Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
x86.xxx.elf

Overview

General Information

Sample name:	x86.xxx.elf
Analysis ID:	1573492
MD5:	7f68c15cea6c38bf51ddb688bf5e8575
SHA1:	f360a7af9a6eb8b0e41fdbbc3fdff822d5ddeb18
SHA256:	ebf918cbf3108878ce016eb5c602d73fa2561e637680cd86b798cbd526a7ad21
Tags:	elfMiraiuser-lontze7
Infos:

Detection

Gafgyt, Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Contains symbols with names commonly found in malware

Machine Learning detection for sample

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Yara signature match

Classification

×

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573492
Start date and time:	2024-12-12 06:49:39 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	x86.xxx.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@2/0

Runtime Messages

Command:	/tmp/x86.xxx.elf
PID:	5507
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

x86.xxx.elf (PID: 5507, Parent: 5425, MD5: 7f68c15cea6c38bf51ddb688bf5e8575) Arguments: /tmp/x86.xxx.elf

x86.xxx.elf New Fork (PID: 5508, Parent: 5507)

x86.xxx.elf New Fork (PID: 5509, Parent: 5508)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
x86.xxx.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
x86.xxx.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
x86.xxx.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe620:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe634:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe648:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe65c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe670:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe684:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe698:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe710:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe724:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe738:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe74c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe760:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe774:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe79c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe7b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
x86.xxx.elf	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x8a6:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
x86.xxx.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x6128:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
x86.xxx.elf	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x7cc:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
x86.xxx.elf	Linux_Trojan_Gafgyt_a0a4de11	unknown	unknown	0x1b79:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88 0x337f:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88
x86.xxx.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x54fa:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x555e:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x56a1:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
x86.xxx.elf	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0xf76:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x102b:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x126c:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
x86.xxx.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xda5e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
x86.xxx.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x64d9:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
x86.xxx.elf	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x15ea:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
x86.xxx.elf	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x6ee:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
x86.xxx.elf	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x323:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
x86.xxx.elf	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x52b8:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
x86.xxx.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x67cf:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
x86.xxx.elf	Linux_Trojan_Gafgyt_e4a1982b	unknown	unknown	0x317:$a: 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89
Click to see the 12 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5508.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5508.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe620:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe634:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe648:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe65c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe670:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe684:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe698:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe710:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe724:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe738:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe74c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe760:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe774:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe79c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe7b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5508.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x8a6:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5508.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x6128:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5508.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x7cc:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5508.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a0a4de11	unknown	unknown	0x1b79:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88 0x337f:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88
5508.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x54fa:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x555e:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x56a1:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5508.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0xf76:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x102b:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x126c:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
5508.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xda5e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5508.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x64d9:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5508.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x15ea:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
5508.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x6ee:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5508.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x323:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
5508.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x52b8:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
5508.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x67cf:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5508.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_e4a1982b	unknown	unknown	0x317:$a: 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89
5507.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5507.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe620:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe634:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe648:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe65c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe670:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe684:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe698:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe710:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe724:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe738:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe74c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe760:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe774:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe79c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe7b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5507.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x8a6:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5507.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x6128:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5507.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x7cc:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5507.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a0a4de11	unknown	unknown	0x1b79:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88 0x337f:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88
5507.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x54fa:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x555e:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x56a1:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5507.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0xf76:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x102b:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x126c:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
5507.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xda5e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5507.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x64d9:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5507.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x15ea:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
5507.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x6ee:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5507.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x323:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
5507.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x52b8:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
5507.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x67cf:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5507.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_e4a1982b	unknown	unknown	0x317:$a: 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89
Process Memory Space: x86.xxx.elf PID: 5507	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: x86.xxx.elf PID: 5507	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xec4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x102c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: x86.xxx.elf PID: 5508	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: x86.xxx.elf PID: 5508	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1404:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1418:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x147c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x156c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 31 entries

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T06:50:36.115110+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35256	185.177.25.107	606	TCP
2024-12-12T06:50:38.245511+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35258	185.177.25.107	606	TCP
2024-12-12T06:50:40.523367+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35260	185.177.25.107	606	TCP
2024-12-12T06:50:42.651506+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35262	185.177.25.107	606	TCP
2024-12-12T06:50:44.760382+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35264	185.177.25.107	606	TCP
2024-12-12T06:50:46.886997+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35266	185.177.25.107	606	TCP
2024-12-12T06:50:48.995459+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35268	185.177.25.107	606	TCP
2024-12-12T06:50:51.137209+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35270	185.177.25.107	606	TCP
2024-12-12T06:50:53.278454+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35272	185.177.25.107	606	TCP
2024-12-12T06:50:55.407017+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35274	185.177.25.107	606	TCP
2024-12-12T06:50:57.544138+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35276	185.177.25.107	606	TCP
2024-12-12T06:50:59.670358+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35278	185.177.25.107	606	TCP
2024-12-12T06:51:01.777018+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35280	185.177.25.107	606	TCP
2024-12-12T06:51:03.902951+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35282	185.177.25.107	606	TCP
2024-12-12T06:51:06.043496+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35284	185.177.25.107	606	TCP
2024-12-12T06:51:08.170111+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35286	185.177.25.107	606	TCP
2024-12-12T06:51:10.277265+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35288	185.177.25.107	606	TCP
2024-12-12T06:51:12.403158+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35290	185.177.25.107	606	TCP
2024-12-12T06:51:14.529453+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35292	185.177.25.107	606	TCP
2024-12-12T06:51:16.654980+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35294	185.177.25.107	606	TCP
2024-12-12T06:51:18.778740+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35296	185.177.25.107	606	TCP
2024-12-12T06:51:20.906228+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35298	185.177.25.107	606	TCP
2024-12-12T06:51:23.030660+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35300	185.177.25.107	606	TCP
2024-12-12T06:51:25.154666+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35302	185.177.25.107	606	TCP
2024-12-12T06:51:27.294873+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35304	185.177.25.107	606	TCP
2024-12-12T06:51:29.420361+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35306	185.177.25.107	606	TCP
2024-12-12T06:51:31.546774+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35308	185.177.25.107	606	TCP
2024-12-12T06:51:33.671824+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35310	185.177.25.107	606	TCP
2024-12-12T06:51:35.797123+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35312	185.177.25.107	606	TCP
2024-12-12T06:51:37.902544+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35314	185.177.25.107	606	TCP
2024-12-12T06:51:40.028224+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35316	185.177.25.107	606	TCP
2024-12-12T06:51:42.138078+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35318	185.177.25.107	606	TCP
2024-12-12T06:51:44.266867+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35320	185.177.25.107	606	TCP
2024-12-12T06:51:46.389778+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35322	185.177.25.107	606	TCP
2024-12-12T06:51:48.513342+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35324	185.177.25.107	606	TCP
2024-12-12T06:51:50.643281+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35326	185.177.25.107	606	TCP
2024-12-12T06:51:52.780170+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35328	185.177.25.107	606	TCP
2024-12-12T06:51:54.904908+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35330	185.177.25.107	606	TCP
2024-12-12T06:51:57.045942+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35332	185.177.25.107	606	TCP
2024-12-12T06:51:59.169406+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35334	185.177.25.107	606	TCP
2024-12-12T06:52:01.280181+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35336	185.177.25.107	606	TCP
2024-12-12T06:52:03.404748+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35338	185.177.25.107	606	TCP
2024-12-12T06:52:05.532481+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35340	185.177.25.107	606	TCP
2024-12-12T06:52:07.656047+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35342	185.177.25.107	606	TCP
2024-12-12T06:52:09.780813+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35344	185.177.25.107	606	TCP
2024-12-12T06:52:11.888005+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35346	185.177.25.107	606	TCP
2024-12-12T06:52:14.015925+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35348	185.177.25.107	606	TCP
2024-12-12T06:52:16.138917+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35350	185.177.25.107	606	TCP
2024-12-12T06:52:18.249100+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35352	185.177.25.107	606	TCP
2024-12-12T06:52:20.374619+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35354	185.177.25.107	606	TCP
2024-12-12T06:52:22.501760+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35356	185.177.25.107	606	TCP
2024-12-12T06:52:24.608814+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35358	185.177.25.107	606	TCP
2024-12-12T06:52:26.717619+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35360	185.177.25.107	606	TCP
2024-12-12T06:52:28.843148+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35362	185.177.25.107	606	TCP
2024-12-12T06:52:30.953022+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35364	185.177.25.107	606	TCP
2024-12-12T06:52:33.061875+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35366	185.177.25.107	606	TCP
2024-12-12T06:52:35.171236+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35368	185.177.25.107	606	TCP
2024-12-12T06:52:37.296513+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35370	185.177.25.107	606	TCP
2024-12-12T06:52:39.423489+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35372	185.177.25.107	606	TCP
2024-12-12T06:52:41.530660+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35374	185.177.25.107	606	TCP
2024-12-12T06:52:43.641841+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35376	185.177.25.107	606	TCP
2024-12-12T06:52:45.766246+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35378	185.177.25.107	606	TCP
2024-12-12T06:52:47.890696+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35380	185.177.25.107	606	TCP
2024-12-12T06:52:50.016850+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35382	185.177.25.107	606	TCP
2024-12-12T06:52:52.140735+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35384	185.177.25.107	606	TCP
2024-12-12T06:52:54.280457+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35386	185.177.25.107	606	TCP
2024-12-12T06:52:56.407225+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35388	185.177.25.107	606	TCP
2024-12-12T06:52:58.532411+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35390	185.177.25.107	606	TCP
2024-12-12T06:53:00.657366+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35392	185.177.25.107	606	TCP
2024-12-12T06:53:02.781466+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35394	185.177.25.107	606	TCP
2024-12-12T06:53:04.907838+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35396	185.177.25.107	606	TCP
2024-12-12T06:53:07.030777+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35398	185.177.25.107	606	TCP
2024-12-12T06:53:09.287784+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35400	185.177.25.107	606	TCP
2024-12-12T06:53:11.423622+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35402	185.177.25.107	606	TCP
2024-12-12T06:53:13.547530+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35404	185.177.25.107	606	TCP
2024-12-12T06:53:15.800695+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35406	185.177.25.107	606	TCP
2024-12-12T06:53:17.939719+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35408	185.177.25.107	606	TCP
2024-12-12T06:53:20.062219+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35410	185.177.25.107	606	TCP
2024-12-12T06:53:22.191500+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35412	185.177.25.107	606	TCP
2024-12-12T06:53:24.329517+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35414	185.177.25.107	606	TCP
2024-12-12T06:53:26.454009+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35416	185.177.25.107	606	TCP
2024-12-12T06:53:28.578581+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35418	185.177.25.107	606	TCP
2024-12-12T06:53:30.703822+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35420	185.177.25.107	606	TCP
2024-12-12T06:53:32.829663+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35422	185.177.25.107	606	TCP
2024-12-12T06:53:35.180477+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35424	185.177.25.107	606	TCP
2024-12-12T06:53:37.313728+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35426	185.177.25.107	606	TCP
2024-12-12T06:53:39.437723+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35428	185.177.25.107	606	TCP
2024-12-12T06:53:41.735680+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35430	185.177.25.107	606	TCP
2024-12-12T06:53:43.860955+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35432	185.177.25.107	606	TCP
2024-12-12T06:53:45.985207+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35434	185.177.25.107	606	TCP
2024-12-12T06:53:48.093180+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35436	185.177.25.107	606	TCP
2024-12-12T06:53:50.222069+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35438	185.177.25.107	606	TCP
2024-12-12T06:53:52.344077+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35440	185.177.25.107	606	TCP
2024-12-12T06:53:54.532611+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35442	185.177.25.107	606	TCP
2024-12-12T06:53:56.658670+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35444	185.177.25.107	606	TCP
2024-12-12T06:53:58.798432+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35446	185.177.25.107	606	TCP
2024-12-12T06:54:00.939739+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35448	185.177.25.107	606	TCP
2024-12-12T06:54:03.046053+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35450	185.177.25.107	606	TCP
2024-12-12T06:54:05.171789+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35452	185.177.25.107	606	TCP
2024-12-12T06:54:07.280798+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35454	185.177.25.107	606	TCP
2024-12-12T06:54:09.390653+0100	2846526	1	A Network Trojan was detected	192.168.2.14	35456	185.177.25.107	606	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: x86.xxx.elf

Avira: detected

Found malware configuration

Source: x86.xxx.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "185.177.25.107:606"}

Multi AV Scanner detection for submitted file

Source: x86.xxx.elf

Virustotal: Detection: 57%

Machine Learning detection for sample

Source: x86.xxx.elf

Joe Sandbox ML: detected

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/x86.xxx.elf (PID: 5507)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35260 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35270 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35268 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35278 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35304 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35316 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35266 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35280 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35306 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35282 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35264 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35310 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35292 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35288 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35322 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35326 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35298 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35276 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35324 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35352 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35318 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35356 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35332 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35272 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35350 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35284 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35274 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35300 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35312 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35334 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35404 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35382 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35366 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35328 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35330 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35344 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35348 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35402 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35360 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35380 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35294 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35424 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35286 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35432 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35376 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35428 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35368 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35416 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35370 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35262 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35336 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35440 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35410 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35338 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35358 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35414 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35450 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35362 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35364 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35388 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35342 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35258 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35394 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35420 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35430 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35346 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35452 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35444 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35354 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35442 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35340 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35422 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35454 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35396 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35296 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35426 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35290 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35438 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35384 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35400 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35408 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35446 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35314 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35392 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35378 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35406 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35448 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35436 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35372 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35434 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35320 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35412 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35398 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35456 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35390 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35418 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35374 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35256 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35302 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35308 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:35386 -> 185.177.25.107:606

