Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
bot.x86_64.elf

Overview

General Information

Sample name:bot.x86_64.elf
Analysis ID:1567773
MD5:9cc2af514461a0cfbcf17a09a6883acb
SHA1:e0509159d0abafb28663222820dc399df5f34abc
SHA256:bde8d6ae472ad3357a580faf81de3b752f789274da919322d36c0a4b58430f07
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai, Gafgyt, Okiru
Score:100
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Detected Mirai
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Gafgyt
Yara detected Mirai
Yara detected Okiru
Connects to many ports of the same IP (likely port scanning)
Machine Learning detection for sample
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Yara signature match

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1567773
Start date and time:2024-12-03 21:11:09 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 16s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:bot.x86_64.elf
Detection:MAL
Classification:mal100.troj.linELF@0/0@19/0
  • VT rate limit hit for: bot.x86_64.elf
Command:/tmp/bot.x86_64.elf
PID:5488
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
done.
Standard Error:
  • system is lnxubuntu20
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
NameDescriptionAttributionBlogpost URLsLink
Bashlite, GafgytBashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite
SourceRuleDescriptionAuthorStrings
bot.x86_64.elfJoeSecurity_GafgytYara detected GafgytJoe Security
    bot.x86_64.elfJoeSecurity_OkiruYara detected OkiruJoe Security
      bot.x86_64.elfJoeSecurity_Mirai_3Yara detected MiraiJoe Security
        bot.x86_64.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          bot.x86_64.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
          • 0x175c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x175d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x175e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x175fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x17610:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x17624:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x17638:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x1764c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x17660:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x17674:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x17688:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x1769c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x176b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x176c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x176d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x176ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x17700:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x17714:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x17728:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x1773c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x17750:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          Click to see the 15 entries
          SourceRuleDescriptionAuthorStrings
          5488.1.0000000000400000.000000000041b000.r-x.sdmpJoeSecurity_GafgytYara detected GafgytJoe Security
            5488.1.0000000000400000.000000000041b000.r-x.sdmpJoeSecurity_OkiruYara detected OkiruJoe Security
              5488.1.0000000000400000.000000000041b000.r-x.sdmpJoeSecurity_Mirai_3Yara detected MiraiJoe Security
                5488.1.0000000000400000.000000000041b000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
                  5488.1.0000000000400000.000000000041b000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
                  • 0x175c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
                  • 0x175d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
                  • 0x175e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
                  • 0x175fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
                  • 0x17610:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
                  • 0x17624:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
                  • 0x17638:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
                  • 0x1764c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
                  • 0x17660:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
                  • 0x17674:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
                  • 0x17688:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
                  • 0x1769c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
                  • 0x176b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
                  • 0x176c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
                  • 0x176d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
                  • 0x176ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
                  • 0x17700:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
                  • 0x17714:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
                  • 0x17728:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
                  • 0x1773c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
                  • 0x17750:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
                  Click to see the 20 entries
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-12-03T21:11:53.710503+010020304901Malware Command and Control Activity Detected192.168.2.144806680.76.51.4547925TCP
                  2024-12-03T21:12:02.360009+010020304901Malware Command and Control Activity Detected192.168.2.144806880.76.51.4547925TCP
                  2024-12-03T21:12:11.739296+010020304901Malware Command and Control Activity Detected192.168.2.144807080.76.51.4547925TCP
                  2024-12-03T21:12:17.117444+010020304901Malware Command and Control Activity Detected192.168.2.144807280.76.51.4547925TCP
                  2024-12-03T21:12:27.483748+010020304901Malware Command and Control Activity Detected192.168.2.144807480.76.51.4547925TCP
                  2024-12-03T21:12:34.863509+010020304901Malware Command and Control Activity Detected192.168.2.144807680.76.51.4547925TCP
                  2024-12-03T21:12:41.243141+010020304901Malware Command and Control Activity Detected192.168.2.144807880.76.51.4547925TCP
                  2024-12-03T21:12:46.632343+010020304901Malware Command and Control Activity Detected192.168.2.144808080.76.51.4547925TCP
                  2024-12-03T21:12:55.012434+010020304901Malware Command and Control Activity Detected192.168.2.144808280.76.51.4547925TCP
                  2024-12-03T21:12:56.383529+010020304901Malware Command and Control Activity Detected192.168.2.144808480.76.51.4547925TCP
                  2024-12-03T21:13:06.765845+010020304901Malware Command and Control Activity Detected192.168.2.144808680.76.51.4547925TCP
                  2024-12-03T21:13:15.150822+010020304901Malware Command and Control Activity Detected192.168.2.144808880.76.51.4547925TCP
                  2024-12-03T21:13:25.537555+010020304901Malware Command and Control Activity Detected192.168.2.144809080.76.51.4547925TCP
                  2024-12-03T21:13:27.904678+010020304901Malware Command and Control Activity Detected192.168.2.144809280.76.51.4547925TCP
                  2024-12-03T21:13:32.283846+010020304901Malware Command and Control Activity Detected192.168.2.144809480.76.51.4547925TCP
                  2024-12-03T21:13:40.652450+010020304901Malware Command and Control Activity Detected192.168.2.144809680.76.51.4547925TCP
                  2024-12-03T21:13:49.030235+010020304901Malware Command and Control Activity Detected192.168.2.144809880.76.51.4547925TCP
                  2024-12-03T21:13:57.407114+010020304901Malware Command and Control Activity Detected192.168.2.144810080.76.51.4547925TCP

