Edit tour

Linux Analysis Report
vwkjebwi686.elf

Overview

General Information

Sample name:	vwkjebwi686.elf
Analysis ID:	1544682
MD5:	881f9d6a05bdf13aa459f1047e283f06
SHA1:	3904c5aae6341cef851b1da95d4bdfb776437ed3
SHA256:	4ff3cbf3faf806219c21bd672cc4e46d2ba526ae76e97543aed280443ea7495e
Tags:	elfMiraiuser-abuse_ch
Infos:

Detection

Mirai, Okiru

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Yara detected Okiru

Machine Learning detection for sample

Sample deletes itself

Sends malformed DNS queries

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544682
Start date and time:	2024-10-29 17:21:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	vwkjebwi686.elf
Detection:	MAL
Classification:	mal92.troj.evad.linELF@0/0@96/0

Runtime Messages

Command:	/tmp/vwkjebwi686.elf
PID:	5514
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

vwkjebwi686.elf (PID: 5514, Parent: 5439, MD5: 881f9d6a05bdf13aa459f1047e283f06) Arguments: /tmp/vwkjebwi686.elf

vwkjebwi686.elf New Fork (PID: 5515, Parent: 5514)

vwkjebwi686.elf New Fork (PID: 5516, Parent: 5515)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
vwkjebwi686.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
vwkjebwi686.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
vwkjebwi686.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x13448:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1345c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13470:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13484:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13498:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x134ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x134c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x134d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x134e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x134fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13510:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13524:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13538:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1354c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13560:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13574:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13588:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1359c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x135b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x135c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x135d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
vwkjebwi686.elf	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x6caf:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
vwkjebwi686.elf	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x6c62:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
vwkjebwi686.elf	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x85fd:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x869d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
vwkjebwi686.elf	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
vwkjebwi686.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x8c52:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
vwkjebwi686.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xd9cd:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Click to see the 4 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5514.1.0000000008048000.000000000805e000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5514.1.0000000008048000.000000000805e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5514.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x13448:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1345c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13470:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13484:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13498:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x134ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x134c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x134d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x134e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x134fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13510:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13524:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13538:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1354c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13560:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13574:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13588:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1359c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x135b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x135c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x135d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5514.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x6caf:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
5514.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x6c62:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
5514.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x85fd:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x869d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
5514.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
5514.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x8c52:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5514.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xd9cd:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Process Memory Space: vwkjebwi686.elf PID: 5514	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: vwkjebwi686.elf PID: 5514	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: vwkjebwi686.elf PID: 5514	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x93c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x98c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 7 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: vwkjebwi686.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: vwkjebwi686.elf

ReversingLabs: Detection: 42%

Machine Learning detection for sample

Source: vwkjebwi686.elf

Joe Sandbox ML: detected

Source: vwkjebwi686.elf

String: /proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemdshellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/anko-app/ankosample _8182T_1104/usr/libexec/openssh/sftp-serverraw.eye-network.ruabcdefghijklmnopqrstuvwxyz/proc/%d/proc/self/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: raw.eye-network.ru. [malformed]

Source: global traffic

TCP traffic: 192.168.2.15:49924 -> 213.232.235.18:33966

Source: global traffic	DNS traffic detected: DNS query: raw.eye-network.ru
Source: global traffic	DNS traffic detected: DNS query: raw.eye-network.ru. [malformed]

System Summary

Malicious sample detected (through community Yara rule)

Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5514.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5514.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 5514.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 5514.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 5514.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 5514.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5514.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: Process Memory Space: vwkjebwi686.elf PID: 5514, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: /proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemdshellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/anko-app/ankosample _8182T_1104/usr/libexec/openssh/sftp-serverraw.eye-network.ruabcdefghijklmnopqrstuvwxyz/proc/%d/proc/self/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt

Source: ELF static info symbol of initial sample

.symtab present: no

Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5514.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5514.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 5514.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 5514.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 5514.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 5514.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5514.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: Process Memory Space: vwkjebwi686.elf PID: 5514, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal92.troj.evad.linELF@0/0@96/0

Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/1591/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/804/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/3407/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/1484/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/133/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/1479/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/931/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/1595/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/812/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/933/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/3419/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/262/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/142/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/263/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/264/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/265/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/145/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/266/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/267/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/268/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/3303/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/269/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/1486/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/1806/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/3440/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/270/cmdline	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 5516)	File opened: /proc/271/cmdline	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/vwkjebwi686.elf (PID: 5515)

File: /tmp/vwkjebwi686.elf

Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: vwkjebwi686.elf, type: SAMPLE
Source: Yara match	File source: 5514.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vwkjebwi686.elf PID: 5514, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: vwkjebwi686.elf, type: SAMPLE
Source: Yara match	File source: 5514.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vwkjebwi686.elf PID: 5514, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: vwkjebwi686.elf, type: SAMPLE
Source: Yara match	File source: 5514.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vwkjebwi686.elf PID: 5514, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: vwkjebwi686.elf, type: SAMPLE
Source: Yara match	File source: 5514.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vwkjebwi686.elf PID: 5514, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File Deletion	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label
vwkjebwi686.elf	42%	ReversingLabs	Linux.Backdoor.Mirai
vwkjebwi686.elf	100%	Avira	EXP/ELF.Mirai.Z.A
vwkjebwi686.elf	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
raw.eye-network.ru	213.232.235.18	true	true		unknown
raw.eye-network.ru. [malformed]	unknown	unknown	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
213.232.235.18	raw.eye-network.ru	Russian Federation		39824	ALMANET-ASKZ	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
213.232.235.18	dvwkja7.elf	Get hash	malicious	Mirai, Okiru	Browse
	dwhdbg.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	wriww68k.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	vqsjh4.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	wheiuwa4.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	jwwofba5.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	qkbfi86.elf	Get hash	malicious	Mirai, Okiru	Browse
	qkehusl.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	vkjqpc.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	vqsjh4.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.eye-network.ru	dwhdbg.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	213.232.235.18
	qkehusl.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	213.232.235.18
	vkjqpc.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	213.232.235.18

