Edit tour

Linux Analysis Report
Space.x86.elf

Overview

General Information

Sample name:	Space.x86.elf
Analysis ID:	1579471
MD5:	f66071f9e603dd7b96793058e206b45c
SHA1:	f90eaf59e5a2c5030450de5b1f12a72a8ec8f256
SHA256:	8b8facc7fb2d6cd6f278ea77711c41970dcdff8a367d2d04a2221fd4286ffb45
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Machine Learning detection for sample

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Sample contains only a LOAD segment without any section mappings

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579471
Start date and time:	2024-12-22 15:41:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Space.x86.elf
Detection:	MAL
Classification:	mal72.troj.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/Space.x86.elf
PID:	6257
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

Space.x86.elf (PID: 6257, Parent: 6183, MD5: f66071f9e603dd7b96793058e206b45c) Arguments: /tmp/Space.x86.elf

Space.x86.elf New Fork (PID: 6258, Parent: 6257)

Space.x86.elf New Fork (PID: 6259, Parent: 6258)

Space.x86.elf New Fork (PID: 6260, Parent: 6258)

Space.x86.elf New Fork (PID: 6286, Parent: 6257)

Space.x86.elf New Fork (PID: 6287, Parent: 6257)

dash New Fork (PID: 6264, Parent: 4331)

rm (PID: 6264, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.FaSbxKwr0i /tmp/tmp.r0aODzvN1V /tmp/tmp.xxTImeJncx

dash New Fork (PID: 6265, Parent: 4331)

rm (PID: 6265, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.FaSbxKwr0i /tmp/tmp.r0aODzvN1V /tmp/tmp.xxTImeJncx

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
6259.1.0000000008048000.0000000008059000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6259.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd8d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd8e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd8fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd910:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd924:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd938:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd94c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd960:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd974:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd988:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd99c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6259.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0xbaa:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
6259.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x4940:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6259.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0xc35:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
6259.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0xadb:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
6259.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1710:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x17f9:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x18d7:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1b82:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x2004:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
6259.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x9f3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
6259.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x70e2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6259.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6259.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xa5f7:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6259.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x8ff7:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6259.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x70b2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6257.1.0000000008048000.0000000008059000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6257.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd8d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd8e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd8fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd910:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd924:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd938:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd94c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd960:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd974:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd988:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd99c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6257.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0xbaa:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
6257.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x4940:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6257.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0xc35:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
6257.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0xadb:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
6257.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1710:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x17f9:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x18d7:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1b82:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x2004:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
6257.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x9f3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
6257.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x70e2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6257.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6257.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xa5f7:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6257.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x8ff7:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6257.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x70b2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6258.1.0000000008048000.0000000008059000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6258.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd8d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd8e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd8fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd910:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd924:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd938:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd94c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd960:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd974:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd988:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd99c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6258.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0xbaa:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
6258.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x4940:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6258.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0xc35:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
6258.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0xadb:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
6258.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1710:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x17f9:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x18d7:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1b82:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x2004:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
6258.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x9f3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
6258.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x70e2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6258.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6258.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xa5f7:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6258.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x8ff7:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6258.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x70b2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6286.1.0000000008048000.0000000008059000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6286.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd8d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd8e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd8fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd910:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd924:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd938:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd94c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd960:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd974:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd988:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd99c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6286.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0xbaa:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
6286.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x4940:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6286.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0xc35:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
6286.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0xadb:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
6286.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1710:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x17f9:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x18d7:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1b82:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x2004:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
6286.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x9f3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
6286.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x70e2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6286.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6286.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xa5f7:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6286.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x8ff7:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6286.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x70b2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Process Memory Space: Space.x86.elf PID: 6257	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.x86.elf PID: 6257	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1640:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1654:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1668:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x167c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1690:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1708:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1730:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1744:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1758:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x176c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1780:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1794:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.x86.elf PID: 6258	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x100e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1022:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1036:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x105e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1072:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1086:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10ae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10ea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10fe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1112:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1126:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x113a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x114e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1162:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1176:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x119e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.x86.elf PID: 6259	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.x86.elf PID: 6259	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x9ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa67:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa7b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa8f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaa3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xab7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xacb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xadf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaf3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb07:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb1b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb2f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb43:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb57:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb7f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.x86.elf PID: 6286	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.x86.elf PID: 6286	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x47e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x492:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x50a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x51e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x532:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x546:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x55a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x56e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x582:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x596:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 54 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Space.x86.elf	Virustotal: Detection: 44%			Perma Link
Source: Space.x86.elf	ReversingLabs: Detection: 47%

Machine Learning detection for sample

Source: Space.x86.elf

Joe Sandbox ML: detected

Source: global traffic

TCP traffic: 192.168.2.23:49058 -> 89.213.158.208:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208

Source: Space.x86.elf

String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: Process Memory Space: Space.x86.elf PID: 6257, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.x86.elf PID: 6258, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.x86.elf PID: 6259, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.x86.elf PID: 6286, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0xc01000

Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: Process Memory Space: Space.x86.elf PID: 6257, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.x86.elf PID: 6258, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.x86.elf PID: 6259, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.x86.elf PID: 6286, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal72.troj.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/1582/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/3088/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/1579/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/1699/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/1335/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/1698/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/1334/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/1576/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/2302/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/910/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/912/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/2307/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/918/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/6243/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/6242/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/1594/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/1349/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/1344/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/1465/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/1586/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/1463/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/801/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/1900/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/6257/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/491/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/1599/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/1477/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/379/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/1476/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/4502/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/2208/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/1809/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 6257)	File opened: /proc/1494/status	Jump to behavior

Source: /usr/bin/dash (PID: 6264)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.FaSbxKwr0i /tmp/tmp.r0aODzvN1V /tmp/tmp.xxTImeJncx			Jump to behavior
Source: /usr/bin/dash (PID: 6265)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.FaSbxKwr0i /tmp/tmp.r0aODzvN1V /tmp/tmp.xxTImeJncx			Jump to behavior

Source: Space.x86.elf

Submission file: segment LOAD with 7.9562 entropy (max. 8.0)