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection

                  barindex
                  Source: bot.x86_64.elfAvira: detected
                  Source: bot.x86_64.elfReversingLabs: Detection: 60%
                  Source: bot.x86_64.elfJoe Sandbox ML: detected
                  Source: bot.x86_64.elfString: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exeElite Botnet is here! var/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemdshellmnt/sys/htopboot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/anko-app/ankosample _8182T_1104/usr/libexec/openssh/sftp-serverabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

                  Networking

                  barindex
                  Source: Network trafficSuricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:48074 -> 80.76.51.45:47925
                  Source: Network trafficSuricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:48082 -> 80.76.51.45:47925
                  Source: Network trafficSuricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:48096 -> 80.76.51.45:47925
                  Source: Network trafficSuricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:48080 -> 80.76.51.45:47925
                  Source: Network trafficSuricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:48098 -> 80.76.51.45:47925
                  Source: Network trafficSuricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:48068 -> 80.76.51.45:47925
                  Source: Network trafficSuricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:48086 -> 80.76.51.45:47925
                  Source: Network trafficSuricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:48070 -> 80.76.51.45:47925
                  Source: Network trafficSuricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:48090 -> 80.76.51.45:47925
                  Source: Network trafficSuricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:48072 -> 80.76.51.45:47925
                  Source: Network trafficSuricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:48084 -> 80.76.51.45:47925
                  Source: Network trafficSuricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:48078 -> 80.76.51.45:47925
                  Source: Network trafficSuricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:48088 -> 80.76.51.45:47925
                  Source: Network trafficSuricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:48076 -> 80.76.51.45:47925
                  Source: Network trafficSuricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:48066 -> 80.76.51.45:47925
                  Source: Network trafficSuricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:48100 -> 80.76.51.45:47925
                  Source: Network trafficSuricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:48092 -> 80.76.51.45:47925
                  Source: Network trafficSuricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:48094 -> 80.76.51.45:47925
                  Source: global trafficTCP traffic: 80.76.51.45 ports 47925,2,4,5,7,9
                  Source: global trafficTCP traffic: 192.168.2.14:48066 -> 80.76.51.45:47925
                  Source: global trafficDNS traffic detected: DNS query: fr.elite-api.su

                  System Summary

                  barindex
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_1e0c5ce0 Author: unknown
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_1e0c5ce0 Author: unknown
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
                  Source: Process Memory Space: bot.x86_64.elf PID: 5488, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
                  Source: Process Memory Space: bot.x86_64.elf PID: 5488, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
                  Source: Initial sampleString containing 'busybox' found: /bin/busybox
                  Source: Initial sampleString containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exeElite Botnet is here! var/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemdshellmnt/sys/htopboot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/anko-app/ankosample _8182T_1104/usr/libexec/openssh/sftp-serverabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f
                  Source: ELF static info symbol of initial sample.symtab present: no
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_1e0c5ce0 reference_sample = 5b1f95840caebf9721bf318126be27085ec08cf7881ec64a884211a934351c2d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8e45538b59f9c9b8bc49661069044900c8199e487714c715c1b1f970fd528e3b, id = 1e0c5ce0-3b76-4da4-8bed-2e5036b6ce79, last_modified = 2021-09-16
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
                  Source: bot.x86_64.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_1e0c5ce0 reference_sample = 5b1f95840caebf9721bf318126be27085ec08cf7881ec64a884211a934351c2d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8e45538b59f9c9b8bc49661069044900c8199e487714c715c1b1f970fd528e3b, id = 1e0c5ce0-3b76-4da4-8bed-2e5036b6ce79, last_modified = 2021-09-16
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
                  Source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
                  Source: Process Memory Space: bot.x86_64.elf PID: 5488, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
                  Source: Process Memory Space: bot.x86_64.elf PID: 5488, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
                  Source: classification engineClassification label: mal100.troj.linELF@0/0@19/0
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/3760/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/3761/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/1583/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/2672/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/110/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/3759/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/111/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/112/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/113/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/234/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/1577/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/114/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/235/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/115/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/116/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/117/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/118/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/119/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/10/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/917/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/3758/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/11/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/12/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/13/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/14/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/15/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/16/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/17/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/18/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/19/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/1593/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/240/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/120/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/3094/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/121/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/242/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/3406/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/1/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/122/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/243/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/2/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/123/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/244/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/1589/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/3/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/124/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/245/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/1588/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/125/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/4/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/246/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/3402/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/126/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/5/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/247/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/127/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/6/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/248/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/128/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/7/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/249/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/8/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/129/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/800/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/9/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/801/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/803/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/20/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/806/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/21/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/807/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/928/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/22/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/23/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/24/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/25/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/26/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/27/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/28/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/29/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/3662/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/3420/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/490/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/250/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/130/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/251/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/131/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/252/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/132/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/253/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/254/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/255/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/135/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/256/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/1599/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/257/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/378/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/258/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/3412/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/259/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/30/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/35/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/1371/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/260/cmdlineJump to behavior
                  Source: /tmp/bot.x86_64.elf (PID: 5490)File opened: /proc/261/cmdlineJump to behavior

