Edit tour

Linux Analysis Report
Space.i686.elf

Overview

General Information

Sample name:	Space.i686.elf
Analysis ID:	1575723
MD5:	a56e91b6fcccccac6af83d4b96c2d3ed
SHA1:	60b057a4285c39228b11e854362fd312fac1b94c
SHA256:	78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Machine Learning detection for sample

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575723
Start date and time:	2024-12-16 09:00:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Space.i686.elf
Detection:	MAL
Classification:	mal72.troj.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/Space.i686.elf
PID:	6259
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

Space.i686.elf (PID: 6259, Parent: 6185, MD5: a56e91b6fcccccac6af83d4b96c2d3ed) Arguments: /tmp/Space.i686.elf

Space.i686.elf New Fork (PID: 6260, Parent: 6259)

Space.i686.elf New Fork (PID: 6261, Parent: 6260)

Space.i686.elf New Fork (PID: 6262, Parent: 6260)

Space.i686.elf New Fork (PID: 6265, Parent: 6259)

Space.i686.elf New Fork (PID: 6266, Parent: 6259)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
6260.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6260.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xec14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeda4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6260.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x531f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
6260.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x52d2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
6260.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x63ed:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x646d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
6260.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_485c4b13	unknown	unknown	0xb08:$a: 7E 1F 8B 4C 24 4C 01 D1 0F B6 11 88 D0 2C 61 3C 19 77 05 80
6260.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_7d05725e	unknown	unknown	0xa7e:$a: 24 97 00 00 00 89 6C 24 08 89 74 24 04 89 14 24 0F B7 C0 89 44
6260.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
6260.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0d73971c	unknown	unknown	0x6292:$a: 89 C2 83 EB 04 C1 E2 0B 31 C2 89 F0 C1 E8 13 89 D1 31 F0 C1
6260.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x8282:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6260.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xa2b1:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6261.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6261.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xec14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeda4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6261.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x531f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
6261.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x52d2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
6261.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x63ed:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x646d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
6261.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_485c4b13	unknown	unknown	0xb08:$a: 7E 1F 8B 4C 24 4C 01 D1 0F B6 11 88 D0 2C 61 3C 19 77 05 80
6261.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_7d05725e	unknown	unknown	0xa7e:$a: 24 97 00 00 00 89 6C 24 08 89 74 24 04 89 14 24 0F B7 C0 89 44
6261.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
6261.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0d73971c	unknown	unknown	0x6292:$a: 89 C2 83 EB 04 C1 E2 0B 31 C2 89 F0 C1 E8 13 89 D1 31 F0 C1
6261.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x8282:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6261.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xa2b1:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6265.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6265.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xec14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeda4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6265.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x531f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
6265.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x52d2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
6265.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x63ed:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x646d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
6265.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_485c4b13	unknown	unknown	0xb08:$a: 7E 1F 8B 4C 24 4C 01 D1 0F B6 11 88 D0 2C 61 3C 19 77 05 80
6265.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_7d05725e	unknown	unknown	0xa7e:$a: 24 97 00 00 00 89 6C 24 08 89 74 24 04 89 14 24 0F B7 C0 89 44
6265.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
6265.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0d73971c	unknown	unknown	0x6292:$a: 89 C2 83 EB 04 C1 E2 0B 31 C2 89 F0 C1 E8 13 89 D1 31 F0 C1
6265.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x8282:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6265.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xa2b1:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6259.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6259.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xec14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeda4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6259.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x531f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
6259.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x52d2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
6259.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x63ed:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x646d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
6259.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_485c4b13	unknown	unknown	0xb08:$a: 7E 1F 8B 4C 24 4C 01 D1 0F B6 11 88 D0 2C 61 3C 19 77 05 80
6259.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_7d05725e	unknown	unknown	0xa7e:$a: 24 97 00 00 00 89 6C 24 08 89 74 24 04 89 14 24 0F B7 C0 89 44
6259.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
6259.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0d73971c	unknown	unknown	0x6292:$a: 89 C2 83 EB 04 C1 E2 0B 31 C2 89 F0 C1 E8 13 89 D1 31 F0 C1
6259.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x8282:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6259.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xa2b1:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Process Memory Space: Space.i686.elf PID: 6259	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1098:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1110:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1124:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1138:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x114c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1160:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1174:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1188:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x119c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1200:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1214:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1228:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.i686.elf PID: 6260	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.i686.elf PID: 6260	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x85d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x871:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x885:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x899:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x911:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x925:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x939:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x94d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x961:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x975:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x989:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x99d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.i686.elf PID: 6261	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.i686.elf PID: 6261	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x531:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x545:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x559:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x56d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x581:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x595:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5e5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5f9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x621:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x635:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x649:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x65d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x671:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x685:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x699:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.i686.elf PID: 6265	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.i686.elf PID: 6265	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x25f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x273:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x287:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x29b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x313:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x327:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x363:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x377:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 46 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Space.i686.elf	Virustotal: Detection: 46%			Perma Link
Source: Space.i686.elf	ReversingLabs: Detection: 47%