Source: global traffic

TCP traffic: 192.168.2.14:35256 -> 185.177.25.107:606

Source: global traffic

TCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Network traffic detected: HTTP traffic on port 46540 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 Author: unknown
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_e4a1982b Author: unknown
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 Author: unknown
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b Author: unknown
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 Author: unknown
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b Author: unknown
Source: Process Memory Space: x86.xxx.elf PID: 5507, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: x86.xxx.elf PID: 5508, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: vseattack

Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047, id = a0a4de11-fe65-449f-a990-ad5f18ac66f0, last_modified = 2021-09-16
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: x86.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_e4a1982b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622, id = e4a1982b-928a-4da5-b497-cedc1d26e845, last_modified = 2021-09-16
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047, id = a0a4de11-fe65-449f-a990-ad5f18ac66f0, last_modified = 2021-09-16
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622, id = e4a1982b-928a-4da5-b497-cedc1d26e845, last_modified = 2021-09-16
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047, id = a0a4de11-fe65-449f-a990-ad5f18ac66f0, last_modified = 2021-09-16
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622, id = e4a1982b-928a-4da5-b497-cedc1d26e845, last_modified = 2021-09-16
Source: Process Memory Space: x86.xxx.elf PID: 5507, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: x86.xxx.elf PID: 5508, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@2/0

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: x86.xxx.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: x86.xxx.elf, type: SAMPLE
Source: Yara match	File source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: x86.xxx.elf PID: 5507, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: x86.xxx.elf PID: 5508, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: x86.xxx.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: x86.xxx.elf, type: SAMPLE
Source: Yara match	File source: 5508.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5507.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: x86.xxx.elf PID: 5507, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: x86.xxx.elf PID: 5508, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 Remote System Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

Threatname: Gafgyt

{"C2 url": "185.177.25.107:606"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
x86.xxx.elf	57%	Virustotal		Browse
x86.xxx.elf	100%	Avira	EXP/ELF.Mirai.Z.A
x86.xxx.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
185.177.25.107:606	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false
185.177.25.107	unknown	Turkey		18013	ASLINE-AS-APASLINELIMITEDHK	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.125.190.26	arm4.elf	Get hash	malicious	Mirai	Browse
	main_x86_64.elf	Get hash	malicious	Mirai	Browse
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse
	kjsusa6.elf	Get hash	malicious	Mirai	Browse
	main_x86.elf	Get hash	malicious	Mirai	Browse
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	x-3.2-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	.5r3fqt67ew531has4231.sh4.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
185.177.25.107	x32.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	arm5.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	mips.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	arm7.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	m68k.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	ppc.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	arm6.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	mpsl.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	fruit.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	fruit.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	x32.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	arm5.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	arm7.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	m68k.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	arm6.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	mpsl.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	fruit.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	fruit.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	fruit.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	mips.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	ppc.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fruit.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	fruit.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	fruit.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	fruit.arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	fruit.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	fruit.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
ASLINE-AS-APASLINELIMITEDHK	x32.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	arm5.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	mips.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	arm7.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	m68k.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	ppc.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	arm6.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	mpsl.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	fruit.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	fruit.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	5.915536323496362
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	x86.xxx.elf
File size:	110'721 bytes
MD5:	7f68c15cea6c38bf51ddb688bf5e8575
SHA1:	f360a7af9a6eb8b0e41fdbbc3fdff822d5ddeb18
SHA256:	ebf918cbf3108878ce016eb5c602d73fa2561e637680cd86b798cbd526a7ad21
SHA512:	bf8a9e6dd0a810e1e392e4ba096d4090ac8d16ca5bf23c8d4f4bd94c48ad36e721e4e37410399b5f8738861d267d11c9bf705bd66c3ac69a1e127885f2cdcc2b
SSDEEP:	3072:3umlo71DhFGYvuoIpD/FXwOTumTT3gxHuW4:JoIZrumTT3gxuW4
TLSH:	CEB33B07D560C47AC0C76A712FDF96629673B4F90332720B23947EA52F128DADE9D782
File Content Preview:	.ELF..............>.......@.....@.......HE..........@.8...@.......................@.......@....................... .......................a.......a......)................ .....Q.td....................................................H...._........H........

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	83272
Section Header Size:	64
Number of Section Headers:	15
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x400100	0x100	0xddd4	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x40ded4	0xded4	0xe	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x40def0	0xdef0	0x2fb0	0x0	0x2	A	0	0	16
.eh_frame	PROGBITS	0x611000	0x11000	0x2514	0x0	0x3	WA	0	0	8
.ctors	PROGBITS	0x613518	0x13518	0x10	0x0	0x3	WA	0	0	8
.dtors	PROGBITS	0x613528	0x13528	0x10	0x0	0x3	WA	0	0	8
.jcr	PROGBITS	0x613538	0x13538	0x8	0x0	0x3	WA	0	0	8
.data	PROGBITS	0x613540	0x13540	0x460	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x6139a0	0x139a0	0x6af0	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0x139a0	0xb40	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x144e0	0x66	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x14908	0x44d0	0x18	0x0		14	249	8
.strtab	STRTAB	0x0	0x18dd8	0x22a9	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Prog Interpreter	Section Mappings
LOAD	0x0	0x400000	0x400000	0x10ea0	0x10ea0	6.4109	0x5	R E	0x200000		.init .text .fini .rodata
LOAD	0x11000	0x611000	0x611000	0x29a0	0x9490	3.5669	0x6	RW	0x200000		.eh_frame .ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Symbols

