (0)	srv10.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:16.728074074 CEST	192.168.2.23	8.8.8.8	0x15ae	Standard query (0)	srv10.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:16.735622883 CEST	192.168.2.23	8.8.8.8	0x15ae	Standard query (0)	srv10.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:16.744359016 CEST	192.168.2.23	8.8.8.8	0x15ae	Standard query (0)	srv10.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:18.422621965 CEST	192.168.2.23	8.8.8.8	0x8497	Standard query (0)	srv7.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:20.107495070 CEST	192.168.2.23	8.8.8.8	0x8b04	Standard query (0)	srv4.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:20.116096020 CEST	192.168.2.23	8.8.8.8	0x8b04	Standard query (0)	srv4.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:21.788614988 CEST	192.168.2.23	8.8.8.8	0xea99	Standard query (0)	srv3.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:21.798367023 CEST	192.168.2.23	8.8.8.8	0xea99	Standard query (0)	srv3.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:21.811645985 CEST	192.168.2.23	8.8.8.8	0xea99	Standard query (0)	srv3.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:21.821078062 CEST	192.168.2.23	8.8.8.8	0xea99	Standard query (0)	srv3.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:21.830563068 CEST	192.168.2.23	8.8.8.8	0xea99	Standard query (0)	srv3.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:23.488281965 CEST	192.168.2.23	8.8.8.8	0x5e71	Standard query (0)	srv9.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:25.169538021 CEST	192.168.2.23	8.8.8.8	0x2159	Standard query (0)	srv5.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:25.177948952 CEST	192.168.2.23	8.8.8.8	0x2159	Standard query (0)	srv5.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:25.185939074 CEST	192.168.2.23	8.8.8.8	0x2159	Standard query (0)	srv5.pty.su	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:47.599112988 CEST	192.168.2.23	8.8.8.8	0x9ef7	Standard query (0)	srv3.pty.su	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 11, 2024 11:10:05.322132111 CEST	8.8.8.8	192.168.2.23	0x83b6	Name error (3)	srv3.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:05.335818052 CEST	8.8.8.8	192.168.2.23	0x83b6	Name error (3)	srv3.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:05.351923943 CEST	8.8.8.8	192.168.2.23	0x83b6	Name error (3)	srv3.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:05.376066923 CEST	8.8.8.8	192.168.2.23	0x83b6	Name error (3)	srv3.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:05.388961077 CEST	8.8.8.8	192.168.2.23	0x83b6	Name error (3)	srv3.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:27.810636044 CEST	8.8.8.8	192.168.2.23	0xe64c	Name error (3)	srv6.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:27.819020033 CEST	8.8.8.8	192.168.2.23	0xe64c	Name error (3)	srv6.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:27.827598095 CEST	8.8.8.8	192.168.2.23	0xe64c	Name error (3)	srv6.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:27.835900068 CEST	8.8.8.8	192.168.2.23	0xe64c	Name error (3)	srv6.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:27.849344015 CEST	8.8.8.8	192.168.2.23	0xe64c	No error (0)	srv6.pty.su		5.206.227.62	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:29.519875050 CEST	8.8.8.8	192.168.2.23	0xc3b2	Name error (3)	srv4.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:29.527420044 CEST	8.8.8.8	192.168.2.23	0xc3b2	Name error (3)	srv4.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:29.539429903 CEST	8.8.8.8	192.168.2.23	0xc3b2	Name error (3)	srv4.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:29.546540976 CEST	8.8.8.8	192.168.2.23	0xc3b2	Name error (3)	srv4.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:29.553844929 CEST	8.8.8.8	192.168.2.23	0xc3b2	Name error (3)	srv4.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:31.222666025 CEST	8.8.8.8	192.168.2.23	0x64df	Name error (3)	srv7.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:31.237154007 CEST	8.8.8.8	192.168.2.23	0x64df	Name error (3)	srv7.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:31.250011921 CEST	8.8.8.8	192.168.2.23	0x64df	Name error (3)	srv7.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:31.264478922 CEST	8.8.8.8	192.168.2.23	0x64df	Name error (3)	srv7.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:31.273111105 CEST	8.8.8.8	192.168.2.23	0x64df	Name error (3)	srv7.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:32.945327997 CEST	8.8.8.8	192.168.2.23	0x9ff7	Name error (3)	srv10.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:32.953526020 CEST	8.8.8.8	192.168.2.23	0x9ff7	Name error (3)	srv10.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:32.961198092 CEST	8.8.8.8	192.168.2.23	0x9ff7	Name error (3)	srv10.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:32.969264984 CEST	8.8.8.8	192.168.2.23	0x9ff7	Name error (3)	srv10.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:32.977608919 CEST	8.8.8.8	192.168.2.23	0x9ff7	Name error (3)	srv10.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:34.696485043 CEST	8.8.8.8	192.168.2.23	0x6fc8	No error (0)	srv9.pty.su		38.43.93.83	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:36.373621941 CEST	8.8.8.8	192.168.2.23	0xacf5	Name error (3)	srv2.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:36.381308079 CEST	8.8.8.8	192.168.2.23	0xacf5	Name error (3)	srv2.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:36.389405012 CEST	8.8.8.8	192.168.2.23	0xacf5	Name error (3)	srv2.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:36.397808075 CEST	8.8.8.8	192.168.2.23	0xacf5	Name error (3)	srv2.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:36.405296087 CEST	8.8.8.8	192.168.2.23	0xacf5	Name error (3)	srv2.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:38.245836020 CEST	8.8.8.8	192.168.2.23	0xa188	Name error (3)	srv2.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:38.256211042 CEST	8.8.8.8	192.168.2.23	0xa188	Name error (3)	srv2.