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Space.x86.elf PID: 6257, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.x86.elf PID: 6259, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.x86.elf PID: 6286, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 6259.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6257.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6258.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6286.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Space.x86.elf PID: 6257, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.x86.elf PID: 6259, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.x86.elf PID: 6286, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Space.x86.elf	44%	Virustotal		Browse
Space.x86.elf	47%	ReversingLabs	Linux.Backdoor.Mirai
Space.x86.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Space.x86.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.171.230.55	unknown	United States	16509	AMAZON-02US	false
89.213.158.208	unknown	United Kingdom	8851	EDGEtaGCIComGB	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54.171.230.55	nn.elf	Get hash	malicious	Nanominer, Xmrig	Browse
	arm6.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	dlr.arm6.elf	Get hash	malicious	Unknown	Browse
	arm6.elf	Get hash	malicious	Mirai	Browse
	http://112.31.189.32:40158	Get hash	malicious	Mirai	Browse
	Aqua.mpsl.elf	Get hash	malicious	Mirai	Browse
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse
	la.bot.arc.elf	Get hash	malicious	Mirai	Browse
	armv6l.elf	Get hash	malicious	Mirai	Browse
	la.bot.powerpc.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	nn.elf	Get hash	malicious	Nanominer, Xmrig	Browse
	arm6.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	vlxx.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	vlxx.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	nn.elf	Get hash	malicious	Nanominer, Xmrig	Browse
	arm6.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	vlxx.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	vlxx.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	vlxx.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	nn.elf	Get hash	malicious	Nanominer, Xmrig	Browse	91.189.91.42
	arm6.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	vlxx.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	vlxx.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	vlxx.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	vlxx.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	185.125.190.26
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
EDGEtaGCIComGB	ppc.elf	Get hash	malicious	Mirai	Browse	77.107.120.29
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	89.213.109.95
	1.elf	Get hash	malicious	Unknown	Browse	89.213.55.225
	wi86CSarYC.exe	Get hash	malicious	DanaBot	Browse	213.210.13.4
	UFh7A8CImG.exe	Get hash	malicious	DanaBot	Browse	213.210.13.4
	nSORtPkIOR.msi	Get hash	malicious	DanaBot	Browse	213.210.13.4
	cloudflare.msi	Get hash	malicious	DanaBot	Browse	213.210.13.4
	zDcNyG6Csn.exe	Get hash	malicious	DanaBot	Browse	213.210.13.4
	Support.Client (1).exe	Get hash	malicious	ScreenConnect Tool	Browse	185.49.126.73
	Support.Client (1).exe	Get hash	malicious	ScreenConnect Tool	Browse	185.49.126.73
AMAZON-02US	nn.elf	Get hash	malicious	Nanominer, Xmrig	Browse	54.171.230.55
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	34.252.132.197
	arm6.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	54.171.230.55
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	13.236.254.247
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	54.154.131.169
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	108.154.170.136
	3.elf	Get hash	malicious	Unknown	Browse	54.97.133.72
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	18.159.41.41
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	3.35.124.145
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	18.254.104.182
INIT7CH	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	nn.elf	Get hash	malicious	Nanominer, Xmrig	Browse	109.202.202.202
	arm6.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	vlxx.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
	vlxx.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
	vlxx.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.954011092386006
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	Space.x86.elf
File size:	34'896 bytes
MD5:	f66071f9e603dd7b96793058e206b45c
SHA1:	f90eaf59e5a2c5030450de5b1f12a72a8ec8f256
SHA256:	8b8facc7fb2d6cd6f278ea77711c41970dcdff8a367d2d04a2221fd4286ffb45
SHA512:	d5d307f49f255d8f2e36027cdb5b0b7171f83d99147fb1d074bdb64f4c65fa19a7af2556508e0a317a9a4e0df5bd005b5d1b3396282647d9672b12d916d3fc88
SSDEEP:	768:LzbGjwng3vdOhxV/Whew0IAls1SeGhRLN1Hv8s8xfp8AbanbcuyD7UHQRjj:fdnAzhe3rs2hRLbHv81tvanouy8Hyv
TLSH:	D0F2E107D18A724AF55E433E58FEBE0F1621F51DFA4550A6EEE8803AB854F4C536A383
File Content Preview:	.ELF....................X...4...........4. ...(.....................L...L...............@...@...@...................Q.td.............................-[.UPX!........T...T.......V..........?..k.I/.j....\.d*nlz.e........4.0.N..9..y...........p"Nr..]9.~...n..

