Edit tour

Linux Analysis Report
Space.x86.elf

Overview

General Information

Sample name:	Space.x86.elf
Analysis ID:	1575718
MD5:	7fd15b25eadc2d7f94f4124546174e50
SHA1:	2c056f909dbe70e262a7ab80426b7e088799b78e
SHA256:	14a364908f6b67c83ce526976e8fccf4cff103d613866fb6e3da170e2e0a926f
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Machine Learning detection for sample

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575718
Start date and time:	2024-12-16 08:56:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Space.x86.elf
Detection:	MAL
Classification:	mal72.troj.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/Space.x86.elf
PID:	5566
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

Space.x86.elf (PID: 5566, Parent: 5487, MD5: 7fd15b25eadc2d7f94f4124546174e50) Arguments: /tmp/Space.x86.elf

Space.x86.elf New Fork (PID: 5567, Parent: 5566)

Space.x86.elf New Fork (PID: 5568, Parent: 5567)

Space.x86.elf New Fork (PID: 5569, Parent: 5567)

Space.x86.elf New Fork (PID: 5574, Parent: 5566)

Space.x86.elf New Fork (PID: 5575, Parent: 5566)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5567.1.0000000008048000.0000000008059000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5567.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd8d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd8e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd8fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd910:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd924:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd938:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd94c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd960:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd974:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd988:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd99c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5567.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0xbaa:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
5567.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x4940:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5567.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0xc35:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
5567.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0xadb:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
5567.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1710:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x17f9:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x18d7:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1b82:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x2004:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
5567.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x9f3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
5567.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x70e2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5567.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
5567.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xa5f7:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5567.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x8ff7:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5567.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x70b2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
5574.1.0000000008048000.0000000008059000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5574.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd8d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd8e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd8fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd910:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd924:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd938:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd94c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd960:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd974:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd988:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd99c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5574.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0xbaa:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
5574.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x4940:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5574.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0xc35:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
5574.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0xadb:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
5574.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1710:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x17f9:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x18d7:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1b82:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x2004:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
5574.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x9f3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
5574.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x70e2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5574.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
5574.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xa5f7:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5574.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x8ff7:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5574.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x70b2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
5568.1.0000000008048000.0000000008059000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5568.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd8d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd8e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd8fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd910:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd924:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd938:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd94c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd960:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd974:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd988:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd99c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5568.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0xbaa:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
5568.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x4940:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5568.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0xc35:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
5568.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0xadb:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
5568.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1710:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x17f9:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x18d7:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1b82:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x2004:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
5568.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x9f3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
5568.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x70e2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5568.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
5568.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xa5f7:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5568.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x8ff7:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5568.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x70b2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
5566.1.0000000008048000.0000000008059000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5566.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd8d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd8e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd8fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd910:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd924:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd938:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd94c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd960:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd974:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd988:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd99c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5566.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0xbaa:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
5566.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x4940:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5566.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0xc35:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
5566.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0xadb:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
5566.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1710:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x17f9:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x18d7:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1b82:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x2004:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
5566.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x9f3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
5566.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x70e2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5566.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
5566.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xa5f7:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5566.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x8ff7:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5566.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x70b2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Process Memory Space: Space.x86.elf PID: 5566	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.x86.elf PID: 5566	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x47e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x492:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x50a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x51e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x532:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x546:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x55a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x56e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x582:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x596:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.x86.elf PID: 5567	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.x86.elf PID: 5567	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x9ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa67:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa7b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa8f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaa3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xab7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xacb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xadf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaf3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb07:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb1b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb2f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb43:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb57:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb7f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.x86.elf PID: 5568	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1001:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1015:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1029:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1051:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1065:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1079:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1105:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1119:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1141:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1155:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1169:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1191:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.x86.elf PID: 5574	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.x86.elf PID: 5574	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1641:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1655:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1669:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x167d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1691:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1709:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1731:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1745:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1759:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x176d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1781:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1795:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 54 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Space.x86.elf

ReversingLabs: Detection: 50%

Machine Learning detection for sample

Source: Space.x86.elf

Joe Sandbox ML: detected

Source: global traffic

TCP traffic: 192.168.2.14:46700 -> 89.169.4.44:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44

Source: Space.x86.elf

String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: Process Memory Space: Space.x86.elf PID: 5566, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.x86.elf PID: 5567, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.x86.elf PID: 5568, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.x86.elf PID: 5574, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0xc01000

Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: Process Memory Space: Space.x86.elf PID: 5566, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.x86.elf PID: 5567, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.x86.elf PID: 5568, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.x86.elf PID: 5574, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal72.troj.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/3760/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/1583/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/2672/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/3759/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/1577/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/3757/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/917/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/3758/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/19/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/1593/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/240/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/3094/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/242/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/3406/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/244/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/1589/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/245/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/1588/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/246/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/3402/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/5/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/247/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/7/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/8/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/129/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/801/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/803/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/806/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/807/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/928/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/3420/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/490/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/131/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/135/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/1599/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/378/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/3412/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/3672/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/1371/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/260/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5566)	File opened: /proc/261/status	Jump to behavior

Source: Space.x86.elf

Submission file: segment LOAD with 7.9574 entropy (max. 8.0)

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Space.x86.elf PID: 5566, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.x86.elf PID: 5567, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.x86.elf PID: 5574, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 5567.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5574.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5568.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5566.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Space.x86.elf PID: 5566, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.x86.elf PID: 5567, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.x86.elf PID: 5574, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Space.x86.elf	50%	ReversingLabs	Linux.Backdoor.Mirai
Space.x86.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Space.x86.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.169.4.44	unknown	Russian Federation		31514	INF-NET-ASRU	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
89.169.4.44	Space.arm.elf	Get hash	malicious	Mirai	Browse
	Space.sh4.elf	Get hash	malicious	Mirai	Browse
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INF-NET-ASRU	Space.arm.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	Space.sh4.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	jade.m68k.elf	Get hash	malicious	Mirai	Browse	89.169.156.74
	https://santa-secret.ru/api/verify?a=NjgyODEwNCw1bWluOHE2MHpuX3J1LC9hY2NvdW50L2JveGVzLHZsYWRpbWlyLmdsdXNoZW5rb0Bob2NobGFuZC5ydSwyNDE0MTYzMg==	Get hash	malicious	Unknown	Browse	87.228.10.139
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	89.169.4.44

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.955354657323113
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	Space.x86.elf
File size:	34'896 bytes
MD5:	7fd15b25eadc2d7f94f4124546174e50
SHA1:	2c056f909dbe70e262a7ab80426b7e088799b78e
SHA256:	14a364908f6b67c83ce526976e8fccf4cff103d613866fb6e3da170e2e0a926f
SHA512:	dd28a5c4d022da86df61bb6e60ddf04eeec747be632b4801c7f8115129e26ccf1c29b9f16bcae570435a303e87175dbb1b3c2b7c622e4453dba2aa9d7a68f47d
SSDEEP:	768:mzbGjwng3vdOXjjYNAEiuWD2ILrm1Xey6aEyeRI7bLo2IHnbcuyD7UHQRjC:WdnA0Y7EjmQCd7bc2Unouy8HyW
TLSH:	FEF2E102868AC793E72D4339E8DDB94D0954A76E779358619FA4D1338088F29DD2F2CB
File Content Preview:	.ELF....................X...4...........4. ...(.....................L...L...............@...@...@...................Q.td.............................-[.UPX!........T...T.......V..........?..k.I/.j....\.d*nlz.e........4.0.N..9..y...........p"Nr..]9.~...n..

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0xc08558
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0xc01000	0xc01000	0x874c	0x874c	7.9574	0x5	R E	0x1000
LOAD	0xc40	0x805bc40	0x805bc40	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 08:57:20.415983915 CET	46700	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:20.535973072 CET	3778	46700	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:20.536042929 CET	46700	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:20.536092043 CET	46700	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:20.655986071 CET	3778	46700	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:20.656054020 CET	46700	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:20.776124001 CET	3778	46700	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:21.863094091 CET	3778	46700	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:21.863296986 CET	46700	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:21.863296986 CET	46700	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:21.863367081 CET	46702	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:21.983247042 CET	3778	46702	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:21.983369112 CET	46702	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:21.983408928 CET	46702	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:22.103295088 CET	3778	46702	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:22.103395939 CET	46702	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:22.223305941 CET	3778	46702	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:23.309647083 CET	3778	46702	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:23.309931040 CET	46702	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:23.309931040 CET	46702	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:23.310023069 CET	46704	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:23.430068970 CET	3778	46704	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:23.430254936 CET	46704	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:23.430254936 CET	46704	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:23.550405025 CET	3778	46704	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:23.550721884 CET	46704	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:23.670698881 CET	3778	46704	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:24.753978968 CET	3778	46704	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:24.754148006 CET	46704	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:24.754220963 CET	46704	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:24.754255056 CET	46706	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:24.874308109 CET	3778	46706	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:24.874521971 CET	46706	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:24.874572992 CET	46706	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:24.994527102 CET	3778	46706	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:24.994626045 CET	46706	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:25.114644051 CET	3778	46706	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:26.199687004 CET	3778	46706	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:26.199938059 CET	46708	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:26.199959993 CET	46706	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:26.199959993 CET	46706	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:26.268657923 CET	46710	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:26.319993019 CET	3778	46708	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:26.320075989 CET	46708	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:26.320105076 CET	46708	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:26.388583899 CET	3778	46710	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:26.388789892 CET	46710	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:26.388930082 CET	46710	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:26.440140963 CET	3778	46708	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:26.440417051 CET	46708	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:26.508961916 CET	3778	46710	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:26.509268999 CET	46710	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:26.560318947 CET	3778	46708	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:26.629210949 CET	3778	46710	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:27.649249077 CET	3778	46708	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:27.649506092 CET	46708	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:27.649544954 CET	46708	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:27.649593115 CET	46712	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:27.714412928 CET	3778	46710	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:27.714636087 CET	46710	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:27.714636087 CET	46710	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:27.714637041 CET	46714	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:27.769470930 CET	3778	46712	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:27.769690037 CET	46712	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:27.769690990 CET	46712	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:27.834527016 CET	3778	46714	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:27.834827900 CET	46714	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:27.834827900 CET	46714	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:27.889518023 CET	3778	46712	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:27.889738083 CET	46712	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:27.954654932 CET	3778	46714	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:27.954938889 CET	46714	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:28.009551048 CET	3778	46712	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:28.074759007 CET	3778	46714	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:29.094934940 CET	3778	46712	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:29.095076084 CET	46712	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:29.095076084 CET	46712	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:29.095129013 CET	46716	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:29.155241966 CET	3778	46714	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:29.155353069 CET	46714	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:29.155353069 CET	46714	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:29.155459881 CET	46718	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:29.215137959 CET	3778	46716	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:29.215266943 CET	46716	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:29.215336084 CET	46716	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:29.275515079 CET	3778	46718	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:29.275914907 CET	46718	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:29.275914907 CET	46718	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:29.335237026 CET	3778	46716	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:29.335508108 CET	46716	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:29.395730019 CET	3778	46718	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:29.395920038 CET	46718	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:29.455353022 CET	3778	46716	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:29.515973091 CET	3778	46718	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:30.539026022 CET	3778	46716	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:30.539335966 CET	46716	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:30.539335966 CET	46716	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:30.539400101 CET	46720	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:30.606175900 CET	3778	46718	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:30.606447935 CET	46722	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:30.606452942 CET	46718	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:30.606452942 CET	46718	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:30.659343958 CET	3778	46720	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:30.659496069 CET	46720	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:30.659611940 CET	46720	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:30.726213932 CET	3778	46722	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:30.726480961 CET	46722	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:30.726480961 CET	46722	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:30.779439926 CET	3778	46720	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:30.780069113 CET	46720	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:30.846278906 CET	3778	46722	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:30.846487045 CET	46722	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:30.900042057 CET	3778	46720	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:30.966206074 CET	3778	46722	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:31.986754894 CET	3778	46720	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:31.986991882 CET	46720	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:31.987030983 CET	46720	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:31.987302065 CET	46724	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:32.055202007 CET	3778	46722	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:32.055339098 CET	46722	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:32.055517912 CET	46722	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:32.055545092 CET	46726	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:32.107655048 CET	3778	46724	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:32.107759953 CET	46724	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:32.108009100 CET	46724	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:32.176150084 CET	3778	46726	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:32.176307917 CET	46726	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:32.176330090 CET	46726	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:32.227726936 CET	3778	46724	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:32.227832079 CET	46724	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:32.296360970 CET	3778	46726	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:32.296554089 CET	46726	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:32.347651005 CET	3778	46724	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:32.417217970 CET	3778	46726	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:33.448430061 CET	3778	46724	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:33.448556900 CET	46724	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:33.448585033 CET	46724	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:33.448677063 CET	46728	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:33.500576019 CET	3778	46726	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:33.500716925 CET	46726	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:33.500735998 CET	46726	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:33.500772953 CET	46730	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:33.568645954 CET	3778	46728	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:33.568901062 CET	46728	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:33.568928957 CET	46728	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:33.620635986 CET	3778	46730	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:33.620809078 CET	46730	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:33.620955944 CET	46730	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:33.690256119 CET	3778	46728	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:33.690529108 CET	46728	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:33.740737915 CET	3778	46730	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:33.740942001 CET	46730	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:33.811008930 CET	3778	46728	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:33.861438036 CET	3778	46730	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:34.895536900 CET	3778	46728	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:34.895791054 CET	46732	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:34.895798922 CET	46728	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:34.895800114 CET	46728	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:34.948873997 CET	3778	46730	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:34.949141979 CET	46734	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:34.949155092 CET	46730	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:34.949156046 CET	46730	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:35.016334057 CET	3778	46732	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:35.016514063 CET	46732	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:35.016514063 CET	46732	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:35.069166899 CET	3778	46734	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:35.069401979 CET	46734	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:35.069401979 CET	46734	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:35.136502981 CET	3778	46732	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:35.136689901 CET	46732	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:35.189299107 CET	3778	46734	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:35.189529896 CET	46734	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:35.256560087 CET	3778	46732	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:35.309422016 CET	3778	46734	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:36.338658094 CET	3778	46732	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:36.338901043 CET	46736	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:36.339030981 CET	46732	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:36.339030981 CET	46732	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:36.404295921 CET	3778	46734	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:36.404594898 CET	46738	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:36.404638052 CET	46734	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:36.404638052 CET	46734	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:36.458697081 CET	3778	46736	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:36.459017038 CET	46736	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:36.459017038 CET	46736	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:36.524410963 CET	3778	46738	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:36.524523020 CET	46738	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:36.524554014 CET	46738	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:36.578866959 CET	3778	46736	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:36.579112053 CET	46736	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:36.644390106 CET	3778	46738	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:36.644543886 CET	46738	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:36.699146986 CET	3778	46736	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:36.764425993 CET	3778	46738	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:37.812659979 CET	3778	46736	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:37.812767029 CET	46736	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:37.812824965 CET	46736	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:37.812870979 CET	46740	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:37.854979038 CET	3778	46738	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:37.855062008 CET	46738	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:37.855106115 CET	46738	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:37.855154991 CET	46742	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:37.932616949 CET	3778	46740	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:37.932693005 CET	46740	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:37.975004911 CET	3778	46742	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:37.975172997 CET	46742	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:37.975214958 CET	46742	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:38.095101118 CET	3778	46742	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:38.095276117 CET	46742	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:38.215442896 CET	3778	46742	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:38.838996887 CET	46740	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:38.958940983 CET	3778	46740	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:38.959198952 CET	46740	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:38.959199905 CET	46740	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:39.079046965 CET	3778	46740	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:39.079262018 CET	46740	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:39.199242115 CET	3778	46740	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:39.300061941 CET	3778	46742	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:39.300328970 CET	46742	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:39.300328970 CET	46742	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:39.300333977 CET	46744	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:39.420459986 CET	3778	46744	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:39.420627117 CET	46744	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:39.420741081 CET	46744	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:39.540617943 CET	3778	46744	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:39.540771008 CET	46744	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:39.660969973 CET	3778	46744	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:40.279259920 CET	3778	46740	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:40.279447079 CET	46740	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:40.279447079 CET	46740	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:40.279536963 CET	46746	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:40.399326086 CET	3778	46746	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:40.399446964 CET	46746	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:40.399538994 CET	46746	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:40.519341946 CET	3778	46746	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:40.519572973 CET	46746	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:40.848576069 CET	3778	46744	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:40.848594904 CET	3778	46746	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:40.848720074 CET	46744	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:40.848783016 CET	46744	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:40.848881960 CET	46748	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:40.968646049 CET	3778	46748	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:40.968852997 CET	46748	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:40.968991995 CET	46748	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:41.088730097 CET	3778	46748	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:41.088920116 CET	46748	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:41.209682941 CET	3778	46748	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:41.721865892 CET	3778	46746	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:41.722032070 CET	46746	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:41.722126007 CET	46746	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:41.722280025 CET	46750	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:41.842197895 CET	3778	46750	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:41.842422009 CET	46750	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:41.842422009 CET	46750	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:41.963021994 CET	3778	46750	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:41.963165045 CET	46750	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:42.083019972 CET	3778	46750	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:42.308886051 CET	3778	46748	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:42.309256077 CET	46752	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:42.309312105 CET	46748	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:42.309312105 CET	46748	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:42.429253101 CET	3778	46752	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:42.429383993 CET	46752	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:42.429491043 CET	46752	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:42.549294949 CET	3778	46752	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:42.549463987 CET	46752	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:42.669312954 CET	3778	46752	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:43.190028906 CET	3778	46750	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:43.190200090 CET	46750	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:43.190258980 CET	46750	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:43.190359116 CET	46754	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:43.310123920 CET	3778	46754	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:43.310323000 CET	46754	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:43.310323000 CET	46754	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:43.430188894 CET	3778	46754	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:43.430388927 CET	46754	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:43.550201893 CET	3778	46754	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:43.755234957 CET	3778	46752	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:43.755341053 CET	46752	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:43.755379915 CET	46752	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:43.755450010 CET	46756	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:43.876951933 CET	3778	46756	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:43.877193928 CET	46756	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:43.877194881 CET	46756	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:43.997091055 CET	3778	46756	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:43.997178078 CET	46756	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:44.117115974 CET	3778	46756	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:44.636034012 CET	3778	46754	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:44.636208057 CET	46754	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:44.636257887 CET	46754	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:44.636298895 CET	46758	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:44.756098032 CET	3778	46758	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:44.756288052 CET	46758	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:44.756419897 CET	46758	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:44.876209021 CET	3778	46758	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:44.876406908 CET	46758	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:44.996215105 CET	3778	46758	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:45.198457956 CET	3778	46756	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:45.198738098 CET	46756	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:45.198810101 CET	46756	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:45.198884964 CET	46760	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:45.318658113 CET	3778	46760	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:45.318794966 CET	46760	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:45.318847895 CET	46760	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:45.438679934 CET	3778	46760	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:45.438879967 CET	46760	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:45.558721066 CET	3778	46760	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:46.077877045 CET	3778	46758	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:46.078116894 CET	46758	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:46.078252077 CET	46758	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:46.078366041 CET	46762	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:46.198096991 CET	3778	46762	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:46.198297977 CET	46762	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:46.198395014 CET	46762	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:46.318300009 CET	3778	46762	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:46.318576097 CET	46762	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:46.438374996 CET	3778	46762	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:46.639709949 CET	3778	46760	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:46.639868975 CET	46760	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:46.639961004 CET	46760	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:46.639991999 CET	46764	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:46.759855986 CET	3778	46764	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:46.759948969 CET	46764	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:46.760021925 CET	46764	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:46.879786968 CET	3778	46764	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:46.880007029 CET	46764	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:46.999835014 CET	3778	46764	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:47.522512913 CET	3778	46762	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:47.522648096 CET	46762	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:47.522711039 CET	46762	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:47.522731066 CET	46766	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:47.642570019 CET	3778	46766	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:47.642846107 CET	46766	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:47.642952919 CET	46766	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:47.762758017 CET	3778	46766	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:47.763036013 CET	46766	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:47.882899046 CET	3778	46766	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:48.965389967 CET	3778	46766	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:48.965522051 CET	46766	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:48.965523005 CET	46766	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:48.965734005 CET	46768	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:49.085603952 CET	3778	46768	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:49.085963964 CET	46768	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:49.085963964 CET	46768	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:49.205873013 CET	3778	46768	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:49.206159115 CET	46768	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:49.326244116 CET	3778	46768	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:50.437391043 CET	3778	46768	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:50.437648058 CET	46768	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:50.437778950 CET	46768	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:50.437778950 CET	46770	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:50.557580948 CET	3778	46770	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:50.557840109 CET	46770	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:51.446350098 CET	46770	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:51.566176891 CET	3778	46770	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:51.566297054 CET	46770	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:51.566368103 CET	46770	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:51.686225891 CET	3778	46770	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:51.686549902 CET	46770	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:51.806375027 CET	3778	46770	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:52.890748978 CET	3778	46770	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:52.890902996 CET	46770	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:52.890902996 CET	46770	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:52.890959978 CET	46772	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:53.010916948 CET	3778	46772	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:53.011109114 CET	46772	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:53.011188030 CET	46772	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:53.131371975 CET	3778	46772	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:53.131695986 CET	46772	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:53.251684904 CET	3778	46772	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:54.332439899 CET	3778	46772	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:54.332715988 CET	46772	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:54.332741976 CET	46772	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:54.332783937 CET	46774	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:54.452558994 CET	3778	46774	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:54.452660084 CET	46774	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:54.452724934 CET	46774	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:54.572608948 CET	3778	46774	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:54.572710037 CET	46774	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:54.692965984 CET	3778	46774	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:55.771754026 CET	3778	46774	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:55.771883011 CET	46774	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:55.771914959 CET	46774	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:55.771964073 CET	46776	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:55.891921997 CET	3778	46776	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:55.892188072 CET	46776	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:55.892188072 CET	46776	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:56.012299061 CET	3778	46776	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:56.012567043 CET	46776	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:56.132893085 CET	3778	46776	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:56.769746065 CET	46764	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:56.889885902 CET	3778	46764	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:57.202697992 CET	3778	46764	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:57.202984095 CET	46764	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:57.213505983 CET	3778	46776	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:57.213748932 CET	46776	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:57.213748932 CET	46776	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:57.213748932 CET	46778	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:57.333869934 CET	3778	46778	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:57.333997965 CET	46778	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:57.333997965 CET	46778	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:57.454119921 CET	3778	46778	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:57.454309940 CET	46778	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:57.577069998 CET	3778	46778	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:58.689101934 CET	3778	46778	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:58.689419985 CET	46780	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:58.689461946 CET	46778	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:58.689462900 CET	46778	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:58.809323072 CET	3778	46780	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:58.809482098 CET	46780	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:58.809540987 CET	46780	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:58.929367065 CET	3778	46780	89.169.4.44	192.168.2.14
Dec 16, 2024 08:57:58.929495096 CET	46780	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:57:59.049382925 CET	3778	46780	89.169.4.44	192.168.2.14
Dec 16, 2024 08:58:00.132011890 CET	3778	46780	89.169.4.44	192.168.2.14
Dec 16, 2024 08:58:00.132376909 CET	46780	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:58:00.132376909 CET	46780	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:58:00.132478952 CET	46782	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:58:00.252397060 CET	3778	46782	89.169.4.44	192.168.2.14
Dec 16, 2024 08:58:00.252623081 CET	46782	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:58:00.252624035 CET	46782	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:58:00.372874975 CET	3778	46782	89.169.4.44	192.168.2.14
Dec 16, 2024 08:58:00.372987986 CET	46782	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:58:00.493565083 CET	3778	46782	89.169.4.44	192.168.2.14
Dec 16, 2024 08:58:01.579849005 CET	3778	46782	89.169.4.44	192.168.2.14
Dec 16, 2024 08:58:01.579977989 CET	46782	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:58:01.579977989 CET	46782	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:58:01.580039024 CET	46784	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:58:01.699918985 CET	3778	46784	89.169.4.44	192.168.2.14
Dec 16, 2024 08:58:01.700011015 CET	46784	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:58:01.700048923 CET	46784	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:58:01.819822073 CET	3778	46784	89.169.4.44	192.168.2.14
Dec 16, 2024 08:58:01.819900990 CET	46784	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:58:01.940069914 CET	3778	46784	89.169.4.44	192.168.2.14
Dec 16, 2024 08:58:11.709662914 CET	46784	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:58:11.829763889 CET	3778	46784	89.169.4.44	192.168.2.14
Dec 16, 2024 08:58:12.142697096 CET	3778	46784	89.169.4.44	192.168.2.14
Dec 16, 2024 08:58:12.142873049 CET	46784	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:58:57.252167940 CET	46764	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:58:57.372087002 CET	3778	46764	89.169.4.44	192.168.2.14
Dec 16, 2024 08:58:57.685034037 CET	3778	46764	89.169.4.44	192.168.2.14
Dec 16, 2024 08:58:57.685375929 CET	46764	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:59:12.198971033 CET	46784	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 08:59:12.319608927 CET	3778	46784	89.169.4.44	192.168.2.14
Dec 16, 2024 08:59:12.632472038 CET	3778	46784	89.169.4.44	192.168.2.14
Dec 16, 2024 08:59:12.632834911 CET	46784	3778	192.168.2.14	89.169.4.44

System Behavior

Analysis Process: Space.x86.elf PID: 5566, Parent PID: 5487

General

Start time (UTC):	07:57:19
Start date (UTC):	16/12/2024
Path:	/tmp/Space.x86.elf
Arguments:	/tmp/Space.x86.elf
File size:	34896 bytes
MD5 hash:	7fd15b25eadc2d7f94f4124546174e50

Chronological Activities

Analysis Process: Space.x86.elf PID: 5567, Parent PID: 5566

General

Start time (UTC):	07:57:19
Start date (UTC):	16/12/2024
Path:	/tmp/Space.x86.elf
Arguments:	-
File size:	34896 bytes
MD5 hash:	7fd15b25eadc2d7f94f4124546174e50

Chronological Activities

Analysis Process: Space.x86.elf PID: 5568, Parent PID: 5567

General

Start time (UTC):	07:57:19
Start date (UTC):	16/12/2024
Path:	/tmp/Space.x86.elf
Arguments:	-
File size:	34896 bytes
MD5 hash:	7fd15b25eadc2d7f94f4124546174e50

Chronological Activities

Analysis Process: Space.x86.elf PID: 5569, Parent PID: 5567

General

Start time (UTC):	07:57:19
Start date (UTC):	16/12/2024
Path:	/tmp/Space.x86.elf
Arguments:	-
File size:	34896 bytes
MD5 hash:	7fd15b25eadc2d7f94f4124546174e50

Analysis Process: Space.x86.elf PID: 5574, Parent PID: 5566

General

Start time (UTC):	07:57:25
Start date (UTC):	16/12/2024
Path:	/tmp/Space.x86.elf
Arguments:	-
File size:	34896 bytes
MD5 hash:	7fd15b25eadc2d7f94f4124546174e50

Chronological Activities

Analysis Process: Space.x86.elf PID: 5575, Parent PID: 5566

General

Start time (UTC):	07:57:25
Start date (UTC):	16/12/2024
Path:	/tmp/Space.x86.elf
Arguments:	-
File size:	34896 bytes
MD5 hash:	7fd15b25eadc2d7f94f4124546174e50

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Space.x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: Space.x86.elf PID: 5566, Parent PID: 5487

General

Chronological Activities

Analysis Process: Space.x86.elf PID: 5567, Parent PID: 5566

General

Chronological Activities

Analysis Process: Space.x86.elf PID: 5568, Parent PID: 5567

General

Chronological Activities

Analysis Process: Space.x86.elf PID: 5569, Parent PID: 5567

General

Analysis Process: Space.x86.elf PID: 5574, Parent PID: 5566

General

Chronological Activities

Analysis Process: Space.x86.elf PID: 5575, Parent PID: 5566

General

Linux Analysis Report
Space.x86.elf