Edit tour

Linux Analysis Report
Space.spc.elf

Overview

General Information

Sample name:	Space.spc.elf
Analysis ID:	1575721
MD5:	16221739200082e2067e721d9877a254
SHA1:	14c5591cda6d9bc274274f75e4acd3f7104d7779
SHA256:	8f863596a5cfcc5b800925a5b2c89bada6276f01886e25ec274d7ee73f7d5ed4
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575721
Start date and time:	2024-12-16 09:00:36 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Space.spc.elf
Detection:	MAL
Classification:	mal72.troj.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/Space.spc.elf
PID:	5567
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

Space.spc.elf (PID: 5567, Parent: 5484, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/Space.spc.elf

Space.spc.elf New Fork (PID: 5569, Parent: 5567)

Space.spc.elf New Fork (PID: 5571, Parent: 5569)

Space.spc.elf New Fork (PID: 5572, Parent: 5569)

Space.spc.elf New Fork (PID: 5575, Parent: 5567)

Space.spc.elf New Fork (PID: 5576, Parent: 5567)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Space.spc.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Space.spc.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x106b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10708:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1071c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10730:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10744:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10758:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1076c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10780:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10794:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1080c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10820:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10834:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10848:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5571.1.00007f19e8011000.00007f19e8025000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5571.1.00007f19e8011000.00007f19e8025000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x106b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10708:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1071c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10730:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10744:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10758:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1076c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10780:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10794:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1080c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10820:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10834:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10848:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5567.1.00007f19e8011000.00007f19e8025000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5567.1.00007f19e8011000.00007f19e8025000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x106b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10708:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1071c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10730:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10744:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10758:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1076c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10780:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10794:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1080c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10820:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10834:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10848:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5569.1.00007f19e8011000.00007f19e8025000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5569.1.00007f19e8011000.00007f19e8025000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x106b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10708:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1071c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10730:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10744:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10758:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1076c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10780:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10794:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1080c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10820:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10834:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10848:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5575.1.00007f19e8011000.00007f19e8025000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5575.1.00007f19e8011000.00007f19e8025000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x106b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10708:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1071c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10730:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10744:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10758:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1076c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10780:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10794:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1080c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10820:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10834:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10848:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.spc.elf PID: 5567	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.spc.elf PID: 5567	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x76d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x76e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x76fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7711:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7725:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7739:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x774d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7761:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7775:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7789:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x779d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x77b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x77c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x77d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x77ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7801:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7815:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7829:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x783d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7851:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7865:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.spc.elf PID: 5569	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.spc.elf PID: 5569	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2444:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2458:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x246c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2480:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2494:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x250c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2520:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2534:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2548:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x255c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2570:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2584:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2598:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.spc.elf PID: 5571	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.spc.elf PID: 5571	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x7e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x80c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x820:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x834:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x848:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x85c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x870:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x884:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x898:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x910:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x924:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x938:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x94c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x960:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x974:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.spc.elf PID: 5575	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.spc.elf PID: 5575	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x8bae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8bc2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8bd6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8bea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8bfe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c12:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8cb2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8cc6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8cda:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8cee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8d02:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8d16:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8d2a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8d3e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 11 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Space.spc.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: Space.spc.elf	ReversingLabs: Detection: 65%
Source: Space.spc.elf	Virustotal: Detection: 60%			Perma Link

Source: global traffic

TCP traffic: 192.168.2.14:46698 -> 89.169.4.44:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44

System Summary

Malicious sample detected (through community Yara rule)

Source: Space.spc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5571.1.00007f19e8011000.00007f19e8025000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5567.1.00007f19e8011000.00007f19e8025000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5569.1.00007f19e8011000.00007f19e8025000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5575.1.00007f19e8011000.00007f19e8025000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.spc.elf PID: 5567, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.spc.elf PID: 5569, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.spc.elf PID: 5571, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.spc.elf PID: 5575, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: /proc/net/tcp/proc/proc/%d/exe/proc/%s/statusrName:%s/bin/busybox/bin/systemd/usr/bintest/tmp/condi/tmp/zxcr9999/tmp/condinetwork/var/condibot/var/zxcr9999/var/CondiBot/var/condinet/bin/watchdog.x86.x86_64.arm.arm5.arm6.arm7.mips.mipsel.sh4.ppc89.169.4.44