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ALMANET-ASKZ	dvwkja7.elf	Get hash	malicious	Mirai, Okiru	Browse	213.232.235.18
	dwhdbg.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	213.232.235.18
	wriww68k.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	213.232.235.18
	vqsjh4.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	213.232.235.18
	wheiuwa4.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	213.232.235.18
	jwwofba5.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	213.232.235.18
	qkbfi86.elf	Get hash	malicious	Mirai, Okiru	Browse	213.232.235.18
	qkehusl.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	213.232.235.18
	vkjqpc.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	213.232.235.18
	vqsjh4.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	213.232.235.18

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.766702752264612
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	vwkjebwi686.elf
File size:	106'184 bytes
MD5:	881f9d6a05bdf13aa459f1047e283f06
SHA1:	3904c5aae6341cef851b1da95d4bdfb776437ed3
SHA256:	4ff3cbf3faf806219c21bd672cc4e46d2ba526ae76e97543aed280443ea7495e
SHA512:	959e4113def723bc40e4fc53f284f3e0be8948a096258878533e4e21f4ea2e2b0c8b5eb39f5b756346a55e3bebc65fe415cb26bf33d8e24e84e40b15ce3177db
SSDEEP:	1536:HybIo+QIajC30jCjRSso0aYHLb/3TXUgmJjtW/IzKqQWdafSrxGnl:Hyko+Daj32N3aYn/DXU/qwzKqQWd7Gl
TLSH:	1AA337C1F54780F6D8434971006AFB3FDF32C1A59031DA6EEFADAE36DA235429216A5C
File Content Preview:	.ELF....................h...4...8.......4. ...(......................U...U...............U...........G..............Q.td............................U..S........d...h.....+..[]...$.............U......=.-...t..1....D......D.......u........t...$............-

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048168
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	105784
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0x12c01	0x0	0x6	AX	16
.fini	PROGBITS	0x805acb1	0x12cb1	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x805ace0	0x12ce0	0x2833	0x0	0x2	A	32
.ctors	PROGBITS	0x805e518	0x15518	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x805e524	0x15524	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x805e540	0x15540	0x47b8	0x0	0x3	WA	32
.bss	NOBITS	0x8062d00	0x19cf8	0x49ec	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x19cf8	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x15513	0x15513	6.4737	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x15518	0x805e518	0x805e518	0x47e0	0x91d4	0.4136	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 17:22:36.068675995 CET	49924	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:36.074079037 CET	33966	49924	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:36.074141026 CET	49924	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:36.074183941 CET	49924	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:36.080282927 CET	33966	49924	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:36.080334902 CET	49924	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:36.086838007 CET	33966	49924	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:37.024111986 CET	33966	49924	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:37.024283886 CET	49924	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:37.024283886 CET	49924	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:37.102359056 CET	49926	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:37.108725071 CET	33966	49926	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:37.108812094 CET	49926	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:37.108812094 CET	49926	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:37.114692926 CET	33966	49926	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:37.114742994 CET	49926	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:37.120074034 CET	33966	49926	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:38.035979986 CET	33966	49926	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:38.036079884 CET	49926	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:38.036079884 CET	49926	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:38.116439104 CET	49928	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:38.122886896 CET	33966	49928	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:38.122968912 CET	49928	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:38.122968912 CET	49928	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:38.129005909 CET	33966	49928	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:38.129079103 CET	49928	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:38.134679079 CET	33966	49928	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:39.040512085 CET	33966	49928	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:39.040606022 CET	49928	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:39.040606022 CET	49928	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:39.129956961 CET	49930	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:39.137012959 CET	33966	49930	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:39.137130976 CET	49930	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:39.137130976 CET	49930	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:39.142585993 CET	33966	49930	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:39.142631054 CET	49930	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:39.148127079 CET	33966	49930	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:40.055006027 CET	33966	49930	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:40.055130959 CET	49930	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:40.055207968 CET	49930	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:40.132116079 CET	49932	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:40.137568951 CET	33966	49932	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:40.137650967 CET	49932	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:40.137650967 CET	49932	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:40.143148899 CET	33966	49932	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:40.143198013 CET	49932	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:40.148989916 CET	33966	49932	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:41.544691086 CET	33966	49932	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:41.544797897 CET	49932	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:41.544797897 CET	49932	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:41.546528101 CET	33966	49932	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:41.546665907 CET	49932	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:41.549149036 CET	33966	49932	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:41.549455881 CET	49932	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:41.626931906 CET	49934	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:41.632333994 CET	33966	49934	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:41.632492065 CET	49934	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:41.632523060 CET	49934	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:41.637876034 CET	33966	49934	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:41.637928963 CET	49934	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:41.643351078 CET	33966	49934	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:42.538073063 CET	33966	49934	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:42.538158894 CET	49934	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:42.538158894 CET	49934	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:42.615617990 CET	49936	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:42.620982885 CET	33966	49936	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:42.621052027 CET	49936	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:42.621064901 CET	49936	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:42.626652002 CET	33966	49936	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:42.626712084 CET	49936	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:42.632185936 CET	33966	49936	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:43.032458067 CET	33966	49936	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:46.112231016 CET	49938	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:46.117866993 CET	33966	49938	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:46.117944002 CET	49938	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:46.117958069 CET	49938	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:46.123486042 CET	33966	49938	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:46.123545885 CET	49938	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:46.129314899 CET	33966	49938	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:46.138042927 