Name	Version Info Name	Version Info File Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
			.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
			.symtab	0x4000e8	0	SECTION	<unknown>	DEFAULT	1
			.symtab	0x400100	0	SECTION	<unknown>	DEFAULT	2
			.symtab	0x40ded4	0	SECTION	<unknown>	DEFAULT	3
			.symtab	0x40def0	0	SECTION	<unknown>	DEFAULT	4
			.symtab	0x611000	0	SECTION	<unknown>	DEFAULT	5
			.symtab	0x613518	0	SECTION	<unknown>	DEFAULT	6
			.symtab	0x613528	0	SECTION	<unknown>	DEFAULT	7
			.symtab	0x613538	0	SECTION	<unknown>	DEFAULT	8
			.symtab	0x613540	0	SECTION	<unknown>	DEFAULT	9
			.symtab	0x6139a0	0	SECTION	<unknown>	DEFAULT	10
			.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
C.1.3849			.symtab	0x40fd20	40	OBJECT	<unknown>	DEFAULT	4
Q			.symtab	0x613a20	16384	OBJECT	<unknown>	DEFAULT	10
Sakura_Bot.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
SendSTD			.symtab	0x4025ff	245	FUNC	<unknown>	DEFAULT	2
SendSTDHEX			.symtab	0x401e18	260	FUNC	<unknown>	DEFAULT	2
SendSTD_HEX			.symtab	0x4027f0	295	FUNC	<unknown>	DEFAULT	2
SendUDP			.symtab	0x4015fe	867	FUNC	<unknown>	DEFAULT	2
_Exit			.symtab	0x4055bc	43	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses			.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__			.symtab	0x613520	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__			.symtab	0x613518	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b			.symtab	0x6135c8	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data			.symtab	0x40ef10	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower			.symtab	0x613990	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data			.symtab	0x410ba0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper			.symtab	0x6135d8	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data			.symtab	0x40f210	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__			.symtab	0x613530	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__			.symtab	0x613528	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__			.symtab	0x611000	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__			.symtab	0x613510	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b			.symtab	0x6135c8	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower			.symtab	0x613990	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper			.symtab	0x6135d8	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_b			.symtab	0x6135d0	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower			.symtab	0x613998	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper			.symtab	0x6135e0	8	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location			.symtab	0x405884	6	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel			.symtab	0x405558	100	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked			.symtab	0x408d5c	222	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r			.symtab	0x40cc50	14	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location			.symtab	0x4081ec	6	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl			.symtab	0x4054f4	100	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset			.symtab	0x40622c	28	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset			.symtab	0x406248	30	FUNC	<unknown>	HIDDEN	2
__GI___sigismember			.symtab	0x40620c	32	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini			.symtab	0x4079dc	70	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init			.symtab	0x407a57	58	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r			.symtab	0x40cc60	196	FUNC	<unknown>	HIDDEN	2
__GI__exit			.symtab	0x4055bc	43	FUNC	<unknown>	HIDDEN	2
__GI_abort			.symtab	0x406f70	200	FUNC	<unknown>	HIDDEN	2
__GI_atoi			.symtab	0x407414	18	FUNC	<unknown>	HIDDEN	2
__GI_brk			.symtab	0x409cc8	43	FUNC	<unknown>	HIDDEN	2
__GI_chdir			.symtab	0x405614	38	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres			.symtab	0x407d78	41	FUNC	<unknown>	HIDDEN	2
__GI_close			.symtab	0x40563c	41	FUNC	<unknown>	HIDDEN	2
__GI_closedir			.symtab	0x407f20	147	FUNC	<unknown>	HIDDEN	2
__GI_config_close			.symtab	0x4084b6	43	FUNC	<unknown>	HIDDEN	2
__GI_config_open			.symtab	0x4084e1	46	FUNC	<unknown>	HIDDEN	2
__GI_config_read			.symtab	0x4081f4	706	FUNC	<unknown>	HIDDEN	2
__GI_connect			.symtab	0x406018	43	FUNC	<unknown>	HIDDEN	2
__GI_errno			.symtab	0x617c58	4	OBJECT	<unknown>	HIDDEN	10
__GI_exit			.symtab	0x407588	95	FUNC	<unknown>	HIDDEN	2
__GI_fclose			.symtab	0x408510	269	FUNC	<unknown>	HIDDEN	2
__GI_fcntl			.symtab	0x4054f4	100	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked			.symtab	0x408c18	322	FUNC	<unknown>	HIDDEN	2
__GI_fgetc			.symtab	0x408a4c	128	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked			.symtab	0x408d5c	222	FUNC	<unknown>	HIDDEN	2
__GI_fgets			.symtab	0x408acc	116	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked			.symtab	0x408e3c	116	FUNC	<unknown>	HIDDEN	2
__GI_fopen			.symtab	0x408620	10	FUNC	<unknown>	HIDDEN	2
__GI_fork			.symtab	0x405668	38	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked			.symtab	0x40cacc	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek			.symtab	0x40dd08	5	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64			.symtab	0x40dd10	225	FUNC	<unknown>	HIDDEN	2
__GI_fstat			.symtab	0x409cf4	82	FUNC	<unknown>	HIDDEN	2
__GI_fstat64			.symtab	0x409cf4	82	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked			.symtab	0x40cb04	128	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked			.symtab	0x408d5c	222	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize			.symtab	0x407da4	36	FUNC	<unknown>	HIDDEN	2
__GI_getegid			.symtab	0x407dc8	8	FUNC	<unknown>	HIDDEN	2
__GI_geteuid			.symtab	0x407dd0	8	FUNC	<unknown>	HIDDEN	2
__GI_getgid			.symtab	0x407dd8	8	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname			.symtab	0x405fc8	10	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2			.symtab	0x405fd4	65	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r			.symtab	0x409538	761	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r			.symtab	0x40b6c8	802	FUNC	<unknown>	HIDDEN	2
__GI_gethostname			.symtab	0x40b9ec	94	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize			.symtab	0x407de0	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid			.symtab	0x405690	8	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit			.symtab	0x407df4	40	FUNC	<unknown>	HIDDEN	2
__GI_getsockname			.symtab	0x406044	41	FUNC	<unknown>	HIDDEN	2
__GI_getuid			.symtab	0x407e1c	8	FUNC	<unknown>	HIDDEN	2
__GI_h_errno			.symtab	0x617c5c	4	OBJECT	<unknown>	HIDDEN	10
__GI_htonl			.symtab	0x405f3c	5	FUNC	<unknown>	HIDDEN	2
__GI_htons			.symtab	0x405f34	8	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr			.symtab	0x405fa8	29	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton			.symtab	0x4094b0	135	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa			.symtab	0x405f9d	10	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r			.symtab	0x405f50	77	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop			.symtab	0x40a7a7	518	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton			.symtab	0x40a4c7	493	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r			.symtab	0x407358	185	FUNC	<unknown>	HIDDEN	2
__GI_ioctl			.symtab	0x405698	101	FUNC	<unknown>	HIDDEN	2
__GI_isatty			.symtab	0x409424	25	FUNC	<unknown>	HIDDEN	2
__GI_isspace			.symtab	0x405850	18	FUNC	<unknown>	HIDDEN	2
__GI_kill			.symtab	0x405700	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek			.symtab	0x40d118	45	FUNC	<unknown>	HIDDEN	2
__GI_lseek64			.symtab	0x40baf0	5	FUNC	<unknown>	HIDDEN	2
__GI_memchr			.symtab	0x40da5c	236	FUNC	<unknown>	HIDDEN	2
__GI_memcpy			.symtab	0x405970	102	FUNC	<unknown>	HIDDEN	2
__GI_memmove			.symtab	0x408fc0	702	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy			.symtab	0x40a210	90	FUNC	<unknown>	HIDDEN	2
__GI_memrchr			.symtab	0x40db48	233	FUNC	<unknown>	HIDDEN	2
__GI_memset			.symtab	0x4059e0	210	FUNC	<unknown>	HIDDEN	2
__GI_mmap			.symtab	0x407d48	48	FUNC	<unknown>	HIDDEN	2
__GI_mremap			.symtab	0x409d48	42	FUNC	<unknown>	HIDDEN	2
__GI_munmap			.symtab	0x407e24	38	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep			.symtab	0x407e4c	38	FUNC	<unknown>	HIDDEN	2
__GI_ntohl			.symtab	0x405f49	5	FUNC	<unknown>	HIDDEN	2
__GI_ntohs			.symtab	0x405f41	8	FUNC	<unknown>	HIDDEN	2
__GI_open			.symtab	0x40572c	106	FUNC	<unknown>	HIDDEN	2
__GI_opendir			.symtab	0x408049	157	FUNC	<unknown>	HIDDEN	2
__GI_poll			.symtab	0x40ba4c	41	FUNC	<unknown>	HIDDEN	2
__GI_raise			.symtab	0x409834	18	FUNC	<unknown>	HIDDEN	2
__GI_random			.symtab	0x407044	72	FUNC	<unknown>	HIDDEN	2
__GI_random_r			.symtab	0x407247	90	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr			.symtab	0x40a2fc	189	FUNC	<unknown>	HIDDEN	2
__GI_read			.symtab	0x405798	39	FUNC	<unknown>	HIDDEN	2
__GI_readdir64			.symtab	0x40815c	143	FUNC	<unknown>	HIDDEN	2
__GI_recv			.symtab	0x4060a4	11	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom			.symtab	0x4060b0	45	FUNC	<unknown>	HIDDEN	2
__GI_sbrk			.symtab	0x407e74	74	FUNC	<unknown>	HIDDEN	2
__GI_select			.symtab	0x4057c0	44	FUNC	<unknown>	HIDDEN	2
__GI_send			.symtab	0x4060e0	11	FUNC	<unknown>	HIDDEN	2
__GI_sendto			.symtab	0x4060ec	48	FUNC	<unknown>	HIDDEN	2
__GI_setsid			.symtab	0x4057ec	38	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt			.symtab	0x40611c	53	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r			.symtab	0x40719c	171	FUNC	<unknown>	HIDDEN	2
__GI_sigaction			.symtab	0x407cd5	114	FUNC	<unknown>	HIDDEN	2
__GI_signal			.symtab	0x406184	133	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask			.symtab	0x407ec0	47	FUNC	<unknown>	HIDDEN	2
__GI_sleep			.symtab	0x4075e8	142	FUNC	<unknown>	HIDDEN	2
__GI_socket			.symtab	0x406154	47	FUNC	<unknown>	HIDDEN	2
__GI_sprintf			.symtab	0x40baf8	149	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r			.symtab	0x4072a1	183	FUNC	<unknown>	HIDDEN	2
__GI_stat			.symtab	0x40ba78	79	FUNC	<unknown>	HIDDEN	2
__GI_stat64			.symtab	0x40ba78	79	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp			.symtab	0x40dc34	48	FUNC	<unknown>	HIDDEN	2
__GI_strchr			.symtab	0x405ac0	417	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul			.symtab	0x409280	268	FUNC	<unknown>	HIDDEN	2
__GI_strcmp			.symtab	0x405c64	33	FUNC	<unknown>	HIDDEN	2
__GI_strcoll			.symtab	0x405c64	33	FUNC	<unknown>	HIDDEN	2
__GI_strcpy			.symtab	0x405c90	213	FUNC	<unknown>	HIDDEN	2
__GI_strcspn			.symtab	0x408eb0	135	FUNC	<unknown>	HIDDEN	2
__GI_strdup			.symtab	0x40cd24	54	FUNC	<unknown>	HIDDEN	2
__GI_strlen			.symtab	0x405d70	225	FUNC	<unknown>	HIDDEN	2
__GI_strncpy			.symtab	0x40a3bc	131	FUNC	<unknown>	HIDDEN	2
__GI_strnlen			.symtab	0x40cb84	201	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk			.symtab	0x40a270	140	FUNC	<unknown>	HIDDEN	2
__GI_strrchr			.symtab	0x40938c	53	FUNC	<unknown>	HIDDEN	2
__GI_strspn			.symtab	0x408f38	135	FUNC	<unknown>	HIDDEN	2
__GI_strstr			.symtab	0x405e54	193	FUNC	<unknown>	HIDDEN	2
__GI_strtok			.symtab	0x405f28	10	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r			.symtab	0x4093c4	94	FUNC	<unknown>	HIDDEN	2
__GI_strtol			.symtab	0x407428	10	FUNC	<unknown>	HIDDEN	2
__GI_strtoll			.symtab	0x407428	10	FUNC	<unknown>	HIDDEN	2
__GI_sysconf			.symtab	0x407757	560	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr			.symtab	0x409440	110	FUNC	<unknown>	HIDDEN	2
__GI_time			.symtab	0x405814	8	FUNC	<unknown>	HIDDEN	2
__GI_toupper			.symtab	0x405864	30	FUNC	<unknown>	HIDDEN	2
__GI_uname			.symtab	0x40bac8	38	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf			.symtab	0x40bb90	189	FUNC	<unknown>	HIDDEN	2
__GI_wait4			.symtab	0x407ef0	47	FUNC	<unknown>	HIDDEN	2
__GI_waitpid			.symtab	0x40581c	7	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb			.symtab	0x40d148	68	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs			.symtab	0x40d19c	123	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs			.symtab	0x40d18c	15	FUNC	<unknown>	HIDDEN	2
__GI_write			.symtab	0x405824	42	FUNC	<unknown>	HIDDEN	2
__JCR_END__			.symtab	0x613538	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__			.symtab	0x613538	0	OBJECT	<unknown>	DEFAULT	8
__app_fini			.symtab	0x617c48	8	OBJECT	<unknown>	HIDDEN	10
__atexit_lock			.symtab	0x613730	40	OBJECT	<unknown>	DEFAULT	9
__bss_start			.symtab	0x6139a0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd			.symtab	0x407a22	53	FUNC	<unknown>	DEFAULT	2
__close_nameservers			.symtab	0x40b628	109	FUNC	<unknown>	HIDDEN	2
__ctype_b			.symtab	0x6135d0	8	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower			.symtab	0x613998	8	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper			.symtab	0x6135e0	8	OBJECT	<unknown>	DEFAULT	9
__curbrk			.symtab	0x619c70	8	OBJECT	<unknown>	HIDDEN	10
__data_start			.symtab	0x613550	0	NOTYPE	<unknown>	DEFAULT	9
__decode_dotted			.symtab	0x40a9b0	280	FUNC	<unknown>	HIDDEN	2
__decode_header			.symtab	0x40ce20	156	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info			.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup			.symtab	0x40aac8	1853	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux			.symtab	0x40dea0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux			.symtab	0x400100	0	FUNC	<unknown>	DEFAULT	2
__dso_handle			.symtab	0x613540	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted			.symtab	0x40dc64	162	FUNC	<unknown>	HIDDEN	2
__encode_header			.symtab	0x40cd5c	193	FUNC	<unknown>	HIDDEN	2
__encode_question			.symtab	0x40cebc	80	FUNC	<unknown>	HIDDEN	2
__environ			.symtab	0x617c38	8	OBJECT	<unknown>	DEFAULT	10
__errno_location			.symtab	0x405884	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup			.symtab	0x617c28	8	OBJECT	<unknown>	HIDDEN	10
__fcntl_nocancel			.symtab	0x405558	100	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked			.symtab	0x408d5c	222	FUNC	<unknown>	DEFAULT	2
__fini_array_end			.symtab	0x613514	0	NOTYPE	<unknown>	HIDDEN	5
__fini_array_start			.symtab	0x613514	0	NOTYPE	<unknown>	HIDDEN	5
__get_hosts_byname_r			.symtab	0x40b698	48	FUNC	<unknown>	HIDDEN	2
__getdents			.symtab	0x409f78	288	FUNC	<unknown>	HIDDEN	2
__getdents64			.symtab	0x409f78	288	FUNC	<unknown>	HIDDEN	2
__getpagesize			.symtab	0x407de0	19	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r			.symtab	0x40cc50	14	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location			.symtab	0x4081ec	6	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end			.symtab	0x613514	0	NOTYPE	<unknown>	HIDDEN	5
__init_array_start			.symtab	0x613514	0	NOTYPE	<unknown>	HIDDEN	5
__libc_close			.symtab	0x40563c	41	FUNC	<unknown>	DEFAULT	2
__libc_connect			.symtab	0x406018	43	FUNC	<unknown>	DEFAULT	2
__libc_fcntl			.symtab	0x4054f4	100	FUNC	<unknown>	DEFAULT	2
__libc_fork			.symtab	0x405668	38	FUNC	<unknown>	DEFAULT	2
__libc_lseek			.symtab	0x40d118	45	FUNC	<unknown>	DEFAULT	2
__libc_lseek64			.symtab	0x40baf0	5	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep			.symtab	0x407e4c	38	FUNC	<unknown>	DEFAULT	2
__libc_open			.symtab	0x40572c	106	FUNC	<unknown>	DEFAULT	2
__libc_read			.symtab	0x405798	39	FUNC	<unknown>	DEFAULT	2
__libc_recv			.symtab	0x4060a4	11	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom			.symtab	0x4060b0	45	FUNC	<unknown>	DEFAULT	2
__libc_select			.symtab	0x4057c0	44	FUNC	<unknown>	DEFAULT	2
__libc_send			.symtab	0x4060e0	11	FUNC	<unknown>	DEFAULT	2
__libc_sendto			.symtab	0x4060ec	48	FUNC	<unknown>	DEFAULT	2
__libc_sigaction			.symtab	0x407cd5	114	FUNC	<unknown>	DEFAULT	2
__libc_stack_end			.symtab	0x617c30	8	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid			.symtab	0x40581c	7	FUNC	<unknown>	DEFAULT	2
__libc_write			.symtab	0x405824	42	FUNC	<unknown>	DEFAULT	2
__local_nameserver			.symtab	0x40fe20	16	OBJECT	<unknown>	HIDDEN	4
__malloc_consolidate			.symtab	0x406bfa	407	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index			.symtab	0x406268	110	FUNC	<unknown>	DEFAULT	2
__malloc_lock			.symtab	0x6135f0	40	OBJECT	<unknown>	DEFAULT	9
__malloc_state			.symtab	0x619ce0	1752	OBJECT	<unknown>	DEFAULT	10
__malloc_trim			.symtab	0x406b64	150	FUNC	<unknown>	DEFAULT	2
__nameserver			.symtab	0x61a3d8	8	OBJECT	<unknown>	HIDDEN	10
__nameservers			.symtab	0x61a3e0	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts			.symtab	0x40cf0c	10	FUNC	<unknown>	HIDDEN	2
__open_nameservers			.symtab	0x40b25d	968	FUNC	<unknown>	HIDDEN	2
__pagesize			.symtab	0x617c40	8	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end			.symtab	0x613514	0	NOTYPE	<unknown>	HIDDEN	5
__preinit_array_start			.symtab	0x613514	0	NOTYPE	<unknown>	HIDDEN	5
__progname			.symtab	0x613760	8	OBJECT	<unknown>	DEFAULT	9
__progname_full			.symtab	0x613768	8	OBJECT	<unknown>	DEFAULT	9
__pthread_initialize_minimal			.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init			.symtab	0x4079bf	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock			.symtab	0x4079bc	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock			.symtab	0x4079bc	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock			.symtab	0x4079bc	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0			.symtab	0x4079bc	3	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r			.symtab	0x40cf16	511	FUNC	<unknown>	HIDDEN	2
__register_frame_info			.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync			.symtab	0x61a3c8	8	OBJECT	<unknown>	HIDDEN	10
__resolv_attempts			.symtab	0x613985	1	OBJECT	<unknown>	HIDDEN	9
__resolv_lock			.symtab	0x619c80	40	OBJECT	<unknown>	DEFAULT	10
__resolv_timeout			.symtab	0x613984	1	OBJECT	<unknown>	HIDDEN	9
__restore_rt			.symtab	0x407ccc	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini			.symtab	0x617c50	8	OBJECT	<unknown>	HIDDEN	10
__searchdomain			.symtab	0x61a3d0	8	OBJECT	<unknown>	HIDDEN	10
__searchdomains			.symtab	0x61a3e4	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset			.symtab	0x40622c	28	FUNC	<unknown>	DEFAULT	2
__sigdelset			.symtab	0x406248	30	FUNC	<unknown>	DEFAULT	2
__sigismember			.symtab	0x40620c	32	FUNC	<unknown>	DEFAULT	2
__stdin			.symtab	0x613788	8	OBJECT	<unknown>	DEFAULT	9
__stdio_READ			.symtab	0x40a098	58	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE			.symtab	0x40a0d4	171	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position			.symtab	0x40ddf4	131	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite			.symtab	0x40d218	259	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex			.symtab	0x4088bf	15	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4920			.symtab	0x40fd50	40	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill			.symtab	0x40a180	37	FUNC	<unknown>	HIDDEN	2
__stdio_seek			.symtab	0x40de78	31	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o			.symtab	0x40a1a8	90	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o			.symtab	0x40d31c	149	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit			.symtab	0x408958	39	FUNC	<unknown>	HIDDEN	2
__stdout			.symtab	0x613790	8	OBJECT	<unknown>	DEFAULT	9
__syscall_fcntl.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini			.symtab	0x4079dc	70	FUNC	<unknown>	DEFAULT	2
__uClibc_init			.symtab	0x407a57	58	FUNC	<unknown>	DEFAULT	2
__uClibc_main			.symtab	0x407a91	570	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname			.symtab	0x613758	8	OBJECT	<unknown>	HIDDEN	9
__xpg_strerror_r			.symtab	0x40cc60	196	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv			.symtab	0x409e20	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv			.symtab	0x409d74	172	FUNC	<unknown>	HIDDEN	2
__xstat_conv			.symtab	0x409ecc	172	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec			.symtab	0x619cb0	10	OBJECT	<unknown>	DEFAULT	10
_charpad			.symtab	0x40bc50	77	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo			.symtab	0x61a3f0	80	OBJECT	<unknown>	HIDDEN	10
_custom_printf_handler			.symtab	0x61a440	80	OBJECT	<unknown>	HIDDEN	10
_custom_printf_spec			.symtab	0x613988	8	OBJECT	<unknown>	HIDDEN	9
_dl_aux_init			.symtab	0x409cb0	23	FUNC	<unknown>	DEFAULT	2
_dl_phdr			.symtab	0x61a3b8	8	OBJECT	<unknown>	DEFAULT	10
_dl_phnum			.symtab	0x61a3c0	8	OBJECT	<unknown>	DEFAULT	10
_edata			.symtab	0x6139a0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end			.symtab	0x61a490	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno			.symtab	0x617c58	4	OBJECT	<unknown>	DEFAULT	10
_exit			.symtab	0x4055bc	43	FUNC	<unknown>	DEFAULT	2
_exit.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini			.symtab	0x40ded4	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers			.symtab	0x617c70	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow			.symtab	0x40bc9d	120	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr			.symtab	0x40d43c	1565	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno			.symtab	0x617c5c	4	OBJECT	<unknown>	DEFAULT	10
_init			.symtab	0x4000e8	0	FUNC	<unknown>	DEFAULT	1
_load_inttype			.symtab	0x40d3b4	85	FUNC	<unknown>	HIDDEN	2
_load_inttype.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init			.symtab	0x40c3cc	114	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec			.symtab	0x40c666	1126	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs			.symtab	0x40c440	67	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs			.symtab	0x40c484	436	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size			.symtab	0x40c638	46	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore			.symtab	0x4079ca	18	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer			.symtab	0x4079c2	8	FUNC	<unknown>	DEFAULT	2
_rfill.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr			.symtab	0x619cd0	8	OBJECT	<unknown>	HIDDEN	10
_start			.symtab	0x400194	42	FUNC	<unknown>	DEFAULT	2
_stdio.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen			.symtab	0x40862c	563	FUNC	<unknown>	HIDDEN	2
_stdio_init			.symtab	0x408860	95	FUNC	<unknown>	HIDDEN	2
_stdio_openlist			.symtab	0x613798	8	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock			.symtab	0x6137a0	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use			.symtab	0x408b40	216	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count			.symtab	0x617c64	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock			.symtab	0x6137d0	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count			.symtab	0x617c60	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams			.symtab	0x613800	384	OBJECT	<unknown>	DEFAULT	9
_stdio_term			.symtab	0x4088ce	135	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking			.symtab	0x6137f8	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l			.symtab	0x407434	339	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype			.symtab	0x40d40c	46	FUNC	<unknown>	HIDDEN	2
_store_inttype.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs			.symtab	0x40ff20	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr			.symtab	0x408980	201	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal			.symtab	0x40bd15	1716	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort			.symtab	0x406f70	200	FUNC	<unknown>	DEFAULT	2
abort.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access			.symtab	0x4055e8	41	FUNC	<unknown>	DEFAULT	2
access.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
astd			.symtab	0x40361e	256	FUNC	<unknown>	DEFAULT	2
atcp			.symtab	0x403167	1207	FUNC	<unknown>	DEFAULT	2
atoi			.symtab	0x407414	18	FUNC	<unknown>	DEFAULT	2
atoi.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
audp			.symtab	0x402cc2	1189	FUNC	<unknown>	DEFAULT	2
bcopy			.symtab	0x405f18	14	FUNC	<unknown>	DEFAULT	2
bcopy.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that			.symtab	0x617c20	4	OBJECT	<unknown>	DEFAULT	10
