Linux
Analysis Report
na.elf
Overview
General Information
Sample name: | na.elf |
Analysis ID: | 1536985 |
MD5: | e9d0c72f8add65dfff1b5713b5bf4f38 |
SHA1: | 7f51d9c64e201a174253f485904899a1afd21287 |
SHA256: | 3765cbb6e3c979f95f9be53d03cc8c1e996cbdc5b145ea59255a005564577958 |
Tags: | elfuser-abuse_ch |
Infos: |
Detection
Score: | 52 |
Range: | 0 - 100 |
Whitelisted: | false |
Signatures
Malicious sample detected (through community Yara rule)
Sample is packed with UPX
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Sample contains only a LOAD segment without any section mappings
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match
Classification
Joe Sandbox version: | 41.0.0 Charoite |
Analysis ID: | 1536985 |
Start date and time: | 2024-10-18 13:34:02 +02:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 4m 59s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | defaultlinuxfilecookbook.jbs |
Analysis system description: | Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11) |
Analysis Mode: | default |
Sample name: | na.elf |
Detection: | MAL |
Classification: | mal52.evad.linELF@0/0@0/0 |
- VT rate limit hit for: na.elf
Command: | /tmp/na.elf |
PID: | 6257 |
Exit Code: | 0 |
Exit Code Info: | |
Killed: | False |
Standard Output: | lzrd cock fest"/proc/"/exe |
Standard Error: |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
Linux_Trojan_Gafgyt_28a2fe0c | unknown | unknown |
| |
Linux_Trojan_Gafgyt_28a2fe0c | unknown | unknown |
| |
Linux_Trojan_Gafgyt_28a2fe0c | unknown | unknown |
| |
Linux_Trojan_Gafgyt_28a2fe0c | unknown | unknown |
| |
Linux_Trojan_Gafgyt_28a2fe0c | unknown | unknown |
| |
Click to see the 3 entries |
⊘No Suricata rule has matched
- • Networking
- • System Summary
- • Data Obfuscation
- • Persistence and Installation Behavior
- • Hooking and other Techniques for Hiding and Protection
- • Malware Analysis System Evasion
Click to jump to signature section
Show All Signature Results
Source: | TCP traffic: |
Source: | TCP traffic: | ||
Source: | TCP traffic: | ||
Source: | TCP traffic: |
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: |
Source: | String found in binary or memory: |
Source: | Network traffic detected: | ||
Source: | Network traffic detected: |
System Summary |
---|
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: |
Source: | Program segment: |
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: |
Source: | Classification label: |
Data Obfuscation |
---|
Source: | String containing UPX found: | ||
Source: | String containing UPX found: | ||
Source: | String containing UPX found: |
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior |
Source: | Submission file: |
Source: | Queries kernel information via 'uname': | Jump to behavior |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | Path Interception | Path Interception | 11 Obfuscated Files or Information | 1 OS Credential Dumping | 11 Security Software Discovery | Remote Services | Data from Local System | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | Rootkit | LSASS Memory | Application Window Discovery | Remote Desktop Protocol | Data from Removable Media | 1 Non-Standard Port | Exfiltration Over Bluetooth | Network Denial of Service |
Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | Obfuscated Files or Information | Security Account Manager | Query Registry | SMB/Windows Admin Shares | Data from Network Shared Drive | 1 Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
⊘No configs have been found
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
0% | URL Reputation | safe |
⊘No contacted domains info
Name | Source | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|
true |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
---|---|---|---|---|---|---|
45.86.155.23 | unknown | Germany | 202322 | EVERYONE-BANDWIDTH-INCDE | false | |
109.202.202.202 | unknown | Switzerland | 13030 | INIT7CH | false | |
91.189.91.43 | unknown | United Kingdom | 41231 | CANONICAL-ASGB | false | |
91.189.91.42 | unknown | United Kingdom | 41231 | CANONICAL-ASGB | false |
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
45.86.155.23 | Get hash | malicious | Unknown | Browse | ||
Get hash | malicious | Unknown | Browse | |||
Get hash | malicious | Unknown | Browse | |||
Get hash | malicious | Mirai | Browse | |||
