Edit tour

Linux Analysis Report
ub8ehJSePAfc9FYqZIT6.arm7.elf

Overview

General Information

Sample name:	ub8ehJSePAfc9FYqZIT6.arm7.elf
Analysis ID:	1579582
MD5:	dd8912eb748a3b3d43b0d09182d9b84c
SHA1:	64cd4170db13db6ac7136dcec2cef18167dc0d81
SHA256:	90960c76eb5015cd3bae1b149917c699ba527a370137e2310c25c4f7d14f8741
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579582
Start date and time:	2024-12-23 03:22:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ub8ehJSePAfc9FYqZIT6.arm7.elf
Detection:	MAL
Classification:	mal68.troj.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf
PID:	6242
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242, Parent: 6165, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf

ub8ehJSePAfc9FYqZIT6.arm7.elf New Fork (PID: 6244, Parent: 6242)

ub8ehJSePAfc9FYqZIT6.arm7.elf New Fork (PID: 6246, Parent: 6244)

ub8ehJSePAfc9FYqZIT6.arm7.elf New Fork (PID: 6248, Parent: 6244)

ub8ehJSePAfc9FYqZIT6.arm7.elf New Fork (PID: 6254, Parent: 6242)

ub8ehJSePAfc9FYqZIT6.arm7.elf New Fork (PID: 6256, Parent: 6242)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
6242.1.00007fa960017000.00007fa96002f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6242.1.00007fa960017000.00007fa96002f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1542c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1547c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1551c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1556c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6246.1.00007fa960017000.00007fa96002f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6246.1.00007fa960017000.00007fa96002f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1542c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1547c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1551c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1556c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6244.1.00007fa960017000.00007fa96002f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6244.1.00007fa960017000.00007fa96002f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1542c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1547c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1551c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1556c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6254.1.00007fa960017000.00007fa96002f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6254.1.00007fa960017000.00007fa96002f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1542c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1547c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1551c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1556c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6242	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6242	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x71a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x72e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x742:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x756:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x76a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x77e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x792:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x80a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x81e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x832:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x846:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x85a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x86e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x882:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x896:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6244	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6244	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x331b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x332f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3343:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3357:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x336b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x337f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3393:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x340b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x341f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3433:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3447:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x345b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x346f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3483:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3497:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6246	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6246	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x134:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x148:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x198:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6254	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6254	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16164:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16178:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1618c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x161a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x161b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x161c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x161dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x161f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16204:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16218:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1622c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16240:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16254:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16268:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1627c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16290:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 11 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ub8ehJSePAfc9FYqZIT6.arm7.elf	ReversingLabs: Detection: 39%
Source: ub8ehJSePAfc9FYqZIT6.arm7.elf	Virustotal: Detection: 36%			Perma Link

Source: global traffic

TCP traffic: 192.168.2.23:45330 -> 195.26.252.19:3778

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19

Source: ub8ehJSePAfc9FYqZIT6.arm7.elf

String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 6242.1.00007fa960017000.00007fa96002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6246.1.00007fa960017000.00007fa96002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6244.1.00007fa960017000.00007fa96002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6254.1.00007fa960017000.00007fa96002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6242, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6244, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6246, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6254, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0x8000

Source: 6242.1.00007fa960017000.00007fa96002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6246.1.00007fa960017000.00007fa96002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6244.1.00007fa960017000.00007fa96002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6254.1.00007fa960017000.00007fa96002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6242, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6244, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6246, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6254, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal68.troj.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/1582/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/3088/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/1579/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/1699/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/1335/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/1698/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/1334/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/1576/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/2302/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/910/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/6226/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/912/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/2307/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/918/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/6242/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/1594/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/1349/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/1344/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/1465/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/1586/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/1463/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/801/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/1900/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/491/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/1599/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/1477/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/379/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/1476/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/6248/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/2208/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/6142/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/1809/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)	File opened: /proc/1494/status	Jump to behavior

Source: ub8ehJSePAfc9FYqZIT6.arm7.elf

Submission file: segment LOAD with 7.9748 entropy (max. 8.0)

Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 6242)

Queries kernel information via 'uname':

Jump to behavior

Source: ub8ehJSePAfc9FYqZIT6.arm7.elf, 6242.1.00007ffcadd71000.00007ffcadd92000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 6244.1.00007ffcadd71000.00007ffcadd92000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 6246.1.00007ffcadd71000.00007ffcadd92000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 6254.1.00007ffcadd71000.00007ffcadd92000.rw-.sdmp	Binary or memory string: Fx86_64/usr/bin/qemu-arm/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf
Source: ub8ehJSePAfc9FYqZIT6.arm7.elf, 6242.1.000055b81a4d3000.000055b81a722000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 6244.1.000055b81a4d3000.000055b81a701000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 6246.1.000055b81a4d3000.000055b81a701000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 6254.1.000055b81a4d3000.000055b81a722000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: ub8ehJSePAfc9FYqZIT6.arm7.elf, 6242.1.000055b81a4d3000.000055b81a722000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 6244.1.000055b81a4d3000.000055b81a701000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 6246.1.000055b81a4d3000.000055b81a701000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 6254.1.000055b81a4d3000.000055b81a722000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: ub8ehJSePAfc9FYqZIT6.arm7.elf, 6242.1.00007ffcadd71000.00007ffcadd92000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 6244.1.00007ffcadd71000.00007ffcadd92000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 6246.1.00007ffcadd71000.00007ffcadd92000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 6254.1.00007ffcadd71000.00007ffcadd92000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 6242.1.00007fa960017000.00007fa96002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6246.1.00007fa960017000.00007fa96002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6244.1.00007fa960017000.00007fa96002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6254.1.00007fa960017000.00007fa96002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6242, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6246, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6254, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 6242.1.00007fa960017000.00007fa96002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6246.1.00007fa960017000.00007fa96002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6244.1.00007fa960017000.00007fa96002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6254.1.00007fa960017000.00007fa96002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6242, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6246, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6254, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ub8ehJSePAfc9FYqZIT6.arm7.elf	39%	ReversingLabs	Linux.Trojan.Mirai
ub8ehJSePAfc9FYqZIT6.arm7.elf	37%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	ub8ehJSePAfc9FYqZIT6.arm7.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
195.26.252.19	unknown	United Kingdom	8897	KCOM-SPNService-ProviderNetworkex-MistralGB	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
195.26.252.19	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse
91.189.91.43	Mozi.m.elf	Get hash	malicious	Unknown	Browse
	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	loligang.m68k.elf	Get hash	malicious	Mirai	Browse
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	loligang.arm5.elf	Get hash	malicious	Mirai	Browse
	loligang.arm6.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	Mozi.m.elf	Get hash	malicious	Unknown	Browse
	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	loligang.m68k.elf	Get hash	malicious	Mirai	Browse
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	loligang.arm5.elf	Get hash	malicious	Mirai	Browse
	loligang.arm6.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	Mozi.m.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	bot.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	loligang.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	loligang.arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	loligang.arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CANONICAL-ASGB	Mozi.m.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	bot.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	loligang.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	loligang.arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	loligang.arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
INIT7CH	Mozi.m.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
	bot.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	loligang.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
	loligang.arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	loligang.arm6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
KCOM-SPNService-ProviderNetworkex-MistralGB	ub8ehJSePAfc9FYqZIT6.i686.elf	Get hash	malicious	Unknown	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse	195.26.252.19
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	213.254.174.221
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	193.108.169.23
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	217.154.178.248
	ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	159.15.89.185
	IGz.mpsl.elf	Get hash	malicious	Mirai	Browse	158.179.218.195
	TRC.ppc.elf	Get hash	malicious	Mirai	Browse	159.15.172.177
	zZ8OdFfZnb.exe	Get hash	malicious	Unknown	Browse	194.164.163.84
	pH6L2VWRbU.dll	Get hash	malicious	Unknown	Browse	194.164.163.84