CET	33966	49938	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:49.217937946 CET	49940	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:49.224297047 CET	33966	49940	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:49.224368095 CET	49940	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:49.224391937 CET	49940	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:49.229928970 CET	33966	49940	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:49.230000973 CET	49940	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:49.235780001 CET	33966	49940	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:50.144148111 CET	33966	49940	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:50.144258976 CET	49940	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:50.144273043 CET	49940	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:50.218988895 CET	49942	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:50.224524021 CET	33966	49942	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:50.224586010 CET	49942	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:50.224610090 CET	49942	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:50.229973078 CET	33966	49942	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:50.230040073 CET	49942	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:50.235497952 CET	33966	49942	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:51.134546995 CET	33966	49942	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:51.134666920 CET	49942	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:51.134685040 CET	49942	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:51.211154938 CET	49944	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:51.217252016 CET	33966	49944	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:51.217423916 CET	49944	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:51.217463970 CET	49944	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:51.223165989 CET	33966	49944	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:51.223228931 CET	49944	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:51.229233980 CET	33966	49944	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:52.131889105 CET	33966	49944	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:52.132117987 CET	49944	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:52.132117987 CET	49944	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:52.211853027 CET	49946	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:52.219432116 CET	33966	49946	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:52.219515085 CET	49946	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:52.219515085 CET	49946	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:52.224992037 CET	33966	49946	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:52.225070000 CET	49946	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:52.230429888 CET	33966	49946	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:53.127480984 CET	33966	49946	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:53.127708912 CET	49946	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:53.127708912 CET	49946	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:53.200310946 CET	49948	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:53.205770016 CET	33966	49948	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:53.205857992 CET	49948	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:53.205893993 CET	49948	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:53.211477995 CET	33966	49948	213.232.235.18	192.168.2.15
Oct 29, 2024 17:22:53.211523056 CET	49948	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:22:53.216826916 CET	33966	49948	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:03.252415895 CET	49948	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:03.257797956 CET	33966	49948	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:05.349987984 CET	33966	49948	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:05.350298882 CET	49948	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:05.355796099 CET	33966	49948	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:06.431194067 CET	49950	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:06.436933041 CET	33966	49950	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:06.437020063 CET	49950	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:06.437053919 CET	49950	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:06.442357063 CET	33966	49950	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:06.442421913 CET	49950	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:06.448416948 CET	33966	49950	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:07.365441084 CET	33966	49950	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:07.365586996 CET	49950	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:07.365586996 CET	49950	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:07.448494911 CET	49952	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:07.453803062 CET	33966	49952	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:07.453881025 CET	49952	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:07.453881025 CET	49952	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:07.459196091 CET	33966	49952	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:07.459258080 CET	49952	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:07.464590073 CET	33966	49952	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:08.342636108 CET	33966	49952	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:08.342840910 CET	49952	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:08.342840910 CET	49952	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:08.418988943 CET	49954	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:08.424312115 CET	33966	49954	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:08.424403906 CET	49954	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:08.424439907 CET	49954	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:08.429795980 CET	33966	49954	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:08.429872036 CET	49954	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:08.435244083 CET	33966	49954	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:09.313241005 CET	33966	49954	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:09.313585043 CET	49954	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:09.313585997 CET	49954	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:09.388804913 CET	49956	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:09.394356012 CET	33966	49956	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:09.394432068 CET	49956	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:09.394443989 CET	49956	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:09.399786949 CET	33966	49956	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:09.399851084 CET	49956	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:09.405814886 CET	33966	49956	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:10.292499065 CET	33966	49956	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:10.292766094 CET	49956	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:10.292787075 CET	49956	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:10.367486954 CET	49958	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:10.372896910 CET	33966	49958	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:10.372973919 CET	49958	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:10.372987986 CET	49958	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:10.379532099 CET	33966	49958	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:10.379597902 CET	49958	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:10.384958029 CET	33966	49958	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:11.283129930 CET	33966	49958	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:11.283253908 CET	49958	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:11.283253908 CET	49958	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:11.355690002 CET	49960	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:11.361181974 CET	33966	49960	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:11.361238003 CET	49960	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:11.361255884 CET	49960	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:11.366774082 CET	33966	49960	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:11.366820097 CET	49960	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:11.372180939 CET	33966	49960	213.232.235.18	192.168.2.15
Oct 29, 2024 17:24:21.367775917 CET	49960	33966	192.168.2.15	213.232.235.18
Oct 29, 2024 17:24:21.373166084 CET	33966	49960	213.232.235.18	192.168.2.15