                  Stealing of Sensitive Information

                  barindex
                  Source: Yara matchFile source: bot.x86_64.elf, type: SAMPLE
                  Source: Yara matchFile source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
                  Source: Yara matchFile source: bot.x86_64.elf, type: SAMPLE
                  Source: Yara matchFile source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: bot.x86_64.elf PID: 5488, type: MEMORYSTR
                  Source: Yara matchFile source: bot.x86_64.elf, type: SAMPLE
                  Source: Yara matchFile source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: bot.x86_64.elf PID: 5488, type: MEMORYSTR

                  Remote Access Functionality

                  barindex
                  Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
                  Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
                  Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
                  Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
                  Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
                  Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
                  Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
                  Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
                  Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
                  Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
                  Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
                  Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
                  Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
                  Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
                  Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
                  Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
                  Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
                  Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
                  Source: Yara matchFile source: bot.x86_64.elf, type: SAMPLE
                  Source: Yara matchFile source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
                  Source: Yara matchFile source: bot.x86_64.elf, type: SAMPLE
                  Source: Yara matchFile source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: bot.x86_64.elf PID: 5488, type: MEMORYSTR
                  Source: Yara matchFile source: bot.x86_64.elf, type: SAMPLE
                  Source: Yara matchFile source: 5488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: bot.x86_64.elf PID: 5488, type: MEMORYSTR
                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                  Gather Victim Identity Information1
                  Scripting
                  Valid AccountsWindows Management Instrumentation1
                  Scripting
                  Path InterceptionDirect Volume Access1
                  OS Credential Dumping
                  System Service DiscoveryRemote ServicesData from Local System1
                  Non-Standard Port
                  Exfiltration Over Other Network MediumAbuse Accessibility Features
                  CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
                  Non-Application Layer Protocol
                  Exfiltration Over BluetoothNetwork Denial of Service
                  Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
                  Application Layer Protocol
                  Automated ExfiltrationData Encrypted for Impact
                  No configs have been found
                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Number of created Files
                  • Is malicious
                  • Internet