Get hash | malicious | Unknown | Browse | |||
Get hash | malicious | Unknown | Browse | |||
109.202.202.202 | Get hash | malicious | Unknown | Browse |
| |
91.189.91.43 | Get hash | malicious | Unknown | Browse | ||
Get hash | malicious | Unknown | Browse | |||
Get hash | malicious | Unknown | Browse | |||
Get hash | malicious | Rekoobe | Browse | |||
Get hash | malicious | Mirai | Browse | |||
Get hash | malicious | Mirai | Browse | |||
Get hash | malicious | Mirai | Browse | |||
Get hash | malicious | Unknown | Browse | |||
Get hash | malicious | Mirai | Browse | |||
Get hash | malicious | Gafgyt, Mirai | Browse | |||
91.189.91.42 | Get hash | malicious | Unknown | Browse | ||
Get hash | malicious | Unknown | Browse | |||
Get hash | malicious | Unknown | Browse | |||
Get hash | malicious | Rekoobe | Browse | |||
Get hash | malicious | Mirai | Browse | |||
Get hash | malicious | Mirai | Browse | |||
Get hash | malicious | Mirai | Browse | |||
Get hash | malicious | Unknown | Browse | |||
Get hash | malicious | Mirai | Browse | |||
Get hash | malicious | Gafgyt, Mirai | Browse |
⊘No context
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
EVERYONE-BANDWIDTH-INCDE | Get hash | malicious | Unknown | Browse |
| |
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Phisher | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
CANONICAL-ASGB | Get hash | malicious | Unknown | Browse |
| |
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Rekoobe | Browse |
| ||
Get hash | malicious | Rekoobe | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
CANONICAL-ASGB | Get hash | malicious | Unknown | Browse |
| |
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Rekoobe | Browse |
| ||
Get hash | malicious | Rekoobe | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
INIT7CH | Get hash | malicious | Unknown | Browse |
| |
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Rekoobe | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Gafgyt, Mirai | Browse |
|
⊘No context
⊘No context
⊘No created / dropped files found
File type: | |
Entropy (8bit): | 7.946733238373652 |
TrID: |
|
File name: | na.elf |
File size: | 44'188 bytes |
MD5: | e9d0c72f8add65dfff1b5713b5bf4f38 |
SHA1: | 7f51d9c64e201a174253f485904899a1afd21287 |
SHA256: | 3765cbb6e3c979f95f9be53d03cc8c1e996cbdc5b145ea59255a005564577958 |
SHA512: | 706eaf63e717e3f09782084f086aaff49fcbacaa5a55546c51d4fecc534a04383e902df5e1050345df75483144741098fef61079bff95ad0a922b9312b00982a |
SSDEEP: | 768:MgDfzzMwdu3W4CbuznqQd8eYkGyJfH6QhjS0jlDGnHMhgNSRxUkCkHhVeg527+0X:PDEwdu3ubuznqreGyJfH6QhjDGnHMhgZ |
TLSH: | 2713F188370305E5CA9AD4F18BF443627F752FFD61868C496DA1EBE2B9D1448BCE4AC4 |
File Content Preview: | .ELF.......................(...4.........4. ...(.......................l...l.................C...C......................UPX!.d.....................V.......?.E.h4...@b..) ..]....E..`..........@4#.Y..~.9....b...Q".|.H.%Q.z....6u.."....cLw................... |
ELF header | |
---|---|
Class: | |
Data: | |
Version: | |
Machine: | |
Version Number: | |
Type: | |
OS/ABI: | |
ABI Version: | 0 |
Entry Point Address: | |
Flags: | |
ELF Header Size: | 52 |
Program Header Offset: | 52 |
Program Header Size: | 32 |
Number of Program Headers: | 2 |
Section Header Offset: | 0 |
Section Header Size: | 40 |
Number of Section Headers: | 0 |
Header String Table Index: | 0 |
Type | Offset | Virtual Address | Physical Address | File Size | Memory Size | Entropy | Flags | Flags Description | Align | Prog Interpreter | Section Mappings |
---|---|---|---|---|---|---|---|---|---|---|---|
LOAD | 0x0 | 0x100000 | 0x100000 | 0xab6c | 0xab6c | 7.9490 | 0x5 | R E | 0x10000 | ||
LOAD | 0xcffc | 0x43cffc | 0x43cffc | 0x0 | 0x0 | 0.0000 | 0x6 | RW | 0x10000 |
Download Network PCAP: filtered – full
- Total Packets: 59
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Oct 18, 2024 13:34:59.317423105 CEST | 42484 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:34:59.322503090 CEST | 3778 | 42484 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:34:59.322563887 CEST | 42484 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:00.161861897 CEST | 43928 | 443 | 192.168.2.23 | 91.189.91.42 |
Oct 18, 2024 13:35:00.321832895 CEST | 42484 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:00.327080965 CEST | 3778 | 42484 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:00.327227116 CEST | 42484 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:00.329138994 CEST | 42484 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:00.334050894 CEST | 3778 | 42484 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:00.334125042 CEST | 42484 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:00.339047909 CEST | 3778 | 42484 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:01.160307884 CEST | 3778 | 42484 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:01.160491943 CEST | 42484 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:01.161007881 CEST | 42484 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:01.161920071 CEST | 42486 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:01.166837931 CEST | 3778 | 42486 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:01.166913986 CEST | 42486 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:01.168478012 CEST | 42486 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:01.173403025 CEST | 3778 | 42486 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:01.173526049 CEST | 42486 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:01.178442001 CEST | 3778 | 42486 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:02.015518904 CEST | 3778 | 42486 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:02.015539885 CEST | 3778 | 42486 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:02.015928984 CEST | 42486 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:02.015929937 CEST | 42486 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:02.015929937 CEST | 42486 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:02.016417980 CEST | 42488 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:02.021397114 CEST | 3778 | 42488 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:02.021478891 CEST | 42488 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:02.022196054 CEST | 42488 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:02.027056932 CEST | 3778 | 42488 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:02.027137041 CEST | 42488 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:02.032098055 CEST | 3778 | 42488 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:02.850994110 CEST | 3778 | 42488 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:02.851176977 CEST | 42488 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:02.851329088 CEST | 42488 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:02.851990938 CEST | 42490 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:02.856864929 CEST | 3778 | 42490 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:02.856941938 CEST | 42490 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:03.873389006 CEST | 42490 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:03.878472090 CEST | 3778 | 42490 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:03.878640890 CEST | 42490 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:03.879537106 CEST | 42490 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:03.884392023 CEST | 3778 | 42490 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:03.884465933 CEST | 42490 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:03.889368057 CEST | 3778 | 42490 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:04.513330936 CEST | 42516 | 80 | 192.168.2.23 | 109.202.202.202 |
Oct 18, 2024 13:35:04.723093033 CEST | 3778 | 42490 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:04.723140001 CEST | 3778 | 42490 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:04.723336935 CEST | 42490 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:04.723336935 CEST | 42490 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:04.723450899 CEST | 42490 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:04.723942041 CEST | 42492 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:04.728925943 CEST | 3778 | 42492 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:04.728991032 CEST | 42492 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:04.729703903 CEST | 42492 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:04.734563112 CEST | 3778 | 42492 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:04.734653950 CEST | 42492 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:04.739473104 