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 17:22:36.012707949 CET	59508	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:36.023068905 CET	53	59508	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:36.023206949 CET	48305	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:36.030766010 CET	53	48305	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:36.030839920 CET	49276	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:36.040966988 CET	53	49276	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:36.041047096 CET	53901	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:36.051934958 CET	53	53901	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:36.052000999 CET	47974	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:36.060334921 CET	53	47974	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:36.060410023 CET	36978	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:36.068572998 CET	53	36978	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:37.024290085 CET	52996	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:37.033570051 CET	53	52996	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:37.033668041 CET	55298	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:37.040718079 CET	53	55298	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:37.040802956 CET	39931	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:37.048185110 CET	53	39931	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:37.048254013 CET	51920	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:37.055265903 CET	53	51920	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:37.055346012 CET	52524	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:37.063652992 CET	53	52524	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:37.063719988 CET	40734	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:37.071377039 CET	53	40734	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:37.071469069 CET	60973	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:37.079130888 CET	53	60973	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:37.079205036 CET	47005	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:37.087307930 CET	53	47005	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:37.087399960 CET	45849	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:37.094716072 CET	53	45849	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:37.094774008 CET	41772	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:37.102276087 CET	53	41772	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:38.036187887 CET	37297	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:38.044321060 CET	53	37297	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:38.044420004 CET	57717	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:38.052309990 CET	53	57717	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:38.052380085 CET	47534	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:38.060400963 CET	53	47534	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:38.060892105 CET	52746	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:38.068787098 CET	53	52746	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:38.068865061 CET	32770	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:38.076234102 CET	53	32770	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:38.076308966 CET	45715	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:38.084920883 CET	53	45715	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:38.084997892 CET	59867	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:38.093033075 CET	53	59867	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:38.093126059 CET	42250	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:38.100286007 CET	53	42250	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:38.100366116 CET	55937	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:38.108683109 CET	53	55937	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:38.108750105 CET	41027	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:38.116331100 CET	53	41027	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:39.040668964 CET	46920	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:39.047914982 CET	53	46920	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:39.047992945 CET	49431	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:39.055825949 CET	53	49431	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:39.055897951 CET	39841	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:39.063102007 CET	53	39841	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:39.063165903 CET	58507	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:39.070092916 CET	53	58507	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:39.070157051 CET	59842	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:39.077850103 CET	53	59842	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:39.077915907 CET	33545	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:39.084851027 CET	53	33545	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:39.084908962 CET	56513	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:39.097170115 CET	53	56513	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:39.097248077 CET	60191	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:39.113888025 CET	53	60191	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:39.113995075 CET	52757	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:39.122195005 CET	53	52757	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:39.122275114 CET	55018	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:39.129880905 CET	53	55018	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:40.055172920 CET	49154	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:40.063194990 CET	53	49154	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:40.063291073 CET	52484	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:40.070458889 CET	53	52484	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:40.070532084 CET	45169	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:40.077737093 CET	53	45169	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:40.077816010 CET	52617	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:40.085683107 CET	53	52617	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:40.085747004 CET	39345	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:40.093286037 CET	53	39345	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:40.093355894 CET	50486	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:40.101174116 CET	53	50486	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:40.101242065 CET	51443	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:40.108472109 CET	53	51443	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:40.108535051 CET	56948	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:40.117640018 CET	53	56948	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:40.117707968 CET	45329	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:40.125008106 CET	53	45329	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:40.125098944 CET	39493	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:40.132042885 CET	53	39493	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:41.544867039 CET	60749	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:41.560549021 CET	53	60749	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:41.560687065 CET	54667	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:41.568311930 CET	53	54667	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:41.568406105 CET	34747	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:41.576046944 CET	53	34747	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:41.576144934 CET	33136	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:41.583477974 CET	53	33136	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:41.583570957 CET	56978	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:41.591428041 CET	53	56978	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:41.591515064 CET	53900	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:41.598340034 CET	53	53900	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:41.598529100 CET	51992	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:41.605597019 CET	53	51992	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:41.605676889 CET	49230	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:41.612648010 CET	53	49230	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:41.612726927 CET	41266	