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                  windows-stand
                  SourceDetectionScannerLabelLink
                  bot.x86_64.elf61%ReversingLabsLinux.Backdoor.Mirai
                  bot.x86_64.elf100%AviraEXP/ELF.Mirai.Z.A
                  bot.x86_64.elf100%Joe Sandbox ML
                  No Antivirus matches
                  No Antivirus matches
                  No Antivirus matches
                  NameIPActiveMaliciousAntivirus DetectionReputation
                  fr.elite-api.su
                  80.76.51.45
                  truefalse
                    high
                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs
                    IPDomainCountryFlagASNASN NameMalicious
                    80.76.51.45
                    fr.elite-api.suBulgaria
                    43659CLOUDCOMPUTINGDEfalse
                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                    80.76.51.45bot.m68k.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                      bot.mpsl.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                        bot.mips.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          fr.elite-api.subot.m68k.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                          • 80.76.51.45
                          bot.mpsl.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                          • 80.76.51.45
                          bot.mips.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                          • 80.76.51.45
                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          CLOUDCOMPUTINGDEbot.m68k.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                          • 80.76.51.45
                          bot.mpsl.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                          • 80.76.51.45
                          bot.mips.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                          • 80.76.51.45
                          cac2L07hOS.exeGet hashmaliciousRedLine, XmrigBrowse
                          • 85.31.47.143
                          8UR62ANiqm.exeGet hashmaliciousXWormBrowse
                          • 194.169.175.112
                          8UR62ANiqm.exeGet hashmaliciousXWormBrowse
                          • 194.169.175.112
                          inerr.ps1Get hashmaliciousUnknownBrowse
                          • 80.76.51.159
                          17304052250b9baaf5a761ccc772d95d677ec70f56bbae9f30fbbf26b5b71b9b9867fc8bb2802.dat-decoded.exeGet hashmaliciousRemcosBrowse
                          • 80.76.51.190
                          sample.exeGet hashmaliciousUnknownBrowse
                          • 185.216.68.121
                          sample.exeGet hashmaliciousUnknownBrowse
                          • 185.216.68.121
                          No context
                          No context
                          No created / dropped files found
                          File type:ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
                          Entropy (8bit):5.285874123507357
                          TrID:
                          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                          File name:bot.x86_64.elf
                          File size:144'184 bytes
                          MD5:9cc2af514461a0cfbcf17a09a6883acb
                          SHA1:e0509159d0abafb28663222820dc399df5f34abc
                          SHA256:bde8d6ae472ad3357a580faf81de3b752f789274da919322d36c0a4b58430f07
                          SHA512:9c9a7044a7b5ca0e6aa6746db6525d720acb542662141adefd98193cde780942fc8c3b5cc02fecf16bc7869cb9f90d2ff9c76cf752b681a1ad5fb1521a4d22d1
                          SSDEEP:3072:syTDTHCZO7FuttETeuqVzI2z5fi23a5wmB1e0dOU+BMv:syTDTHCZO7FuttED5hm1M
                          TLSH:B0E33A07B4C184FDC4DAC1B44F9EF53ADD32B0AD5238B16B2BD4AA226E4DE215F1DA50
                          File Content Preview:.ELF..............>.......@.....@........0..........@.8...@.......................@.......@...............................................Q.......Q.....p.......................Q.td....................................................H...._.....l..H........