Source: ELF static info symbol of initial sample

.symtab present: no

Source: Space.spc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5571.1.00007f19e8011000.00007f19e8025000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5567.1.00007f19e8011000.00007f19e8025000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5569.1.00007f19e8011000.00007f19e8025000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5575.1.00007f19e8011000.00007f19e8025000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.spc.elf PID: 5567, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.spc.elf PID: 5569, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.spc.elf PID: 5571, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.spc.elf PID: 5575, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal72.troj.linELF@0/0@0/0

Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/3760/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/3761/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/1583/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/2672/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/3759/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/1577/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/917/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/19/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/1593/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/240/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/3094/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/242/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/3406/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/244/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/1589/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/245/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/1588/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/246/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/3402/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/5/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/247/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/7/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/8/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/129/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/3762/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/801/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/803/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/806/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/807/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/928/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/3420/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/490/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/131/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/135/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/1599/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/378/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/3412/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/1371/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/260/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/261/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 5567)	File opened: /proc/262/status	Jump to behavior

Source: /tmp/Space.spc.elf (PID: 5567)

Queries kernel information via 'uname':

Jump to behavior

Source: Space.spc.elf, 5567.1.0000558c03e91000.0000558c03f16000.rw-.sdmp, Space.spc.elf, 5569.1.0000558c03e91000.0000558c03f16000.rw-.sdmp, Space.spc.elf, 5571.1.0000558c03e91000.0000558c03f16000.rw-.sdmp, Space.spc.elf, 5575.1.0000558c03e91000.0000558c03f16000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: Space.spc.elf, 5567.1.0000558c03e91000.0000558c03f16000.rw-.sdmp, Space.spc.elf, 5569.1.0000558c03e91000.0000558c03f16000.rw-.sdmp, Space.spc.elf, 5571.1.0000558c03e91000.0000558c03f16000.rw-.sdmp, Space.spc.elf, 5575.1.0000558c03e91000.0000558c03f16000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: Space.spc.elf, 5567.1.00007fff550bc000.00007fff550dd000.rw-.sdmp, Space.spc.elf, 5569.1.00007fff550bc000.00007fff550dd000.rw-.sdmp, Space.spc.elf, 5571.1.00007fff550bc000.00007fff550dd000.rw-.sdmp, Space.spc.elf, 5575.1.00007fff550bc000.00007fff550dd000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/Space.spc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Space.spc.elf
Source: Space.spc.elf, 5567.1.00007fff550bc000.00007fff550dd000.rw-.sdmp, Space.spc.elf, 5569.1.00007fff550bc000.00007fff550dd000.rw-.sdmp, Space.spc.elf, 5571.1.00007fff550bc000.00007fff550dd000.rw-.sdmp, Space.spc.elf, 5575.1.00007fff550bc000.00007fff550dd000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: Space.spc.elf, type: SAMPLE
Source: Yara match	File source: 5571.1.00007f19e8011000.00007f19e8025000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5567.1.00007f19e8011000.00007f19e8025000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5569.1.00007f19e8011000.00007f19e8025000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5575.1.00007f19e8011000.00007f19e8025000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Space.spc.elf PID: 5567, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.spc.elf PID: 5569, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.spc.elf PID: 5571, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.spc.elf PID: 5575, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: Space.spc.elf, type: SAMPLE
Source: Yara match	File source: 5571.1.00007f19e8011000.00007f19e8025000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5567.1.00007f19e8011000.00007f19e8025000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5569.1.00007f19e8011000.00007f19e8025000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5575.1.00007f19e8011000.00007f19e8025000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Space.spc.elf PID: 5567, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.spc.elf PID: 5569, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.spc.elf PID: 5571, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.spc.elf PID: 5575, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Space.spc.elf	66%	ReversingLabs	Linux.Trojan.Mirai
Space.spc.elf	60%	Virustotal		Browse
Space.spc.elf	100%	Avira	LINUX/Mirai.bonb

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.169.4.44	unknown	Russian Federation		31514	INF-NET-ASRU	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
89.169.4.44	Space.x86_64.elf	Get hash	malicious	Mirai	Browse
	Space.mips.elf	Get hash	malicious	Mirai	Browse
	Space.x86.elf	Get hash	malicious	Mirai	Browse
	Space.arm.elf	Get hash	malicious	Mirai	Browse
	Space.sh4.elf	Get hash	malicious	Mirai	Browse
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INF-NET-ASRU	Space.x86_64.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	Space.mips.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	Space.x86.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	Space.arm.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	Space.sh4.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	jade.m68k.elf	Get hash	malicious	Mirai	Browse	89.169.156.74
	https://santa-secret.ru/api/verify?a=NjgyODEwNCw1bWluOHE2MHpuX3J1LC9hY2NvdW50L2JveGVzLHZsYWRpbWlyLmdsdXNoZW5rb0Bob2NobGFuZC5ydSwyNDE0MTYzMg==	Get hash	malicious	Unknown	Browse	87.228.10.139
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	89.169.4.44