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:41.619637012 CET	53	41266	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:41.619756937 CET	43447	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:41.626853943 CET	53	43447	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:42.538228989 CET	60678	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:42.546111107 CET	53	60678	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:42.546212912 CET	43932	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:42.553431988 CET	53	43932	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:42.553529024 CET	38135	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:42.561184883 CET	53	38135	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:42.561258078 CET	32888	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:42.568640947 CET	53	32888	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:42.568713903 CET	42421	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:42.575962067 CET	53	42421	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:42.576050997 CET	47950	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:42.583951950 CET	53	47950	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:42.584074020 CET	47178	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:42.592442989 CET	53	47178	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:42.592508078 CET	51089	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:42.600591898 CET	53	51089	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:42.600684881 CET	55859	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:42.607708931 CET	53	55859	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:42.608535051 CET	50818	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:42.615525007 CET	53	50818	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:46.036014080 CET	40233	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:46.042949915 CET	53	40233	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:46.043047905 CET	42483	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:46.052125931 CET	53	42483	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:46.052232981 CET	42693	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:46.059283972 CET	53	42693	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:46.059396029 CET	49510	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:46.066459894 CET	53	49510	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:46.066561937 CET	59260	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:46.074253082 CET	53	59260	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:46.074392080 CET	43298	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:46.082572937 CET	53	43298	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:46.082659960 CET	59212	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:46.089920998 CET	53	59212	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:46.089993000 CET	48800	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:46.097696066 CET	53	48800	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:46.097774982 CET	46360	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:46.105146885 CET	53	46360	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:46.105220079 CET	42218	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:46.112154961 CET	53	42218	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:49.141146898 CET	36674	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:49.149971962 CET	53	36674	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:49.150059938 CET	44122	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:49.158001900 CET	53	44122	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:49.158060074 CET	33338	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:49.165611982 CET	53	33338	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:49.165672064 CET	41644	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:49.172642946 CET	53	41644	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:49.172698975 CET	55008	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:49.180413008 CET	53	55008	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:49.180497885 CET	54511	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:49.187962055 CET	53	54511	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:49.188019037 CET	58764	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:49.195285082 CET	53	58764	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:49.195365906 CET	36092	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:49.202461004 CET	53	36092	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:49.202577114 CET	35071	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:49.210022926 CET	53	35071	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:49.210087061 CET	50858	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:49.217861891 CET	53	50858	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:50.144334078 CET	37392	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:50.151679993 CET	53	37392	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:50.151773930 CET	58110	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:50.158834934 CET	53	58110	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:50.158899069 CET	38067	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:50.165673018 CET	53	38067	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:50.165733099 CET	47362	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:50.173254967 CET	53	47362	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:50.173315048 CET	59142	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:50.182689905 CET	53	59142	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:50.182751894 CET	35483	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:50.190710068 CET	53	35483	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:50.190885067 CET	33632	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:50.198358059 CET	53	33632	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:50.198416948 CET	45962	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:50.205269098 CET	53	45962	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:50.205338955 CET	35199	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:50.212014914 CET	53	35199	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:50.212081909 CET	42746	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:50.218895912 CET	53	42746	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:51.134741068 CET	37673	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:51.142302990 CET	53	37673	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:51.142410040 CET	52002	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:51.150492907 CET	53	52002	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:51.150564909 CET	40527	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:51.157481909 CET	53	40527	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:51.157553911 CET	45524	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:51.165051937 CET	53	45524	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:51.165170908 CET	39648	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:51.172768116 CET	53	39648	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:51.172852039 CET	40590	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:51.180519104 CET	53	40590	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:51.180589914 CET	52812	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:51.187903881 CET	53	52812	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:51.188081026 CET	50883	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:51.195082903 CET	53	50883	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:51.195173025 CET	36157	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:51.202831030 CET	53	36157	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:51.202910900 CET	45751	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:51.211067915 CET	53	45751	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:52.132159948 CET	45200	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:52.139476061 CET	53	45200	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:52.139590025 CET	35325	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:52.146847963 CET	53	35325	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:52.146939039 CET	55082	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:52.154568911 CET	53	55082	