                          ELF header

                          Class:ELF64
                          Data:2's complement, little endian
                          Version:1 (current)
                          Machine:Advanced Micro Devices X86-64
                          Version Number:0x1
                          Type:EXEC (Executable file)
                          OS/ABI:UNIX - System V
                          ABI Version:0
                          Entry Point Address:0x400194
                          Flags:0x0
                          ELF Header Size:64
                          Program Header Offset:64
                          Program Header Size:56
                          Number of Program Headers:3
                          Section Header Offset:143544
                          Section Header Size:64
                          Number of Section Headers:10
                          Header String Table Index:9
                          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                          NULL0x00x00x00x00x0000
                          .initPROGBITS0x4000e80xe80x130x00x6AX001
                          .textPROGBITS0x4001000x1000x16ce60x00x6AX0016
                          .finiPROGBITS0x416de60x16de60xe0x00x6AX001
                          .rodataPROGBITS0x416e000x16e000x34000x00x2A0032
                          .ctorsPROGBITS0x51a2080x1a2080x180x00x3WA008
                          .dtorsPROGBITS0x51a2200x1a2200x100x00x3WA008
                          .dataPROGBITS0x51a2400x1a2400x8e380x00x3WA0032
                          .bssNOBITS0x5230800x230780x72a00x00x3WA0032
                          .shstrtabSTRTAB0x00x230780x3e0x00x0001
                          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                          LOAD0x00x4000000x4000000x1a2000x1a2006.41750x5R E0x100000.init .text .fini .rodata
                          LOAD0x1a2080x51a2080x51a2080x8e700x101180.22770x6RW 0x100000.ctors .dtors .data .bss
                          GNU_STACK0x00x00x00x00x00.00000x6RW 0x8
                          TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                          2024-12-03T21:11:53.710503+01002030490ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)1192.168.2.144806680.76.51.4547925TCP
                          2024-12-03T21:12:02.360009+01002030490ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)1192.168.2.144806880.76.51.4547925TCP
                          2024-12-03T21:12:11.739296+01002030490ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)1192.168.2.144807080.76.51.4547925TCP
                          2024-12-03T21:12:17.117444+01002030490ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)1192.168.2.144807280.76.51.4547925TCP
                          2024-12-03T21:12:27.483748+01002030490ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)1192.168.2.144807480.76.51.4547925TCP
                          2024-12-03T21:12:34.863509+01002030490ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)1192.168.2.144807680.76.51.4547925TCP
                          2024-12-03T21:12:41.243141+01002030490ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)1192.168.2.144807880.76.51.4547925TCP
                          2024-12-03T21:12:46.632343+01002030490ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)1192.168.2.144808080.76.51.4547925TCP
                          2024-12-03T21:12:55.012434+01002030490ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)1192.168.2.144808280.76.51.4547925TCP
                          2024-12-03T21:12:56.383529+01002030490ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)1192.168.2.144808480.76.51.4547925TCP
                          2024-12-03T21:13:06.765845+01002030490ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)1192.168.2.144808680.76.51.4547925TCP
                          2024-12-03T21:13:15.150822+01002030490ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)1192.168.2.144808880.76.51.4547925TCP
                          2024-12-03T21:13:25.537555+01002030490ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)1192.168.2.144809080.76.51.4547925TCP
                          2024-12-03T21:13:27.904678+01002030490ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)1192.168.2.144809280.76.51.4547925TCP
                          2024-12-03T21:13:32.283846+01002030490ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)1192.168.2.144809480.76.51.4547925TCP
                          2024-12-03T21:13:40.652450+01002030490ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)1192.168.2.144809680.76.51.4547925TCP
                          2024-12-03T21:13:49.030235+01002030490ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)1192.168.2.144809880.76.51.4547925TCP
                          2024-12-03T21:13:57.407114+01002030490ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)1192.168.2.144810080.76.51.4547925TCP
                          TimestampSource PortDest PortSource IPDest IP
                          Dec 3, 2024 21:11:53.589433908 CET4806647925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:11:53.709563017 CET479254806680.76.51.45192.168.2.14
                          Dec 3, 2024 21:11:53.709609032 CET4806647925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:11:53.710503101 CET4806647925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:11:53.830030918 CET479254806680.76.51.45192.168.2.14
                          Dec 3, 2024 21:11:53.830085039 CET4806647925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:11:53.830526114 CET479254806680.76.51.45192.168.2.14