Machine Learning detection for sample

Source: Space.i686.elf

Joe Sandbox ML: detected

Source: global traffic

TCP traffic: 192.168.2.23:50954 -> 89.169.4.44:3778

Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443

Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44

Source: Space.i686.elf

String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 6260.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6260.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 6260.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 6260.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 6260.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 Author: unknown
Source: 6260.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e Author: unknown
Source: 6260.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 6260.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c Author: unknown
Source: 6260.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6260.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6261.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6261.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 6261.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 6261.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 6261.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 Author: unknown
Source: 6261.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e Author: unknown
Source: 6261.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 6261.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c Author: unknown
Source: 6261.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6261.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6265.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6265.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 6265.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 6265.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 6265.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 Author: unknown
Source: 6265.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e Author: unknown
Source: 6265.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 6265.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c Author: unknown
Source: 6265.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6265.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6259.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6259.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 6259.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 6259.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 6259.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 Author: unknown
Source: 6259.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e Author: unknown
Source: 6259.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 6259.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c Author: unknown
Source: 6259.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6259.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: Process Memory Space: Space.i686.elf PID: 6259, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.i686.elf PID: 6260, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.i686.elf PID: 6261, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.i686.elf PID: 6265, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0xc01000

Source: 6260.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6260.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 6260.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 6260.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 6260.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 28f3e8982cee2836a59721c88ee0a9159ad6fdfc27c0091927f5286f3a731e9a, id = 485c4b13-3c7c-47a7-b926-8237cb759ad7, last_modified = 2021-09-16
Source: 6260.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 7fcd34cb7c37836a1fa8eb9375a80da01bda0e98c568422255d83c840acc0714, id = 7d05725e-db59-42a7-99aa-99de79728126, last_modified = 2021-09-16
Source: 6260.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 6260.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 95279bc45936ca867efb30040354c8ff81de31dccda051cfd40b4fb268c228c5, id = 0d73971c-4253-4e7d-b1e1-20b031197f9e, last_modified = 2021-09-16
Source: 6260.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6260.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6261.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6261.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 6261.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 6261.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 6261.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 28f3e8982cee2836a59721c88ee0a9159ad6fdfc27c0091927f5286f3a731e9a, id = 485c4b13-3c7c-47a7-b926-8237cb759ad7, last_modified = 2021-09-16
Source: 6261.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 7fcd34cb7c37836a1fa8eb9375a80da01bda0e98c568422255d83c840acc0714, id = 7d05725e-db59-42a7-99aa-99de79728126, last_modified = 2021-09-16
Source: 6261.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 6261.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 95279bc45936ca867efb30040354c8ff81de31dccda051cfd40b4fb268c228c5, id = 0d73971c-4253-4e7d-b1e1-20b031197f9e, last_modified = 2021-09-16
Source: 6261.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6261.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6265.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6265.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 6265.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 6265.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 6265.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 28f3e8982cee2836a59721c88ee0a9159ad6fdfc27c0091927f5286f3a731e9a, id = 485c4b13-3c7c-47a7-b926-8237cb759ad7, last_modified = 2021-09-16
Source: 6265.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 7fcd34cb7c37836a1fa8eb9375a80da01bda0e98c568422255d83c840acc0714, id = 7d05725e-db59-42a7-99aa-99de79728126, last_modified = 2021-09-16
Source: 6265.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 6265.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 95279bc45936ca867efb30040354c8ff81de31dccda051cfd40b4fb268c228c5, id = 0d73971c-4253-4e7d-b1e1-20b031197f9e, last_modified = 2021-09-16
Source: 6265.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6265.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6259.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6259.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 6259.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 6259.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 6259.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 28f3e8982cee2836a59721c88ee0a9159ad6fdfc27c0091927f5286f3a731e9a, id = 485c4b13-3c7c-47a7-b926-8237cb759ad7, last_modified = 2021-09-16
Source: 6259.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 7fcd34cb7c37836a1fa8eb9375a80da01bda0e98c568422255d83c840acc0714, id = 7d05725e-db59-42a7-99aa-99de79728126, last_modified = 2021-09-16
Source: 6259.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 6259.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 95279bc45936ca867efb30040354c8ff81de31dccda051cfd40b4fb268c228c5, id = 0d73971c-4253-4e7d-b1e1-20b031197f9e, last_modified = 2021-09-16
Source: 6259.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6259.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: Process Memory Space: Space.i686.elf PID: 6259, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.i686.elf PID: 6260, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.i686.elf PID: 6261, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.i686.elf PID: 6265, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal72.troj.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/1582/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/3088/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/5816/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/1579/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/1699/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/1335/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/1698/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/1334/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/1576/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/2302/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/910/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/912/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/2307/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/918/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/6243/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/6244/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/1594/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/1349/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/1344/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/1465/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/1586/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/1463/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/801/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/1900/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/491/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/4509/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/1599/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/1477/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/379/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/1476/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/2208/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/6262/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6259)	File opened: /proc/1809/status	Jump to behavior