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:52.154658079 CET	36368	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:52.162486076 CET	53	36368	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:52.162563086 CET	57052	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:52.169457912 CET	53	57052	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:52.169539928 CET	34629	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:52.181518078 CET	53	34629	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:52.181608915 CET	41165	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:52.189344883 CET	53	41165	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:52.189430952 CET	36010	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:52.197016954 CET	53	36010	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:52.197113991 CET	56502	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:52.204684973 CET	53	56502	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:52.204756021 CET	41379	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:52.211654902 CET	53	41379	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:53.127708912 CET	33760	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:53.134363890 CET	53	33760	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:53.134443045 CET	37688	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:53.142362118 CET	53	37688	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:53.142611027 CET	36600	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:53.149940968 CET	53	36600	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:53.150006056 CET	56537	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:53.156924009 CET	53	56537	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:53.156990051 CET	42856	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:53.163878918 CET	53	42856	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:53.163953066 CET	42968	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:53.170814037 CET	53	42968	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:53.170897007 CET	41049	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:53.178069115 CET	53	41049	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:53.178139925 CET	50549	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:53.185765982 CET	53	50549	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:53.185849905 CET	46533	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:53.193147898 CET	53	46533	8.8.8.8	192.168.2.15
Oct 29, 2024 17:22:53.193214893 CET	50023	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:22:53.200237989 CET	53	50023	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:06.352629900 CET	48008	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:06.363778114 CET	53	48008	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:06.363940001 CET	60366	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:06.371483088 CET	53	60366	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:06.371596098 CET	55402	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:06.379281998 CET	53	55402	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:06.379406929 CET	35538	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:06.386574984 CET	53	35538	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:06.386687040 CET	51130	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:06.394018888 CET	53	51130	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:06.394140959 CET	49250	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:06.401844025 CET	53	49250	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:06.401978016 CET	42233	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:06.409872055 CET	53	42233	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:06.409991026 CET	34239	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:06.417093992 CET	53	34239	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:06.417192936 CET	36771	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:06.424209118 CET	53	36771	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:06.424305916 CET	54420	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:06.431062937 CET	53	54420	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:07.365720987 CET	41852	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:07.373200893 CET	53	41852	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:07.373280048 CET	53778	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:07.380143881 CET	53	53778	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:07.380217075 CET	59274	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:07.387252092 CET	53	59274	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:07.387335062 CET	60176	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:07.394783020 CET	53	60176	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:07.394898891 CET	47180	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:07.402179003 CET	53	47180	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:07.402268887 CET	42350	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:07.410485029 CET	53	42350	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:07.410572052 CET	47182	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:07.418735981 CET	53	47182	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:07.418880939 CET	46252	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:07.431138992 CET	53	46252	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:07.431241035 CET	55742	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:07.440643072 CET	53	55742	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:07.440726042 CET	55050	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:07.448405981 CET	53	55050	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:08.342875957 CET	53302	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:08.350428104 CET	53	53302	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:08.350528002 CET	59865	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:08.358922005 CET	53	59865	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:08.359010935 CET	60989	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:08.367289066 CET	53	60989	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:08.367384911 CET	33913	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:08.374900103 CET	53	33913	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:08.374990940 CET	46044	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:08.381824017 CET	53	46044	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:08.381912947 CET	48463	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:08.389209032 CET	53	48463	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:08.389336109 CET	51982	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:08.396713018 CET	53	51982	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:08.396826982 CET	50878	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:08.403713942 CET	53	50878	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:08.403822899 CET	50018	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:08.410617113 CET	53	50018	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:08.410706997 CET	47883	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:08.418859959 CET	53	47883	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:09.313585043 CET	51119	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:09.320719004 CET	53	51119	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:09.320827961 CET	54076	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:09.328313112 CET	53	54076	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:09.328425884 CET	40761	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:09.335683107 CET	53	40761	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:09.335767031 CET	38460	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:09.342777967 CET	53	38460	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:09.342863083 CET	42513	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:09.350430965 CET	53	42513	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:09.350539923 CET	43529	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:09.357789993 CET	53	43529	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:09.357891083 CET	38921	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:09.365437031 CET	53	38921	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:09.365556955 CET	47652	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:09.372849941 