                          Dec 3, 2024 21:11:53.950169086 CET479254806680.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:02.239172935 CET4806847925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:02.359226942 CET479254806880.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:02.359338045 CET4806847925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:02.360008955 CET4806847925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:02.479636908 CET479254806880.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:02.479758024 CET4806847925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:02.479953051 CET479254806880.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:02.599796057 CET479254806880.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:11.618513107 CET4807047925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:11.738472939 CET479254807080.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:11.738563061 CET4807047925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:11.739295959 CET4807047925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:11.858730078 CET479254807080.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:11.858802080 CET4807047925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:11.859827042 CET479254807080.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:11.978748083 CET479254807080.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:16.996330023 CET4807247925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:17.116604090 CET479254807280.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:17.116679907 CET4807247925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:17.117444038 CET4807247925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:17.237004995 CET479254807280.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:17.237143040 CET4807247925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:17.237479925 CET479254807280.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:17.357275963 CET479254807280.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:27.362194061 CET4807447925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:27.482836008 CET479254807480.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:27.482968092 CET4807447925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:27.483747959 CET4807447925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:27.604860067 CET479254807480.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:27.604993105 CET4807447925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:27.605374098 CET479254807480.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:27.725322008 CET479254807480.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:34.742290020 CET4807647925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:34.862416029 CET479254807680.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:34.862531900 CET4807647925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:34.863508940 CET4807647925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:34.982753038 CET479254807680.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:34.982856989 CET4807647925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:34.983418941 CET479254807680.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:35.104269028 CET479254807680.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:41.121889114 CET4807847925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:41.242026091 CET479254807880.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:41.242161989 CET4807847925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:41.243140936 CET4807847925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:41.362432003 CET479254807880.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:41.362551928 CET4807847925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:41.363001108 CET479254807880.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:41.483164072 CET479254807880.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:46.510998011 CET4808047925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:46.631479979 CET479254808080.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:46.631575108 CET4808047925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:46.632343054 CET4808047925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:46.751714945 CET479254808080.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:46.751838923 CET4808047925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:46.752347946 CET479254808080.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:46.872870922 CET479254808080.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:54.890934944 CET4808247925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:55.011483908 CET479254808280.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:55.011569023 CET4808247925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:55.012434006 CET4808247925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:55.131823063 CET479254808280.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:55.131944895 CET4808247925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:55.132380009 CET479254808280.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:55.251879930 CET479254808280.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:56.262583971 CET4808447925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:56.382643938 CET479254808480.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:56.382738113 CET4808447925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:56.383528948 CET4808447925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:56.503041029 CET479254808480.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:56.503134966 CET4808447925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:12:56.503434896 CET479254808480.76.51.45192.168.2.14
                          Dec 3, 2024 21:12:56.623145103 CET479254808480.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:06.643064976 CET4808647925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:06.764955997 CET479254808680.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:06.765067101 CET4808647925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:06.765845060 CET4808647925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:06.885535955 CET479254808680.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:06.885687113 CET4808647925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:06.885885954 CET479254808680.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:07.005625963 CET479254808680.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:15.029349089 CET4808847925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:15.149947882 CET479254808880.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:15.150053978 CET4808847925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:15.150821924 CET4808847925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:15.270349026 CET479254808880.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:15.270498037 CET4808847925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:15.270827055 CET479254808880.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:15.390475988 CET479254808880.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:25.416271925 CET4809047925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:25.536362886 CET479254809080.