Source: Space.i686.elf

Submission file: segment LOAD with 7.9577 entropy (max. 8.0)

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 6260.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6261.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6265.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6259.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Space.i686.elf PID: 6260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.i686.elf PID: 6261, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.i686.elf PID: 6265, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 6260.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6261.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6265.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6259.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Space.i686.elf PID: 6260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.i686.elf PID: 6261, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.i686.elf PID: 6265, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Space.i686.elf	47%	Virustotal		Browse
Space.i686.elf	47%	ReversingLabs	Linux.Backdoor.Mirai
Space.i686.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Space.i686.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
89.169.4.44	unknown	Russian Federation	31514	INF-NET-ASRU	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
89.169.4.44	Space.x86_64.elf	Get hash	malicious	Mirai	Browse
	Space.mips.elf	Get hash	malicious	Mirai	Browse
	Space.x86.elf	Get hash	malicious	Mirai	Browse
	Space.arm.elf	Get hash	malicious	Mirai	Browse
	Space.sh4.elf	Get hash	malicious	Mirai	Browse
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse
91.189.91.43	Space.arm.elf	Get hash	malicious	Mirai	Browse
	m68k.elf	Get hash	malicious	Unknown	Browse
	x86.elf	Get hash	malicious	Unknown	Browse
	bin.sh.elf	Get hash	malicious	Mirai	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	spc.elf	Get hash	malicious	Unknown	Browse
	m68k.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	arm.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	Space.mips.elf	Get hash	malicious	Mirai	Browse
	Space.arm.elf	Get hash	malicious	Mirai	Browse
	m68k.elf	Get hash	malicious	Unknown	Browse
	x86.elf	Get hash	malicious	Unknown	Browse
	bin.sh.elf	Get hash	malicious	Mirai	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	spc.elf	Get hash	malicious	Unknown	Browse
	m68k.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	Space.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Space.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	m68k.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	bin.sh.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mpsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	spc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	m68k.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
INF-NET-ASRU	Space.spc.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	Space.x86_64.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	Space.mips.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	Space.x86.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	Space.arm.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	Space.sh4.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	jade.m68k.elf	Get hash	malicious	Mirai	Browse	89.169.156.74
	https://santa-secret.ru/api/verify?a=NjgyODEwNCw1bWluOHE2MHpuX3J1LC9hY2NvdW50L2JveGVzLHZsYWRpbWlyLmdsdXNoZW5rb0Bob2NobGFuZC5ydSwyNDE0MTYzMg==	Get hash	malicious	Unknown	Browse	87.228.10.139
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
INIT7CH	Space.mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Space.arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	m68k.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	x86.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	bin.sh.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	mpsl.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	spc.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	m68k.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	mips.elf	Get hash	malicious	Unknown	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.955595870775248
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	Space.i686.elf
File size:	35'964 bytes
MD5:	a56e91b6fcccccac6af83d4b96c2d3ed
SHA1:	60b057a4285c39228b11e854362fd312fac1b94c
SHA256:	78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d
SHA512:	357a37eab75a1936bb0642094babc9b6a3a98bf85832b853c23117a3203984dbfdde853b68e4174c76cce34b0a5ffeffb6bcc64e944dda608d7cbc5fd3539edf
SSDEEP:	768:Y9JFwkShNFPpaMg3zjC/dSmvlG8jbnohnbcuyD7UHQRjp:cwkQmzWVdvY8j7ohnouy8Hyd
TLSH:	03F2F181C79DC742A25D45B914CC748C8792FE2C8E454993E341F33C2EB2FB66A7D286
File Content Preview:	.ELF........................4...........4. ...(.....................\|...\|...............@...@...@...................Q.td.............................-[.UPX!........T$..T$......U..........?..k.I/.j....\.h.blz.e...)....4.0.N..9..y...@$. ..qX.\Z.....0.v'...%