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.98468899684191
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	ub8ehJSePAfc9FYqZIT6.arm7.elf
File size:	61'848 bytes
MD5:	dd8912eb748a3b3d43b0d09182d9b84c
SHA1:	64cd4170db13db6ac7136dcec2cef18167dc0d81
SHA256:	90960c76eb5015cd3bae1b149917c699ba527a370137e2310c25c4f7d14f8741
SHA512:	df56b75cf99b4fbac9a911df154d7dabcb6772133fa346bb9608546064036bb7893754548c42cb901087d82c3b6c9baed1da63138fd07529f777f4a51e487fc9
SSDEEP:	1536:O7XduYshWhq/HIEy6Og3Nwz9hAy33uLLSM5Tfv83KJGTb6R4O:QdpssMPR9w4y33GLXTX83K0Tb6Rt
TLSH:	5353026294036875E7637E7BB6F00FC3FA0DCB72B499647D21663184F6F8971286128B
File Content Preview:	.ELF..............(.....h...4...........4. ...(.....................U...U................6...6...6..................Q.td...............................OUPX!.........n...n......j..........?.E.h;....#..$...o....P.G.o.....X.*.V......f..T.qh...4.8........8.\|i

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0x11c68
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8000	0x8000	0xae55	0xae55	7.9748	0x5	R E	0x8000
LOAD	0x36c8	0x236c8	0x236c8	0x0	0x0	0.0000	0x6	RW	0x8000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 03:22:52.232536077 CET	45330	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:52.352790117 CET	3778	45330	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:52.352907896 CET	45330	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:52.365700960 CET	45330	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:52.485941887 CET	3778	45330	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:52.485980988 CET	45330	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:52.606157064 CET	3778	45330	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:53.519717932 CET	3778	45330	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:53.519927979 CET	45330	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:53.520097017 CET	45330	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:53.521013975 CET	45332	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:53.640614986 CET	3778	45332	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:53.640963078 CET	45332	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:53.642323971 CET	45332	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:53.762136936 CET	3778	45332	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:53.762231112 CET	45332	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:53.882333994 CET	3778	45332	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:54.398159981 CET	43928	443	192.168.2.23	91.189.91.42
Dec 23, 2024 03:22:54.778964043 CET	3778	45332	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:54.779063940 CET	45332	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:54.779108047 CET	45332	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:54.779736996 CET	45334	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:54.899661064 CET	3778	45334	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:54.899734020 CET	45334	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:54.900408983 CET	45334	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:55.020482063 CET	3778	45334	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:55.020572901 CET	45334	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:55.141053915 CET	3778	45334	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:56.039217949 CET	3778	45334	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:56.039429903 CET	45334	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:56.039429903 CET	45334	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:56.040070057 CET	45336	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:56.160110950 CET	3778	45336	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:56.160394907 CET	45336	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:56.161225080 CET	45336	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:56.281161070 CET	3778	45336	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:56.281373978 CET	45336	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:56.401724100 CET	3778	45336	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:57.299494028 CET	3778	45336	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:57.299737930 CET	45336	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:57.299767971 CET	45336	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:57.300404072 CET	45338	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:57.420253992 CET	3778	45338	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:57.420636892 CET	45338	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:57.421709061 CET	45338	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:57.541541100 CET	3778	45338	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:57.541807890 CET	45338	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:57.661963940 CET	3778	45338	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:58.066239119 CET	45340	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:58.186522007 CET	3778	45340	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:58.186619043 CET	45340	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:58.215888977 CET	45340	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:58.335719109 CET	3778	45340	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:58.335805893 CET	45340	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:58.455940962 CET	3778	45340	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:58.565006971 CET	3778	45338	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:58.565406084 CET	45338	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:58.565406084 CET	45338	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:58.566561937 CET	45342	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:58.686517954 CET	3778	45342	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:58.686635971 CET	45342	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:58.687808037 CET	45342	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:58.807576895 CET	3778	45342	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:58.807693958 CET	45342	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:58.927519083 CET	3778	45342	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:59.325526953 CET	3778	45340	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:59.325815916 CET	45340	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:59.325815916 CET	45340	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:59.326622009 CET	45344	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:59.446619034 CET	3778	45344	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:59.446799994 CET	45344	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:59.448041916 CET	45344	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:59.567822933 CET	3778	45344	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:59.568025112 CET	45344	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:59.688114882 CET	3778	45344	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:59.773504972 CET	42836	443	192.168.2.23	91.189.91.43
Dec 23, 2024 03:22:59.827444077 CET	3778	45342	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:59.827738047 CET	45342	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:59.827738047 CET	45342	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:59.828707933 CET	45346	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:59.948520899 CET	3778	45346	195.26.252.19	192.168.2.23