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:38.267462015 CEST	8.8.8.8	192.168.2.23	0xa188	Name error (3)	srv2.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:38.274931908 CEST	8.8.8.8	192.168.2.23	0xa188	Name error (3)	srv2.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:38.283015966 CEST	8.8.8.8	192.168.2.23	0xa188	Name error (3)	srv2.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:44.715337992 CEST	8.8.8.8	192.168.2.23	0xe90d	No error (0)	srv6.pty.su		5.206.227.62	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:46.373843908 CEST	8.8.8.8	192.168.2.23	0x6591	Name error (3)	srv2.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:46.382100105 CEST	8.8.8.8	192.168.2.23	0x6591	Name error (3)	srv2.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:46.391176939 CEST	8.8.8.8	192.168.2.23	0x6591	Name error (3)	srv2.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:46.399625063 CEST	8.8.8.8	192.168.2.23	0x6591	Name error (3)	srv2.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:46.407774925 CEST	8.8.8.8	192.168.2.23	0x6591	Name error (3)	srv2.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:48.101484060 CEST	8.8.8.8	192.168.2.23	0x296d	No error (0)	srv9.pty.su		38.43.93.83	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:52.531909943 CEST	8.8.8.8	192.168.2.23	0xf06b	Name error (3)	srv3.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:52.539655924 CEST	8.8.8.8	192.168.2.23	0xf06b	Name error (3)	srv3.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:52.552670002 CEST	8.8.8.8	192.168.2.23	0xf06b	Name error (3)	srv3.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:52.560967922 CEST	8.8.8.8	192.168.2.23	0xf06b	Name error (3)	srv3.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:52.568576097 CEST	8.8.8.8	192.168.2.23	0xf06b	Name error (3)	srv3.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:54.254653931 CEST	8.8.8.8	192.168.2.23	0x8f65	Name error (3)	srv4.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:54.263442039 CEST	8.8.8.8	192.168.2.23	0x8f65	Name error (3)	srv4.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:54.275247097 CEST	8.8.8.8	192.168.2.23	0x8f65	No error (0)	srv4.pty.su		81.4.109.41	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:55.956954956 CEST	8.8.8.8	192.168.2.23	0x8412	No error (0)	srv8.pty.su		154.213.192.29	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:57.500330925 CEST	8.8.8.8	192.168.2.23	0xd165	No error (0)	srv8.pty.su		154.213.192.29	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:59.051625013 CEST	8.8.8.8	192.168.2.23	0x73a9	Name error (3)	srv4.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:59.059514999 CEST	8.8.8.8	192.168.2.23	0x73a9	Name error (3)	srv4.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:10:59.071285963 CEST	8.8.8.8	192.168.2.23	0x73a9	No error (0)	srv4.pty.su		81.4.109.41	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:00.742403984 CEST	8.8.8.8	192.168.2.23	0x5aae	No error (0)	srv5.pty.su		107.161.24.95	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:15.174535990 CEST	8.8.8.8	192.168.2.23	0xc1e8	No error (0)	srv8.pty.su		154.213.192.29	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:16.719293118 CEST	8.8.8.8	192.168.2.23	0x15ae	Name error (3)	srv10.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:16.727113008 CEST	8.8.8.8	192.168.2.23	0x15ae	Name error (3)	srv10.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:16.734662056 CEST	8.8.8.8	192.168.2.23	0x15ae	Name error (3)	srv10.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:16.743151903 CEST	8.8.8.8	192.168.2.23	0x15ae	Name error (3)	srv10.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:16.751512051 CEST	8.8.8.8	192.168.2.23	0x15ae	Name error (3)	srv10.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:18.433969975 CEST	8.8.8.8	192.168.2.23	0x8497	No error (0)	srv7.pty.su		185.236.228.87	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:20.115202904 CEST	8.8.8.8	192.168.2.23	0x8b04	Name error (3)	srv4.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:20.123261929 CEST	8.8.8.8	192.168.2.23	0x8b04	No error (0)	srv4.pty.su		81.4.109.41	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:21.795494080 CEST	8.8.8.8	192.168.2.23	0xea99	Name error (3)	srv3.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:21.805358887 CEST	8.8.8.8	192.168.2.23	0xea99	Name error (3)	srv3.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:21.818614006 CEST	8.8.8.8	192.168.2.23	0xea99	Name error (3)	srv3.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:21.827721119 CEST	8.8.8.8	192.168.2.23	0xea99	Name error (3)	srv3.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:21.837656975 CEST	8.8.8.8	192.168.2.23	0xea99	Name error (3)	srv3.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:23.499970913 CEST	8.8.8.8	192.168.2.23	0x5e71	No error (0)	srv9.pty.su		38.43.93.83	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:25.177103043 CEST	8.8.8.8	192.168.2.23	0x2159	Name error (3)	srv5.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:25.185162067 CEST	8.8.8.8	192.168.2.23	0x2159	Name error (3)	srv5.pty.su	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:25.196763992 CEST	8.8.8.8	192.168.2.23	0x2159	No error (0)	srv5.pty.su		107.161.24.95	A (IP address)	IN (0x0001)	false
Oct 11, 2024 11:11:47.609041929 CEST	8.8.8.8	192.168.2.23	0x9ef7	No error (0)	srv3.pty.su		212.34.155.222	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: na.elf PID: 6295, Parent PID: 6208

General

Start time (UTC):	09:10:03
Start date (UTC):	11/10/2024
Path:	/tmp/na.elf
Arguments:	/tmp/na.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: na.elf PID: 6298, Parent PID: 6295

General

Start time (UTC):	09:10:04
Start date (UTC):	11/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report na.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: na.elf PID: 6295, Parent PID: 6208

General

Chronological Activities

Analysis Process: na.elf PID: 6298, Parent PID: 6295

General

Chronological Activities

Linux Analysis Report
na.elf