Edit tour

Linux Analysis Report
wriww68k.elf

Overview

General Information

Sample name:	wriww68k.elf
Analysis ID:	1544619
MD5:	53b10c77216a6cc471112efcbb97b20e
SHA1:	c5a94bff861d83528566763d0c86deeb08ce21db
SHA256:	7574b078fe5776a0d9c650eded35ae5c213b155e943d18acd10ab2034f363ecc
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai, Okiru

Score:	96
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Yara detected Okiru

Sample deletes itself

Sends malformed DNS queries

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544619
Start date and time:	2024-10-29 16:35:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	wriww68k.elf
Detection:	MAL
Classification:	mal96.troj.evad.linELF@0/1026@41/0

Runtime Messages

Command:	/tmp/wriww68k.elf
PID:	5505
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

wriww68k.elf (PID: 5505, Parent: 5424, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/wriww68k.elf

wriww68k.elf New Fork (PID: 5507, Parent: 5505)

wriww68k.elf New Fork (PID: 5509, Parent: 5507)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
wriww68k.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
wriww68k.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
wriww68k.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
wriww68k.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1faeb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1faff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fb13:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fb27:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fb3b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fb4f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fb63:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fb77:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fb8b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fb9f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fbb3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fbc7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fbdb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fbef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fc03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fc17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fc2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fc3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fc53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fc67:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fc7b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5505.1.00007f27a8001000.00007f27a8024000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5505.1.00007f27a8001000.00007f27a8024000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5505.1.00007f27a8001000.00007f27a8024000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5505.1.00007f27a8001000.00007f27a8024000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1faeb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1faff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fb13:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fb27:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fb3b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fb4f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fb63:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fb77:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fb8b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fb9f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fbb3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fbc7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fbdb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fbef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fc03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fc17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fc2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fc3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fc53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fc67:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fc7b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: wriww68k.elf PID: 5505	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: wriww68k.elf PID: 5505	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: wriww68k.elf PID: 5505	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3bd6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3bea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3bfe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c12:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3cb2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3cc6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3cda:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3cee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3d02:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3d16:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3d2a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3d3e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3d52:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3d66:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 2 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: wriww68k.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: wriww68k.elf

ReversingLabs: Detection: 50%

Source: wriww68k.elf

String: /proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-servershellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/raw.eye-network.ruabcdefghijklmnopqrstuvwxyz/proc/%d/proc/self/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt

Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26

Source: global traffic	DNS traffic detected: DNS query: raw.eye-network.ru
Source: global traffic	DNS traffic detected: DNS query: raw.eye-network.ru. [malformed]

Source: wriww68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5505.1.00007f27a8001000.00007f27a8024000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: wriww68k.elf PID: 5505, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: /proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-servershellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/raw.eye-network.ruabcdefghijklmnopqrstuvwxyz/proc/%d/proc/self/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt

Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/3760/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/3761/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/1577/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/3762/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/3763/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/806/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/807/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/928/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/135/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/3412/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/1371/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/wriww68k.elf (PID: 5509)	File opened: /proc/262/cmdline	Jump to behavior

Source: wriww68k.elf, 5505.1.0000556c33446000.0000556c334cb000.rw-.sdmp	Binary or memory string: D3lU!/etc/qemu-binfmt/m68k
Source: wriww68k.elf, 5505.1.00007ffc51c32000.00007ffc51c53000.rw-.sdmp	Binary or memory string: /qemu-open.XXXXX
Source: wriww68k.elf, 5505.1.00007ffc51c32000.00007ffc51c53000.rw-.sdmp	Binary or memory string: %80lU/tmp/qemu-open.6u3vEq\
Source: wriww68k.elf, 5505.1.00007ffc51c32000.00007ffc51c53000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: wriww68k.elf, 5505.1.0000556c33446000.0000556c334cb000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k
Source: wriww68k.elf, 5505.1.00007ffc51c32000.00007ffc51c53000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.6u3vEq
Source: wriww68k.elf, 5505.1.00007ffc51c32000.00007ffc51c53000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/wriww68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/wriww68k.elf

Source: Yara match	File source: wriww68k.elf, type: SAMPLE
Source: Yara match	File source: 5505.1.00007f27a8001000.00007f27a8024000.r-x.sdmp, type: MEMORY