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0xc08988
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0xc01000	0xc01000	0x8b7c	0x8b7c	7.9577	0x5	R E	0x1000
LOAD	0xc40	0x805cc40	0x805cc40	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 09:01:50.549352884 CET	42516	80	192.168.2.23	109.202.202.202
Dec 16, 2024 09:01:51.573417902 CET	43928	443	192.168.2.23	91.189.91.42
Dec 16, 2024 09:01:52.159574986 CET	50954	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:01:52.280495882 CET	3778	50954	89.169.4.44	192.168.2.23
Dec 16, 2024 09:01:52.280594110 CET	50954	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:01:52.280658007 CET	50954	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:01:52.400283098 CET	3778	50954	89.169.4.44	192.168.2.23
Dec 16, 2024 09:01:52.400351048 CET	50954	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:01:52.520138979 CET	3778	50954	89.169.4.44	192.168.2.23
Dec 16, 2024 09:01:57.204319000 CET	42836	443	192.168.2.23	91.189.91.43
Dec 16, 2024 09:01:57.890014887 CET	50956	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:01:58.009857893 CET	3778	50956	89.169.4.44	192.168.2.23
Dec 16, 2024 09:01:58.010041952 CET	50956	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:01:58.010042906 CET	50956	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:01:58.129749060 CET	3778	50956	89.169.4.44	192.168.2.23
Dec 16, 2024 09:01:58.129992962 CET	50956	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:01:58.249701023 CET	3778	50956	89.169.4.44	192.168.2.23
Dec 16, 2024 09:01:59.332226992 CET	3778	50956	89.169.4.44	192.168.2.23
Dec 16, 2024 09:01:59.332386017 CET	50956	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:01:59.332421064 CET	50956	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:01:59.332421064 CET	50958	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:01:59.452125072 CET	3778	50958	89.169.4.44	192.168.2.23
Dec 16, 2024 09:01:59.452260017 CET	50958	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:01:59.452331066 CET	50958	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:01:59.572066069 CET	3778	50958	89.169.4.44	192.168.2.23
Dec 16, 2024 09:01:59.572177887 CET	50958	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:01:59.692512035 CET	3778	50958	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:00.777853966 CET	3778	50958	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:00.777960062 CET	50958	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:00.777992964 CET	50958	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:00.778029919 CET	50960	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:00.897794962 CET	3778	50960	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:00.898051023 CET	50960	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:00.898154974 CET	50960	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:01.017951012 CET	3778	50960	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:01.018057108 CET	50960	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:01.137778044 CET	3778	50960	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:02.223839045 CET	3778	50960	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:02.224036932 CET	50960	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:02.224036932 CET	50960	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:02.224133968 CET	50962	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:02.289294004 CET	50954	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:02.343818903 CET	3778	50962	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:02.343966961 CET	50962	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:02.344113111 CET	50962	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:02.408970118 CET	3778	50954	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:02.463785887 CET	3778	50962	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:02.463934898 CET	50962	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:02.583699942 CET	3778	50962	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:02.722960949 CET	3778	50954	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:02.723076105 CET	50954	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:03.665095091 CET	3778	50962	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:03.665318012 CET	50962	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:03.665318012 CET	50962	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:03.665364027 CET	50964	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:03.785212994 CET	3778	50964	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:03.785496950 CET	50964	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:03.785496950 CET	50964	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:03.906328917 CET	3778	50964	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:03.906507969 CET	50964	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:04.026268005 CET	3778	50964	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:05.108504057 CET	3778	50964	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:05.108742952 CET	50964	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:05.108742952 CET	50964	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:05.108742952 CET	50966	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:05.228552103 CET	3778	50966	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:05.228744030 CET	50966	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:05.228807926 CET	50966	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:05.349324942 CET	3778	50966	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:05.349546909 CET	50966	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:05.470117092 CET	3778	50966	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:06.664609909 CET	3778	50966	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:06.664793015 CET	50966	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:06.664834023 CET	50966	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:06.664881945 CET	50968	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:06.784996033 CET	3778	50968	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:06.785212040 CET	50968	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:06.785291910 CET	50968	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:06.905347109 CET	3778	50968	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:06.905635118 CET	50968	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:07.025640965 CET	3778	50968	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:08.110174894 CET	3778	50968	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:08.110390902 CET	50968	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:08.110390902 CET	50968	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:08.110491991 CET	50970	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:08.230356932 CET	3778	50970	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:08.230557919 CET	50970	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:08.230684042 CET	50970	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:08.350461960 CET	3778	50970	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:08.350687981 CET	50970	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:08.470531940 CET	3778	50970	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:09.553549051 CET	3778	50970	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:09.553673983 CET	50970	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:09.553761959 CET	50972	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:09.553781033 CET	50970	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:09.673635006 CET	3778	50972	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:09.673773050 CET	50972	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:09.673929930 CET	50972	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:09.794243097 CET	3778	50972	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:09.794354916 CET	50972	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:09.914321899 CET	3778	50972	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:11.003206015 CET	3778	50972	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:11.003348112 CET	50972	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:11.003493071 CET	50972	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:11.003587008 CET	50974	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:11.123333931 CET	3778	50974	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:11.123471975 CET	50974	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:11.123719931 CET	50974	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:11.243750095 CET	3778	50974	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:11.243885040 CET	50974	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:11.363679886 CET	3778	50974	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:12.306288958 CET	43928	443	192.168.2.23	91.189.91.42