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0xc08558
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0xc01000	0xc01000	0x874c	0x874c	7.9562	0x5	R E	0x1000
LOAD	0xc40	0x805bc40	0x805bc40	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2024 15:41:57.006181955 CET	43928	443	192.168.2.23	91.189.91.42
Dec 22, 2024 15:41:57.095536947 CET	49058	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:41:57.215398073 CET	3778	49058	89.213.158.208	192.168.2.23
Dec 22, 2024 15:41:57.215471029 CET	49058	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:41:57.215528011 CET	49058	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:41:57.335433960 CET	3778	49058	89.213.158.208	192.168.2.23
Dec 22, 2024 15:41:57.335490942 CET	49058	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:41:57.455379009 CET	3778	49058	89.213.158.208	192.168.2.23
Dec 22, 2024 15:41:58.799710989 CET	3778	49058	89.213.158.208	192.168.2.23
Dec 22, 2024 15:41:58.799838066 CET	49058	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:41:58.799870014 CET	49058	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:41:58.799976110 CET	49060	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:41:58.847450972 CET	443	33606	54.171.230.55	192.168.2.23
Dec 22, 2024 15:41:58.847719908 CET	33606	443	192.168.2.23	54.171.230.55
Dec 22, 2024 15:41:58.920064926 CET	3778	49060	89.213.158.208	192.168.2.23
Dec 22, 2024 15:41:58.920260906 CET	49060	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:41:58.920260906 CET	49060	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:41:58.967453957 CET	443	33606	54.171.230.55	192.168.2.23
Dec 22, 2024 15:41:59.039953947 CET	3778	49060	89.213.158.208	192.168.2.23
Dec 22, 2024 15:41:59.040148973 CET	49060	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:41:59.160013914 CET	3778	49060	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:00.207259893 CET	3778	49060	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:00.207391024 CET	49060	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:00.207391024 CET	49060	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:00.207449913 CET	49062	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:00.327044010 CET	3778	49062	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:00.327250004 CET	49062	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:00.327250004 CET	49062	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:00.449021101 CET	3778	49062	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:00.449259043 CET	49062	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:00.569016933 CET	3778	49062	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:02.061109066 CET	3778	49062	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:02.061269999 CET	49062	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:02.061326981 CET	49062	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:02.061367035 CET	49064	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:02.180862904 CET	3778	49064	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:02.180988073 CET	49064	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:02.181070089 CET	49064	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:02.300724983 CET	3778	49064	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:02.300844908 CET	49064	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:02.420864105 CET	3778	49064	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:02.537149906 CET	49066	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:02.637469053 CET	42836	443	192.168.2.23	91.189.91.43
Dec 22, 2024 15:42:02.657618999 CET	3778	49066	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:02.657840967 CET	49066	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:02.657908916 CET	49066	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:02.777995110 CET	3778	49066	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:02.778105974 CET	49066	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:02.898231983 CET	3778	49066	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:03.405378103 CET	42516	80	192.168.2.23	109.202.202.202
Dec 22, 2024 15:42:04.684570074 CET	3778	49066	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:04.684624910 CET	3778	49064	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:04.684700966 CET	49066	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:04.684767008 CET	49064	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:04.684845924 CET	49066	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:04.684936047 CET	49064	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:04.685024977 CET	49068	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:04.685025930 CET	49070	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:04.805983067 CET	3778	49068	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:04.806018114 CET	3778	49070	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:04.806406975 CET	49068	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:04.806406975 CET	49070	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:04.806406975 CET	49070	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:04.806406975 CET	49068	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:04.926608086 CET	3778	49070	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:04.926655054 CET	3778	49068	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:04.926899910 CET	49070	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:04.926899910 CET	49068	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:05.049690008 CET	3778	49070	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:05.049735069 CET	3778	49068	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:06.458702087 CET	3778	49068	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:06.458748102 CET	3778	49070	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:06.459027052 CET	49068	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:06.459027052 CET	49070	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:06.459027052 CET	49068	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:06.459027052 CET	49070	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:06.459104061 CET	49072	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:06.459104061 CET	49074	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:06.579310894 CET	3778	49072	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:06.579391956 CET	3778	49074	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:06.579452038 CET	49072	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:06.579505920 CET	49074	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:06.579533100 CET	49072	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:06.579543114 CET	49074	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:06.699532986 CET	3778	49072	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:06.699577093 CET	3778	49074	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:06.699666023 CET	49072	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:06.699666023 CET	49074	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:06.819988012 CET	3778	49072	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:06.820036888 CET	3778	49074	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:10.601521015 CET	3778	49072	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:10.601556063 CET	3778	49074	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:10.601744890 CET	49072	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:10.601744890 CET	49074	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:10.601744890 CET	49072	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:10.601768970 CET	49076	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:10.601788044 CET	49074	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:10.601824045 CET	49078	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:10.721750021 CET	3778	49076	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:10.721796036 CET	3778	49078	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:10.721852064 CET	49076	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:10.721879005 CET	49078	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:10.721879005 CET	49076	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:10.721904039 CET	49078	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:10.842271090 CET	3778	49076	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:10.842314959 CET	3778	49078	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:10.842346907 CET	49076	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:10.842370033 CET	49078	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:10.962672949 CET	3778	49076	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:10.962717056 CET	3778	49078	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:13.619390965 CET	3778	49078	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:13.619412899 CET	3778	49076	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:13.619842052 CET	49078	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:13.619842052 CET	49076	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:13.619887114 CET	49076	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:13.620146036 CET	49078	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:13.620194912 CET	49082	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:13.620196104 CET	49080	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:13.740266085 CET	3778	49082	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:13.740305901 CET	3778	49080	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:13.740585089 CET	49082	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:13.740585089 CET	49082	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:13.740585089 CET	49080	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:13.740782022 CET	49080	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:13.860690117 CET	3778	49082	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:13.860735893 CET	3778	49080	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:13.860874891 CET	49082	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:13.860874891 CET	49080	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:13.983937979 CET	3778	49082	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:13.983983994 CET	3778	49080	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:16.607539892 CET	3778	49080	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:16.607577085 CET	3778	49082	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:16.607764959 CET	49082	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:16.607814074 CET	49080	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:16.608015060 CET	49082	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:16.608022928 CET	49084	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:16.608230114 CET	49086	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:16.608239889 CET	49080	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:16.847357988 CET	3778	49084	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:16.847404003 CET	3778	49086	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:16.847676039 CET	49086	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:16.847676992 CET	49086	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:16.847707987 CET	49084	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:16.847707987 CET	49084	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:16.968684912 CET	3778	49086	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:16.968903065 CET	3778	49084	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:16.968981981 CET	49086	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:16.968981981 CET	49084	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:17.088795900 CET	3778	49086	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:17.088818073 CET	3778	49084	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:17.739437103 CET	43928	443	192.168.2.23	91.189.91.42
Dec 22, 2024 15:42:20.412688017 CET	3778	49086	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:20.412869930 CET	49086	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:20.413152933 CET	49086	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:20.413317919 CET	49088	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:20.426134109 CET	3778	49084	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:20.426491022 CET	49090	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:20.426498890 CET	49084	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:20.426498890 CET	49084	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:20.534538984 CET	3778	49088	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:20.534821987 CET	49088	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:20.534821987 CET	49088	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:20.653764963 CET	3778	49090	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:20.654134035 CET	49090	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:20.654134989 CET	49090	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:20.654514074 CET	3778	49088	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:20.654602051 CET	49088	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:20.779409885 CET	3778	49090	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:20.779432058 CET	3778	49088	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:20.779757023 CET	49090	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:20.900789022 CET	3778	49090	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:22.336639881 CET	3778	49090	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:22.336848974 CET	49092	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:22.336949110 CET	49090	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:22.336950064 CET	49090	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:22.457360983 CET	3778	49092	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:22.457585096 CET	49092	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:22.457585096 CET	49092	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:22.517930984 CET	3778	49088	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:22.518109083 CET	49088	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:22.518109083 CET	49088	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:22.518167019 CET	49094	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:22.577505112 CET	3778	49092	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:22.577609062 CET	49092	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:22.638194084 CET	3778	49094	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:22.638274908 CET	49094	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:22.638293982 CET	49094	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:22.698559999 CET	3778	49092	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:22.758721113 CET	3778	49094	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:22.758802891 CET	49094	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:22.881418943 CET	3778	49094	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:24.332725048 CET	3778	49092	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:24.332807064 CET	3778	49094	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:24.333108902 CET	49092	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:24.333108902 