brk			.symtab	0x409cc8	43	FUNC	<unknown>	DEFAULT	2
brk.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal			.symtab	0x406184	133	FUNC	<unknown>	DEFAULT	2
buf.3312			.symtab	0x617a30	16	OBJECT	<unknown>	DEFAULT	10
buf.5843			.symtab	0x617a40	448	OBJECT	<unknown>	DEFAULT	10
bzero			.symtab	0x405890	210	FUNC	<unknown>	DEFAULT	2
c			.symtab	0x6135bc	4	OBJECT	<unknown>	DEFAULT	9
calloc			.symtab	0x409848	248	FUNC	<unknown>	DEFAULT	2
calloc.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir			.symtab	0x405614	38	FUNC	<unknown>	DEFAULT	2
chdir.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres			.symtab	0x407d78	41	FUNC	<unknown>	DEFAULT	2
clock_getres.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close			.symtab	0x40563c	41	FUNC	<unknown>	DEFAULT	2
close.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir			.symtab	0x407f20	147	FUNC	<unknown>	DEFAULT	2
closedir.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer			.symtab	0x613560	8	OBJECT	<unknown>	DEFAULT	9
completed.5156			.symtab	0x6139a0	1	OBJECT	<unknown>	DEFAULT	10
connect			.symtab	0x406018	43	FUNC	<unknown>	DEFAULT	2
connect.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout			.symtab	0x40112f	582	FUNC	<unknown>	DEFAULT	2
crtstuff.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum			.symtab	0x401448	116	FUNC	<unknown>	DEFAULT	2
currentServer			.symtab	0x6135b8	4	OBJECT	<unknown>	DEFAULT	9
data_start			.symtab	0x613550	0	NOTYPE	<unknown>	DEFAULT	9
decoded.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ			.symtab	0x617c38	8	OBJECT	<unknown>	DEFAULT	10
errno			.symtab	0x617c58	4	OBJECT	<unknown>	DEFAULT	10
errno.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit			.symtab	0x407588	95	FUNC	<unknown>	DEFAULT	2
exit.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table			.symtab	0x410ab0	208	OBJECT	<unknown>	DEFAULT	4
fclose			.symtab	0x408510	269	FUNC	<unknown>	DEFAULT	2
fclose.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl			.symtab	0x4054f4	100	FUNC	<unknown>	DEFAULT	2
fd_to_DIR			.symtab	0x407fb4	149	FUNC	<unknown>	DEFAULT	2
fdgets			.symtab	0x400323	130	FUNC	<unknown>	DEFAULT	2
fdopendir			.symtab	0x4080e6	115	FUNC	<unknown>	DEFAULT	2
fflush_unlocked			.symtab	0x408c18	322	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc			.symtab	0x408a4c	128	FUNC	<unknown>	DEFAULT	2
fgetc.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked			.symtab	0x408d5c	222	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets			.symtab	0x408acc	116	FUNC	<unknown>	DEFAULT	2
fgets.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked			.symtab	0x408e3c	116	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt			.symtab	0x410a90	20	OBJECT	<unknown>	DEFAULT	4
fopen			.symtab	0x408620	10	FUNC	<unknown>	DEFAULT	2
fopen.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork			.symtab	0x405668	38	FUNC	<unknown>	DEFAULT	2
fork.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked			.symtab	0x40cacc	56	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy			.symtab	0x400150	0	FUNC	<unknown>	DEFAULT	2
free			.symtab	0x406d91	451	FUNC	<unknown>	DEFAULT	2
free.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek			.symtab	0x40dd08	5	FUNC	<unknown>	DEFAULT	2
fseeko			.symtab	0x40dd08	5	FUNC	<unknown>	DEFAULT	2
fseeko.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64			.symtab	0x40dd10	225	FUNC	<unknown>	DEFAULT	2
fseeko64.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat			.symtab	0x409cf4	82	FUNC	<unknown>	DEFAULT	2
fstat.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat64			.symtab	0x409cf4	82	FUNC	<unknown>	DEFAULT	2
ftcp			.symtab	0x401961	1207	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked			.symtab	0x40cb04	128	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch			.symtab	0x40371e	11	FUNC	<unknown>	DEFAULT	2
getHost			.symtab	0x400e42	65	FUNC	<unknown>	DEFAULT	2
getOurIP			.symtab	0x4003a5	483	FUNC	<unknown>	DEFAULT	2
getPortz			.symtab	0x403729	142	FUNC	<unknown>	DEFAULT	2
getRandomIP			.symtab	0x4002f4	47	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc			.symtab	0x408a4c	128	FUNC	<unknown>	DEFAULT	2
getc_unlocked			.symtab	0x408d5c	222	FUNC	<unknown>	DEFAULT	2
getdents64.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize			.symtab	0x407da4	36	FUNC	<unknown>	DEFAULT	2
getdtablesize.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid			.symtab	0x407dc8	8	FUNC	<unknown>	DEFAULT	2
getegid.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid			.symtab	0x407dd0	8	FUNC	<unknown>	DEFAULT	2
geteuid.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid			.symtab	0x407dd8	8	FUNC	<unknown>	DEFAULT	2
getgid.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname			.symtab	0x405fc8	10	FUNC	<unknown>	DEFAULT	2
gethostbyname.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2			.symtab	0x405fd4	65	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r			.symtab	0x409538	761	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r			.symtab	0x40b6c8	802	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname			.symtab	0x40b9ec	94	FUNC	<unknown>	DEFAULT	2
gethostname.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize			.symtab	0x407de0	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid			.symtab	0x405690	8	FUNC	<unknown>	DEFAULT	2
getpid.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit			.symtab	0x407df4	40	FUNC	<unknown>	DEFAULT	2
getrlimit.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit64			.symtab	0x407df4	40	FUNC	<unknown>	DEFAULT	2
getsockname			.symtab	0x406044	41	FUNC	<unknown>	DEFAULT	2
getsockname.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt			.symtab	0x406070	50	FUNC	<unknown>	DEFAULT	2
getsockopt.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid			.symtab	0x407e1c	8	FUNC	<unknown>	DEFAULT	2
getuid.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP			.symtab	0x613a04	4	OBJECT	<unknown>	DEFAULT	10
h_errno			.symtab	0x617c5c	4	OBJECT	<unknown>	DEFAULT	10
hoste.5842			.symtab	0x617c00	32	OBJECT	<unknown>	DEFAULT	10
htonl			.symtab	0x405f3c	5	FUNC	<unknown>	DEFAULT	2
htons			.symtab	0x405f34	8	FUNC	<unknown>	DEFAULT	2
i.4978			.symtab	0x6135c0	4	OBJECT	<unknown>	DEFAULT	9
index			.symtab	0x405ac0	417	FUNC	<unknown>	DEFAULT	2
inet_addr			.symtab	0x405fa8	29	FUNC	<unknown>	DEFAULT	2
inet_aton			.symtab	0x4094b0	135	FUNC	<unknown>	DEFAULT	2
inet_aton.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa			.symtab	0x405f9d	10	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r			.symtab	0x405f50	77	FUNC	<unknown>	DEFAULT	2
inet_ntop			.symtab	0x40a7a7	518	FUNC	<unknown>	DEFAULT	2
inet_ntop4			.symtab	0x40a6b4	243	FUNC	<unknown>	DEFAULT	2
inet_pton			.symtab	0x40a4c7	493	FUNC	<unknown>	DEFAULT	2
inet_pton4			.symtab	0x40a440	135	FUNC	<unknown>	DEFAULT	2
initConnection			.symtab	0x404edc	296	FUNC	<unknown>	DEFAULT	2
init_rand			.symtab	0x4001c0	126	FUNC	<unknown>	DEFAULT	2
initfini.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate			.symtab	0x4070e6	110	FUNC	<unknown>	DEFAULT	2
initstate_r			.symtab	0x407358	185	FUNC	<unknown>	DEFAULT	2
ioctl			.symtab	0x405698	101	FUNC	<unknown>	DEFAULT	2
ioctl.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty			.symtab	0x409424	25	FUNC	<unknown>	DEFAULT	2
isatty.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace			.symtab	0x405850	18	FUNC	<unknown>	DEFAULT	2
isspace.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill			.symtab	0x405700	44	FUNC	<unknown>	DEFAULT	2
kill.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
last_id.5904			.symtab	0x613980	2	OBJECT	<unknown>	DEFAULT	9
last_ns_num.5903			.symtab	0x619c78	4	OBJECT	<unknown>	DEFAULT	10
listFork			.symtab	0x401375	211	FUNC	<unknown>	DEFAULT	2
llseek.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek			.symtab	0x40d118	45	FUNC	<unknown>	DEFAULT	2
lseek.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64			.symtab	0x40baf0	5	FUNC	<unknown>	DEFAULT	2
macAddress			.symtab	0x613a10	6	OBJECT	<unknown>	DEFAULT	10
main			.symtab	0x405004	1261	FUNC	<unknown>	DEFAULT	2
mainCommSock			.symtab	0x613a00	4	OBJECT	<unknown>	DEFAULT	10
makeIPPacket			.symtab	0x401565	153	FUNC	<unknown>	DEFAULT	2
makeRandomStr			.symtab	0x400e83	110	FUNC	<unknown>	DEFAULT	2
makevsepacket			.symtab	0x401ff4	169	FUNC	<unknown>	DEFAULT	2
malloc			.symtab	0x4062d6	2187	FUNC	<unknown>	DEFAULT	2
malloc.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim			.symtab	0x406f54	28	FUNC	<unknown>	DEFAULT	2
memchr			.symtab	0x40da5c	236	FUNC	<unknown>	DEFAULT	2
memchr.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy			.symtab	0x405970	102	FUNC	<unknown>	DEFAULT	2
memmove			.symtab	0x408fc0	702	FUNC	<unknown>	DEFAULT	2
memmove.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy			.symtab	0x40a210	90	FUNC	<unknown>	DEFAULT	2
memrchr			.symtab	0x40db48	233	FUNC	<unknown>	DEFAULT	2
memrchr.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset			.symtab	0x4059e0	210	FUNC	<unknown>	DEFAULT	2
mmap			.symtab	0x407d48	48	FUNC	<unknown>	DEFAULT	2
mmap.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap			.symtab	0x409d48	42	FUNC	<unknown>	DEFAULT	2
mremap.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap			.symtab	0x407e24	38	FUNC	<unknown>	DEFAULT	2
munmap.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock			.symtab	0x613620	40	OBJECT	<unknown>	DEFAULT	9
mylock			.symtab	0x613650	40	OBJECT	<unknown>	DEFAULT	9
nanosleep			.symtab	0x407e4c	38	FUNC	<unknown>	DEFAULT	2
nanosleep.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1699			.symtab	0x617a20	8	OBJECT	<unknown>	DEFAULT	10
nprocessors_onln			.symtab	0x407678	223	FUNC	<unknown>	DEFAULT	2
ntohl			.symtab	0x405f49	5	FUNC	<unknown>	DEFAULT	2
ntohl.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs			.symtab	0x405f41	8	FUNC	<unknown>	DEFAULT	2
ntop.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids			.symtab	0x613a08	8	OBJECT	<unknown>	DEFAULT	10
object.5168			.symtab	0x6139c0	48	OBJECT	<unknown>	DEFAULT	10
open			.symtab	0x40572c	106	FUNC	<unknown>	DEFAULT	2
open.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir			.symtab	0x408049	157	FUNC	<unknown>	DEFAULT	2
opendir.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP			.symtab	0x619cc0	4	OBJECT	<unknown>	DEFAULT	10
p.5154			.symtab	0x613548	0	OBJECT	<unknown>	DEFAULT	9
parse_config.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids			.symtab	0x619cc8	8	OBJECT	<unknown>	DEFAULT	10
poll			.symtab	0x40ba4c	41	FUNC	<unknown>	DEFAULT	2
poll.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.5143			.symtab	0x40fe40	12	OBJECT	<unknown>	DEFAULT	4
print			.symtab	0x4008b1	1084	FUNC	<unknown>	DEFAULT	2
printchar			.symtab	0x40063e	75	FUNC	<unknown>	DEFAULT	2
printi			.symtab	0x400770	321	FUNC	<unknown>	DEFAULT	2
prints			.symtab	0x400689	231	FUNC	<unknown>	DEFAULT	2
processCmd			.symtab	0x4037b7	5925	FUNC	<unknown>	DEFAULT	2
program_invocation_name			.symtab	0x613768	8	OBJECT	<unknown>	DEFAULT	9
program_invocation_short_name			.symtab	0x613760	8	OBJECT	<unknown>	DEFAULT	9
qual_chars.5150			.symtab	0x40fe60	20	OBJECT	<unknown>	DEFAULT	4
raise			.symtab	0x409834	18	FUNC	<unknown>	DEFAULT	2
raise.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand			.symtab	0x407038	11	FUNC	<unknown>	DEFAULT	2
rand.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc			.symtab	0x40023e	182	FUNC	<unknown>	DEFAULT	2
random			.symtab	0x407044	72	FUNC	<unknown>	DEFAULT	2
random.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info			.symtab	0x40f510	40	OBJECT	<unknown>	DEFAULT	4
random_r			.symtab	0x407247	90	FUNC	<unknown>	DEFAULT	2
random_r.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl			.symtab	0x6136b0	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr			.symtab	0x40a2fc	189	FUNC	<unknown>	DEFAULT	2
rawmemchr.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read			.symtab	0x405798	39	FUNC	<unknown>	DEFAULT	2
read.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64			.symtab	0x40815c	143	FUNC	<unknown>	DEFAULT	2
readdir64.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc			.symtab	0x409940	878	FUNC	<unknown>	DEFAULT	2
realloc.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv			.symtab	0x4060a4	11	FUNC	<unknown>	DEFAULT	2
recv.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine			.symtab	0x400ef1	574	FUNC	<unknown>	DEFAULT	2
recvfrom			.symtab	0x4060b0	45	FUNC	<unknown>	DEFAULT	2
recvfrom.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_conf_mtime.5885			.symtab	0x619ca8	4	OBJECT	<unknown>	DEFAULT	10
rindex			.symtab	0x40938c	53	FUNC	<unknown>	DEFAULT	2
rtcp			.symtab	0x402917	939	FUNC	<unknown>	DEFAULT	2
sbrk			.symtab	0x407e74	74	FUNC	<unknown>	DEFAULT	2
sbrk.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select			.symtab	0x4057c0	44	FUNC	<unknown>	DEFAULT	2
select.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send			.symtab	0x4060e0	11	FUNC	<unknown>	DEFAULT	2
send.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendto			.symtab	0x4060ec	48	FUNC	<unknown>	DEFAULT	2
sendto.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid			.symtab	0x4057ec	38	FUNC	<unknown>	DEFAULT	2
setsid.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt			.symtab	0x40611c	53	FUNC	<unknown>	DEFAULT	2
setsockopt.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate			.symtab	0x40708c	90	FUNC	<unknown>	DEFAULT	2
setstate_r			.symtab	0x40719c	171	FUNC	<unknown>	DEFAULT	2
sigaction			.symtab	0x407cd5	114	FUNC	<unknown>	DEFAULT	2
sigaction.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal			.symtab	0x406184	133	FUNC	<unknown>	DEFAULT	2
signal.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask			.symtab	0x407ec0	47	FUNC	<unknown>	DEFAULT	2
sigprocmask.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
skip_and_NUL_space			.symtab	0x40b231	44	FUNC	<unknown>	DEFAULT	2
skip_nospace			.symtab	0x40b208	41	FUNC	<unknown>	DEFAULT	2
sleep			.symtab	0x4075e8	142	FUNC	<unknown>	DEFAULT	2
sleep.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket			.symtab	0x406154	47	FUNC	<unknown>	DEFAULT	2
socket.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect			.symtab	0x401f1c	216	FUNC	<unknown>	DEFAULT	2
sockprintf			.symtab	0x400ced	341	FUNC	<unknown>	DEFAULT	2
spec_and_mask.5149			.symtab	0x40fe80	16	OBJECT	<unknown>	DEFAULT	4
spec_base.5142			.symtab	0x40fe4c	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.5146			.symtab	0x40fee0	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.5145			.symtab	0x40ff00	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.5148			.symtab	0x40fe90	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.5147			.symtab	0x40fea0	9	OBJECT	<unknown>	DEFAULT	4
sprintf			.symtab	0x40baf8	149	FUNC	<unknown>	DEFAULT	2
sprintf.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand			.symtab	0x407154	72	FUNC	<unknown>	DEFAULT	2
srandom			.symtab	0x407154	72	FUNC	<unknown>	DEFAULT	2
srandom_r			.symtab	0x4072a1	183	FUNC	<unknown>	DEFAULT	2
stat			.symtab	0x40ba78	79	FUNC	<unknown>	DEFAULT	2
stat.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
stat64			.symtab	0x40ba78	79	FUNC	<unknown>	DEFAULT	2
stderr			.symtab	0x613780	8	OBJECT	<unknown>	DEFAULT	9
stdhexflood			.symtab	0x4026f4	252	FUNC	<unknown>	DEFAULT	2
stdin			.symtab	0x613770	8	OBJECT	<unknown>	DEFAULT	9
stdout			.symtab	0x613778	8	OBJECT	<unknown>	DEFAULT	9
strcasecmp			.symtab	0x40dc34	48	FUNC	<unknown>	DEFAULT	2
strcasecmp.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr			.symtab	0x405ac0	417	FUNC	<unknown>	DEFAULT	2
strchrnul			.symtab	0x409280	268	FUNC	<unknown>	DEFAULT	2
strchrnul.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp			.symtab	0x405c64	33	FUNC	<unknown>	DEFAULT	2
strcoll			.symtab	0x405c64	33	FUNC	<unknown>	DEFAULT	2
strcpy			.symtab	0x405c90	213	FUNC	<unknown>	DEFAULT	2
strcspn			.symtab	0x408eb0	135	FUNC	<unknown>	DEFAULT	2
strdup			.symtab	0x40cd24	54	FUNC	<unknown>	DEFAULT	2
strdup.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r			.symtab	0x40cc60	196	FUNC	<unknown>	DEFAULT	2
strlen			.symtab	0x405d70	225	FUNC	<unknown>	DEFAULT	2
strncpy			.symtab	0x40a3bc	131	FUNC	<unknown>	DEFAULT	2
strncpy.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen			.symtab	0x40cb84	201	FUNC	<unknown>	DEFAULT	2
strnlen.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk			.symtab	0x40a270	140	FUNC	<unknown>	DEFAULT	2
strrchr			.symtab	0x40938c	53	FUNC	<unknown>	DEFAULT	2
strrchr.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn			.symtab	0x408f38	135	FUNC	<unknown>	DEFAULT	2
strstr			.symtab	0x405e54	193	FUNC	<unknown>	DEFAULT	2
strstr.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoimax			.symtab	0x407428	10	FUNC	<unknown>	DEFAULT	2
strtok			.symtab	0x405f28	10	FUNC	<unknown>	DEFAULT	2
strtok.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r			.symtab	0x4093c4	94	FUNC	<unknown>	DEFAULT	2
strtok_r.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol			.symtab	0x407428	10	FUNC	<unknown>	DEFAULT	2
strtol.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoll			.symtab	0x407428	10	FUNC	<unknown>	DEFAULT	2
strtoq			.symtab	0x407428	10	FUNC	<unknown>	DEFAULT	2
sysconf			.symtab	0x407757	560	FUNC	<unknown>	DEFAULT	2
sysconf.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr			.symtab	0x409440	110	FUNC	<unknown>	DEFAULT	2
tcgetattr.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum			.symtab	0x4014bc	169	FUNC	<unknown>	DEFAULT	2
time			.symtab	0x405814	8	FUNC	<unknown>	DEFAULT	2
time.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper			.symtab	0x405864	30	FUNC	<unknown>	DEFAULT	2
toupper.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim			.symtab	0x400588	182	FUNC	<unknown>	DEFAULT	2
type_codes			.symtab	0x40feb0	24	OBJECT	<unknown>	DEFAULT	4
type_sizes			.symtab	0x40fec8	12	OBJECT	<unknown>	DEFAULT	4
uname			.symtab	0x40bac8	38	FUNC	<unknown>	DEFAULT	2
uname.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1721			.symtab	0x40ff08	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state			.symtab	0x613680	40	OBJECT	<unknown>	DEFAULT	9
useragents			.symtab	0x613580	56	OBJECT	<unknown>	DEFAULT	9
usleep			.symtab	0x407988	52	FUNC	<unknown>	DEFAULT	2
usleep.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vseattack			.symtab	0x40209d	1378	FUNC	<unknown>	DEFAULT	2
vsnprintf			.symtab	0x40bb90	189	FUNC	<unknown>	DEFAULT	2
vsnprintf.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4			.symtab	0x407ef0	47	FUNC	<unknown>	DEFAULT	2
wait4.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid			.symtab	0x40581c	7	FUNC	<unknown>	DEFAULT	2
waitpid.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb			.symtab	0x40d148	68	FUNC	<unknown>	DEFAULT	2
wcrtomb.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs			.symtab	0x40d19c	123	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs			.symtab	0x40d18c	15	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write			.symtab	0x405824	42	FUNC	<unknown>	DEFAULT	2
write.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3743			.symtab	0x40fdc0	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-12T06:50:36.115110+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35256	185.177.25.107	606	TCP
2024-12-12T06:50:38.245511+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35258	185.177.25.107	606	TCP
2024-12-12T06:50:40.523367+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35260	185.177.25.107	606	TCP
2024-12-12T06:50:42.651506+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35262	185.177.25.107	606	TCP
2024-12-12T06:50:44.760382+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35264	185.177.25.107	606	TCP
2024-12-12T06:50:46.886997+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35266	185.177.25.107	606	TCP
2024-12-12T06:50:48.995459+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35268	185.177.25.107	606	TCP
2024-12-12T06:50:51.137209+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35270	185.177.25.107	606	TCP
2024-12-12T06:50:53.278454+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35272	185.177.25.107	606	TCP
2024-12-12T06:50:55.407017+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35274	185.177.25.107	606	TCP
2024-12-12T06:50:57.544138+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35276	185.177.25.107	606	TCP
2024-12-12T06:50:59.670358+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35278	185.177.25.107	606	TCP
2024-12-12T06:51:01.777018+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35280	185.177.25.107	606	TCP
2024-12-12T06:51:03.902951+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35282	185.177.25.107	606	TCP
2024-12-12T06:51:06.043496+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35284	185.177.25.107	606	TCP
2024-12-12T06:51:08.170111+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35286	185.177.25.107	606	TCP
2024-12-12T06:51:10.277265+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35288	185.177.25.107	606	TCP
2024-12-12T06:51:12.403158+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35290	185.177.25.107	606	TCP
2024-12-12T06:51:14.529453+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35292	185.177.25.107	606	TCP
2024-12-12T06:51:16.654980+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35294	185.177.25.107	606	TCP
2024-12-12T06:51:18.778740+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35296	185.177.25.107	606	TCP
2024-12-12T06:51:20.906228+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35298	185.177.25.107	606	TCP
2024-12-12T06:51:23.030660+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35300	185.177.25.107	606	TCP
2024-12-12T06:51:25.154666+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35302	185.177.25.107	606	TCP
2024-12-12T06:51:27.294873+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35304	185.177.25.107	606	TCP
2024-12-12T06:51:29.420361+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35306	185.177.25.107	606	TCP
2024-12-12T06:51:31.546774+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35308	185.177.25.107	606	TCP
2024-12-12T06:51:33.671824+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35310	185.177.25.107	606	TCP
2024-12-12T06:51:35.797123+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35312	185.177.25.107	606	TCP
2024-12-12T06:51:37.902544+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35314	185.177.25.107	606	TCP
2024-12-12T06:51:40.028224+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35316	185.177.25.107	606	TCP
2024-12-12T06:51:42.138078+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35318	185.177.25.107	606	TCP
2024-12-12T06:51:44.266867+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35320	185.177.25.107	606	TCP
2024-12-12T06:51:46.389778+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35322	185.177.25.107	606	TCP
2024-12-12T06:51:48.513342+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35324	185.177.25.107	606	TCP
2024-12-12T06:51:50.643281+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35326	185.177.25.107	606	TCP
2024-12-12T06:51:52.780170+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35328	185.177.25.107	606	TCP
2024-12-12T06:51:54.904908+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35330	185.177.25.107	606	TCP
2024-12-12T06:51:57.045942+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35332	185.177.25.107	606	TCP
2024-12-12T06:51:59.169406+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35334	185.177.25.107	606	TCP
2024-12-12T06:52:01.280181+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35336	185.177.25.107	606	TCP