Dec 16, 2024 09:02:12.444956064 CET	3778	50974	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:12.445079088 CET	50974	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:12.445174932 CET	50974	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:12.445286989 CET	50976	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:12.565076113 CET	3778	50976	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:12.565279961 CET	50976	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:12.565279961 CET	50976	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:12.685163975 CET	3778	50976	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:12.685322046 CET	50976	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:12.805192947 CET	3778	50976	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:13.892563105 CET	3778	50976	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:13.892680883 CET	50976	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:13.892745018 CET	50976	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:13.892745018 CET	50978	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:14.012463093 CET	3778	50978	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:14.012542009 CET	50978	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:14.012598038 CET	50978	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:14.132285118 CET	3778	50978	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:14.132396936 CET	50978	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:14.252337933 CET	3778	50978	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:15.332307100 CET	3778	50978	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:15.332417011 CET	50978	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:15.332464933 CET	50978	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:15.332495928 CET	50980	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:15.452375889 CET	3778	50980	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:15.452552080 CET	50980	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:15.452672005 CET	50980	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:15.572360039 CET	3778	50980	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:15.572485924 CET	50980	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:15.692702055 CET	3778	50980	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:16.780385017 CET	3778	50980	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:16.780533075 CET	50980	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:16.780584097 CET	50980	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:16.780615091 CET	50982	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:16.901276112 CET	3778	50982	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:16.901422977 CET	50982	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:16.901488066 CET	50982	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:17.021205902 CET	3778	50982	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:17.021373987 CET	50982	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:17.141581059 CET	3778	50982	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:18.225533009 CET	3778	50982	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:18.225678921 CET	50982	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:18.225723028 CET	50982	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:18.225748062 CET	50984	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:18.345501900 CET	3778	50984	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:18.345868111 CET	50984	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:18.346018076 CET	50984	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:18.465826035 CET	3778	50984	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:18.466006041 CET	50984	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:18.585808992 CET	3778	50984	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:19.666610956 CET	3778	50984	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:19.666800022 CET	50984	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:19.666877985 CET	50984	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:19.666980982 CET	50986	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:19.786653996 CET	3778	50986	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:19.786859989 CET	50986	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:19.786957979 CET	50986	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:19.907473087 CET	3778	50986	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:19.907609940 CET	50986	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:20.027306080 CET	3778	50986	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:20.496968985 CET	42516	80	192.168.2.23	109.202.202.202
Dec 16, 2024 09:02:21.112437010 CET	3778	50986	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:21.112570047 CET	50986	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:21.112636089 CET	50986	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:21.112644911 CET	50988	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:21.232534885 CET	3778	50988	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:21.232695103 CET	50988	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:21.232781887 CET	50988	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:21.352510929 CET	3778	50988	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:21.352760077 CET	50988	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:21.472562075 CET	3778	50988	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:22.556227922 CET	3778	50988	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:22.556360960 CET	50988	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:22.556449890 CET	50988	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:22.556449890 CET	50990	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:22.676404953 CET	3778	50990	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:22.676558971 CET	50990	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:22.676692963 CET	50990	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:22.798193932 CET	3778	50990	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:22.798333883 CET	50990	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:22.918138027 CET	3778	50990	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:24.026403904 CET	3778	50990	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:24.026576996 CET	50990	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:24.026648045 CET	50990	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:24.026978970 CET	50992	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:24.146848917 CET	3778	50992	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:24.147289038 CET	50992	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:24.147289038 CET	50992	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:24.267374039 CET	3778	50992	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:24.267671108 CET	50992	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:24.387639046 CET	3778	50992	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:24.592334986 CET	42836	443	192.168.2.23	91.189.91.43