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:25.536478043 CET4809047925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:25.537554979 CET4809047925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:25.656750917 CET479254809080.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:25.656888008 CET4809047925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:25.657464981 CET479254809080.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:25.777873993 CET479254809080.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:27.783485889 CET4809247925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:27.903892040 CET479254809280.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:27.903995991 CET4809247925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:27.904678106 CET4809247925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:28.024689913 CET479254809280.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:28.024831057 CET4809247925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:28.024864912 CET479254809280.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:28.145059109 CET479254809280.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:32.162725925 CET4809447925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:32.282968044 CET479254809480.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:32.283081055 CET4809447925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:32.283845901 CET4809447925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:32.404126883 CET479254809480.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:32.404391050 CET479254809480.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:40.531147003 CET4809647925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:40.651216030 CET479254809680.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:40.651343107 CET4809647925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:40.652450085 CET4809647925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:40.772145033 CET479254809680.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:40.772269011 CET4809647925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:40.772763968 CET479254809680.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:40.892455101 CET479254809680.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:48.908925056 CET4809847925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:49.028945923 CET479254809880.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:49.029135942 CET4809847925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:49.030235052 CET4809847925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:49.149545908 CET479254809880.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:49.149794102 CET4809847925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:49.150167942 CET479254809880.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:49.269701004 CET479254809880.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:57.286443949 CET4810047925192.168.2.1480.76.51.45
                          Dec 3, 2024 21:13:57.406443119 CET479254810080.76.51.45192.168.2.14
                          Dec 3, 2024 21:13:57.406517029 CET4810047925192.168.2.1480.76.51.45
                          TimestampSource PortDest PortSource IPDest IP
                          Dec 3, 2024 21:11:53.344450951 CET5714353192.168.2.148.8.8.8
                          Dec 3, 2024 21:11:53.589040041 CET53571438.8.8.8192.168.2.14
                          Dec 3, 2024 21:12:01.831613064 CET3935253192.168.2.148.8.8.8
                          Dec 3, 2024 21:12:02.238624096 CET53393528.8.8.8192.168.2.14
                          Dec 3, 2024 21:12:11.480979919 CET4801753192.168.2.148.8.8.8
                          Dec 3, 2024 21:12:11.617963076 CET53480178.8.8.8192.168.2.14
                          Dec 3, 2024 21:12:16.860434055 CET4604353192.168.2.148.8.8.8
                          Dec 3, 2024 21:12:16.995701075 CET53460438.8.8.8192.168.2.14
                          Dec 3, 2024 21:12:27.238703966 CET5812153192.168.2.148.8.8.8
                          Dec 3, 2024 21:12:27.361584902 CET53581218.8.8.8192.168.2.14
                          Dec 3, 2024 21:12:34.606519938 CET3731153192.168.2.148.8.8.8
                          Dec 3, 2024 21:12:34.741720915 CET53373118.8.8.8192.168.2.14
                          Dec 3, 2024 21:12:40.984486103 CET4665853192.168.2.148.8.8.8
                          Dec 3, 2024 21:12:41.121157885 CET53466588.8.8.8192.168.2.14
                          Dec 3, 2024 21:12:46.364222050 CET3612253192.168.2.148.8.8.8
                          Dec 3, 2024 21:12:46.510260105 CET53361228.8.8.8192.168.2.14
                          Dec 3, 2024 21:12:54.753712893 CET4523153192.168.2.148.8.8.8
                          Dec 3, 2024 21:12:54.890394926 CET53452318.8.8.8192.168.2.14
                          Dec 3, 2024 21:12:56.133749962 CET3559853192.168.2.148.8.8.8
                          Dec 3, 2024 21:12:56.262052059 CET53355988.8.8.8192.168.2.14
                          Dec 3, 2024 21:13:06.504293919 CET5329253192.168.2.148.8.8.8
                          Dec 3, 2024 21:13:06.642429113 CET53532928.8.8.8192.168.2.14
                          Dec 3, 2024 21:13:14.887480974 CET5819853192.168.2.148.8.8.8
                          Dec 3, 2024 21:13:15.028631926 CET53581988.8.8.8192.168.2.14
                          Dec 3, 2024 21:13:20.272722960 CET5191353192.168.2.148.8.8.8
                          Dec 3, 2024 21:13:25.278897047 CET5659053192.168.2.148.8.8.8
                          Dec 3, 2024 21:13:25.415613890 CET53565908.8.8.8192.168.2.14
                          Dec 3, 2024 21:13:27.658679962 CET4295153192.168.2.148.8.8.8
                          Dec 3, 2024 21:13:27.782846928 CET53429518.8.8.8192.168.2.14
                          Dec 3, 2024 21:13:32.026145935 CET3886053192.168.2.148.8.8.8
                          Dec 3, 2024 21:13:32.161616087 CET53388608.8.8.8192.168.2.14
                          Dec 3, 2024 21:13:40.406385899 CET3330753192.168.2.148.8.8.8
                          Dec 3, 2024 21:13:40.530400038 CET53333078.8.8.8192.168.2.14
                          Dec 3, 2024 21:13:48.773531914 CET4115853192.168.2.148.8.8.8
                          Dec 3, 2024 21:13:48.908082962 CET53411588.8.8.8192.168.2.14
                          Dec 3, 2024 21:13:57.151186943 CET4010153192.168.2.148.8.8.8
                          Dec 3, 2024 21:13:57.286072016 CET53401018.8.8.8192.168.2.14
                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                          Dec 3, 2024 21:11:53.344450951 CET192.168.2.148.8.8.80xcc9aStandard query (0)fr.elite-api.suA (IP address)IN (0x0001)false