CET	49094	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:24.333108902 CET	49092	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:24.333333015 CET	49094	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:24.333347082 CET	49096	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:24.333347082 CET	49098	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:24.454381943 CET	3778	49096	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:24.454404116 CET	3778	49098	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:24.454535007 CET	49096	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:24.454535961 CET	49098	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:24.454890013 CET	49096	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:24.454890013 CET	49098	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:24.574505091 CET	3778	49096	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:24.574544907 CET	3778	49098	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:24.574954987 CET	49096	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:24.574954987 CET	49098	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:24.696250916 CET	3778	49096	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:24.696273088 CET	3778	49098	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:26.997476101 CET	3778	49098	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:26.997528076 CET	3778	49096	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:26.997612000 CET	49098	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:26.997612000 CET	49096	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:26.997653008 CET	49098	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:26.997673988 CET	49100	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:26.997680902 CET	49096	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:26.997752905 CET	49102	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:27.117794037 CET	3778	49100	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:27.117815971 CET	3778	49102	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:27.117875099 CET	49102	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:27.117875099 CET	49100	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:27.118046045 CET	49102	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:27.118046045 CET	49100	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:27.238010883 CET	3778	49102	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:27.238116980 CET	3778	49100	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:27.238197088 CET	49102	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:27.238197088 CET	49100	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:27.361229897 CET	3778	49102	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:27.361252069 CET	3778	49100	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:30.026005983 CET	42836	443	192.168.2.23	91.189.91.43
Dec 22, 2024 15:42:30.543442011 CET	3778	49102	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:30.543534040 CET	3778	49100	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:30.543709040 CET	49102	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:30.543709040 CET	49102	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:30.543720961 CET	49104	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:30.543720961 CET	49106	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:30.543746948 CET	49100	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:30.543746948 CET	49100	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:30.663918972 CET	3778	49104	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:30.663944006 CET	3778	49106	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:30.664254904 CET	49104	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:30.664254904 CET	49104	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:30.664254904 CET	49106	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:30.664254904 CET	49106	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:30.784519911 CET	3778	49104	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:30.784535885 CET	3778	49106	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:30.784774065 CET	49104	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:30.784774065 CET	49106	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:30.909068108 CET	3778	49104	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:30.909087896 CET	3778	49106	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:32.821569920 CET	3778	49104	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:32.821585894 CET	3778	49106	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:32.821903944 CET	49104	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:32.821903944 CET	49106	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:32.821903944 CET	49104	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:32.821903944 CET	49106	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:32.821974039 CET	49108	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:32.821974039 CET	49110	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:32.942850113 CET	3778	49108	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:32.942872047 CET	3778	49110	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:32.943142891 CET	49108	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:32.943142891 CET	49110	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:32.943264008 CET	49108	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:32.943264008 CET	49110	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:33.063637972 CET	3778	49108	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:33.063658953 CET	3778	49110	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:33.063860893 CET	49108	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:33.063862085 CET	49110	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:33.183779955 CET	3778	49108	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:33.183803082 CET	3778	49110	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:34.121305943 CET	42516	80	192.168.2.23	109.202.202.202
Dec 22, 2024 15:42:35.445657015 CET	3778	49110	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:35.445723057 CET	3778	49108	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:35.445960999 CET	49108	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:35.445961952 CET	49110	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:35.445998907 CET	49108	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:35.446067095 CET	49112	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:35.446146011 CET	49114	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:35.446285009 CET	49110	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:35.566137075 CET	3778	49112	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:35.566175938 CET	3778	49114	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:35.566248894 CET	49114	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:35.566248894 CET	49112	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:35.566338062 CET	49114	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:35.566404104 CET	49112	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:35.686579943 CET	3778	49114	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:35.686604023 CET	3778	49112	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:35.686707020 CET	49114	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:35.686709881 CET	49112	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:35.806811094 CET	3778	49114	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:35.806869984 CET	3778	49112	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:37.240453005 CET	3778	49114	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:37.240516901 CET	3778	49112	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:37.240714073 CET	49114	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:37.240714073 CET	49114	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:37.240714073 CET	49112	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:37.240761995 CET	49112	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:37.240879059 CET	49118	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:37.240879059 CET	49116	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:37.479619980 CET	3778	49118	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:37.479666948 CET	3778	49116	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:37.479918957 CET	49118	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:37.479918957 CET	49118	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:37.479918957 CET	49116	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:37.480237961 CET	49116	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:37.601166010 CET	3778	49118	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:37.601188898 CET	3778	49116	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:37.601381063 CET	49118	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:37.601382017 CET	49116	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:37.721134901 CET	3778	49118	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:37.721410036 CET	3778	49116	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:40.448621988 CET	3778	49116	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:40.448820114 CET	49116	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:40.448820114 CET	49116	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:40.448844910 CET	3778	49118	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:40.448887110 CET	49120	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:40.448905945 CET	49118	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:40.449009895 CET	49118	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:40.449023008 CET	49122	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:40.569565058 CET	3778	49120	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:40.569612980 CET	3778	49122	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:40.569711924 CET	49120	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:40.569711924 CET	49122	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:40.569828987 CET	49122	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:40.569886923 CET	49120	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:40.690773010 CET	3778	49122	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:40.690819025 CET	3778	49120	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:40.690907955 CET	49122	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:40.690907955 CET	49120	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:40.813575029 CET	3778	49122	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:40.813623905 CET	3778	49120	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:42.110161066 CET	3778	49120	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:42.110199928 CET	3778	49122	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:42.110419035 CET	49120	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:42.110419035 CET	49122	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:42.110419035 CET	49122	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:42.110637903 CET	49120	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:42.110788107 CET	49126	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:42.110788107 CET	49124	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:42.230648041 CET	3778	49126	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:42.230671883 CET	3778	49124	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:42.230946064 CET	49126	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:42.230946064 CET	49124	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:42.230946064 CET	49126	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:42.230946064 CET	49124	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:42.351747990 CET	3778	49126	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:42.351824999 CET	3778	49124	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:42.351982117 CET	49126	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:42.351982117 CET	49124	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:42.472044945 CET	3778	49126	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:42.472067118 CET	3778	49124	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:45.364561081 CET	3778	49126	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:45.364612103 CET	3778	49124	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:45.364727020 CET	49126	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:45.364727020 CET	49124	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:45.364727020 CET	49126	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:45.364763975 CET	49128	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:45.364818096 CET	49124	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:45.364819050 CET	49130	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:45.485212088 CET	3778	49128	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:45.485316038 CET	3778	49130	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:45.485506058 CET	49128	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:45.485506058 CET	49130	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:45.485712051 CET	49130	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:45.485712051 CET	49128	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:45.606082916 CET	3778	49130	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:45.606129885 CET	3778	49128	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:45.606295109 CET	49130	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:45.606296062 CET	49128	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:45.726445913 CET	3778	49130	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:45.726522923 CET	3778	49128	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:48.522737980 CET	3778	49130	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:48.522753954 CET	3778	49128	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:48.523047924 CET	49130	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:48.523047924 CET	49128	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:48.523047924 CET	49130	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:48.523231030 CET	49132	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:48.523322105 CET	49128	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:48.523339987 CET	49134	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:48.648770094 CET	3778	49132	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:48.648804903 CET	3778	49134	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:48.649147987 CET	49132	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:48.649147987 CET	49132	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:48.649147987 CET	49134	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:48.649147987 CET	49134	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:48.768984079 CET	3778	49132	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:48.769020081 CET	3778	49134	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:48.769309998 CET	49132	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:48.769309998 CET	49134	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:48.890136003 