Dec 23, 2024 03:22:59.948751926 CET	45346	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:22:59.949893951 CET	45346	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:00.069714069 CET	3778	45346	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:00.069956064 CET	45346	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:00.189810991 CET	3778	45346	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:00.589026928 CET	3778	45344	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:00.589135885 CET	45344	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:00.589154959 CET	45344	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:00.590295076 CET	45348	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:00.710402966 CET	3778	45348	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:00.710716963 CET	45348	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:00.712570906 CET	45348	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:00.832377911 CET	3778	45348	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:00.832819939 CET	45348	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:00.952989101 CET	3778	45348	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:01.089734077 CET	3778	45346	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:01.089845896 CET	45346	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:01.089863062 CET	45346	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:01.091398001 CET	45350	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:01.211227894 CET	3778	45350	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:01.211452961 CET	45350	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:01.213258982 CET	45350	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:01.309199095 CET	42516	80	192.168.2.23	109.202.202.202
Dec 23, 2024 03:23:01.333080053 CET	3778	45350	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:01.333271027 CET	45350	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:01.453349113 CET	3778	45350	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:01.846594095 CET	3778	45348	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:01.846760035 CET	45348	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:01.846760035 CET	45348	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:01.847860098 CET	45352	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:01.967902899 CET	3778	45352	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:01.968075991 CET	45352	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:01.970015049 CET	45352	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:02.090075016 CET	3778	45352	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:02.090471029 CET	45352	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:02.210766077 CET	3778	45352	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:02.349823952 CET	3778	45350	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:02.350239038 CET	45350	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:02.350464106 CET	45350	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:02.351310015 CET	45354	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:02.471031904 CET	3778	45354	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:02.471129894 CET	45354	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:02.472695112 CET	45354	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:02.592834949 CET	3778	45354	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:02.593085051 CET	45354	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:02.714087963 CET	3778	45354	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:03.106374979 CET	3778	45352	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:03.106583118 CET	45352	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:03.106615067 CET	45352	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:03.107793093 CET	45356	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:03.227646112 CET	3778	45356	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:03.228102922 CET	45356	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:03.230531931 CET	45356	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:03.350311041 CET	3778	45356	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:03.350658894 CET	45356	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:03.470495939 CET	3778	45356	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:03.606987953 CET	3778	45354	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:03.607270956 CET	45354	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:03.607395887 CET	45354	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:03.608900070 CET	45358	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:03.728563070 CET	3778	45358	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:03.728894949 CET	45358	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:03.731266975 CET	45358	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:03.851332903 CET	3778	45358	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:03.851732016 CET	45358	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:03.971621990 CET	3778	45358	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:04.869626045 CET	3778	45358	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:04.870003939 CET	45358	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:04.870003939 CET	45358	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:04.870898008 CET	45360	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:04.990472078 CET	3778	45360	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:04.990691900 CET	45360	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:04.992336035 CET	45360	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:05.116503000 CET	3778	45360	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:05.116802931 CET	45360	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:05.236880064 CET	3778	45360	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:06.128642082 CET	3778	45360	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:06.129040003 CET	45360	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:06.129142046 CET	45360	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:06.130063057 CET	45362	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:06.249677896 CET	3778	45362	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:06.250122070 CET	45362	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:06.251530886 CET	45362	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:06.371155977 CET	3778	45362	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:06.371381044 CET	45362	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:06.491133928 CET	3778	45362	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:07.389158010 CET	3778	45362	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:07.389744997 CET	45362	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:07.389744997 CET	45362	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:07.390609026 CET	45364	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:07.510262012 CET	3778	45364	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:07.510781050 CET	45364	