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.203998137755792
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Space.spc.elf
File size:	80'032 bytes
MD5:	16221739200082e2067e721d9877a254
SHA1:	14c5591cda6d9bc274274f75e4acd3f7104d7779
SHA256:	8f863596a5cfcc5b800925a5b2c89bada6276f01886e25ec274d7ee73f7d5ed4
SHA512:	c01af6ab23b4d927498cc7af19017a64c16bf0dc77c6756962ceeae7188b1197ef48c273ae949ac8c67e443b196e7a57247d65ae3bf5d2bbb425b76b25707ab4
SSDEEP:	1536:U2kN6QCXbqt5guvvF7tR7SYm5BHxS1H1tTIfT:HhilL7SYOBR2IfT
TLSH:	AF734B31F939092BC0D4917A61F74723B5F287CA20A8861F3E720F9DBF615403A57AB9
File Content Preview:	.ELF...........................4..7......4. ...(......................3X..3X..............3\..3\..3\...t..).........dt.Q................................@..(....@.A+................#.....b...`.....!.....#t..@.....".........`......$#t..#t..@...........`....

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101a4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	79632
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	4
.text	PROGBITS	0x100b0	0xb0	0x104e4	0x0	0x6	AX	4
.fini	PROGBITS	0x20594	0x10594	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x205a8	0x105a8	0x2db0	0x0	0x2	A	8
.ctors	PROGBITS	0x3335c	0x1335c	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x33364	0x13364	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x33370	0x13370	0x360	0x0	0x3	WA	8
.bss	NOBITS	0x336d0	0x136d0	0x2628	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0x136d0	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0x13358	0x13358	6.2364	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x1335c	0x3335c	0x3335c	0x374	0x299c	2.7137	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 09:01:40.109541893 CET	46698	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:40.229481936 CET	3778	46698	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:40.229609966 CET	46698	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:40.249722958 CET	46698	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:40.369469881 CET	3778	46698	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:40.369524002 CET	46698	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:40.489244938 CET	3778	46698	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:41.470863104 CET	46700	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:41.554150105 CET	3778	46698	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:41.554228067 CET	46698	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:41.554512024 CET	46698	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:41.568370104 CET	46702	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:41.590697050 CET	3778	46700	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:41.590795040 CET	46700	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:41.603605986 CET	46700	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:41.688098907 CET	3778	46702	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:41.688215971 CET	46702	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:41.696715117 CET	46702	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:41.723345041 CET	3778	46700	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:41.723434925 CET	46700	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:41.816546917 CET	3778	46702	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:41.816615105 CET	46702	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:41.843499899 CET	3778	46700	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:41.936384916 CET	3778	46702	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:42.916848898 CET	3778	46700	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:42.917016029 CET	46700	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:42.917356968 CET	46700	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:42.918273926 CET	46704	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:43.037818909 CET	3778	46702	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:43.037976980 CET	3778	46704	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:43.038012028 CET	46702	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:43.038058996 CET	46704	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:43.038158894 CET	46702	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:43.039382935 CET	46706	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:43.040177107 CET	46704	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:43.159080029 CET	3778	46706	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:43.159250975 CET	46706	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:43.159809113 CET	3778	46704	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:43.159858942 CET	46704	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:43.160429001 CET	46706	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:43.279500008 CET	3778	46704	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:43.280061007 CET	3778	46706	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:43.280139923 CET	46706	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:43.399760962 CET	3778	46706	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:44.479142904 CET	3778	46706	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:44.479334116 CET	46706	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:44.479381084 CET	46706	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:44.480037928 CET	46708	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:44.602011919 CET	3778	46708	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:44.602279902 CET	46708	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:44.603022099 CET	46708	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:44.722680092 CET	3778	46708	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:44.722877026 CET	46708	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:44.842601061 CET	3778	46708	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:45.927449942 CET	3778	46708	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:45.927747965 CET	46708	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:45.927747965 CET	46708	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:45.928250074 CET	46710	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:46.048409939 CET	3778	46710	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:46.048643112 CET	46710	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:46.049575090 CET	46710	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:46.169480085 CET	3778	46710	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:46.169698000 CET	46710	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:46.289443016 CET	3778	46710	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:47.385819912 CET	3778	46710	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:47.386204958 CET	46710	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:47.386288881 CET	46710	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:47.386846066 CET	46712	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:47.506608963 CET	3778	46712	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:47.506863117 CET	46712	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:47.507790089 CET	46712	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:47.627660990 CET	3778	46712	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:47.627778053 CET	46712	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:47.747540951 CET	3778	46712	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:48.829063892 CET	3778	46712	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:48.829319000 CET	46712	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:48.829319000 CET	46712	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:48.830284119 CET	46714	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:48.949929953 CET	3778	46714	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:48.950372934 CET	46714	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:48.951591015 CET	46714	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:49.071258068 CET	3778	46714	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:49.071511030 CET	46714	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:49.191390038 CET	3778	46714	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:50.276829004 CET	3778	46714	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:50.277129889 CET	46714	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:50.277160883 CET	46714	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:50.278192997 CET	46716	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:50.397989035 CET	3778	46716	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:50.398113012 CET	46716	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:50.399986982 CET	46716	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:50.519762993 CET	3778	46716	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:50.519897938 CET	46716	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:50.640669107 CET	3778	46716	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:51.729559898 CET	3778	46716	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:51.729724884 CET	46716	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:51.729747057 CET	46716	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:51.730329990 CET	46718	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:51.850207090 CET	3778	46718	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:51.850378990 