CET	3778	49132	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:48.890157938 CET	3778	49134	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:52.126851082 CET	3778	49134	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:52.126894951 CET	3778	49132	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:52.127120018 CET	49132	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:52.127120018 CET	49132	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:52.127120018 CET	49134	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:52.127120018 CET	49134	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:52.127243042 CET	49136	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:52.127243042 CET	49138	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:52.247276068 CET	3778	49136	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:52.247298956 CET	3778	49138	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:52.247643948 CET	49136	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:52.247643948 CET	49138	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:52.247643948 CET	49138	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:52.247644901 CET	49136	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:52.367588043 CET	3778	49138	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:52.367603064 CET	3778	49136	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:52.367943048 CET	49138	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:52.367943048 CET	49136	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:52.487822056 CET	3778	49138	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:52.487891912 CET	3778	49136	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:53.957753897 CET	3778	49138	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:53.957783937 CET	3778	49136	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:53.958142996 CET	49140	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:53.958142996 CET	49142	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:53.958148956 CET	49138	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:53.958148956 CET	49136	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:53.958148956 CET	49138	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:53.958149910 CET	49136	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:54.078841925 CET	3778	49140	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:54.078866005 CET	3778	49142	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:54.079114914 CET	49140	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:54.079114914 CET	49142	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:54.079202890 CET	49142	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:54.079370975 CET	49140	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:54.198988914 CET	3778	49142	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:54.199191093 CET	3778	49140	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:54.199245930 CET	49142	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:54.199245930 CET	49140	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:54.319678068 CET	3778	49142	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:54.319701910 CET	3778	49140	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:56.304748058 CET	3778	49140	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:56.304799080 CET	3778	49142	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:56.305082083 CET	49140	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:56.305082083 CET	49142	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:56.305082083 CET	49140	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:56.305108070 CET	49144	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:56.305169106 CET	49142	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:56.305206060 CET	49146	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:56.425708055 CET	3778	49144	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:56.425766945 CET	3778	49146	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:56.426122904 CET	49146	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:56.426122904 CET	49146	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:56.426122904 CET	49144	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:56.426335096 CET	49144	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:56.546648979 CET	3778	49146	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:56.546720028 CET	3778	49144	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:56.546895027 CET	49146	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:56.546895027 CET	49144	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:56.666645050 CET	3778	49146	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:56.666806936 CET	3778	49144	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:58.693851948 CET	43928	443	192.168.2.23	91.189.91.42
Dec 22, 2024 15:42:59.320898056 CET	3778	49146	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:59.320965052 CET	3778	49144	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:59.321085930 CET	49146	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:59.321085930 CET	49144	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:59.321120024 CET	49148	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:59.321125031 CET	49146	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:59.321125031 CET	49144	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:59.321156025 CET	49150	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:59.441334963 CET	3778	49148	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:59.441380978 CET	3778	49150	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:59.441560984 CET	49150	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:59.441560984 CET	49150	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:59.441591978 CET	49148	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:59.441591978 CET	49148	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:59.561681986 CET	3778	49150	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:59.561732054 CET	3778	49148	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:59.561808109 CET	49150	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:59.561821938 CET	49148	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:42:59.681705952 CET	3778	49150	89.213.158.208	192.168.2.23
Dec 22, 2024 15:42:59.681756973 CET	3778	49148	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:02.269079924 CET	3778	49148	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:02.269175053 CET	3778	49150	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:02.269288063 CET	49148	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:02.269332886 CET	49150	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:02.269360065 CET	49148	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:02.269608974 CET	49152	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:02.269689083 CET	49150	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:02.269766092 CET	49154	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:02.391032934 CET	3778	49152	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:02.391079903 CET	3778	49154	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:02.391391993 CET	49152	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:02.391391993 CET	49154	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:02.391391993 CET	49154	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:02.391475916 CET	49152	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:02.511559010 CET	3778	49154	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:02.511591911 CET	3778	49152	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:02.511857033 CET	49154	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:02.511857986 CET	49152	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:02.631608009 CET	3778	49154	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:02.631647110 CET	3778	49152	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:04.715181112 CET	3778	49154	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:04.715241909 CET	3778	49152	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:04.715413094 CET	49156	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:04.715430021 CET	49152	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:04.715430021 CET	49154	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:04.715430021 CET	49154	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:04.715430021 CET	49152	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:04.715482950 CET	49158	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:04.836354017 CET	3778	49156	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:04.836402893 CET	3778	49158	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:04.836452007 CET	49156	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:04.836452007 CET	49158	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:04.836486101 CET	49156	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:04.836496115 CET	49158	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:04.956674099 CET	3778	49156	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:04.956682920 CET	3778	49158	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:04.956741095 CET	49156	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:04.956741095 CET	49158	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:05.077126026 CET	3778	49156	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:05.077174902 CET	3778	49158	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:06.534009933 CET	3778	49156	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:06.534075022 CET	3778	49158	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:06.534173965 CET	49156	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:06.534173965 CET	49158	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:06.534209013 CET	49156	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:06.534440041 CET	49158	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:06.534610987 CET	49160	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:06.534610987 CET	49162	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:06.773874044 CET	3778	49160	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:06.773922920 CET	3778	49162	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:06.774100065 CET	49160	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:06.774100065 CET	49162	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:06.774100065 CET	49162	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:06.774100065 CET	49160	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:06.894224882 CET	3778	49162	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:06.894273043 CET	3778	49160	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:06.894490957 CET	49162	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:06.894490957 CET	49160	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:07.014666080 CET	3778	49162	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:07.014700890 CET	3778	49160	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:11.022957087 CET	3778	49160	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:11.023200989 CET	3778	49162	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:11.023458958 CET	49164	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:11.023458958 CET	49166	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:11.023463964 CET	49160	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:11.023463964 CET	49160	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:11.023464918 CET	49162	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:11.023464918 CET	49162	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:11.143872023 CET	3778	49164	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:11.143928051 CET	3778	49166	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:11.144094944 CET	49164	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:11.144094944 CET	49166	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:11.144165039 CET	49166	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:11.144195080 CET	49164	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:11.265491009 CET	3778	49166	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:11.265522957 CET	3778	49164	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:11.265742064 CET	49166	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:11.265742064 CET	49164	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:11.385783911 CET	3778	49166	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:11.385831118 CET	3778	49164	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:12.829552889 CET	3778	49166	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:12.829617977 CET	3778	49164	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:12.829727888 CET	49166	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:12.829727888 CET	49164	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:12.829756975 CET	49166	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:12.829756975 CET	49164	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:12.829763889 CET	49168	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:12.829763889 CET	49170	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:12.949594975 CET	3778	49168	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:12.949700117 CET	49168	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:12.949700117 CET	49168	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:13.068387032 CET	3778	49170	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:13.068512917 CET	49170	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:13.068536043 CET	49170	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:13.069966078 CET	3778	49168	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:13.070027113 CET	49168	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:13.188491106 CET	3778	49170	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:13.188653946 CET	49170	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:13.189697027 CET	3778	49168	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:13.308633089 CET	3778	49170	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:14.626173019 CET	3778	49168	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:14.626207113 CET	3778	49170	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:14.626389027 CET	49168	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:14.626389027 CET	49170	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:14.626491070 CET	49168	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:14.626560926 CET	49172	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:14.626635075 CET	49170	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:14.626637936 CET	49174	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:14.864659071 CET	3778	49172	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:14.864706993 CET	3778	49174	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:14.865118027 CET	49172	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:14.865118027 CET	49174	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:14.865118980 CET	49174	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:14.865204096 CET	49172	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:14.985284090 