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:07.513097048 CET	45364	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:07.632730007 CET	3778	45364	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:07.632961988 CET	45364	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:07.752829075 CET	3778	45364	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:08.648550034 CET	3778	45364	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:08.648973942 CET	45364	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:08.649061918 CET	45364	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:08.650887012 CET	45366	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:08.770823956 CET	3778	45366	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:08.771063089 CET	45366	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:08.772496939 CET	45366	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:08.892425060 CET	3778	45366	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:08.892761946 CET	45366	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:09.012762070 CET	3778	45366	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:09.910051107 CET	3778	45366	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:09.910623074 CET	45366	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:09.910623074 CET	45366	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:09.911711931 CET	45368	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:10.031465054 CET	3778	45368	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:10.031797886 CET	45368	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:10.033360958 CET	45368	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:10.153265953 CET	3778	45368	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:10.153768063 CET	45368	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:10.274009943 CET	3778	45368	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:11.169800043 CET	3778	45368	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:11.170227051 CET	45368	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:11.170228004 CET	45368	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:11.171478033 CET	45370	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:11.291079044 CET	3778	45370	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:11.291292906 CET	45370	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:11.292645931 CET	45370	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:11.412525892 CET	3778	45370	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:11.412821054 CET	45370	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:11.533087015 CET	3778	45370	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:12.427905083 CET	3778	45370	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:12.428236961 CET	45370	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:12.428236961 CET	45370	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:12.429193020 CET	45372	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:12.548816919 CET	3778	45372	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:12.548954964 CET	45372	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:12.550542116 CET	45372	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:12.670134068 CET	3778	45372	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:12.670398951 CET	45372	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:12.790267944 CET	3778	45372	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:13.239603996 CET	45356	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:13.359721899 CET	3778	45356	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:13.581707001 CET	3778	45356	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:13.582194090 CET	45356	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:13.685440063 CET	3778	45372	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:13.685543060 CET	45372	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:13.685571909 CET	45372	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:13.686549902 CET	45374	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:13.806272030 CET	3778	45374	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:13.806602955 CET	45374	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:13.809218884 CET	45374	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:13.929081917 CET	3778	45374	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:13.929281950 CET	45374	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:14.049236059 CET	3778	45374	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:14.959383011 CET	3778	45374	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:14.959505081 CET	45374	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:14.959563017 CET	45374	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:14.961827040 CET	45376	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:15.081387997 CET	3778	45376	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:15.081702948 CET	45376	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:15.084131956 CET	45376	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:15.204027891 CET	3778	45376	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:15.204421043 CET	45376	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:15.324301004 CET	3778	45376	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:15.643343925 CET	43928	443	192.168.2.23	91.189.91.42
Dec 23, 2024 03:23:16.221621990 CET	3778	45376	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:16.221839905 CET	45376	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:16.221839905 CET	45376	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:16.222579002 CET	45378	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:16.342385054 CET	3778	45378	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:16.342719078 CET	45378	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:16.344374895 CET	45378	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:16.464046001 CET	3778	45378	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:16.464253902 CET	45378	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:16.584729910 CET	3778	45378	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:17.481245041 CET	3778	45378	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:17.481587887 CET	45378	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:17.481589079 CET	45378	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:17.482358932 CET	45380	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:17.602216005 CET	3778	45380	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:17.602539062 CET	45380	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:17.603954077 CET	45380	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:17.723913908 CET	3778	45380	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:17.724183083 CET	45380	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:17.844023943 CET	3778	45380	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:18.744390965 CET	3778	45380	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:18.744651079 CET	45380	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:18.744651079 CET	45380	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:18.745522022 CET	45382	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:18.865350008 CET	3778	45382	