CET	46718	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:51.856224060 CET	46718	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:51.976164103 CET	3778	46718	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:51.976298094 CET	46718	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:52.096194983 CET	3778	46718	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:53.049958944 CET	46704	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:53.169732094 CET	3778	46704	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:53.175647020 CET	3778	46718	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:53.175786018 CET	46718	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:53.175786018 CET	46718	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:53.176461935 CET	46720	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:53.296984911 CET	3778	46720	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:53.297303915 CET	46720	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:53.298386097 CET	46720	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:53.418032885 CET	3778	46720	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:53.418128967 CET	46720	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:53.481719017 CET	3778	46704	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:53.481931925 CET	46704	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:53.537837029 CET	3778	46720	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:54.627546072 CET	3778	46720	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:54.627804041 CET	46720	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:54.627804041 CET	46720	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:54.628257990 CET	46722	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:54.747977018 CET	3778	46722	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:54.748136997 CET	46722	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:54.749203920 CET	46722	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:55.133797884 CET	3778	46722	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:55.134001970 CET	46722	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:55.253618956 CET	3778	46722	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:56.084079027 CET	3778	46722	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:56.084208012 CET	46722	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:56.084450006 CET	46722	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:56.085447073 CET	46724	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:56.205178022 CET	3778	46724	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:56.205436945 CET	46724	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:56.206767082 CET	46724	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:56.326375008 CET	3778	46724	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:56.326566935 CET	46724	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:56.446300030 CET	3778	46724	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:57.529200077 CET	3778	46724	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:57.529309034 CET	46724	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:57.529347897 CET	46724	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:57.530169964 CET	46726	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:57.649810076 CET	3778	46726	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:57.649966955 CET	46726	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:57.654743910 CET	46726	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:57.774442911 CET	3778	46726	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:57.774538994 CET	46726	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:57.894270897 CET	3778	46726	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:58.972830057 CET	3778	46726	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:58.972939968 CET	46726	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:58.972979069 CET	46726	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:58.973839998 CET	46728	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:59.094094038 CET	3778	46728	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:59.094322920 CET	46728	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:59.096028090 CET	46728	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:59.215977907 CET	3778	46728	89.169.4.44	192.168.2.14
Dec 16, 2024 09:01:59.216141939 CET	46728	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:01:59.335855961 CET	3778	46728	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:00.421940088 CET	3778	46728	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:00.422091961 CET	46728	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:00.422133923 CET	46728	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:00.423125982 CET	46730	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:00.542906046 CET	3778	46730	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:00.543175936 CET	46730	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:00.544781923 CET	46730	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:00.664499044 CET	3778	46730	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:00.664720058 CET	46730	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:00.784421921 CET	3778	46730	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:01.870358944 CET	3778	46730	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:01.870485067 CET	46730	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:01.870544910 CET	46730	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:01.871320963 CET	46732	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:01.991044998 CET	3778	46732	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:01.991158009 CET	46732	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:01.992760897 CET	46732	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:02.112468004 CET	3778	46732	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:02.112606049 CET	46732	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:02.232316017 CET	3778	46732	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:03.315192938 CET	3778	46732	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:03.315304995 CET	46732	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:03.315346003 CET	46732	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:03.316250086 CET	46734	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:03.435940981 CET	3778	46734	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:03.436079025 CET	46734	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:03.436973095 CET	46734	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:03.556654930 CET	3778	46734	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:03.556770086 CET	46734	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:03.677371979 CET	3778	46734	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:04.759680033 CET	3778	46734	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:04.759793043 CET	46734	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:04.759902000 CET	46734	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:04.760819912 CET	46736	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:04.880656958 CET	3778	46736	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:04.880768061 CET	46736	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:04.882458925 CET	46736	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:05.002173901 CET	3778	46736	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:05.002295971 CET	46736	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:05.122100115 CET	3778	46736	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:06.219890118 CET	3778	46736	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:06.219995975 CET	46736	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:06.220094919 CET	46736	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:06.221489906 CET	46738	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:06.341350079 CET	3778	46738	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:06.341519117 CET	46738	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:06.343692064 CET	46738	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:06.544540882 CET	3778	46738	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:06.544676065 CET	46738	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:06.664908886 CET	3778	46738	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:07.667375088 CET	3778	46738	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:07.667454958 CET	46738	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:07.667527914 CET	46738	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:07.669497967 CET	46740	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:07.789589882 CET	3778	46740	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:07.789731979 CET	46740	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:07.791234970 CET	46740	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:07.910976887 CET	3778	46740	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:07.911087036 CET	46740	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:08.031155109 CET	3778	46740	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:09.113528013 CET	3778	46740	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:09.113739014 CET	46740	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:09.113739014 