CET	3778	49174	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:14.985332012 CET	3778	49172	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:14.985584974 CET	49174	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:14.985584974 CET	49172	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:15.108232021 CET	3778	49174	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:15.108277082 CET	3778	49172	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:18.000102997 CET	3778	49172	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:18.000165939 CET	3778	49174	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:18.000478983 CET	49176	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:18.000494003 CET	49172	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:18.000494957 CET	49172	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:18.000494957 CET	49174	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:18.000714064 CET	49178	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:18.000740051 CET	49174	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:18.126727104 CET	3778	49176	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:18.127038956 CET	49176	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:18.127038956 CET	49176	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:18.153736115 CET	3778	49178	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:18.153853893 CET	49178	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:18.153888941 CET	49178	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:18.273066044 CET	3778	49176	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:18.273206949 CET	49176	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:18.273459911 CET	3778	49178	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:18.273516893 CET	49178	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:18.393264055 CET	3778	49176	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:18.393310070 CET	3778	49178	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:21.428271055 CET	3778	49176	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:21.428411961 CET	3778	49178	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:21.428433895 CET	49176	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:21.428433895 CET	49176	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:21.428459883 CET	49178	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:21.428472996 CET	49180	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:21.428497076 CET	49178	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:21.428579092 CET	49182	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:21.548280001 CET	3778	49180	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:21.548296928 CET	3778	49182	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:21.548541069 CET	49180	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:21.548541069 CET	49182	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:21.548541069 CET	49182	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:21.548541069 CET	49180	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:21.668400049 CET	3778	49182	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:21.668447018 CET	3778	49180	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:21.668809891 CET	49182	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:21.668809891 CET	49180	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:21.788861990 CET	3778	49182	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:21.788907051 CET	3778	49180	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:25.170685053 CET	3778	49182	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:25.170701981 CET	3778	49180	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:25.170895100 CET	49182	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:25.170895100 CET	49180	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:25.170895100 CET	49182	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:25.170895100 CET	49180	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:25.170937061 CET	49184	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:25.170937061 CET	49186	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:25.290792942 CET	3778	49184	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:25.290836096 CET	3778	49186	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:25.290950060 CET	49184	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:25.290950060 CET	49186	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:25.290977001 CET	49184	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:25.291048050 CET	49186	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:25.410852909 CET	3778	49184	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:25.410898924 CET	3778	49186	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:25.411180019 CET	49184	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:25.411180019 CET	49186	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:25.531220913 CET	3778	49184	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:25.531266928 CET	3778	49186	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:27.186640024 CET	3778	49184	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:27.186697006 CET	3778	49186	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:27.186975002 CET	49184	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:27.186975002 CET	49186	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:27.186975002 CET	49186	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:27.186975002 CET	49184	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:27.187020063 CET	49188	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:27.187020063 CET	49190	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:27.308805943 CET	3778	49188	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:27.308857918 CET	3778	49190	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:27.309081078 CET	49188	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:27.309081078 CET	49190	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:27.309081078 CET	49188	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:27.309081078 CET	49190	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:27.429373980 CET	3778	49188	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:27.429419041 CET	3778	49190	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:27.429512024 CET	49188	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:27.429512024 CET	49190	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:27.549407959 CET	3778	49188	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:27.549556017 CET	3778	49190	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:29.584294081 CET	3778	49188	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:29.584367990 CET	3778	49190	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:29.584534883 CET	49192	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:29.584583998 CET	49194	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:29.584641933 CET	49188	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:29.584641933 CET	49190	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:29.584641933 CET	49188	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:29.584641933 CET	49190	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:29.704627991 CET	3778	49192	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:29.704802990 CET	49192	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:29.704849958 CET	49192	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:29.704922915 CET	3778	49194	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:29.704982042 CET	49194	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:29.705029011 CET	49194	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:29.824769974 CET	3778	49192	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:29.824884892 CET	3778	49194	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:29.824959993 CET	49192	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:29.824959993 CET	49194	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:29.945008039 CET	3778	49192	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:29.945101976 CET	3778	49194	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:33.177112103 CET	3778	49192	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:33.177198887 CET	3778	49194	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:33.177376032 CET	49192	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:33.177376032 CET	49194	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:33.177428961 CET	49192	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:33.177447081 CET	49196	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:33.177463055 CET	49194	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:33.177551031 CET	49198	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:33.300209999 CET	3778	49196	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:33.300312996 CET	3778	49198	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:33.300628901 CET	49196	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:33.300628901 CET	49196	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:33.300628901 CET	49198	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:33.300628901 CET	49198	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:33.420492887 CET	3778	49196	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:33.420541048 CET	3778	49198	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:33.421005964 CET	49196	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:33.421006918 CET	49198	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:33.541292906 CET	3778	49196	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:33.541342020 CET	3778	49198	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:36.465018034 CET	3778	49198	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:36.465229034 CET	3778	49196	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:36.465380907 CET	49200	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:36.465405941 CET	49196	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:36.465405941 CET	49198	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:36.465405941 CET	49198	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:36.465405941 CET	49196	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:36.465436935 CET	49202	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:36.585055113 CET	3778	49200	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:36.585108995 CET	3778	49202	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:36.585280895 CET	49200	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:36.585280895 CET	49202	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:36.585280895 CET	49202	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:36.585280895 CET	49200	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:36.704937935 CET	3778	49202	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:36.704967976 CET	3778	49200	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:36.705236912 CET	49202	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:36.705236912 CET	49200	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:36.824907064 CET	3778	49202	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:36.824959993 CET	3778	49200	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:39.742605925 CET	3778	49200	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:39.742747068 CET	3778	49202	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:39.742958069 CET	49200	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:39.742958069 CET	49202	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:39.743027925 CET	49200	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:39.743117094 CET	49204	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:39.743175030 CET	49202	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:39.743235111 CET	49206	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:39.863364935 CET	3778	49204	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:39.863420010 CET	3778	49206	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:39.863686085 CET	49204	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:39.863686085 CET	49206	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:39.863811970 CET	49206	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:39.863884926 CET	49204	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:39.984914064 CET	3778	49206	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:39.984957933 CET	3778	49204	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:39.985119104 CET	49206	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:39.985152960 CET	49204	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:40.105068922 CET	3778	49206	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:40.105112076 CET	3778	49204	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:42.352303028 CET	3778	49204	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:42.352368116 CET	3778	49206	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:42.352605104 CET	49204	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:42.352613926 CET	49206	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:42.352634907 CET	49204	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:42.352731943 CET	49208	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:42.352765083 CET	49206	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:42.352838993 CET	49210	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:42.474179029 CET	3778	49208	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:42.474209070 CET	3778	49210	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:42.474442959 CET	49210	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:42.474442959 CET	49208	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:42.474494934 CET	49210	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:42.474560022 CET	49208	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:42.594558954 CET	3778	49210	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:42.594614983 CET	3778	49208	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:42.594723940 CET	49210	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:42.594724894 CET	49208	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:42.714378119 CET	3778	49210	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:42.714544058 CET	3778	49208	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:44.148498058 CET	3778	49210	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:44.148591995 CET	3778	49208	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:44.148679018 CET	49210	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:44.148708105 CET	49208	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:44.148741961 CET	49210	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:44.148811102 CET	49212	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:44.148866892 CET	49208	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:44.148909092 CET	49214	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:44.270090103 CET	3778	49212	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:44.270121098 CET	3778	49214	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:44.270240068 CET	49212	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:44.270257950 