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:18.865570068 CET	45382	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:18.867269039 CET	45382	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:18.987111092 CET	3778	45382	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:18.987309933 CET	45382	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:19.107280970 CET	3778	45382	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:20.011163950 CET	3778	45382	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:20.011301994 CET	45382	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:20.011301994 CET	45382	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:20.012322903 CET	45384	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:20.132054090 CET	3778	45384	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:20.132302999 CET	45384	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:20.134361029 CET	45384	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:20.254628897 CET	3778	45384	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:20.254895926 CET	45384	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:20.374850035 CET	3778	45384	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:21.270231009 CET	3778	45384	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:21.270369053 CET	45384	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:21.270369053 CET	45384	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:21.271275043 CET	45386	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:21.391210079 CET	3778	45386	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:21.391424894 CET	45386	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:21.393250942 CET	45386	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:21.513169050 CET	3778	45386	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:21.513480902 CET	45386	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:21.633806944 CET	3778	45386	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:22.532052994 CET	3778	45386	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:22.532223940 CET	45386	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:22.532430887 CET	45386	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:22.533854008 CET	45388	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:22.653419971 CET	3778	45388	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:22.653708935 CET	45388	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:22.654906034 CET	45388	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:22.775016069 CET	3778	45388	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:22.775295019 CET	45388	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:22.895054102 CET	3778	45388	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:23.791003942 CET	3778	45388	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:23.791196108 CET	45388	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:23.791196108 CET	45388	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:23.792165995 CET	45390	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:23.911998034 CET	3778	45390	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:23.912286997 CET	45390	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:23.914693117 CET	45390	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:24.034252882 CET	3778	45390	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:24.034513950 CET	45390	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:24.154459953 CET	3778	45390	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:25.050121069 CET	3778	45390	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:25.050498962 CET	45390	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:25.050573111 CET	45390	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:25.051595926 CET	45392	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:25.172468901 CET	3778	45392	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:25.172826052 CET	45392	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:25.174245119 CET	45392	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:25.293963909 CET	3778	45392	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:25.294085026 CET	45392	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:25.414336920 CET	3778	45392	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:25.882024050 CET	42836	443	192.168.2.23	91.189.91.43
Dec 23, 2024 03:23:26.311815977 CET	3778	45392	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:26.311955929 CET	45392	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:26.311989069 CET	45392	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:26.312875032 CET	45394	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:26.432430029 CET	3778	45394	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:26.432522058 CET	45394	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:26.433785915 CET	45394	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:26.553452015 CET	3778	45394	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:26.553775072 CET	45394	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:26.673702955 CET	3778	45394	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:27.573692083 CET	3778	45394	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:27.573971987 CET	45394	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:27.574057102 CET	45394	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:27.575278044 CET	45396	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:27.695247889 CET	3778	45396	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:27.695801020 CET	45396	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:27.697616100 CET	45396	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:27.817392111 CET	3778	45396	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:27.817759037 CET	45396	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:27.937901020 CET	3778	45396	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:28.834316969 CET	3778	45396	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:28.834803104 CET	45396	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:28.834803104 CET	45396	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:28.835817099 CET	45398	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:28.956119061 CET	3778	45398	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:28.956398010 CET	45398	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:28.958101034 CET	45398	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:29.077944040 CET	3778	45398	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:29.078197002 CET	45398	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:29.198442936 CET	3778	45398	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:30.095571041 CET	3778	45398	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:30.096014977 CET	45398	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:30.096014977 CET	45398	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:30.097518921 CET	45400	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:30.217390060 CET	3778	45400	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:30.217672110 CET	45400	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:30.219472885 CET	45400	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:30.340176105 CET	3778	45400	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:30.340429068 CET	45400	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:30.460726976 CET	3778	45400	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:31.356961966 CET	3778	45400	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:31.357163906 CET	45400	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:31.357254982 CET	45400	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:31.358692884 CET	45402	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:31.478558064 CET	3778	45402	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:31.478804111 CET	45402	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:31.480880976 CET	45402	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:31.600867033 CET	3778	45402	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:31.601118088 CET	45402	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:31.721049070 CET	3778	45402	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:32.025103092 CET	42516	80	192.168.2.23	109.202.202.202