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File Deletion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
wriww68k.elf	50%	ReversingLabs	Linux.Trojan.Mirai
wriww68k.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Name	IP	Active	Malicious	Antivirus Detection	Reputation
raw.eye-network.ru	213.232.235.18	true	true		unknown
raw.eye-network.ru. [malformed]	unknown	unknown	true		unknown

Source: wriww68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5505.1.00007f27a8001000.00007f27a8024000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: wriww68k.elf PID: 5505, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
213.232.235.18	raw.eye-network.ru	Russian Federation		39824	ALMANET-ASKZ	true
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
213.232.235.18	vqsjh4.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	wheiuwa4.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	jwwofba5.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	qkbfi86.elf	Get hash	malicious	Mirai, Okiru	Browse
	qkehusl.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	vkjqpc.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	vqsjh4.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	jwwofba5.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	qkehusl.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	vqkjf64.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
185.125.190.26	x86.elf	Get hash	malicious	Unknown	Browse
	zmap.x86_64.elf	Get hash	malicious	Okiru	Browse
	spc.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse
	m68k.elf	Get hash	malicious	Unknown	Browse
	main_arm5.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Process:	/tmp/wriww68k.elf
File Type:	data
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.7946534735443422
Encrypted:	false
SSDEEP:	3:TgkcOC:TgkcOC
MD5:	7A0D40580614CF08E66FD21C1431AD72
SHA1:	58AC09855AA303420043331F698FEAF49F2F611B
SHA-256:	47CE964F6C57D283C29738E5461C9DE902531B778B66FEDB7EDF233A9934C0CA
SHA-512:	95758C29DFAEE50433CB509894885D97EA4ED4BCB9A3AC996FDBA703D6E92C0092077924450A5FD8EF00A4C297E26F8ABC667CE051BC5E08D3460867AF0C1678
Malicious:	false
Reputation:	low
Preview:	/tmp/wriww68k.elf.

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.7526706884329455
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	wriww68k.elf
File size:	160'320 bytes
MD5:	53b10c77216a6cc471112efcbb97b20e
SHA1:	c5a94bff861d83528566763d0c86deeb08ce21db
SHA256:	7574b078fe5776a0d9c650eded35ae5c213b155e943d18acd10ab2034f363ecc
SHA512:	a5899a87f49b861d1c2d404766541f60182ee6da0f00567770afb85694a4dcbd1654a8d4573560f060c5291e2ad04a25a0b23c77621d5fe813add1c0ecff6c2b
SSDEEP:	3072:+XEpnWHHdoAS9FFrhzni5dPtM5lVljbioLVfhymMvPZg:ZNTrhDi/tMPLnymUZg
TLSH:	C7F328C7FC00DEBDF80BF73648170915B230BB9111825A37625779BBEC3A1A91967E86
File Content Preview:	.ELF.......................D...4..p......4. ...(......................&...&....... .......&...F...F...Ix.......... .dt.Q............................NV..a....da....<N^NuNV..J9...pf>"y..G$ QJ.g.X.#...G$N."y..G$ QJ.f.A.....J.g.Hy..&.N.X........pN^NuNV..N^NuN