CET	53	47652	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:09.372925997 CET	35085	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:09.380424976 CET	53	35085	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:09.380635023 CET	33489	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:09.388720036 CET	53	33489	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:10.292829037 CET	59504	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:10.299745083 CET	53	59504	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:10.299851894 CET	48374	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:10.307307005 CET	53	48374	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:10.307382107 CET	60545	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:10.314837933 CET	53	60545	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:10.314910889 CET	32975	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:10.322540998 CET	53	32975	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:10.322618961 CET	53329	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:10.329955101 CET	53	53329	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:10.330066919 CET	44020	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:10.337405920 CET	53	44020	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:10.337481022 CET	35777	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:10.344990969 CET	53	35777	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:10.345062971 CET	46013	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:10.351995945 CET	53	46013	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:10.352071047 CET	52969	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:10.359958887 CET	53	52969	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:10.360037088 CET	49774	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:10.367408991 CET	53	49774	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:11.283303976 CET	57582	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:11.290116072 CET	53	57582	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:11.290196896 CET	35579	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:11.297350883 CET	53	35579	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:11.297414064 CET	40168	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:11.304308891 CET	53	40168	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:11.304387093 CET	43036	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:11.311542034 CET	53	43036	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:11.311614990 CET	48452	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:11.319341898 CET	53	48452	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:11.319410086 CET	49616	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:11.326261044 CET	53	49616	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:11.326323032 CET	54449	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:11.333703995 CET	53	54449	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:11.333775043 CET	32838	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:11.340708971 CET	53	32838	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:11.340766907 CET	56166	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:11.348467112 CET	53	56166	8.8.8.8	192.168.2.15
Oct 29, 2024 17:24:11.348525047 CET	39383	53	192.168.2.15	8.8.8.8
Oct 29, 2024 17:24:11.355617046 CET	53	39383	8.8.8.8	192.168.2.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 29, 2024 17:22:36.012707949 CET	192.168.2.15	8.8.8.8	0x3d9b	Standard query (0)	raw.eye-network.ru	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:22:36.023206949 CET	192.168.2.15	8.8.8.8	0x45f0	Standard query (0)	raw.eye-network.ru. [malformed]	256	460	false
Oct 29, 2024 17:22:36.030839920 CET	192.168.2.15	8.8.8.8	0x45f0	Standard query (0)	raw.eye-network.ru. [malformed]	256	460	false
Oct 29, 2024 17:22:36.041047096 CET	192.168.2.15	8.8.8.8	0x45f0	Standard query (0)	raw.eye-network.ru. [malformed]	256	460	false
Oct 29, 2024 17:22:36.052000999 CET	192.168.2.15	8.8.8.8	0x45f0	Standard query (0)	raw.eye-network.ru. [malformed]	256	460	false
Oct 29, 2024 17:22:36.060410023 CET	192.168.2.15	8.8.8.8	0x45f0	Standard query (0)	raw.eye-network.ru. [malformed]	256	460	false
Oct 29, 2024 17:22:37.063719988 CET	192.168.2.15	8.8.8.8	0xd39a	Standard query (0)	raw.eye-network.ru. [malformed]	256	461	false
Oct 29, 2024 17:22:37.071469069 CET	192.168.2.15	8.8.8.8	0xd39a	Standard query (0)	raw.eye-network.ru. [malformed]	256	461	false
Oct 29, 2024 17:22:37.079205036 CET	192.168.2.15	8.8.8.8	0xd39a	Standard query (0)	raw.eye-network.ru. [malformed]	256	461	false
Oct 29, 2024 17:22:37.087399960 CET	192.168.2.15	8.8.8.8	0xd39a	Standard query (0)	raw.eye-network.ru. [malformed]	256	461	false
Oct 29, 2024 17:22:37.094774008 CET	192.168.2.15	8.8.8.8	0xd39a	Standard query (0)	raw.eye-network.ru. [malformed]	256	461	false
Oct 29, 2024 17:22:38.076308966 CET	192.168.2.15	8.8.8.8	0xadf5	Standard query (0)	raw.eye-network.ru. [malformed]	256	462	false
Oct 29, 2024 17:22:38.084997892 CET	192.168.2.15	8.8.8.8	0xadf5	Standard query (0)	raw.eye-network.ru. [malformed]	256	462	false
Oct 29, 2024 17:22:38.093126059 CET	192.168.2.15	8.8.8.8	0xadf5	Standard query (0)	raw.eye-network.ru. [malformed]	256	462	false
Oct 29, 2024 17:22:38.100366116 CET	192.168.2.15	8.8.8.8	0xadf5	Standard query (0)	raw.eye-network.ru. [malformed]	256	462	false
Oct 29, 2024 17:22:38.108750105 CET	192.168.2.15	8.8.8.8	0xadf5	Standard query (0)	raw.eye-network.ru. [malformed]	256	462	false
Oct 29, 2024 17:22:39.077915907 CET	192.168.2.15	8.8.8.8	0xa4ec	Standard query (0)	raw.eye-network.ru. [malformed]	256	463	false
Oct 29, 2024 17:22:39.084908962 CET	192.168.2.15	8.8.8.8	0xa4ec	Standard query (0)	raw.eye-network.ru. [malformed]	256	463	false
Oct 29, 2024 17:22:39.097248077 CET	192.168.2.15	8.8.8.8	0xa4ec	Standard query (0)	raw.eye-network.ru. [malformed]	256	463	false
Oct 29, 2024 17:22:39.113995075 CET	192.168.2.15	8.8.8.8	0xa4ec	Standard query (0)	raw.eye-network.ru. [malformed]	256	463	false
Oct 29, 2024 17:22:39.122275114 CET	192.168.2.15	8.8.8.8	0xa4ec	Standard query (0)	raw.eye-network.ru. [malformed]	256	463	false
Oct 29, 2024 17:22:40.093355894 CET	192.168.2.15	8.8.8.8	0x141	Standard query (0)	raw.eye-network.ru. [malformed]	256	464	false
Oct 29, 2024 17:22:40.101242065 CET	192.168.2.15	8.8.8.8	0x141	Standard query (0)	raw.eye-network.ru. [malformed]	256	464	false
Oct 29, 2024 17:22:40.108535051 CET	192.168.2.15	8.8.8.8	0x141	Standard query (0)	raw.eye-network.ru. [malformed]	256	464	false
Oct 29, 2024 17:22:40.117707968 CET	192.168.2.15	8.8.8.8	0x141	Standard query (0)	raw.eye-network.ru. [malformed]	256	464	false
Oct 29, 2024 17:22:40.125098944 CET	192.168.2.15	8.8.8.8	0x141	Standard query (0)	raw.eye-network.ru. [malformed]	256	464	false
Oct 29, 2024 17:22:41.591515064 CET	192.168.2.15	8.8.8.8	0x99ef	Standard query (0)	raw.eye-network.ru. [malformed]	256	465	false
Oct 29, 2024 17:22:41.598529100 CET	192.168.2.15	8.8.8.8	0x99ef	Standard query (0)	raw.eye-network.ru. [malformed]	256	465	false
Oct 29, 2024 17:22:41.605676889 CET	192.168.2.15	8.8.8.8	0x99ef	Standard query (0)	raw.eye-network.ru. [malformed]	256	465	false
Oct 29, 2024 17:22:41.612726927 CET	192.168.2.15	8.8.8.8	0x99ef	Standard query (0)	raw.eye-network.ru. [malformed]	256	465	false
Oct 29, 2024 17:22:41.619756937 CET	192.168.2.15	8.8.8.8	0x99ef	Standard query (0)	raw.eye-network.ru. [malformed]	256	465	false
Oct 29, 2024 17:22:42.576050997 CET	192.168.2.15	8.8.8.8	0x7cee	Standard query (0)	raw.eye-network.ru. [malformed]	256	466	false
Oct 29, 2024 17:22:42.584074020 CET	192.168.2.15	8.8.8.8	0x7cee	Standard query (0)	raw.eye-network.ru. [malformed]	256	466	false
Oct 29, 2024 17:22:42.592508078 CET	192.168.2.15	8.8.8.8	0x7cee	Standard query (0)	raw.eye-network.ru. [malformed]	256	466	false
Oct 29, 2024 17:22:42.600684881 CET	192.168.2.15	8.8.8.8	0x7cee	Standard query (0)	raw.eye-network.ru. [malformed]	256	466	false
Oct 29, 2024 17:22:42.608535051 CET	192.168.2.15	8.8.8.8	0x7cee	Standard query (0)	raw.eye-network.ru. [malformed]	256	466	false
Oct 29, 2024 17:22:46.074392080 CET	192.168.2.15	8.8.8.8	0x5665	Standard query (0)	raw.eye-network.ru. [malformed]	256	470	false
Oct 29, 2024 17:22:46.082659960 CET	192.168.2.15	8.8.8.8	0x5665	Standard query (0)	raw.eye-network.ru. [malformed]	256	470	false
Oct 29, 2024 17:22:46.089993000 CET	192.168.2.15	8.8.8.8	0x5665	Standard query (0)	raw.eye-network.ru. [malformed]	256	470	false