2024-12-12T06:52:03.404748+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35338	185.177.25.107	606	TCP
2024-12-12T06:52:05.532481+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35340	185.177.25.107	606	TCP
2024-12-12T06:52:07.656047+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35342	185.177.25.107	606	TCP
2024-12-12T06:52:09.780813+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35344	185.177.25.107	606	TCP
2024-12-12T06:52:11.888005+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35346	185.177.25.107	606	TCP
2024-12-12T06:52:14.015925+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35348	185.177.25.107	606	TCP
2024-12-12T06:52:16.138917+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35350	185.177.25.107	606	TCP
2024-12-12T06:52:18.249100+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35352	185.177.25.107	606	TCP
2024-12-12T06:52:20.374619+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35354	185.177.25.107	606	TCP
2024-12-12T06:52:22.501760+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35356	185.177.25.107	606	TCP
2024-12-12T06:52:24.608814+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35358	185.177.25.107	606	TCP
2024-12-12T06:52:26.717619+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35360	185.177.25.107	606	TCP
2024-12-12T06:52:28.843148+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35362	185.177.25.107	606	TCP
2024-12-12T06:52:30.953022+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35364	185.177.25.107	606	TCP
2024-12-12T06:52:33.061875+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35366	185.177.25.107	606	TCP
2024-12-12T06:52:35.171236+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35368	185.177.25.107	606	TCP
2024-12-12T06:52:37.296513+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35370	185.177.25.107	606	TCP
2024-12-12T06:52:39.423489+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35372	185.177.25.107	606	TCP
2024-12-12T06:52:41.530660+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35374	185.177.25.107	606	TCP
2024-12-12T06:52:43.641841+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35376	185.177.25.107	606	TCP
2024-12-12T06:52:45.766246+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35378	185.177.25.107	606	TCP
2024-12-12T06:52:47.890696+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35380	185.177.25.107	606	TCP
2024-12-12T06:52:50.016850+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35382	185.177.25.107	606	TCP
2024-12-12T06:52:52.140735+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35384	185.177.25.107	606	TCP
2024-12-12T06:52:54.280457+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35386	185.177.25.107	606	TCP
2024-12-12T06:52:56.407225+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35388	185.177.25.107	606	TCP
2024-12-12T06:52:58.532411+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35390	185.177.25.107	606	TCP
2024-12-12T06:53:00.657366+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35392	185.177.25.107	606	TCP
2024-12-12T06:53:02.781466+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35394	185.177.25.107	606	TCP
2024-12-12T06:53:04.907838+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35396	185.177.25.107	606	TCP
2024-12-12T06:53:07.030777+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35398	185.177.25.107	606	TCP
2024-12-12T06:53:09.287784+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35400	185.177.25.107	606	TCP
2024-12-12T06:53:11.423622+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35402	185.177.25.107	606	TCP
2024-12-12T06:53:13.547530+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35404	185.177.25.107	606	TCP
2024-12-12T06:53:15.800695+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35406	185.177.25.107	606	TCP
2024-12-12T06:53:17.939719+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35408	185.177.25.107	606	TCP
2024-12-12T06:53:20.062219+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35410	185.177.25.107	606	TCP
2024-12-12T06:53:22.191500+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35412	185.177.25.107	606	TCP
2024-12-12T06:53:24.329517+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35414	185.177.25.107	606	TCP
2024-12-12T06:53:26.454009+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35416	185.177.25.107	606	TCP
2024-12-12T06:53:28.578581+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35418	185.177.25.107	606	TCP
2024-12-12T06:53:30.703822+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35420	185.177.25.107	606	TCP
2024-12-12T06:53:32.829663+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35422	185.177.25.107	606	TCP
2024-12-12T06:53:35.180477+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35424	185.177.25.107	606	TCP
2024-12-12T06:53:37.313728+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35426	185.177.25.107	606	TCP
2024-12-12T06:53:39.437723+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35428	185.177.25.107	606	TCP
2024-12-12T06:53:41.735680+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35430	185.177.25.107	606	TCP
2024-12-12T06:53:43.860955+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35432	185.177.25.107	606	TCP
2024-12-12T06:53:45.985207+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35434	185.177.25.107	606	TCP
2024-12-12T06:53:48.093180+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35436	185.177.25.107	606	TCP
2024-12-12T06:53:50.222069+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35438	185.177.25.107	606	TCP
2024-12-12T06:53:52.344077+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35440	185.177.25.107	606	TCP
2024-12-12T06:53:54.532611+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35442	185.177.25.107	606	TCP
2024-12-12T06:53:56.658670+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35444	185.177.25.107	606	TCP
2024-12-12T06:53:58.798432+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35446	185.177.25.107	606	TCP
2024-12-12T06:54:00.939739+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35448	185.177.25.107	606	TCP
2024-12-12T06:54:03.046053+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35450	185.177.25.107	606	TCP
2024-12-12T06:54:05.171789+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35452	185.177.25.107	606	TCP
2024-12-12T06:54:07.280798+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35454	185.177.25.107	606	TCP
2024-12-12T06:54:09.390653+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	35456	185.177.25.107	606	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 06:50:35.995635986 CET	35256	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:36.114864111 CET	606	35256	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:36.114991903 CET	35256	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:36.115109921 CET	35256	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:36.234590054 CET	606	35256	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:38.124811888 CET	606	35256	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:38.125158072 CET	35256	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:38.125917912 CET	35258	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:38.244594097 CET	606	35256	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:38.245251894 CET	606	35258	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:38.245459080 CET	35258	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:38.245511055 CET	35258	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:38.364957094 CET	606	35258	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:40.249619007 CET	606	35258	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:40.249989033 CET	35258	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:40.250663996 CET	35260	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:40.523082018 CET	606	35258	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:40.523127079 CET	606	35260	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:40.523366928 CET	35260	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:40.523366928 CET	35260	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:40.643202066 CET	606	35260	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:42.531156063 CET	606	35260	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:42.531430960 CET	35260	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:42.531980991 CET	35262	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:42.650871992 CET	606	35260	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:42.651248932 CET	606	35262	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:42.651505947 CET	35262	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:42.651505947 CET	35262	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:42.770936012 CET	606	35262	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:43.814035892 CET	46540	443	192.168.2.14	185.125.190.26
Dec 12, 2024 06:50:44.639926910 CET	606	35262	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:44.640265942 CET	35262	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:44.640928030 CET	35264	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:44.759727001 CET	606	35262	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:44.760240078 CET	606	35264	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:44.760339022 CET	35264	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:44.760381937 CET	35264	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:44.879770994 CET	606	35264	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:46.766377926 CET	606	35264	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:46.766705990 CET	35264	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:46.767513990 CET	35266	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:46.886197090 CET	606	35264	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:46.886809111 CET	606	35266	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:46.886946917 CET	35266	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:46.886996984 CET	35266	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:47.006659031 CET	606	35266	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:48.874160051 CET	606	35266	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:48.874744892 CET	35266	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:48.875550985 CET	35268	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:48.994959116 CET	606	35266	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:48.994978905 CET	606	35268	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:48.995368004 CET	35268	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:48.995459080 CET	35268	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:49.114845037 CET	606	35268	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:51.016441107 CET	606	35268	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:51.016871929 CET	35268	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:51.017674923 CET	35270	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:51.136596918 CET	606	35268	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:51.136877060 CET	606	35270	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:51.137083054 CET	35270	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:51.137208939 CET	35270	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:51.257946968 CET	606	35270	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:53.157201052 CET	606	35270	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:53.157591105 CET	35270	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:53.158601999 CET	35272	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:53.277185917 CET	606	35270	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:53.277904987 CET	606	35272	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:53.278247118 CET	35272	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:53.278454065 CET	35272	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:53.398139954 CET	606	35272	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:55.281023026 CET	606	35272	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:55.281213999 CET	35272	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:55.287456989 CET	35274	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:55.400675058 CET	606	35272	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:55.406866074 CET	606	35274	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:55.406977892 CET	35274	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:55.407016993 CET	35274	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:55.526369095 CET	606	35274	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:57.423055887 CET	606	35274	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:57.423373938 CET	35274	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:57.424454927 CET	35276	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:57.543001890 CET	606	35274	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:57.543849945 CET	606	35276	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:57.544033051 CET	35276	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:57.544137955 CET	35276	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:57.663980007 CET	606	35276	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:59.548022985 CET	606	35276	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:59.548350096 CET	35276	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:59.549422979 CET	35278	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:59.669229031 CET	606	35276	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:59.669919014 CET	606	35278	185.177.25.107	192.168.2.14
Dec 12, 2024 06:50:59.670255899 CET	35278	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:59.670357943 CET	35278	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:50:59.792850018 CET	606	35278	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:01.655771017 CET	606	35278	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:01.656259060 CET	35278	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:01.657334089 CET	35280	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:01.775835991 CET	606	35278	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:01.776664019 CET	606	35280	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:01.776793957 CET	35280	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:01.777018070 CET	35280	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:01.896377087 CET	606	35280	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:03.781714916 CET	606	35280	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:03.782135963 CET	35280	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:03.782982111 CET	35282	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:03.902494907 CET	606	35280	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:03.902543068 CET	606	35282	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:03.902846098 CET	35282	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:03.902951002 CET	35282	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:04.022655964 CET	606	35282	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:05.922360897 CET	606	35282	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:05.922751904 CET	35282	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:05.923909903 CET	35284	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:06.042151928 CET	606	35282	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:06.043230057 CET	606	35284	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:06.043375969 CET	35284	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:06.043495893 CET	35284	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:06.162904978 CET	606	35284	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:08.047230959 CET	606	35284	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:08.047569036 CET	35284	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:08.048495054 CET	35286	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:08.169152975 CET	606	35284	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:08.169719934 CET	606	35286	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:08.169964075 CET	35286	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:08.170110941 CET	35286	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:08.290992022 CET	606	35286	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:10.155920982 CET	606	35286	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:10.156220913 CET	35286	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:10.157633066 CET	35288	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:10.276009083 CET	606	35286	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:10.277017117 CET	606	35288	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:10.277264118 CET	35288	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:10.277265072 CET	35288	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:10.396826982 CET	606	35288	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:12.281816959 CET	606	35288	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:12.282315969 CET	35288	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:12.283394098 CET	35290	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:12.401901007 CET	606	35288	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:12.402764082 CET	606	35290	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:12.403052092 CET	35290	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:12.403157949 CET	35290	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:12.522646904 CET	606	35290	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:14.407891035 CET	606	35290	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:14.408236980 CET	35290	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:14.409401894 CET	35292	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:14.527909040 CET	606	35290	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:14.528986931 CET	606	35292	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:14.529364109 CET	35292	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:14.529453039 CET	35292	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:14.532974005 CET	46540	443	192.168.2.14	185.125.190.26
Dec 12, 2024 06:51:14.649003029 CET	606	35292	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:16.534013033 CET	606	35292	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:16.534488916 CET	35292	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:16.535357952 CET	35294	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:16.654006958 CET	606	35292	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:16.654737949 CET	606	35294	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:16.654903889 CET	35294	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:16.654979944 CET	35294	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:16.774633884 CET	606	35294	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:18.657831907 CET	606	35294	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:18.658294916 CET	35294	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:18.659204006 CET	35296	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:18.777945042 CET	606	35294	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:18.778517962 CET	606	35296	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:18.778739929 CET	35296	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:18.778739929 CET	35296	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:18.898514032 CET	606	35296	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:20.782902002 CET	606	35296	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:20.783402920 CET	35296	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:20.785604954 CET	35298	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:20.903290033 CET	606	35296	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:20.905416012 CET	606	35298	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:20.905874968 CET	35298	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:20.906228065 CET	35298	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:21.025873899 CET	606	35298	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:22.907820940 CET	606	35298	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:22.908338070 CET	35298	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:22.910310030 CET	35300	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:23.030258894 CET	606	35298	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:23.030354023 CET	606	35300	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:23.030659914 CET	35300	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:23.030659914 CET	35300	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:23.150816917 CET	606	35300	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:25.032468081 CET	606	35300	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:25.032850981 CET	35300	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:25.034533978 CET	35302	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:25.152806044 CET	606	35300	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:25.154186964 CET	606	35302	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:25.154469013 CET	35302	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:25.154665947 CET	35302	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:25.274342060 CET	606	35302	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:27.173548937 CET	606	35302	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:27.173897028 CET	35302	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:27.175128937 CET	35304	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:27.293538094 CET	606	35302	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:27.294537067 CET	606	35304	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:27.294787884 CET	35304	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:27.294872999 CET	35304	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:27.414294958 CET	606	35304	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:29.298311949 CET	606	35304	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:29.298676014 CET	35304	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:29.300607920 CET	35306	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:29.418119907 CET	606	35304	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:29.419855118 CET	606	35306	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:29.420126915 CET	35306	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:29.420361042 CET	35306	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:29.539638996 CET	606	35306	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:31.422916889 CET	606	35306	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:31.423623085 CET	35306	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:31.424671888 CET	35308	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:31.543381929 CET	606	35306	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:31.546387911 CET	606	35308	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:31.546773911 CET	35308	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:31.546773911 CET	35308	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:31.666253090 CET	606	35308	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:33.548547983 CET	606	35308	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:33.549124956 CET	35308	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:33.551986933 CET	35310	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:33.668895960 CET	606	35308	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:33.671417952 CET	606	35310	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:33.671725035 CET	35310	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:33.671823978 CET	35310	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:33.791454077 CET	606	35310	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:35.673588037 CET	606	35310	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:35.674177885 CET	35310	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:35.675344944 CET	35312	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:35.795886040 CET	606	35310	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:35.796896935 CET	606	35312	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:35.797122002 CET	35312	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:35.797122955 CET	35312	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:35.916738033 CET	606	35312	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:37.781327963 CET	606	35312	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:37.781809092 CET	35312	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:37.782869101 CET	35314	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:37.901226044 CET	606	35312	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:37.902169943 CET	606	35314	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:37.902544022 CET	35314	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:37.902544022 CET	35314	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:38.021991968 CET	606	35314	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:39.907421112 CET	606	35314	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:39.907725096 CET	35314	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:39.907726049 CET	35314	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:39.908467054 CET	35316	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:40.027282953 CET	606	35314	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:40.027796030 CET	606	35316	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:40.028059006 CET	35316	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:40.028223991 CET	35316	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:40.147717953 CET	606	35316	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:42.016788960 CET	606	35316	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:42.017285109 CET	35316	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:42.018384933 CET	35318	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:42.137238979 CET	606	35316	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:42.137737989 CET	606	35318	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:42.138077974 CET	35318	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:42.138077974 CET	35318	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:42.257595062 CET	606	35318	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:44.143662930 CET	606	35318	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:44.144207954 CET	35318	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:44.145893097 CET	35320	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:44.264817953 CET	606	35318	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:44.266392946 CET	606	35320	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:44.266680002 CET	35320	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:44.266866922 CET	35320	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:44.386126041 CET	606	35320	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:46.267522097 CET	606	35320	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:46.268073082 CET	35320	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:46.270029068 CET	35322	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:46.387645960 CET	606	35320	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:46.389369011 CET	606	35322	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:46.389776945 CET	35322	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:46.389777899 CET	35322	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:46.509661913 CET	606	35322	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:48.391016960 CET	606	35322	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:48.391505003 CET	35322	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:48.393632889 CET	35324	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:48.511217117 CET	606	35322	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:48.513051987 CET	606	35324	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:48.513237000 CET	35324	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:48.513341904 CET	35324	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:48.632956982 CET	606	35324	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:50.519084930 CET	606	35324	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:50.519556046 CET	35324	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:50.520256042 CET	35326	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:50.639031887 CET	606	35324	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:50.642936945 CET	606	35326	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:50.643100977 CET	35326	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:50.643280983 CET	35326	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:50.762795925 CET	606	35326	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:52.658721924 CET	606	35326	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:52.659192085 CET	35326	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:52.660254955 CET	35328	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:52.778815985 CET	606	35326	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:52.779859066 CET	606	35328	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:52.780169964 CET	35328	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:52.780169964 CET	35328	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:52.901104927 CET	606	35328	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:54.783669949 CET	606	35328	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:54.784182072 CET	35328	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:54.785234928 CET	35330	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:54.904090881 CET	606	35328	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:54.904578924 CET	606	35330	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:54.904907942 CET	35330	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:54.904907942 CET	35330	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:55.024585009 CET	606	35330	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:56.923471928 CET	606	35330	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:56.923871040 CET	35330	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:56.924916983 CET	35332	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:57.043617964 CET	606	35330	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:57.045784950 CET	606	35332	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:57.045898914 CET	35332	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:57.045942068 CET	35332	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:57.165611029 CET	606	35332	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:59.048293114 CET	606	35332	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:59.048623085 CET	35332	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:59.049827099 CET	35334	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:59.168250084 CET	606	35332	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:59.169126987 CET	606	35334	185.177.25.107	192.168.2.14
Dec 12, 2024 06:51:59.169373035 CET	35334	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:59.169405937 CET	35334	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:51:59.288980961 CET	606	35334	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:01.158862114 CET	606	35334	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:01.159037113 CET	35334	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:01.160415888 CET	35336	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:01.278712988 CET	606	35334	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:01.279803991 CET	606	35336	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:01.280075073 CET	35336	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:01.280180931 CET	35336	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:01.399785995 CET	606	35336	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:03.283865929 CET	606	35336	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:03.284058094 CET	35336	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:03.284868956 CET	35338	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:03.403501987 CET	606	35336	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:03.404340982 CET	606	35338	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:03.404587984 CET	35338	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:03.404747963 CET	35338	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:03.524111032 CET	606	35338	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:05.408632040 CET	606	35338	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:05.409146070 CET	35338	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:05.411814928 CET	35340	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:05.530958891 CET	606	35338	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:05.531671047 CET	606	35340	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:05.532074928 CET	35340	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:05.532480955 CET	35340	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:05.651886940 CET	606	35340	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:07.535203934 CET	606	35340	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:07.535479069 CET	35340	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:07.536209106 CET	35342	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:07.655091047 CET	606	35340	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:07.655724049 CET	606	35342	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:07.655855894 CET	35342	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:07.656047106 CET	35342	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:07.775433064 CET	606	35342	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:09.658009052 CET	606	35342	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:09.658632040 CET	35342	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:09.661006927 CET	35344	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:09.778047085 CET	606	35342	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:09.780388117 CET	606	35344	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:09.780812979 CET	35344	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:09.780812979 CET	35344	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:09.900398970 CET	606	35344	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:11.766748905 CET	606	35344	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:11.766985893 CET	35344	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:11.768042088 CET	35346	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:11.886486053 CET	606	35344	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:11.887510061 CET	606	35346	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:11.887911081 CET	35346	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:11.888005018 CET	35346	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:12.007695913 CET	606	35346	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:13.892739058 CET	606	35346	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:13.893346071 CET	35346	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:13.895781994 CET	35348	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:14.013011932 CET	606	35346	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:14.015249014 CET	606	35348	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:14.015822887 CET	35348	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:14.015924931 CET	35348	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:14.135569096 CET	606	35348	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:16.017983913 CET	606	35348	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:16.018402100 CET	35348	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:16.019138098 CET	35350	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:16.137969971 CET	606	35348	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:16.138420105 CET	606	35350	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:16.138916969 CET	35350	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:16.138916969 CET	35350	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:16.259354115 CET	606	35350	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:18.126933098 CET	606	35350	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:18.127433062 CET	35350	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:18.129302025 CET	35352	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:18.247029066 CET	606	35350	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:18.248713970 CET	606	35352	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:18.249010086 CET	35352	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:18.249099970 CET	35352	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:18.368813992 CET	606	35352	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:20.251955032 CET	606	35352	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:20.252793074 CET	35352	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:20.254972935 CET	35354	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:20.372560024 CET	606	35352	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:20.374320030 CET	606	35354	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:20.374618053 CET	35354	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:20.374619007 CET	35354	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:20.494060040 CET	606	35354	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:22.377202034 CET	606	35354	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:22.377726078 CET	35354	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:22.380213976 CET	35356	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:22.497303963 CET	606	35354	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:22.501019001 CET	606	35356	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:22.501456022 CET	35356	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:22.501760006 CET	35356	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:22.621032953 CET	606	35356	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:24.486049891 CET	606	35356	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:24.486705065 CET	35356	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:24.489119053 CET	35358	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:24.606328011 CET	606	35356	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:24.608484030 CET	606	35358	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:24.608732939 CET	35358	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:24.608814001 CET	35358	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:24.728275061 CET	606	35358	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:26.594986916 CET	606	35358	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:26.595566034 CET	35358	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:26.597656012 CET	35360	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:26.715147972 CET	606	35358	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:26.717206955 CET	606	35360	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:26.717617989 CET	35360	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:26.717618942 CET	35360	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:26.837276936 CET	606	35360	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:28.720551014 CET	606	35360	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:28.720890045 CET	35360	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:28.722902060 CET	35362	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:28.840410948 CET	606	35360	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:28.842493057 CET	606	35362	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:28.842875004 CET	35362	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:28.843147993 CET	35362	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:28.962548971 CET	606	35362	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:30.829960108 CET	606	35362	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:30.830605984 CET	35362	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:30.833170891 CET	35364	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:30.949997902 CET	606	35362	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:30.952532053 CET	606	35364	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:30.953022003 CET	35364	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:30.953022003 CET	35364	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:31.072635889 CET	606	35364	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:32.938860893 CET	606	35364	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:32.939448118 CET	35364	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:32.941881895 CET	35366	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:33.059237003 CET	606	35364	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:33.061371088 CET	606	35366	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:33.061753035 CET	35366	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:33.061875105 CET	35366	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:33.181557894 CET	606	35366	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:35.048338890 CET	606	35366	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:35.048991919 CET	35366	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:35.051522017 CET	35368	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:35.168684006 CET	606	35366	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:35.170881033 CET	606	35368	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:35.171236038 CET	35368	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:35.171236038 CET	35368	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:35.291052103 CET	606	35368	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:37.174777985 CET	606	35368	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:37.175477982 CET	35368	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:37.176626921 CET	35370	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:37.295299053 CET	606	35368	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:37.295979977 CET	606	35370	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:37.296314955 CET	35370	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:37.296513081 CET	35370	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:37.416053057 CET	606	35370	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:39.299971104 CET	606	35370	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:39.300622940 CET	35370	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:39.303584099 CET	35372	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:39.420739889 CET	606	35370	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:39.422988892 CET	606	35372	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:39.423398972 CET	35372	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:39.423489094 CET	35372	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:39.543056965 CET	606	35372	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:41.408446074 CET	606	35372	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:41.408998013 CET	35372	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:41.410706043 CET	35374	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:41.528850079 CET	606	35372	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:41.530108929 CET	606	35374	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:41.530468941 CET	35374	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:41.530659914 CET	35374	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:41.650021076 CET	606	35374	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:43.518971920 CET	606	35374	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:43.519555092 CET	35374	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:43.521822929 CET	35376	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:43.639131069 CET	606	35374	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:43.641273975 CET	606	35376	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:43.641515970 CET	35376	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:43.641840935 CET	35376	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:43.761506081 CET	606	35376	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:45.643224955 CET	606	35376	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:45.643959999 CET	35376	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:45.646310091 CET	35378	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:45.763591051 CET	606	35376	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:45.765782118 CET	606	35378	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:45.766244888 CET	35378	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:45.766246080 CET	35378	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:45.886039972 CET	606	35378	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:47.768862009 CET	606	35378	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:47.769428015 CET	35378	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:47.770605087 CET	35380	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:47.888989925 CET	606	35378	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:47.890095949 CET	606	35380	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:47.890583992 CET	35380	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:47.890696049 CET	35380	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:48.010121107 CET	606	35380	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:49.893784046 CET	606	35380	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:49.894402981 CET	35380	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:49.896941900 CET	35382	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:50.014085054 CET	606	35380	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:50.016365051 CET	606	35382	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:50.016756058 CET	35382	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:50.016849995 CET	35382	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:50.136442900 CET	606	35382	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:52.018817902 CET	606	35382	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:52.019237995 CET	35382	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:52.021032095 CET	35384	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:52.138720036 CET	606	35382	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:52.140321016 CET	606	35384	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:52.140734911 CET	35384	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:52.140734911 CET	35384	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:52.260410070 CET	606	35384	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:54.158688068 CET	606	35384	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:54.159266949 CET	35384	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:54.160413027 CET	35386	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:54.278940916 CET	606	35384	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:54.280078888 CET	606	35386	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:54.280353069 CET	35386	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:54.280457020 CET	35386	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:54.399827957 CET	606	35386	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:56.284467936 CET	606	35386	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:56.285068989 CET	35386	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:56.287421942 CET	35388	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:56.404499054 CET	606	35386	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:56.406832933 CET	606	35388	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:56.407051086 CET	35388	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:56.407224894 CET	35388	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:56.526623964 CET	606	35388	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:58.409377098 CET	606	35388	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:58.410151958 CET	35388	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:58.412559986 CET	35390	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:58.529761076 CET	606	35388	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:58.531960011 CET	606	35390	185.177.25.107	192.168.2.14
Dec 12, 2024 06:52:58.532411098 CET	35390	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:58.532411098 CET	35390	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:52:58.651942968 CET	606	35390	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:00.534286022 CET	606	35390	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:00.534895897 CET	35390	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:00.537558079 CET	35392	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:00.654320955 CET	606	35390	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:00.656910896 CET	606	35392	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:00.657366037 CET	35392	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:00.657366037 CET	35392	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:00.776745081 CET	606	35392	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:02.658683062 CET	606	35392	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:02.659312010 CET	35392	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:02.661331892 CET	35394	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:02.778907061 CET	606	35392	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:02.780796051 CET	606	35394	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:02.781181097 CET	35394	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:02.781466007 CET	35394	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:02.900998116 CET	606	35394	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:04.784735918 CET	606	35394	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:04.785382032 CET	35394	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:04.787934065 CET	35396	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:04.904836893 CET	606	35394	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:04.907335043 CET	606	35396	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:04.907708883 CET	35396	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:04.907838106 CET	35396	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:05.027199984 CET	606	35396	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:06.908643961 CET	606	35396	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:06.909265995 CET	35396	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:06.910790920 CET	35398	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:07.028800011 CET	606	35396	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:07.030175924 CET	606	35398	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:07.030616999 CET	35398	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:07.030776978 CET	35398	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:07.150373936 CET	606	35398	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:09.163539886 CET	606	35398	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:09.164093018 CET	35398	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:09.166455030 CET	35400	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:09.284641027 CET	606	35398	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:09.287482023 CET	606	35400	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:09.287784100 CET	35400	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:09.287784100 CET	35400	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:09.408410072 CET	606	35400	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:11.300570965 CET	606	35400	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:11.301095963 CET	35400	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:11.303642988 CET	35402	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:11.420644999 CET	606	35400	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:11.423058033 CET	606	35402	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:11.423315048 CET	35402	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:11.423621893 CET	35402	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:11.543145895 CET	606	35402	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:13.424634933 CET	606	35402	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:13.425297976 CET	35402	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:13.427762985 CET	35404	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:13.544785976 CET	606	35402	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:13.547127008 CET	606	35404	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:13.547529936 CET	35404	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:13.547529936 CET	35404	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:13.667992115 CET	606	35404	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:15.678018093 CET	606	35404	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:15.678642988 CET	35404	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:15.680624962 CET	35406	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:15.798317909 CET	606	35404	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:15.800005913 CET	606	35406	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:15.800450087 CET	35406	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:15.800694942 CET	35406	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:15.920228004 CET	606	35406	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:17.816339016 CET	606	35406	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:17.817023039 CET	35406	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:17.819655895 CET	35408	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:17.936512947 CET	606	35406	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:17.939100027 CET	606	35408	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:17.939527035 CET	35408	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:17.939718962 CET	35408	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:18.059427023 CET	606	35408	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:19.940392017 CET	606	35408	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:19.940516949 CET	35408	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:19.942681074 CET	35410	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:20.060192108 CET	606	35408	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:20.062069893 CET	606	35410	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:20.062218904 CET	35410	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:20.062218904 CET	35410	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:20.182894945 CET	606	35410	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:22.065299988 CET	606	35410	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:22.066024065 CET	35410	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:22.071310043 CET	35412	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:22.185854912 CET	606	35410	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:22.190867901 CET	606	35412	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:22.191337109 CET	35412	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:22.191499949 CET	35412	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:22.311372995 CET	606	35412	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:24.206868887 CET	606	35412	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:24.207659960 CET	35412	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:24.209508896 CET	35414	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:24.327445984 CET	606	35412	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:24.329067945 CET	606	35414	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:24.329515934 CET	35414	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:24.329516888 CET	35414	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:24.449444056 CET	606	35414	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:26.331196070 CET	606	35414	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:26.331688881 CET	35414	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:26.333451986 CET	35416	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:26.451666117 CET	606	35414	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:26.453372002 CET	606	35416	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:26.453715086 CET	35416	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:26.454009056 CET	35416	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:26.573489904 CET	606	35416	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:28.456758976 CET	606	35416	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:28.457339048 CET	35416	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:28.458798885 CET	35418	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:28.576948881 CET	606	35416	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:28.578135014 CET	606	35418	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:28.578581095 CET	35418	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:28.578581095 CET	35418	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:28.698142052 CET	606	35418	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:30.581234932 CET	606	35418	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:30.581805944 CET	35418	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:30.583842039 CET	35420	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:30.701459885 CET	606	35418	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:30.703260899 CET	606	35420	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:30.703821898 CET	35420	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:30.703821898 CET	35420	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:30.823590994 CET	606	35420	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:32.706849098 CET	606	35420	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:32.707492113 CET	35420	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:32.709500074 CET	35422	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:32.827061892 CET	606	35420	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:32.828921080 CET	606	35422	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:32.829305887 CET	35422	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:32.829663038 CET	35422	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:32.948982954 CET	606	35422	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:34.831356049 CET	606	35422	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:34.832143068 CET	35422	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:34.834794998 CET	35424	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:35.179716110 CET	606	35422	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:35.179769039 CET	606	35424	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:35.180351973 CET	35424	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:35.180476904 CET	35424	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:35.299905062 CET	606	35424	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:37.191271067 CET	606	35424	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:37.191884995 CET	35424	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:37.193897963 CET	35426	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:37.311326981 CET	606	35424	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:37.313292980 CET	606	35426	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:37.313726902 CET	35426	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:37.313728094 CET	35426	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:37.433336020 CET	606	35426	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:39.316736937 CET	606	35426	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:39.317013025 CET	35426	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:39.317991018 CET	35428	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:39.436544895 CET	606	35426	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:39.437376022 CET	606	35428	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:39.437509060 CET	35428	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:39.437722921 CET	35428	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:39.557328939 CET	606	35428	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:41.612629890 CET	606	35428	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:41.613387108 CET	35428	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:41.615786076 CET	35430	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:41.732911110 CET	606	35428	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:41.735121012 CET	606	35430	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:41.735680103 CET	35430	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:41.735680103 CET	35430	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:41.855386972 CET	606	35430	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:43.738298893 CET	606	35430	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:43.738760948 CET	35430	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:43.738761902 CET	35430	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:43.741271019 CET	35432	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:43.858218908 CET	606	35430	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:43.860663891 CET	606	35432	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:43.860786915 CET	35432	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:43.860955000 CET	35432	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:43.980130911 CET	606	35432	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:45.863238096 CET	606	35432	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:45.863972902 CET	35432	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:45.865520954 CET	35434	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:45.984323025 CET	606	35432	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:45.984930992 CET	606	35434	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:45.985207081 CET	35434	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:45.985207081 CET	35434	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:46.104825974 CET	606	35434	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:47.972023964 CET	606	35434	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:47.972462893 CET	35434	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:47.973436117 CET	35436	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:48.092083931 CET	606	35434	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:48.092878103 CET	606	35436	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:48.093178988 CET	35436	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:48.093179941 CET	35436	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:48.212860107 CET	606	35436	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:50.099016905 CET	606	35436	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:50.099549055 CET	35436	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:50.100951910 CET	35438	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:50.219518900 CET	606	35436	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:50.221776009 CET	606	35438	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:50.221976042 CET	35438	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:50.222069025 CET	35438	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:50.342236996 CET	606	35438	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:52.222580910 CET	606	35438	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:52.223089933 CET	35438	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:52.224303961 CET	35440	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:52.342525959 CET	606	35438	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:52.343775988 CET	606	35440	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:52.343988895 CET	35440	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:52.344077110 CET	35440	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:52.463526011 CET	606	35440	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:54.410844088 CET	606	35440	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:54.411120892 CET	35440	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:54.412235022 CET	35442	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:54.531214952 CET	606	35440	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:54.532286882 CET	606	35442	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:54.532553911 CET	35442	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:54.532610893 CET	35442	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:54.652054071 CET	606	35442	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:56.537436008 CET	606	35442	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:56.537708998 CET	35442	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:56.538757086 CET	35444	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:56.657248020 CET	606	35442	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:56.658507109 CET	606	35444	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:56.658601999 CET	35444	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:56.658669949 CET	35444	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:56.779804945 CET	606	35444	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:58.675553083 CET	606	35444	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:58.676126003 CET	35444	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:58.678446054 CET	35446	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:58.796143055 CET	606	35444	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:58.797914982 CET	606	35446	185.177.25.107	192.168.2.14
Dec 12, 2024 06:53:58.798276901 CET	35446	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:58.798432112 CET	35446	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:53:58.917954922 CET	606	35446	185.177.25.107	192.168.2.14
Dec 12, 2024 06:54:00.816196918 CET	606	35446	185.177.25.107	192.168.2.14
Dec 12, 2024 06:54:00.816903114 CET	35446	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:54:00.818923950 CET	35448	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:54:00.937768936 CET	606	35446	185.177.25.107	192.168.2.14
Dec 12, 2024 06:54:00.939467907 CET	606	35448	185.177.25.107	192.168.2.14
Dec 12, 2024 06:54:00.939738035 CET	35448	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:54:00.939738989 CET	35448	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:54:01.059489965 CET	606	35448	185.177.25.107	192.168.2.14
Dec 12, 2024 06:54:02.925066948 CET	606	35448	185.177.25.107	192.168.2.14
Dec 12, 2024 06:54:02.925501108 CET	35448	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:54:02.926486969 CET	35450	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:54:03.045093060 CET	606	35448	185.177.25.107	192.168.2.14
Dec 12, 2024 06:54:03.045813084 CET	606	35450	185.177.25.107	192.168.2.14
Dec 12, 2024 06:54:03.046051979 CET	35450	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:54:03.046052933 CET	35450	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:54:03.165659904 CET	606	35450	185.177.25.107	192.168.2.14
Dec 12, 2024 06:54:05.050409079 CET	606	35450	185.177.25.107	192.168.2.14
Dec 12, 2024 06:54:05.050825119 CET	35450	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:54:05.052135944 CET	35452	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:54:05.170344114 CET	606	35450	185.177.25.107	192.168.2.14
Dec 12, 2024 06:54:05.171467066 CET	606	35452	185.177.25.107	192.168.2.14
Dec 12, 2024 06:54:05.171788931 CET	35452	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:54:05.171788931 CET	35452	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:54:05.291289091 CET	606	35452	185.177.25.107	192.168.2.14
Dec 12, 2024 06:54:07.159384012 CET	606	35452	185.177.25.107	192.168.2.14
Dec 12, 2024 06:54:07.159869909 CET	35452	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:54:07.161014080 CET	35454	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:54:07.279500961 CET	606	35452	185.177.25.107	192.168.2.14
Dec 12, 2024 06:54:07.280421972 CET	606	35454	185.177.25.107	192.168.2.14
Dec 12, 2024 06:54:07.280797958 CET	35454	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:54:07.280797958 CET	35454	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:54:07.400332928 CET	606	35454	185.177.25.107	192.168.2.14
Dec 12, 2024 06:54:09.269656897 CET	606	35454	185.177.25.107	192.168.2.14
Dec 12, 2024 06:54:09.270252943 CET	35454	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:54:09.271037102 CET	35456	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:54:09.390008926 CET	606	35454	185.177.25.107	192.168.2.14
Dec 12, 2024 06:54:09.390481949 CET	606	35456	185.177.25.107	192.168.2.14
Dec 12, 2024 06:54:09.390652895 CET	35456	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:54:09.390652895 CET	35456	606	192.168.2.14	185.177.25.107
Dec 12, 2024 06:54:09.510379076 CET	606	35456	185.177.25.107	192.168.2.14