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	159920
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0x1f966	0x0	0x6	AX	4
.fini	PROGBITS	0x8001fa0e	0x1fa0e	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x8001fa1c	0x1fa1c	0x2cd8	0x0	0x2	A	2
.ctors	PROGBITS	0x800246f8	0x226f8	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x80024704	0x22704	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x80024720	0x22720	0x4950	0x0	0x3	WA	32
.bss	NOBITS	0x80029070	0x27070	0x4620	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x27070	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x226f4	0x226f4	6.1639	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0x226f8	0x800246f8	0x800246f8	0x4978	0x8f98	0.4966	0x6	RW	0x2000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 16:35:55.468229055 CET	43266	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:35:55.473676920 CET	33966	43266	213.232.235.18	192.168.2.14
Oct 29, 2024 16:35:55.473767042 CET	43266	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:35:55.474793911 CET	43266	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:35:55.480134964 CET	33966	43266	213.232.235.18	192.168.2.14
Oct 29, 2024 16:35:55.480174065 CET	43266	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:35:55.485512972 CET	33966	43266	213.232.235.18	192.168.2.14
Oct 29, 2024 16:35:56.381892920 CET	33966	43266	213.232.235.18	192.168.2.14
Oct 29, 2024 16:35:56.381953001 CET	43266	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:35:56.382144928 CET	43266	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:35:56.473293066 CET	43268	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:35:56.478719950 CET	33966	43268	213.232.235.18	192.168.2.14
Oct 29, 2024 16:35:56.478799105 CET	43268	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:35:56.480060101 CET	43268	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:35:56.485374928 CET	33966	43268	213.232.235.18	192.168.2.14
Oct 29, 2024 16:35:56.485415936 CET	43268	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:35:56.490751028 CET	33966	43268	213.232.235.18	192.168.2.14
Oct 29, 2024 16:35:57.404495955 CET	33966	43268	213.232.235.18	192.168.2.14
Oct 29, 2024 16:35:57.404601097 CET	43268	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:35:57.404685974 CET	43268	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:35:57.614207029 CET	43270	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:35:57.619658947 CET	33966	43270	213.232.235.18	192.168.2.14
Oct 29, 2024 16:35:57.619731903 CET	43270	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:35:57.621268988 CET	43270	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:35:57.626589060 CET	33966	43270	213.232.235.18	192.168.2.14
Oct 29, 2024 16:35:57.626668930 CET	43270	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:35:57.632025003 CET	33966	43270	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:04.140151024 CET	33966	43270	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:04.140320063 CET	43270	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:04.149687052 CET	33966	43270	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:04.454256058 CET	46540	443	192.168.2.14	185.125.190.26
Oct 29, 2024 16:36:05.228204012 CET	43272	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:05.233552933 CET	33966	43272	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:05.233644962 CET	43272	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:05.234517097 CET	43272	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:05.239883900 CET	33966	43272	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:05.239962101 CET	43272	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:05.245529890 CET	33966	43272	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:06.129642010 CET	33966	43272	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:06.129723072 CET	43272	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:06.129755974 CET	43272	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:06.222608089 CET	43274	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:06.228091955 CET	33966	43274	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:06.228230953 CET	43274	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:06.228851080 CET	43274	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:06.235255003 CET	33966	43274	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:06.235299110 CET	43274	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:06.240881920 CET	33966	43274	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:07.133872032 CET	33966	43274	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:07.133933067 CET	43274	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:07.133965969 CET	43274	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:07.216166973 CET	43276	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:07.221721888 CET	33966	43276	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:07.221767902 CET	43276	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:07.222922087 CET	43276	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:07.228373051 CET	33966	43276	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:07.228410959 CET	43276	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:07.233963966 CET	33966	43276	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:08.312345982 CET	33966	43276	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:08.312504053 CET	43276	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:08.312504053 CET	43276	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:08.402668953 CET	43278	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:08.408118010 CET	33966	43278	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:08.408286095 CET	43278	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:08.409917116 CET	43278	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:08.415252924 CET	33966	43278	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:08.416318893 CET	43278	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:08.421617031 CET	33966	43278	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:09.303088903 CET	33966	43278	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:09.305402994 CET	43278	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:09.305439949 CET	43278	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:09.389772892 CET	43280	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:09.395128012 CET	33966	43280	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:09.397262096 CET	43280	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:09.398175955 CET	43280	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:09.403697014 CET	33966	43280	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:09.405236006 CET	43280	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:09.410648108 CET	33966	43280	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:10.297708988 CET	33966	43280	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:10.298293114 CET	43280	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:10.298341036 CET	43280	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:10.395836115 CET	43282	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:10.401501894 CET	33966	43282	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:10.401561975 CET	43282	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:10.402168036 CET	43282	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:10.407932997 CET	33966	43282	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:10.407974005 CET	43282	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:36:10.414061069 CET	33966	43282	213.232.235.18	192.168.2.14
Oct 29, 2024 16:36:36.197218895 CET	46540	443	192.168.2.14	185.125.190.26
Oct 29, 2024 16:37:20.459460020 CET	43282	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:37:20.465342999 CET	33966	43282	213.232.235.18	192.168.2.14
Oct 29, 2024 16:37:30.469165087 CET	43282	33966	192.168.2.14	213.232.235.18
Oct 29, 2024 16:37:30.475342989 CET	33966	43282	213.232.235.18	192.168.2.14