CET	49214	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:44.270369053 CET	49214	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:44.270437002 CET	49212	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:44.390006065 CET	3778	49214	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:44.390038013 CET	3778	49212	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:44.390189886 CET	49214	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:44.390209913 CET	49212	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:44.510085106 CET	3778	49214	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:44.510118008 CET	3778	49212	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:46.523932934 CET	3778	49214	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:46.524079084 CET	3778	49212	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:46.524112940 CET	49214	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:46.524190903 CET	49212	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:46.524270058 CET	49214	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:46.524377108 CET	49216	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:46.524425983 CET	49212	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:46.524461031 CET	49218	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:46.644645929 CET	3778	49216	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:46.644730091 CET	3778	49218	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:46.644784927 CET	49216	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:46.644829035 CET	49218	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:46.644903898 CET	49218	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:46.644969940 CET	49216	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:46.765801907 CET	3778	49218	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:46.765846968 CET	3778	49216	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:46.765978098 CET	49218	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:46.765978098 CET	49216	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:46.885737896 CET	3778	49218	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:46.885752916 CET	3778	49216	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:49.834758997 CET	3778	49216	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:49.834924936 CET	3778	49218	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:49.835062027 CET	49216	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:49.835062981 CET	49218	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:49.835062981 CET	49216	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:49.835130930 CET	49220	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:49.835130930 CET	49222	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:49.835160017 CET	49218	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:49.955516100 CET	3778	49220	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:49.955569983 CET	3778	49222	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:49.955702066 CET	49220	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:49.955703020 CET	49220	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:49.955729008 CET	49222	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:49.955729008 CET	49222	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:50.075937033 CET	3778	49220	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:50.075980902 CET	3778	49222	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:50.076128006 CET	49220	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:50.076128006 CET	49222	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:50.196274996 CET	3778	49220	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:50.196321964 CET	3778	49222	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:53.816121101 CET	3778	49220	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:53.816348076 CET	3778	49222	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:53.816395044 CET	49220	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:53.816395044 CET	49220	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:53.816489935 CET	49222	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:53.816536903 CET	49224	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:53.816792011 CET	49226	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:53.816801071 CET	49222	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:53.937824965 CET	3778	49224	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:53.938014030 CET	49224	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:53.938014030 CET	49224	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:53.938139915 CET	3778	49226	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:53.938196898 CET	49226	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:53.938477039 CET	49226	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:54.058335066 CET	3778	49224	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:54.058530092 CET	49224	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:54.058608055 CET	3778	49226	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:54.058666945 CET	49226	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:54.178953886 CET	3778	49224	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:54.178999901 CET	3778	49226	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:55.591258049 CET	3778	49226	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:55.591357946 CET	3778	49224	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:55.591430902 CET	49226	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:55.591526985 CET	49224	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:55.591526985 CET	49224	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:55.591604948 CET	49228	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:55.591610909 CET	49226	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:55.591687918 CET	49230	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:55.714484930 CET	3778	49228	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:55.714579105 CET	3778	49230	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:55.714680910 CET	49228	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:55.714680910 CET	49230	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:55.714680910 CET	49228	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:55.714680910 CET	49230	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:55.835546017 CET	3778	49228	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:55.835669994 CET	3778	49230	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:55.835669041 CET	49228	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:55.835716963 CET	49230	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:55.955513954 CET	3778	49228	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:55.955547094 CET	3778	49230	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:57.294989109 CET	3778	49230	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:57.295041084 CET	3778	49228	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:57.295310974 CET	49230	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:57.295310974 CET	49228	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:57.295404911 CET	49230	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:57.295506001 CET	49232	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:57.295576096 CET	49228	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:57.295627117 CET	49234	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:57.416372061 CET	3778	49232	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:57.416436911 CET	3778	49234	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:57.416543007 CET	49232	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:57.416585922 CET	49234	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:57.416799068 CET	49232	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:57.416881084 CET	49234	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:57.537782907 CET	3778	49232	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:57.537928104 CET	3778	49234	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:57.538115978 CET	49232	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:57.538156033 CET	49234	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:57.658801079 CET	3778	49232	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:57.658844948 CET	3778	49234	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:58.959060907 CET	3778	49234	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:58.959409952 CET	49234	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:58.959470034 CET	49234	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:58.959575891 CET	49236	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:59.037662029 CET	3778	49232	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:59.037920952 CET	49232	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:59.038155079 CET	49232	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:59.038254976 CET	49238	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:59.079443932 CET	3778	49236	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:59.079610109 CET	49236	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:59.079689980 CET	49236	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:59.157989025 CET	3778	49238	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:59.158252954 CET	49238	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:59.158495903 CET	49238	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:59.199780941 CET	3778	49236	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:59.199909925 CET	49236	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:59.278264046 CET	3778	49238	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:59.278405905 CET	49238	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:43:59.322572947 CET	3778	49236	89.213.158.208	192.168.2.23
Dec 22, 2024 15:43:59.398116112 CET	3778	49238	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:00.839071989 CET	3778	49238	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:00.839118958 CET	3778	49236	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:00.839431047 CET	49238	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:00.839432001 CET	49236	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:00.839432001 CET	49236	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:00.839448929 CET	49240	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:00.839512110 CET	49238	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:00.839572906 CET	49242	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:00.961549044 CET	3778	49240	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:00.961632013 CET	3778	49242	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:00.961833000 CET	49240	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:00.961833954 CET	49242	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:00.961981058 CET	49240	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:00.962110996 CET	49242	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:01.084070921 CET	3778	49240	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:01.084109068 CET	3778	49242	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:01.084387064 CET	49240	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:01.084387064 CET	49242	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:01.206540108 CET	3778	49240	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:01.206579924 CET	3778	49242	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:02.596894979 CET	3778	49242	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:02.597059965 CET	3778	49240	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:02.597099066 CET	49242	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:02.597167015 CET	49240	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:02.597223997 CET	49242	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:02.597223997 CET	49240	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:02.597271919 CET	49244	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:02.597368956 CET	49246	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:02.716999054 CET	3778	49244	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:02.717334032 CET	49244	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:02.717334032 CET	49244	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:02.740056992 CET	3778	49246	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:02.740235090 CET	49246	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:02.740235090 CET	49246	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:02.837686062 CET	3778	49244	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:02.837903976 CET	49244	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:02.859800100 CET	3778	49246	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:02.860052109 CET	49246	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:02.957576036 CET	3778	49244	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:02.979695082 CET	3778	49246	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:04.303695917 CET	3778	49246	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:04.303729057 CET	3778	49244	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:04.304080963 CET	49248	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:04.304080963 CET	49250	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:04.304179907 CET	49244	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:04.304179907 CET	49244	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:04.304179907 CET	49246	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:04.304179907 CET	49246	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:04.424122095 CET	3778	49248	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:04.424165964 CET	3778	49250	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:04.424369097 CET	49248	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:04.424369097 CET	49250	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:04.424520969 CET	49248	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:04.424521923 CET	49250	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:04.544245005 CET	3778	49248	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:04.544287920 CET	3778	49250	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:04.544506073 CET	49248	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:04.544506073 CET	49250	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:04.665242910 CET	3778	49248	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:04.665287018 CET	3778	49250	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:07.788659096 CET	3778	49248	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:07.788693905 CET	3778	49250	89.213.158.208	192.168.2.23
Dec 22, 2024 15:44:07.788834095 CET	49248	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:07.788922071 CET	49250	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:07.788963079 CET	49248	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:07.789045095 CET	49252	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:07.789118052 CET	49250	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:44:07.789165020 CET	49254	3778	192.168.2.23	89.213.158.208