CEST | 3778 | 42492 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:05.321459055 CEST | 42494 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:05.326790094 CEST | 3778 | 42494 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:05.326920033 CEST | 42494 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:05.384644032 CEST | 42494 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:05.389689922 CEST | 3778 | 42494 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:05.389740944 CEST | 42494 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:05.394736052 CEST | 3778 | 42494 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:05.560297012 CEST | 3778 | 42492 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:05.560364962 CEST | 42492 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:05.560419083 CEST | 42492 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:05.561403036 CEST | 42496 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:05.566945076 CEST | 3778 | 42496 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:05.566994905 CEST | 42496 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:05.569672108 CEST | 42496 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:05.574713945 CEST | 3778 | 42496 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:05.574763060 CEST | 42496 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:05.579829931 CEST | 3778 | 42496 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:05.793143034 CEST | 42836 | 443 | 192.168.2.23 | 91.189.91.43 |
Oct 18, 2024 13:35:15.393769026 CEST | 42494 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:15.398762941 CEST | 3778 | 42494 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:15.578686953 CEST | 42496 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:15.583724022 CEST | 3778 | 42496 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:15.662523031 CEST | 3778 | 42494 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:15.662652016 CEST | 42494 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:15.835987091 CEST | 3778 | 42496 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:35:15.836133957 CEST | 42496 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:35:20.127176046 CEST | 43928 | 443 | 192.168.2.23 | 91.189.91.42 |
Oct 18, 2024 13:35:32.413496971 CEST | 42836 | 443 | 192.168.2.23 | 91.189.91.43 |
Oct 18, 2024 13:35:34.461175919 CEST | 42516 | 80 | 192.168.2.23 | 109.202.202.202 |
Oct 18, 2024 13:36:01.081552982 CEST | 43928 | 443 | 192.168.2.23 | 91.189.91.42 |
Oct 18, 2024 13:36:15.715351105 CEST | 42494 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:36:15.720372915 CEST | 3778 | 42494 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:36:15.877083063 CEST | 42496 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:36:15.882296085 CEST | 3778 | 42496 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:36:15.977469921 CEST | 3778 | 42494 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:36:15.977591991 CEST | 42494 | 3778 | 192.168.2.23 | 45.86.155.23 |
Oct 18, 2024 13:36:16.122921944 CEST | 3778 | 42496 | 45.86.155.23 | 192.168.2.23 |
Oct 18, 2024 13:36:16.123086929 CEST | 42496 | 3778 | 192.168.2.23 | 45.86.155.23 |
System Behavior
Start time (UTC): | 11:34:58 |
Start date (UTC): | 18/10/2024 |
Path: | /tmp/na.elf |
Arguments: | /tmp/na.elf |
File size: | 5777432 bytes |
MD5 hash: | 0083f1f0e77be34ad27f849842bbb00c |
Start time (UTC): | 11:34:58 |
Start date (UTC): | 18/10/2024 |
Path: | /tmp/na.elf |
Arguments: | - |
File size: | 5777432 bytes |
MD5 hash: | 0083f1f0e77be34ad27f849842bbb00c |
Start time (UTC): | 11:34:58 |
Start date (UTC): | 18/10/2024 |
Path: | /tmp/na.elf |
Arguments: | - |
File size: | 5777432 bytes |
MD5 hash: | 0083f1f0e77be34ad27f849842bbb00c |
Start time (UTC): | 11:34:58 |
Start date (UTC): | 18/10/2024 |
Path: | /tmp/na.elf |
Arguments: | - |
File size: | 5777432 bytes |
MD5 hash: | 0083f1f0e77be34ad27f849842bbb00c |
Start time (UTC): | 11:35:04 |
Start date (UTC): | 18/10/2024 |
Path: | /tmp/na.elf |
Arguments: | - |
File size: | 5777432 bytes |
MD5 hash: | 0083f1f0e77be34ad27f849842bbb00c |
Start time (UTC): | 11:35:04 |
Start date (UTC): | 18/10/2024 |
Path: | /tmp/na.elf |
Arguments: | - |
File size: | 5777432 bytes |
MD5 hash: | 0083f1f0e77be34ad27f849842bbb00c |