                          Dec 3, 2024 21:12:01.831613064 CET192.168.2.148.8.8.80x259aStandard query (0)fr.elite-api.suA (IP address)IN (0x0001)false
                          Dec 3, 2024 21:12:11.480979919 CET192.168.2.148.8.8.80x91dStandard query (0)fr.elite-api.suA (IP address)IN (0x0001)false
                          Dec 3, 2024 21:12:16.860434055 CET192.168.2.148.8.8.80xd6f7Standard query (0)fr.elite-api.suA (IP address)IN (0x0001)false
                          Dec 3, 2024 21:12:27.238703966 CET192.168.2.148.8.8.80x5c4aStandard query (0)fr.elite-api.suA (IP address)IN (0x0001)false
                          Dec 3, 2024 21:12:34.606519938 CET192.168.2.148.8.8.80xe43fStandard query (0)fr.elite-api.suA (IP address)IN (0x0001)false
                          Dec 3, 2024 21:12:40.984486103 CET192.168.2.148.8.8.80xeaa7Standard query (0)fr.elite-api.suA (IP address)IN (0x0001)false
                          Dec 3, 2024 21:12:46.364222050 CET192.168.2.148.8.8.80xd6a2Standard query (0)fr.elite-api.suA (IP address)IN (0x0001)false
                          Dec 3, 2024 21:12:54.753712893 CET192.168.2.148.8.8.80x694eStandard query (0)fr.elite-api.suA (IP address)IN (0x0001)false
                          Dec 3, 2024 21:12:56.133749962 CET192.168.2.148.8.8.80xec64Standard query (0)fr.elite-api.suA (IP address)IN (0x0001)false
                          Dec 3, 2024 21:13:06.504293919 CET192.168.2.148.8.8.80xe156Standard query (0)fr.elite-api.suA (IP address)IN (0x0001)false
                          Dec 3, 2024 21:13:14.887480974 CET192.168.2.148.8.8.80xc6e3Standard query (0)fr.elite-api.suA (IP address)IN (0x0001)false
                          Dec 3, 2024 21:13:20.272722960 CET192.168.2.148.8.8.80xa916Standard query (0)fr.elite-api.suA (IP address)IN (0x0001)false
                          Dec 3, 2024 21:13:25.278897047 CET192.168.2.148.8.8.80xa916Standard query (0)fr.elite-api.suA (IP address)IN (0x0001)false
                          Dec 3, 2024 21:13:27.658679962 CET192.168.2.148.8.8.80xd565Standard query (0)fr.elite-api.suA (IP address)IN (0x0001)false
                          Dec 3, 2024 21:13:32.026145935 CET192.168.2.148.8.8.80x6a51Standard query (0)fr.elite-api.suA (IP address)IN (0x0001)false
                          Dec 3, 2024 21:13:40.406385899 CET192.168.2.148.8.8.80xe1cbStandard query (0)fr.elite-api.suA (IP address)IN (0x0001)false
                          Dec 3, 2024 21:13:48.773531914 CET192.168.2.148.8.8.80x9a51Standard query (0)fr.elite-api.suA (IP address)IN (0x0001)false
                          Dec 3, 2024 21:13:57.151186943 CET192.168.2.148.8.8.80x7122Standard query (0)fr.elite-api.suA (IP address)IN (0x0001)false
                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                          Dec 3, 2024 21:11:53.589040041 CET8.8.8.8192.168.2.140xcc9aNo error (0)fr.elite-api.su80.76.51.45A (IP address)IN (0x0001)false
                          Dec 3, 2024 21:12:02.238624096 CET8.8.8.8192.168.2.140x259aNo error (0)fr.elite-api.su80.76.51.45A (IP address)IN (0x0001)false
                          Dec 3, 2024 21:12:11.617963076 CET8.8.8.8192.168.2.140x91dNo error (0)fr.elite-api.su80.76.51.45A (IP address)IN (0x0001)false
                          Dec 3, 2024 21:12:16.995701075 CET8.8.8.8192.168.2.140xd6f7No error (0)fr.elite-api.su80.76.51.45A (IP address)IN (0x0001)false
                          Dec 3, 2024 21:12:27.361584902 CET8.8.8.8192.168.2.140x5c4aNo error (0)fr.elite-api.su80.76.51.45A (IP address)IN (0x0001)false
                          Dec 3, 2024 21:12:34.741720915 CET8.8.8.8192.168.2.140xe43fNo error (0)fr.elite-api.su80.76.51.45A (IP address)IN (0x0001)false
                          Dec 3, 2024 21:12:41.121157885 CET8.8.8.8192.168.2.140xeaa7No error (0)fr.elite-api.su80.76.51.45A (IP address)IN (0x0001)false
                          Dec 3, 2024 21:12:46.510260105 CET8.8.8.8192.168.2.140xd6a2No error (0)fr.elite-api.su80.76.51.45A (IP address)IN (0x0001)false
                          Dec 3, 2024 21:12:54.890394926 CET8.8.8.8192.168.2.140x694eNo error (0)fr.elite-api.su80.76.51.45A (IP address)IN (0x0001)false
                          Dec 3, 2024 21:12:56.262052059 CET8.8.8.8192.168.2.140xec64No error (0)fr.elite-api.su80.76.51.45A (IP address)IN (0x0001)false
                          Dec 3, 2024 21:13:06.642429113 CET8.8.8.8192.168.2.140xe156No error (0)fr.elite-api.su80.76.51.45A (IP address)IN (0x0001)false
                          Dec 3, 2024 21:13:15.028631926 CET8.8.8.8192.168.2.140xc6e3No error (0)fr.elite-api.su80.76.51.45A (IP address)IN (0x0001)false
                          Dec 3, 2024 21:13:25.415613890 CET8.8.8.8192.168.2.140xa916No error (0)fr.elite-api.su80.76.51.45A (IP address)IN (0x0001)false
                          Dec 3, 2024 21:13:27.782846928 CET8.8.8.8192.168.2.140xd565No error (0)fr.elite-api.su80.76.51.45A (IP address)IN (0x0001)false
                          Dec 3, 2024 21:13:32.161616087 CET8.8.8.8192.168.2.140x6a51No error (0)fr.elite-api.su80.76.51.45A (IP address)IN (0x0001)false
                          Dec 3, 2024 21:13:40.530400038 CET8.8.8.8192.168.2.140xe1cbNo error (0)fr.elite-api.su80.76.51.45A (IP address)IN (0x0001)false
                          Dec 3, 2024 21:13:48.908082962 CET8.8.8.8192.168.2.140x9a51No error (0)fr.elite-api.su80.76.51.45A (IP address)IN (0x0001)false
                          Dec 3, 2024 21:13:57.286072016 CET8.8.8.8192.168.2.140x7122No error (0)fr.elite-api.su80.76.51.45A (IP address)IN (0x0001)false

                          System Behavior

                          Start time (UTC):20:11:52
                          Start date (UTC):03/12/2024
                          Path:/tmp/bot.x86_64.elf
                          Arguments:/tmp/bot.x86_64.elf
                          File size:144184 bytes
                          MD5 hash:9cc2af514461a0cfbcf17a09a6883acb

                          Start time (UTC):20:11:52
                          Start date (UTC):03/12/2024
                          Path:/tmp/bot.x86_64.elf
                          Arguments:-
                          File size:144184 bytes
                          MD5 hash:9cc2af514461a0cfbcf17a09a6883acb

                          Start time (UTC):20:11:52
                          Start date (UTC):03/12/2024
                          Path:/tmp/bot.x86_64.elf
                          Arguments:-
                          File size:144184 bytes
                          MD5 hash:9cc2af514461a0cfbcf17a09a6883acb