CET	46740	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:09.114556074 CET	46742	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:09.234328985 CET	3778	46742	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:09.234489918 CET	46742	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:09.235280037 CET	46742	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:09.354973078 CET	3778	46742	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:09.355189085 CET	46742	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:09.475083113 CET	3778	46742	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:10.558578968 CET	3778	46742	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:10.558684111 CET	46742	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:10.558752060 CET	46742	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:10.559272051 CET	46744	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:10.679008961 CET	3778	46744	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:10.679114103 CET	46744	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:10.680476904 CET	46744	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:10.800182104 CET	3778	46744	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:10.800378084 CET	46744	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:10.920433044 CET	3778	46744	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:12.003266096 CET	3778	46744	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:12.003376007 CET	46744	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:12.003556967 CET	46744	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:12.004003048 CET	46746	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:12.123703957 CET	3778	46746	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:12.123811960 CET	46746	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:12.124994040 CET	46746	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:12.245008945 CET	3778	46746	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:12.245105028 CET	46746	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:12.365017891 CET	3778	46746	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:13.449034929 CET	3778	46746	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:13.449150085 CET	46746	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:13.449189901 CET	46746	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:13.450010061 CET	46748	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:13.569832087 CET	3778	46748	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:13.570055008 CET	46748	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:13.570849895 CET	46748	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:13.690620899 CET	3778	46748	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:13.690833092 CET	46748	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:13.810688972 CET	3778	46748	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:14.903567076 CET	3778	46748	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:14.903693914 CET	46748	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:14.903693914 CET	46748	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:14.904844046 CET	46750	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:15.024619102 CET	3778	46750	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:15.024822950 CET	46750	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:15.025553942 CET	46750	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:15.145355940 CET	3778	46750	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:15.145539999 CET	46750	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:15.265338898 CET	3778	46750	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:16.350131989 CET	3778	46750	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:16.350310087 CET	46750	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:16.350404978 CET	46750	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:16.351429939 CET	46752	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:16.471410990 CET	3778	46752	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:16.471539021 CET	46752	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:16.472548962 CET	46752	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:16.592359066 CET	3778	46752	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:16.592469931 CET	46752	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:16.712346077 CET	3778	46752	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:17.795667887 CET	3778	46752	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:17.795856953 CET	46752	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:17.795941114 CET	46752	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:17.796703100 CET	46754	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:17.916508913 CET	3778	46754	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:17.916841984 CET	46754	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:17.918437004 CET	46754	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:18.038168907 CET	3778	46754	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:18.038382053 CET	46754	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:18.158201933 CET	3778	46754	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:19.262814999 CET	3778	46754	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:19.262998104 CET	46754	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:19.263093948 CET	46754	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:19.264022112 CET	46756	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:19.383857965 CET	3778	46756	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:19.383996010 CET	46756	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:19.385047913 CET	46756	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:19.504856110 CET	3778	46756	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:19.505155087 CET	46756	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:19.625037909 CET	3778	46756	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:20.709882021 CET	3778	46756	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:20.710105896 CET	46756	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:20.710150003 CET	46756	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:20.710695982 CET	46758	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:20.830501080 CET	3778	46758	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:20.830764055 CET	46758	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:20.832905054 CET	46758	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:20.952673912 CET	3778	46758	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:20.952858925 CET	46758	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:21.072588921 CET	3778	46758	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:22.153191090 CET	3778	46758	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:22.153400898 CET	46758	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:22.153513908 CET	46758	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:22.154177904 CET	46760	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:22.273941040 CET	3778	46760	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:22.274079084 CET	46760	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:22.275213957 CET	46760	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:22.395013094 CET	3778	46760	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:22.395144939 CET	46760	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:22.515692949 CET	3778	46760	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:23.601519108 CET	3778	46760	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:23.601713896 CET	46760	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:23.601778030 CET	46760	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:23.602494001 CET	46762	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:23.722417116 CET	3778	46762	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:23.722558022 CET	46762	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:23.723824024 CET	46762	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:23.843658924 CET	3778	46762	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:23.843949080 CET	46762	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:23.963888884 CET	3778	46762	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:25.046551943 CET	3778	46762	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:25.046710014 CET	46762	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:25.046744108 CET	46762	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:25.047473907 CET	46764	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:25.167211056 CET	3778	46764	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:25.167279959 CET	46764	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:26.047846079 CET	46764	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:26.167938948 CET	3778	46764	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:26.168140888 CET	46764	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:26.169629097 CET	46764	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:26.289376974 CET	3778	46764	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:26.289649963 CET	46764	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:26.409336090 CET	3778	46764	