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 06:53:19.643536091 CET	50742	53	192.168.2.14	8.8.8.8
Dec 12, 2024 06:53:19.643536091 CET	34200	53	192.168.2.14	8.8.8.8
Dec 12, 2024 06:53:19.766465902 CET	53	34200	8.8.8.8	192.168.2.14
Dec 12, 2024 06:53:19.778198004 CET	53	50742	8.8.8.8	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 12, 2024 06:53:19.643536091 CET	192.168.2.14	8.8.8.8	0x1dac	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 06:53:19.643536091 CET	192.168.2.14	8.8.8.8	0xf39c	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 12, 2024 06:53:19.778198004 CET	8.8.8.8	192.168.2.14	0x1dac	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 12, 2024 06:53:19.778198004 CET	8.8.8.8	192.168.2.14	0x1dac	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: x86.xxx.elf PID: 5507, Parent PID: 5425

General

Start time (UTC):	05:50:34
Start date (UTC):	12/12/2024
Path:	/tmp/x86.xxx.elf
Arguments:	/tmp/x86.xxx.elf
File size:	110721 bytes
MD5 hash:	7f68c15cea6c38bf51ddb688bf5e8575

Chronological Activities

Analysis Process: x86.xxx.elf PID: 5508, Parent PID: 5507

General

Start time (UTC):	05:50:35
Start date (UTC):	12/12/2024
Path:	/tmp/x86.xxx.elf
Arguments:	-
File size:	110721 bytes
MD5 hash:	7f68c15cea6c38bf51ddb688bf5e8575

Chronological Activities

Analysis Process: x86.xxx.elf PID: 5509, Parent PID: 5508

General

Start time (UTC):	05:50:35
Start date (UTC):	12/12/2024
Path:	/tmp/x86.xxx.elf
Arguments:	-
File size:	110721 bytes
MD5 hash:	7f68c15cea6c38bf51ddb688bf5e8575

Chronological Activities