System Behavior

Analysis Process: Space.x86.elf PID: 6257, Parent PID: 6183

General

Start time (UTC):	14:41:56
Start date (UTC):	22/12/2024
Path:	/tmp/Space.x86.elf
Arguments:	/tmp/Space.x86.elf
File size:	34896 bytes
MD5 hash:	f66071f9e603dd7b96793058e206b45c

Chronological Activities

Analysis Process: Space.x86.elf PID: 6258, Parent PID: 6257

General

Start time (UTC):	14:41:56
Start date (UTC):	22/12/2024
Path:	/tmp/Space.x86.elf
Arguments:	-
File size:	34896 bytes
MD5 hash:	f66071f9e603dd7b96793058e206b45c

Chronological Activities

Analysis Process: Space.x86.elf PID: 6259, Parent PID: 6258

General

Start time (UTC):	14:41:56
Start date (UTC):	22/12/2024
Path:	/tmp/Space.x86.elf
Arguments:	-
File size:	34896 bytes
MD5 hash:	f66071f9e603dd7b96793058e206b45c

Chronological Activities

Analysis Process: Space.x86.elf PID: 6260, Parent PID: 6258

General

Start time (UTC):	14:41:56
Start date (UTC):	22/12/2024
Path:	/tmp/Space.x86.elf
Arguments:	-
File size:	34896 bytes
MD5 hash:	f66071f9e603dd7b96793058e206b45c

Analysis Process: Space.x86.elf PID: 6286, Parent PID: 6257

General

Start time (UTC):	14:42:02
Start date (UTC):	22/12/2024
Path:	/tmp/Space.x86.elf
Arguments:	-
File size:	34896 bytes
MD5 hash:	f66071f9e603dd7b96793058e206b45c

Chronological Activities

Analysis Process: Space.x86.elf PID: 6287, Parent PID: 6257

General

Start time (UTC):	14:42:02
Start date (UTC):	22/12/2024
Path:	/tmp/Space.x86.elf
Arguments:	-
File size:	34896 bytes
MD5 hash:	f66071f9e603dd7b96793058e206b45c

Analysis Process: dash PID: 6264, Parent PID: 4331

General

Start time (UTC):	14:41:58
Start date (UTC):	22/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6264, Parent PID: 4331

General

Start time (UTC):	14:41:58
Start date (UTC):	22/12/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.FaSbxKwr0i /tmp/tmp.r0aODzvN1V /tmp/tmp.xxTImeJncx
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 6265, Parent PID: 4331

General

Start time (UTC):	14:41:58
Start date (UTC):	22/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6265, Parent PID: 4331

General

Start time (UTC):	14:41:58
Start date (UTC):	22/12/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.FaSbxKwr0i /tmp/tmp.r0aODzvN1V /tmp/tmp.xxTImeJncx
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Space.x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: Space.x86.elf PID: 6257, Parent PID: 6183

General

Chronological Activities

Analysis Process: Space.x86.elf PID: 6258, Parent PID: 6257

General

Chronological Activities

Analysis Process: Space.x86.elf PID: 6259, Parent PID: 6258

General

Chronological Activities

Analysis Process: Space.x86.elf PID: 6260, Parent PID: 6258

General

Analysis Process: Space.x86.elf PID: 6286, Parent PID: 6257

General

Chronological Activities

Analysis Process: Space.x86.elf PID: 6287, Parent PID: 6257

General

Analysis Process: dash PID: 6264, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6264, Parent PID: 4331

General

Chronological Activities

Linux Analysis Report
Space.x86.elf