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:27.488521099 CET	3778	46764	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:27.488842964 CET	46764	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:27.488920927 CET	46764	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:27.489837885 CET	46766	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:27.609575987 CET	3778	46766	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:27.609719992 CET	46766	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:27.611756086 CET	46766	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:27.731646061 CET	3778	46766	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:27.731749058 CET	46766	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:27.851448059 CET	3778	46766	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:28.933011055 CET	3778	46766	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:28.933235884 CET	46766	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:28.933306932 CET	46766	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:28.934320927 CET	46768	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:29.054176092 CET	3778	46768	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:29.054419994 CET	46768	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:29.055680990 CET	46768	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:29.175431967 CET	3778	46768	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:29.175586939 CET	46768	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:29.295377970 CET	3778	46768	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:30.377429008 CET	3778	46768	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:30.377567053 CET	46768	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:30.377595901 CET	46768	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:30.378067017 CET	46770	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:30.497773886 CET	3778	46770	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:30.498018980 CET	46770	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:30.499201059 CET	46770	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:30.618901014 CET	3778	46770	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:30.619046926 CET	46770	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:30.738867044 CET	3778	46770	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:31.820497990 CET	3778	46770	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:31.820702076 CET	46770	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:31.820794106 CET	46770	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:31.821645021 CET	46772	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:31.941402912 CET	3778	46772	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:31.941601992 CET	46772	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:31.943557024 CET	46772	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:32.063399076 CET	3778	46772	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:32.063604116 CET	46772	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:32.183557034 CET	3778	46772	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:33.263730049 CET	3778	46772	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:33.263912916 CET	46772	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:33.263959885 CET	46772	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:33.264725924 CET	46774	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:33.384632111 CET	3778	46774	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:33.384726048 CET	46774	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:33.385776997 CET	46774	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:33.505510092 CET	3778	46774	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:33.505601883 CET	46774	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:33.625364065 CET	3778	46774	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:34.711065054 CET	3778	46774	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:34.711163044 CET	46774	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:34.711210012 CET	46774	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:34.711725950 CET	46776	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:34.831389904 CET	3778	46776	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:34.831675053 CET	46776	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:34.832623005 CET	46776	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:34.952296019 CET	3778	46776	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:34.952445984 CET	46776	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:35.072056055 CET	3778	46776	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:36.153677940 CET	3778	46776	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:36.153951883 CET	46776	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:36.153987885 CET	46776	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:36.154499054 CET	46778	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:36.274439096 CET	3778	46778	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:36.274643898 CET	46778	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:36.276356936 CET	46778	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:36.395987034 CET	3778	46778	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:36.396184921 CET	46778	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:36.516024113 CET	3778	46778	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:37.598853111 CET	3778	46778	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:37.599035978 CET	46778	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:37.599112034 CET	46778	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:37.599786043 CET	46780	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:37.719799042 CET	3778	46780	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:37.720124006 CET	46780	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:37.721473932 CET	46780	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:37.841275930 CET	3778	46780	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:37.841543913 CET	46780	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:37.961402893 CET	3778	46780	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:39.041745901 CET	3778	46780	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:39.041964054 CET	46780	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:39.041964054 CET	46780	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:39.042349100 CET	46782	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:39.162271023 CET	3778	46782	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:39.162601948 CET	46782	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:39.163815022 CET	46782	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:39.283731937 CET	3778	46782	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:39.284030914 CET	46782	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:39.403750896 CET	3778	46782	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:40.483798981 CET	3778	46782	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:40.484096050 CET	46782	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:40.484096050 CET	46782	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:40.484569073 CET	46784	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:40.604357958 CET	3778	46784	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:40.604578972 CET	46784	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:41.503093958 CET	46784	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:41.622900963 CET	3778	46784	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:41.623111963 CET	46784	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:41.624505997 CET	46784	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:41.744287968 CET	3778	46784	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:41.744411945 CET	46784	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:41.864249945 CET	3778	46784	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:42.943167925 CET	3778	46784	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:42.943475962 CET	46784	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:42.943542957 CET	46784	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:42.944766998 CET	46786	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:43.064449072 CET	3778	46786	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:43.064819098 CET	46786	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:43.066551924 CET	46786	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:43.186242104 CET	3778	46786	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:43.186558008 CET	46786	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:43.306327105 CET	3778	46786	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:53.076423883 CET	46786	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:53.196302891 CET	3778	46786	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:53.508721113 CET	3778	46786	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:53.508872032 CET	46786	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:53.522234917 CET	46704	3778	192.168.2.14	89.169.4.44
Dec 16, 2024 09:02:53.642024040 CET	3778	46704	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:53.954034090 CET	3778	46704	89.169.4.44	192.168.2.14
Dec 16, 2024 09:02:53.954206944 CET	46704	3778	192.168.2.14	89.169.4.44