Oct 29, 2024 17:22:46.097774982 CET	192.168.2.15	8.8.8.8	0x5665	Standard query (0)	raw.eye-network.ru. [malformed]	256	470	false
Oct 29, 2024 17:22:46.105220079 CET	192.168.2.15	8.8.8.8	0x5665	Standard query (0)	raw.eye-network.ru. [malformed]	256	470	false
Oct 29, 2024 17:22:49.180497885 CET	192.168.2.15	8.8.8.8	0x545e	Standard query (0)	raw.eye-network.ru. [malformed]	256	473	false
Oct 29, 2024 17:22:49.188019037 CET	192.168.2.15	8.8.8.8	0x545e	Standard query (0)	raw.eye-network.ru. [malformed]	256	473	false
Oct 29, 2024 17:22:49.195365906 CET	192.168.2.15	8.8.8.8	0x545e	Standard query (0)	raw.eye-network.ru. [malformed]	256	473	false
Oct 29, 2024 17:22:49.202577114 CET	192.168.2.15	8.8.8.8	0x545e	Standard query (0)	raw.eye-network.ru. [malformed]	256	473	false
Oct 29, 2024 17:22:49.210087061 CET	192.168.2.15	8.8.8.8	0x545e	Standard query (0)	raw.eye-network.ru. [malformed]	256	473	false
Oct 29, 2024 17:22:50.182751894 CET	192.168.2.15	8.8.8.8	0xf91e	Standard query (0)	raw.eye-network.ru. [malformed]	256	474	false
Oct 29, 2024 17:22:50.190885067 CET	192.168.2.15	8.8.8.8	0xf91e	Standard query (0)	raw.eye-network.ru. [malformed]	256	474	false
Oct 29, 2024 17:22:50.198416948 CET	192.168.2.15	8.8.8.8	0xf91e	Standard query (0)	raw.eye-network.ru. [malformed]	256	474	false
Oct 29, 2024 17:22:50.205338955 CET	192.168.2.15	8.8.8.8	0xf91e	Standard query (0)	raw.eye-network.ru. [malformed]	256	474	false
Oct 29, 2024 17:22:50.212081909 CET	192.168.2.15	8.8.8.8	0xf91e	Standard query (0)	raw.eye-network.ru. [malformed]	256	474	false
Oct 29, 2024 17:22:51.172852039 CET	192.168.2.15	8.8.8.8	0x1f14	Standard query (0)	raw.eye-network.ru. [malformed]	256	475	false
Oct 29, 2024 17:22:51.180589914 CET	192.168.2.15	8.8.8.8	0x1f14	Standard query (0)	raw.eye-network.ru. [malformed]	256	475	false
Oct 29, 2024 17:22:51.188081026 CET	192.168.2.15	8.8.8.8	0x1f14	Standard query (0)	raw.eye-network.ru. [malformed]	256	475	false
Oct 29, 2024 17:22:51.195173025 CET	192.168.2.15	8.8.8.8	0x1f14	Standard query (0)	raw.eye-network.ru. [malformed]	256	475	false
Oct 29, 2024 17:22:51.202910900 CET	192.168.2.15	8.8.8.8	0x1f14	Standard query (0)	raw.eye-network.ru. [malformed]	256	475	false
Oct 29, 2024 17:22:52.169539928 CET	192.168.2.15	8.8.8.8	0x450	Standard query (0)	raw.eye-network.ru. [malformed]	256	476	false
Oct 29, 2024 17:22:52.181608915 CET	192.168.2.15	8.8.8.8	0x450	Standard query (0)	raw.eye-network.ru. [malformed]	256	476	false
Oct 29, 2024 17:22:52.189430952 CET	192.168.2.15	8.8.8.8	0x450	Standard query (0)	raw.eye-network.ru. [malformed]	256	476	false
Oct 29, 2024 17:22:52.197113991 CET	192.168.2.15	8.8.8.8	0x450	Standard query (0)	raw.eye-network.ru. [malformed]	256	476	false
Oct 29, 2024 17:22:52.204756021 CET	192.168.2.15	8.8.8.8	0x450	Standard query (0)	raw.eye-network.ru. [malformed]	256	476	false
Oct 29, 2024 17:22:53.163953066 CET	192.168.2.15	8.8.8.8	0xc2b	Standard query (0)	raw.eye-network.ru. [malformed]	256	477	false
Oct 29, 2024 17:22:53.170897007 CET	192.168.2.15	8.8.8.8	0xc2b	Standard query (0)	raw.eye-network.ru. [malformed]	256	477	false
Oct 29, 2024 17:22:53.178139925 CET	192.168.2.15	8.8.8.8	0xc2b	Standard query (0)	raw.eye-network.ru. [malformed]	256	477	false
Oct 29, 2024 17:22:53.185849905 CET	192.168.2.15	8.8.8.8	0xc2b	Standard query (0)	raw.eye-network.ru. [malformed]	256	477	false
Oct 29, 2024 17:22:53.193214893 CET	192.168.2.15	8.8.8.8	0xc2b	Standard query (0)	raw.eye-network.ru. [malformed]	256	477	false
Oct 29, 2024 17:24:06.394140959 CET	192.168.2.15	8.8.8.8	0x4210	Standard query (0)	raw.eye-network.ru. [malformed]	256	294	false
Oct 29, 2024 17:24:06.401978016 CET	192.168.2.15	8.8.8.8	0x4210	Standard query (0)	raw.eye-network.ru. [malformed]	256	294	false
Oct 29, 2024 17:24:06.409991026 CET	192.168.2.15	8.8.8.8	0x4210	Standard query (0)	raw.eye-network.ru. [malformed]	256	294	false
Oct 29, 2024 17:24:06.417192936 CET	192.168.2.15	8.8.8.8	0x4210	Standard query (0)	raw.eye-network.ru. [malformed]	256	294	false
Oct 29, 2024 17:24:06.424305916 CET	192.168.2.15	8.8.8.8	0x4210	Standard query (0)	raw.eye-network.ru. [malformed]	256	294	false
Oct 29, 2024 17:24:07.402268887 CET	192.168.2.15	8.8.8.8	0x212a	Standard query (0)	raw.eye-network.ru. [malformed]	256	295	false
Oct 29, 2024 17:24:07.410572052 CET	192.168.2.15	8.8.8.8	0x212a	Standard query (0)	raw.eye-network.ru. [malformed]	256	295	false
Oct 29, 2024 17:24:07.418880939 CET	192.168.2.15	8.8.8.8	0x212a	Standard query (0)	raw.eye-network.ru. [malformed]	256	295	false
Oct 29, 2024 17:24:07.431241035 CET	192.168.2.15	8.8.8.8	0x212a	Standard query (0)	raw.eye-network.ru. [malformed]	256	295	false
Oct 29, 2024 17:24:07.440726042 CET	192.168.2.15	8.8.8.8	0x212a	Standard query (0)	raw.eye-network.ru. [malformed]	256	295	false
Oct 29, 2024 17:24:08.381912947 CET	192.168.2.15	8.8.8.8	0x703a	Standard query (0)	raw.eye-network.ru. [malformed]	256	296	false
Oct 29, 2024 17:24:08.389336109 CET	192.168.2.15	8.8.8.8	0x703a	Standard query (0)	raw.eye-network.ru. [malformed]	256	296	false
Oct 29, 2024 17:24:08.396826982 CET	192.168.2.15	8.8.8.8	0x703a	Standard query (0)	raw.eye-network.ru. [malformed]	256	296	false
Oct 29, 2024 17:24:08.403822899 CET	192.168.2.15	8.8.8.8	0x703a	Standard query (0)	raw.eye-network.ru. [malformed]	256	296	false
Oct 29, 2024 17:24:08.410706997 CET	192.168.2.15	8.8.8.8	0x703a	Standard query (0)	raw.eye-network.ru. [malformed]	256	296	false
Oct 29, 2024 17:24:09.350539923 CET	192.168.2.15	8.8.8.8	0xfc64	Standard query (0)	raw.eye-network.ru. [malformed]	256	297	false
Oct 29, 2024 17:24:09.357891083 CET	192.168.2.15	8.8.8.8	0xfc64	Standard query (0)	raw.eye-network.ru. [malformed]	256	297	false
Oct 29, 2024 17:24:09.365556955 CET	192.168.2.15	8.8.8.8	0xfc64	Standard query (0)	raw.eye-network.ru. [malformed]	256	297	false
Oct 29, 2024 17:24:09.372925997 CET	192.168.2.15	8.8.8.8	0xfc64	Standard query (0)	raw.eye-network.ru. [malformed]	256	297	false
Oct 29, 2024 17:24:09.380635023 CET	192.168.2.15	8.8.8.8	0xfc64	Standard query (0)	raw.eye-network.ru. [malformed]	256	297	false
Oct 29, 2024 17:24:10.330066919 CET	192.168.2.15	8.8.8.8	0xcbff	Standard query (0)	raw.eye-network.ru. [malformed]	256	298	false
Oct 29, 2024 17:24:10.337481022 CET	192.168.2.15	8.8.8.8	0xcbff	Standard query (0)	raw.eye-network.ru. [malformed]	256	298	false
Oct 29, 2024 17:24:10.345062971 CET	192.168.2.15	8.8.8.8	0xcbff	Standard query (0)	raw.eye-network.ru. [malformed]	256	298	false
Oct 29, 2024 17:24:10.352071047 CET	192.168.2.15	8.8.8.8	0xcbff	Standard query (0)	raw.eye-network.ru. [malformed]	256	298	false
Oct 29, 2024 17:24:10.360037088 CET	192.168.2.15	8.8.8.8	0xcbff	Standard query (0)	raw.eye-network.ru. [malformed]	256	298	false
Oct 29, 2024 17:24:11.319410086 CET	192.168.2.15	8.8.8.8	0x10c8	Standard query (0)	raw.eye-network.ru. [malformed]	256	299	false
Oct 29, 2024 17:24:11.326323032 CET	192.168.2.15	8.8.8.8	0x10c8	Standard query (0)	raw.eye-network.ru. [malformed]	256	299	false
Oct 29, 2024 17:24:11.333775043 CET	192.168.2.15	8.8.8.8	0x10c8	Standard query (0)	raw.eye-network.ru. [malformed]	256	299	false
Oct 29, 2024 17:24:11.340766907 CET	192.168.2.15	8.8.8.8	0x10c8	Standard query (0)	raw.eye-network.ru. [malformed]	256	299	false
Oct 29, 2024 17:24:11.348525047 CET	192.168.2.15	8.8.8.8	0x10c8	Standard query (0)	raw.eye-network.ru. [malformed]	256	299	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 29, 2024 17:22:36.023068905 CET	8.8.8.8	192.168.2.15	0x3d9b	No error (0)	raw.eye-network.ru		213.232.235.18	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: vwkjebwi686.elf PID: 5514, Parent PID: 5439

General

Start time (UTC):	16:22:35
Start date (UTC):	29/10/2024
Path:	/tmp/vwkjebwi686.elf
Arguments:	/tmp/vwkjebwi686.elf
File size:	106184 bytes
MD5 hash:	881f9d6a05bdf13aa459f1047e283f06

Start time (UTC):	16:22:35
Start date (UTC):	29/10/2024
Path:	/tmp/vwkjebwi686.elf
Arguments:	-
File size:	106184 bytes
MD5 hash:	881f9d6a05bdf13aa459f1047e283f06

Start time (UTC):	16:22:35
Start date (UTC):	29/10/2024
Path:	/tmp/vwkjebwi686.elf
Arguments:	-
File size:	106184 bytes
MD5 hash:	881f9d6a05bdf13aa459f1047e283f06

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report vwkjebwi686.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: vwkjebwi686.elf PID: 5514, Parent PID: 5439

General

Chronological Activities

Analysis Process: vwkjebwi686.elf PID: 5515, Parent PID: 5514

General

Chronological Activities

Analysis Process: vwkjebwi686.elf PID: 5516, Parent PID: 5515

General

Chronological Activities

Linux Analysis Report
vwkjebwi686.elf