Dec 23, 2024 03:23:32.620471001 CET	3778	45402	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:32.620671034 CET	45402	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:32.620743036 CET	45402	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:32.621793032 CET	45404	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:32.741779089 CET	3778	45404	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:32.742317915 CET	45404	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:32.744056940 CET	45404	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:32.863938093 CET	3778	45404	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:32.864377022 CET	45404	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:32.984167099 CET	3778	45404	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:33.880578041 CET	3778	45404	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:33.880940914 CET	45404	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:33.880942106 CET	45404	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:33.881947041 CET	45406	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:34.001954079 CET	3778	45406	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:34.002310991 CET	45406	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:34.004265070 CET	45406	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:34.124341011 CET	3778	45406	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:34.124480963 CET	45406	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:34.244558096 CET	3778	45406	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:35.143429041 CET	3778	45406	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:35.143865108 CET	45406	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:35.143959999 CET	45406	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:35.145137072 CET	45408	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:35.264993906 CET	3778	45408	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:35.265150070 CET	45408	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:35.266868114 CET	45408	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:35.386666059 CET	3778	45408	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:35.386846066 CET	45408	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:35.506608963 CET	3778	45408	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:36.403445959 CET	3778	45408	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:36.403670073 CET	45408	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:36.403875113 CET	45408	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:36.405097961 CET	45410	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:36.525136948 CET	3778	45410	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:36.525422096 CET	45410	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:36.528227091 CET	45410	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:36.648457050 CET	3778	45410	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:36.648854971 CET	45410	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:36.769251108 CET	3778	45410	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:37.664416075 CET	3778	45410	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:37.664755106 CET	45410	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:37.664778948 CET	45410	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:37.666131020 CET	45412	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:37.786298990 CET	3778	45412	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:37.786514044 CET	45412	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:37.788815022 CET	45412	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:37.908744097 CET	3778	45412	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:37.909159899 CET	45412	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:38.029738903 CET	3778	45412	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:47.792078972 CET	45412	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:47.912025928 CET	3778	45412	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:48.132707119 CET	3778	45412	195.26.252.19	192.168.2.23
Dec 23, 2024 03:23:48.132937908 CET	45412	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:23:56.598303080 CET	43928	443	192.168.2.23	91.189.91.42
Dec 23, 2024 03:24:13.635222912 CET	45356	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:24:13.755438089 CET	3778	45356	195.26.252.19	192.168.2.23
Dec 23, 2024 03:24:13.976866007 CET	3778	45356	195.26.252.19	192.168.2.23
Dec 23, 2024 03:24:13.977018118 CET	45356	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:24:48.170625925 CET	45412	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:24:48.290930033 CET	3778	45412	195.26.252.19	192.168.2.23
Dec 23, 2024 03:24:48.511522055 CET	3778	45412	195.26.252.19	192.168.2.23
Dec 23, 2024 03:24:48.511759996 CET	45412	3778	192.168.2.23	195.26.252.19

System Behavior

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6242, Parent PID: 6165

General

Start time (UTC):	02:22:51
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf
Arguments:	/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6244, Parent PID: 6242

General

Start time (UTC):	02:22:51
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6246, Parent PID: 6244

General

Start time (UTC):	02:22:51
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6248, Parent PID: 6244

General

Start time (UTC):	02:22:51
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6254, Parent PID: 6242

General

Start time (UTC):	02:22:57
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6256, Parent PID: 6242

General

Start time (UTC):	02:22:57
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ub8ehJSePAfc9FYqZIT6.arm7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6242, Parent PID: 6165

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6244, Parent PID: 6242

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6246, Parent PID: 6244

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6248, Parent PID: 6244

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6254, Parent PID: 6242

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 6256, Parent PID: 6242

General

Chronological Activities

Linux Analysis Report
ub8ehJSePAfc9FYqZIT6.arm7.elf