System Behavior

Analysis Process: Space.spc.elf PID: 5567, Parent PID: 5484

General

Start time (UTC):	08:01:39
Start date (UTC):	16/12/2024
Path:	/tmp/Space.spc.elf
Arguments:	/tmp/Space.spc.elf
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: Space.spc.elf PID: 5569, Parent PID: 5567

General

Start time (UTC):	08:01:39
Start date (UTC):	16/12/2024
Path:	/tmp/Space.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: Space.spc.elf PID: 5571, Parent PID: 5569

General

Start time (UTC):	08:01:39
Start date (UTC):	16/12/2024
Path:	/tmp/Space.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: Space.spc.elf PID: 5572, Parent PID: 5569

General

Start time (UTC):	08:01:39
Start date (UTC):	16/12/2024
Path:	/tmp/Space.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: Space.spc.elf PID: 5575, Parent PID: 5567

General

Start time (UTC):	08:01:40
Start date (UTC):	16/12/2024
Path:	/tmp/Space.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: Space.spc.elf PID: 5576, Parent PID: 5567

General

Start time (UTC):	08:01:40
Start date (UTC):	16/12/2024
Path:	/tmp/Space.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Space.spc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: Space.spc.elf PID: 5567, Parent PID: 5484

General

Chronological Activities

Analysis Process: Space.spc.elf PID: 5569, Parent PID: 5567

General

Chronological Activities

Analysis Process: Space.spc.elf PID: 5571, Parent PID: 5569

General

Chronological Activities

Analysis Process: Space.spc.elf PID: 5572, Parent PID: 5569

General

Chronological Activities

Analysis Process: Space.spc.elf PID: 5575, Parent PID: 5567

General

Chronological Activities

Analysis Process: Space.spc.elf PID: 5576, Parent PID: 5567

General

Chronological Activities

Linux Analysis Report
Space.spc.elf