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 16:35:55.370004892 CET	41635	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:55.382051945 CET	53	41635	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:55.402818918 CET	39550	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:55.410545111 CET	53	39550	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:55.425020933 CET	47786	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:55.432338953 CET	53	47786	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:55.440943003 CET	60014	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:55.447757006 CET	53	60014	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:55.449743986 CET	52718	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:55.457086086 CET	53	52718	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:55.458931923 CET	54192	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:55.466486931 CET	53	54192	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:56.384476900 CET	33953	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:56.391467094 CET	53	33953	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:56.393501997 CET	42755	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:56.400590897 CET	53	42755	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:56.403364897 CET	60520	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:56.411041975 CET	53	60520	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:56.412494898 CET	52045	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:56.419456005 CET	53	52045	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:56.420857906 CET	37652	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:56.427901030 CET	53	37652	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:56.429491997 CET	58267	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:56.436459064 CET	53	58267	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:56.439834118 CET	39966	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:56.447076082 CET	53	39966	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:56.448613882 CET	55598	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:56.455621004 CET	53	55598	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:56.457206964 CET	37602	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:56.464490891 CET	53	37602	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:56.465764046 CET	57769	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:56.472568989 CET	53	57769	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:57.495368958 CET	35073	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:57.502940893 CET	53	35073	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:57.534362078 CET	44818	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:57.541472912 CET	53	44818	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:57.542917013 CET	60737	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:57.550478935 CET	53	60737	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:57.551853895 CET	33786	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:57.560236931 CET	53	33786	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:57.561767101 CET	60193	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:57.568628073 CET	53	60193	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:57.570139885 CET	38522	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:57.577487946 CET	53	38522	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:57.578957081 CET	47059	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:57.586740017 CET	53	47059	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:57.588289976 CET	35157	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:57.595890999 CET	53	35157	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:57.597399950 CET	42622	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:57.604546070 CET	53	42622	8.8.8.8	192.168.2.14
Oct 29, 2024 16:35:57.606245995 CET	46278	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:35:57.613467932 CET	53	46278	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:05.142106056 CET	42365	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:05.149122953 CET	53	42365	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:05.150305033 CET	40949	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:05.159507036 CET	53	40949	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:05.160449982 CET	37604	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:05.167100906 CET	53	37604	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:05.168191910 CET	33561	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:05.175348043 CET	53	33561	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:05.176266909 CET	48659	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:05.186585903 CET	53	48659	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:05.187257051 CET	51703	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:05.194875002 CET	53	51703	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:05.195538044 CET	44560	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:05.203286886 CET	53	44560	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:05.204149961 CET	55196	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:05.211395025 CET	53	55196	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:05.212297916 CET	37383	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:05.219635963 CET	53	37383	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:05.220571041 CET	34825	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:05.227899075 CET	53	34825	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:06.130450010 CET	34406	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:06.137629032 CET	53	34406	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:06.138356924 CET	33020	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:06.145349979 CET	53	33020	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:06.145987988 CET	38644	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:06.155369043 CET	53	38644	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:06.156307936 CET	40972	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:06.163867950 CET	53	40972	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:06.164505005 CET	35297	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:06.171475887 CET	53	35297	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:06.172169924 CET	43721	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:06.179680109 CET	53	43721	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:06.184792042 CET	41258	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:06.192181110 CET	53	41258	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:06.196940899 CET	52689	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:06.206855059 CET	53	52689	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:06.207639933 CET	36680	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:06.214776039 CET	53	36680	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:06.215491056 CET	50737	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:06.222239971 CET	53	50737	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:07.134916067 CET	53773	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:07.142019987 CET	53	53773	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:07.146195889 CET	37156	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:07.153223038 CET	53	37156	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:07.154418945 CET	43887	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:07.161649942 CET	53	43887	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:07.162722111 CET	57416	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:07.169698000 CET	53	57416	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:07.170430899 CET	44654	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:07.177261114 CET	53	44654	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:07.178132057 CET	59437	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:07.185348988 CET	53	59437	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:07.185992002 CET	46203	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:07.192898989 CET	53	46203	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:07.193531036 CET	49397	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:07.200670958 CET	53	49397	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:07.201263905 CET	32877	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:07.208229065 CET	53	32877	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:07.209103107 CET	39880	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:07.215852022 CET	53	39880	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:08.313169003 CET	36866	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:08.322810888 CET	53	36866	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:08.323535919 CET	55712	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:08.330709934 CET	53	55712	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:08.331295013 CET	44441	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:08.338387012 CET	53	44441	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:08.339011908 CET	48737	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:08.347035885 CET	53	48737	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:08.347716093 CET	51742	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:08.354871988 CET	53	51742	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:08.355462074 CET	55718	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:08.362833023 CET	53	55718	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:08.363400936 CET	49363	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:08.370847940 CET	53	49363	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:08.371480942 CET	48874	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:08.379153967 CET	53	48874	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:08.384231091 CET	37547	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:08.391601086 CET	53	37547	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:08.394809961 CET	54291	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:08.402240992 CET	53	54291	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:09.306375980 CET	33069	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:09.313421965 CET	53	33069	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:09.314476967 CET	47649	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:09.321763992 CET	53	47649	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:09.322724104 CET	49274	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:09.330492020 CET	53	49274	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:09.331336975 CET	36273	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:09.338669062 CET	53	36273	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:09.339328051 CET	46786	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:09.346477032 CET	53	46786	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:09.347137928 CET	42281	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:09.354753017 CET	53	42281	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:09.355451107 CET	39242	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:09.363333941 CET	53	39242	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:09.364002943 CET	49705	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:09.372025013 CET	53	49705	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:09.372785091 CET	37404	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:09.380544901 CET	53	37404	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:09.381275892 CET	40066	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:09.389317036 CET	53	40066	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:10.298959970 CET	39636	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:10.306694984 CET	53	39636	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:10.307590961 CET	33915	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:10.315876007 CET	53	33915	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:10.316463947 CET	33391	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:10.326396942 CET	53	33391	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:10.327027082 CET	57946	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:10.335903883 CET	53	57946	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:10.336780071 CET	49857	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:10.350285053 CET	53	49857	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:10.351169109 CET	60943	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:10.359908104 CET	53	60943	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:10.360507011 CET	40798	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:10.369081974 CET	53	40798	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:10.369884968 CET	57134	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:10.377814054 CET	53	57134	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:10.378407955 CET	58869	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:10.386812925 CET	53	58869	8.8.8.8	192.168.2.14
Oct 29, 2024 16:36:10.387695074 CET	44422	53	192.168.2.14	8.8.8.8
Oct 29, 2024 16:36:10.395522118 CET	53	44422	8.8.8.8	192.168.2.14