Dec 16, 2024 09:02:25.472198009 CET	3778	50992	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:25.472563028 CET	50992	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:25.472563028 CET	50992	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:25.472626925 CET	50994	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:25.592386007 CET	3778	50994	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:25.592556000 CET	50994	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:25.592616081 CET	50994	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:25.712945938 CET	3778	50994	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:25.713104010 CET	50994	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:25.833112001 CET	3778	50994	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:26.917838097 CET	3778	50994	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:26.918061018 CET	50994	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:26.918103933 CET	50994	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:26.918150902 CET	50996	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:27.038028002 CET	3778	50996	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:27.038295031 CET	50996	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:27.038405895 CET	50996	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:27.158061981 CET	3778	50996	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:27.158271074 CET	50996	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:27.278078079 CET	3778	50996	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:28.364356041 CET	3778	50996	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:28.364531994 CET	50996	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:28.364567041 CET	50996	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:28.364658117 CET	50998	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:28.484349966 CET	3778	50998	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:28.484528065 CET	50998	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:28.484590054 CET	50998	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:28.604485989 CET	3778	50998	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:28.604639053 CET	50998	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:28.725596905 CET	3778	50998	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:29.808096886 CET	3778	50998	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:29.808295965 CET	50998	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:29.808352947 CET	50998	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:29.808454037 CET	51000	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:29.928417921 CET	3778	51000	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:29.928580046 CET	51000	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:29.928683043 CET	51000	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:30.048782110 CET	3778	51000	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:30.048923016 CET	51000	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:30.168714046 CET	3778	51000	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:31.255419970 CET	3778	51000	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:31.255582094 CET	51000	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:31.255655050 CET	51000	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:31.255667925 CET	51002	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:31.375540972 CET	3778	51002	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:31.375682116 CET	51002	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:31.375782013 CET	51002	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:31.495697021 CET	3778	51002	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:31.495829105 CET	51002	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:31.615663052 CET	3778	51002	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:32.704008102 CET	3778	51002	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:32.704206944 CET	51002	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:32.704241991 CET	51002	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:32.704298973 CET	51004	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:32.824430943 CET	3778	51004	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:32.824707985 CET	51004	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:32.824768066 CET	51004	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:32.944649935 CET	3778	51004	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:32.944788933 CET	51004	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:33.065068007 CET	3778	51004	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:34.145970106 CET	3778	51004	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:34.146126032 CET	51004	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:34.146156073 CET	51004	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:34.146207094 CET	51006	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:34.265911102 CET	3778	51006	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:34.266061068 CET	51006	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:34.266113997 CET	51006	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:34.385802984 CET	3778	51006	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:34.385896921 CET	51006	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:34.505575895 CET	3778	51006	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:35.589797974 CET	3778	51006	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:35.589957952 CET	51006	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:35.589957952 CET	51006	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:35.589998007 CET	51008	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:35.709858894 CET	3778	51008	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:35.709992886 CET	51008	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:35.710036993 CET	51008	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:35.829858065 CET	3778	51008	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:35.829940081 CET	51008	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:35.949601889 CET	3778	51008	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:37.030852079 CET	3778	51008	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:37.031053066 CET	51008	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:37.031053066 CET	51008	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:37.031116009 CET	51010	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:37.151037931 CET	3778	51010	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:37.151236057 CET	51010	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:37.151309013 CET	51010	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:37.271039963 CET	3778	51010	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:37.271167994 CET	51010	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:37.390871048 CET	3778	51010	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:38.477581024 CET	3778	51010	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:38.477730989 CET	51010	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:38.477771997 CET	51010	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:38.477822065 CET	51012	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:38.597498894 CET	3778	51012	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:38.597620010 CET	51012	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:39.502235889 CET	51012	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:39.622155905 CET	3778	51012	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:39.622452974 CET	51012	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:39.622571945 CET	51012	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:39.742351055 CET	3778	51012	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:39.742465019 CET	51012	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:39.862421989 CET	3778	51012	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:49.623286963 CET	51012	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:49.743036985 CET	3778	51012	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:50.056627989 CET	3778	51012	89.169.4.44	192.168.2.23
Dec 16, 2024 09:02:50.056885958 CET	51012	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:02:53.260339975 CET	43928	443	192.168.2.23	91.189.91.42
Dec 16, 2024 09:03:02.748713970 CET	50954	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:03:02.868501902 CET	3778	50954	89.169.4.44	192.168.2.23
Dec 16, 2024 09:03:03.182179928 CET	3778	50954	89.169.4.44	192.168.2.23
Dec 16, 2024 09:03:03.182333946 CET	50954	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:03:50.108736038 CET	51012	3778	192.168.2.23	89.169.4.44
Dec 16, 2024 09:03:50.228634119 CET	3778	51012	89.169.4.44	192.168.2.23
Dec 16, 2024 09:03:50.541860104 CET	3778	51012	89.169.4.44	192.168.2.23
Dec 16, 2024 09:03:50.542011023 CET	51012	3778	192.168.2.23	89.169.4.44

System Behavior

Analysis Process: Space.i686.elf PID: 6259, Parent PID: 6185

General

Start time (UTC):	08:01:51
Start date (UTC):	16/12/2024
Path:	/tmp/Space.i686.elf
Arguments:	/tmp/Space.i686.elf
File size:	35964 bytes
MD5 hash:	a56e91b6fcccccac6af83d4b96c2d3ed

Chronological Activities

Analysis Process: Space.i686.elf PID: 6260, Parent PID: 6259

General

Start time (UTC):	08:01:51
Start date (UTC):	16/12/2024
Path:	/tmp/Space.i686.elf
Arguments:	-
File size:	35964 bytes
MD5 hash:	a56e91b6fcccccac6af83d4b96c2d3ed

Chronological Activities

Analysis Process: Space.i686.elf PID: 6261, Parent PID: 6260

General

Start time (UTC):	08:01:51
Start date (UTC):	16/12/2024
Path:	/tmp/Space.i686.elf
Arguments:	-
File size:	35964 bytes
MD5 hash:	a56e91b6fcccccac6af83d4b96c2d3ed

Chronological Activities

Analysis Process: Space.i686.elf PID: 6262, Parent PID: 6260

General

Start time (UTC):	08:01:51
Start date (UTC):	16/12/2024
Path:	/tmp/Space.i686.elf
Arguments:	-
File size:	35964 bytes
MD5 hash:	a56e91b6fcccccac6af83d4b96c2d3ed

Analysis Process: Space.i686.elf PID: 6265, Parent PID: 6259

General

Start time (UTC):	08:01:57
Start date (UTC):	16/12/2024
Path:	/tmp/Space.i686.elf
Arguments:	-
File size:	35964 bytes
MD5 hash:	a56e91b6fcccccac6af83d4b96c2d3ed

Chronological Activities

Analysis Process: Space.i686.elf PID: 6266, Parent PID: 6259

General

Start time (UTC):	08:01:57
Start date (UTC):	16/12/2024
Path:	/tmp/Space.i686.elf
Arguments:	-
File size:	35964 bytes
MD5 hash:	a56e91b6fcccccac6af83d4b96c2d3ed

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Space.i686.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: Space.i686.elf PID: 6259, Parent PID: 6185

General

Chronological Activities

Analysis Process: Space.i686.elf PID: 6260, Parent PID: 6259

General

Chronological Activities

Analysis Process: Space.i686.elf PID: 6261, Parent PID: 6260

General

Chronological Activities

Analysis Process: Space.i686.elf PID: 6262, Parent PID: 6260

General

Analysis Process: Space.i686.elf PID: 6265, Parent PID: 6259

General

Chronological Activities

Analysis Process: Space.i686.elf PID: 6266, Parent PID: 6259

General

Linux Analysis Report
Space.i686.elf