Start time (UTC):	15:35:54
Start date (UTC):	29/10/2024
Path:	/tmp/wriww68k.elf
Arguments:	/tmp/wriww68k.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report wriww68k.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.004xzM (deleted)

/tmp/qemu-open.0AzRLM (deleted)

/tmp/qemu-open.0DsSJL (deleted)

/tmp/qemu-open.0EFffN (deleted)

/tmp/qemu-open.0N3gTK (deleted)

/tmp/qemu-open.0NrTGK (deleted)

/tmp/qemu-open.0QRNpK (deleted)

/tmp/qemu-open.0Vg9AM (deleted)

/tmp/qemu-open.0dZ9lK (deleted)

/tmp/qemu-open.0tlswJ (deleted)

/tmp/qemu-open.0zvBqK (deleted)

/tmp/qemu-open.12o7fN (deleted)

/tmp/qemu-open.16O34M (deleted)

/tmp/qemu-open.16ghKL (deleted)

/tmp/qemu-open.19xcNK (deleted)

/tmp/qemu-open.19yI2K (deleted)

/tmp/qemu-open.1J52tL (deleted)

/tmp/qemu-open.1JFOnK (deleted)

/tmp/qemu-open.1MtMnL (deleted)

/tmp/qemu-open.1VgdkK (deleted)

/tmp/qemu-open.1Vxv3K (deleted)

/tmp/qemu-open.1WTBtN (deleted)

/tmp/qemu-open.1Yeo5K (deleted)

/tmp/qemu-open.1cfnRJ (deleted)

/tmp/qemu-open.1dmogN (deleted)

/tmp/qemu-open.1jbHBN (deleted)

/tmp/qemu-open.1q7GqJ (deleted)

/tmp/qemu-open.1wMcPM (deleted)

/tmp/qemu-open.1wQTfM (deleted)

Linux Analysis Report
wriww68k.elf

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre