Edit tour

Linux Analysis Report
ub8ehJSePAfc9FYqZIT6.i686.elf

Overview

General Information

Sample name:	ub8ehJSePAfc9FYqZIT6.i686.elf
Analysis ID:	1579583
MD5:	5a0517d1fa30a6fab030e281d2957328
SHA1:	4abefe8b469f8e7efebb4756ea5d0963cff00161
SHA256:	e9b0591495af8c41cc5d6bb3dc368fc2df912322fd62be36c378f1b854764290
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579583
Start date and time:	2024-12-23 03:22:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ub8ehJSePAfc9FYqZIT6.i686.elf
Detection:	MAL
Classification:	mal64.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/ub8ehJSePAfc9FYqZIT6.i686.elf
PID:	5432
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432, Parent: 5358, MD5: 5a0517d1fa30a6fab030e281d2957328) Arguments: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf

ub8ehJSePAfc9FYqZIT6.i686.elf New Fork (PID: 5433, Parent: 5432)

ub8ehJSePAfc9FYqZIT6.i686.elf New Fork (PID: 5434, Parent: 5433)

ub8ehJSePAfc9FYqZIT6.i686.elf New Fork (PID: 5435, Parent: 5433)

ub8ehJSePAfc9FYqZIT6.i686.elf New Fork (PID: 5446, Parent: 5432)

ub8ehJSePAfc9FYqZIT6.i686.elf New Fork (PID: 5447, Parent: 5432)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5432.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x115f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1161c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11630:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11644:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11658:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1166c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11680:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11694:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1170c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11720:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11734:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11748:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1175c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11770:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11784:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5432.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x9ccb:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
5432.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x84ae:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
5434.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x115f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1161c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11630:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11644:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11658:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1166c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11680:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11694:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1170c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11720:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11734:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11748:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1175c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11770:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11784:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5434.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x9ccb:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
5434.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x84ae:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
5433.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x115f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1161c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11630:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11644:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11658:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1166c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11680:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11694:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1170c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11720:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11734:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11748:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1175c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11770:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11784:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5433.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x9ccb:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
5433.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x84ae:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
5446.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x115f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1161c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11630:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11644:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11658:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1166c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11680:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11694:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1170c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11720:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11734:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11748:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1175c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11770:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11784:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5446.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x9ccb:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
5446.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x84ae:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
Process Memory Space: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5432	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xb01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbb5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbc9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbdd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbf1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc05:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc19:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc41:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc55:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc69:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc7d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc91:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5433	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xccc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xce0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5434	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xbf6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc0a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc1e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc32:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc46:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc5a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc6e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc82:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc96:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcaa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcbe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xce6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcfa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd0e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd22:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd36:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd4a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd5e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd72:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd86:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5446	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x463:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x477:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x48b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x49f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x503:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x517:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x52b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x53f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x553:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x567:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x57b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x58f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 11 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ub8ehJSePAfc9FYqZIT6.i686.elf

ReversingLabs: Detection: 47%

Machine Learning detection for sample

Source: ub8ehJSePAfc9FYqZIT6.i686.elf

Joe Sandbox ML: detected

Source: global traffic

TCP traffic: 192.168.2.13:36150 -> 195.26.252.19:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19

Source: ub8ehJSePAfc9FYqZIT6.i686.elf

String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 5432.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5432.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 5432.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 5434.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5434.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 5434.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 5433.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5433.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 5433.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 5446.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5446.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 5446.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5432, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5433, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5434, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5446, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0xc01000

Source: 5432.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5432.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 5432.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 5434.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 5433.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5433.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 5433.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 5446.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5446.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 5446.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5432, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5433, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5434, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5446, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal64.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/5380/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/238/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/239/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/914/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/917/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/5275/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/3772/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/19/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/240/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/3095/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/241/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/242/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/244/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/245/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/1588/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/246/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/5/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/247/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/7/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/129/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/8/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/1906/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/802/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/803/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/3420/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/1482/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/490/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/1480/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/371/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/131/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/1238/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/134/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/378/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/3413/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.i686.elf (PID: 5432)	File opened: /proc/30/status	Jump to behavior

Source: ub8ehJSePAfc9FYqZIT6.i686.elf

Submission file: segment LOAD with 7.962 entropy (max. 8.0)

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ub8ehJSePAfc9FYqZIT6.i686.elf	47%	ReversingLabs	Linux.Backdoor.Mirai
ub8ehJSePAfc9FYqZIT6.i686.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	ub8ehJSePAfc9FYqZIT6.i686.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
195.26.252.19	unknown	United Kingdom		8897	KCOM-SPNService-ProviderNetworkex-MistralGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
195.26.252.19	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
KCOM-SPNService-ProviderNetworkex-MistralGB	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse	195.26.252.19
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	213.254.174.221
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	193.108.169.23
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	217.154.178.248
	ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	159.15.89.185
	IGz.mpsl.elf	Get hash	malicious	Mirai	Browse	158.179.218.195
	TRC.ppc.elf	Get hash	malicious	Mirai	Browse	159.15.172.177
	zZ8OdFfZnb.exe	Get hash	malicious	Unknown	Browse	194.164.163.84
	pH6L2VWRbU.dll	Get hash	malicious	Unknown	Browse	194.164.163.84
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	158.179.254.255

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.960091395823542
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	ub8ehJSePAfc9FYqZIT6.i686.elf
File size:	38'304 bytes
MD5:	5a0517d1fa30a6fab030e281d2957328
SHA1:	4abefe8b469f8e7efebb4756ea5d0963cff00161
SHA256:	e9b0591495af8c41cc5d6bb3dc368fc2df912322fd62be36c378f1b854764290
SHA512:	f387c8c2e996ba98b9a100c260959d3454f75d4580e5862209c7e2338b3a6fb15213191681536912b45cac0c05427c925040f3bf64bc224a75eb12721ca760bc
SSDEEP:	768:0gpHcj1yjMXU+JdXQq6WIcVTNxAN8O3inbcuyD7UHQRjv:0g+1yjMXU0XQETNxAN0nouy8Hyj
TLSH:	D003E103D4F50A64F2BE367B19AF34C3A454F04FE5C88ABB1E91627B1202B957A562F1
File Content Preview:	.ELF........................4...........4. ...(.....................................................................Q.td.............................-[.UPX!.........B...B......W..........?..k.I/.j....\.W'"....)....4go.\|.>#.....{~vx...A.Zg..3~........2..R.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0xc092b0
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0xc01000	0xc01000	0x94a4	0x94a4	7.9620	0x5	R E	0x1000
LOAD	0xc08	0x805cc08	0x805cc08	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 03:23:00.317893028 CET	36150	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:00.437979937 CET	3778	36150	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:00.438049078 CET	36150	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:00.438091040 CET	36150	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:00.557975054 CET	3778	36150	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:00.558027029 CET	36150	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:00.677884102 CET	3778	36150	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:01.577915907 CET	3778	36150	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:01.578433037 CET	36150	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:01.578433037 CET	36150	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:01.578538895 CET	36152	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:01.698609114 CET	3778	36152	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:01.698945999 CET	36152	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:01.699028969 CET	36152	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:01.818921089 CET	3778	36152	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:01.819170952 CET	36152	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:01.939121008 CET	3778	36152	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:02.838212013 CET	3778	36152	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:02.838756084 CET	36152	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:02.838756084 CET	36152	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:02.838756084 CET	36154	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:02.958628893 CET	3778	36154	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:02.959189892 CET	36154	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:02.959189892 CET	36154	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:03.079113007 CET	3778	36154	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:03.079483986 CET	36154	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:03.199132919 CET	3778	36154	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:04.097894907 CET	3778	36154	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:04.098366976 CET	36156	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:04.098448038 CET	36154	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:04.098448992 CET	36154	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:04.218204021 CET	3778	36156	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:04.218446016 CET	36156	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:04.218497992 CET	36156	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:04.338633060 CET	3778	36156	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:04.339159966 CET	36156	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:04.458832026 CET	3778	36156	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:05.758004904 CET	36158	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:05.877739906 CET	3778	36158	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:05.878247023 CET	36158	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:05.878396988 CET	36158	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:05.998481989 CET	3778	36158	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:05.998739004 CET	36158	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:06.118575096 CET	3778	36158	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:07.016742945 CET	3778	36158	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:07.016979933 CET	36158	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:07.016979933 CET	36158	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:07.017019033 CET	36160	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:07.136882067 CET	3778	36160	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:07.137016058 CET	36160	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:07.137161970 CET	36160	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:07.256830931 CET	3778	36160	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:07.257024050 CET	36160	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:07.376933098 CET	3778	36160	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:08.275551081 CET	3778	36160	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:08.275796890 CET	36160	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:08.276277065 CET	36160	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:08.276277065 CET	36162	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:08.395973921 CET	3778	36162	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:08.396353960 CET	36162	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:08.396632910 CET	36162	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:08.517215014 CET	3778	36162	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:08.517458916 CET	36162	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:08.637438059 CET	3778	36162	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:09.535451889 CET	3778	36162	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:09.535865068 CET	36162	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:09.536163092 CET	36164	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:09.536173105 CET	36162	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:09.655942917 CET	3778	36164	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:09.656265020 CET	36164	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:09.656424046 CET	36164	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:09.776326895 CET	3778	36164	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:09.776740074 CET	36164	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:09.896868944 CET	3778	36164	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:10.795613050 CET	3778	36164	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:10.796089888 CET	36164	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:10.796089888 CET	36164	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:10.796329021 CET	36166	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:10.916248083 CET	3778	36166	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:10.916678905 CET	36166	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:10.916945934 CET	36166	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:11.036786079 CET	3778	36166	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:11.037295103 CET	36166	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:11.157777071 CET	3778	36166	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:12.055896044 CET	3778	36166	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:12.056525946 CET	36166	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:12.056525946 CET	36166	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:12.056526899 CET	36168	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:12.176743031 CET	3778	36168	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:12.177356005 CET	36168	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:12.177356005 CET	36168	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:12.297409058 CET	3778	36168	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:12.297749996 CET	36168	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:12.418018103 CET	3778	36168	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:13.315592051 CET	3778	36168	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:13.316045046 CET	36168	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:13.316046000 CET	36168	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:13.316046000 CET	36170	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:13.436440945 CET	3778	36170	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:13.436744928 CET	36170	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:13.436928034 CET	36170	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:13.556770086 CET	3778	36170	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:13.557389021 CET	36170	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:13.677628994 CET	3778	36170	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:14.219921112 CET	36156	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:14.340221882 CET	3778	36156	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:14.561054945 CET	3778	36156	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:14.561361074 CET	36156	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:14.591280937 CET	3778	36170	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:14.591922998 CET	36170	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:14.591923952 CET	36170	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:14.591970921 CET	36172	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:14.711884022 CET	3778	36172	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:14.712260962 CET	36172	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:14.712260962 CET	36172	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:14.832036972 CET	3778	36172	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:14.832412958 CET	36172	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:14.952481985 CET	3778	36172	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:15.851223946 CET	3778	36172	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:15.851783037 CET	36172	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:15.851783037 CET	36172	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:15.851939917 CET	36174	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:15.972023010 CET	3778	36174	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:15.972487926 CET	36174	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:15.972712040 CET	36174	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:16.092681885 CET	3778	36174	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:16.093249083 CET	36174	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:16.213447094 CET	3778	36174	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:17.110819101 CET	3778	36174	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:17.111280918 CET	36174	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:17.111320972 CET	36174	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:17.111423969 CET	36176	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:17.231271029 CET	3778	36176	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:17.231586933 CET	36176	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:17.231808901 CET	36176	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:17.351674080 CET	3778	36176	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:17.351975918 CET	36176	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:17.472143888 CET	3778	36176	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:18.371922016 CET	3778	36176	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:18.372080088 CET	36176	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:18.372210979 CET	36176	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:18.372312069 CET	36178	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:18.492417097 CET	3778	36178	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:18.492686987 CET	36178	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:18.492796898 CET	36178	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:18.615645885 CET	3778	36178	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:18.615978003 CET	36178	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:18.735999107 CET	3778	36178	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:19.661746025 CET	3778	36178	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:19.662183046 CET	36178	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:19.662203074 CET	36178	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:19.662451982 CET	36180	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:19.782668114 CET	3778	36180	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:19.783010006 CET	36180	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:19.783133030 CET	36180	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:19.903208971 CET	3778	36180	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:19.903707027 CET	36180	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:20.023602009 CET	3778	36180	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:20.924624920 CET	3778	36180	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:20.925131083 CET	36180	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:20.925213099 CET	36180	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:20.925308943 CET	36182	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:21.045526981 CET	3778	36182	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:21.045986891 CET	36182	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:21.045988083 CET	36182	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:21.166616917 CET	3778	36182	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:21.167049885 CET	36182	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:21.287252903 CET	3778	36182	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:22.196110010 CET	3778	36182	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:22.196520090 CET	36184	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:22.196650028 CET	36182	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:22.196650028 CET	36182	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:22.316759109 CET	3778	36184	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:22.317269087 CET	36184	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:22.317485094 CET	36184	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:22.437463045 CET	3778	36184	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:22.437817097 CET	36184	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:22.557842016 CET	3778	36184	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:23.455082893 CET	3778	36184	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:23.455652952 CET	36184	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:23.455652952 CET	36184	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:23.455816031 CET	36186	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:23.575927019 CET	3778	36186	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:23.576189995 CET	36186	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:23.576337099 CET	36186	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:23.696296930 CET	3778	36186	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:23.696459055 CET	36186	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:23.816356897 CET	3778	36186	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:24.715423107 CET	3778	36186	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:24.715723038 CET	36186	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:24.715965033 CET	36186	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:24.716100931 CET	36188	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:24.836154938 CET	3778	36188	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:24.836577892 CET	36188	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:24.836577892 CET	36188	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:24.956665039 CET	3778	36188	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:24.957123995 CET	36188	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:25.077241898 CET	3778	36188	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:25.975686073 CET	3778	36188	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:25.976098061 CET	36188	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:25.976098061 CET	36188	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:25.976098061 CET	36190	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:26.096815109 CET	3778	36190	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:26.097333908 CET	36190	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:26.097419977 CET	36190	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:26.217601061 CET	3778	36190	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:26.217899084 CET	36190	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:26.338202953 CET	3778	36190	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:27.233097076 CET	3778	36190	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:27.233654976 CET	36192	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:27.233762026 CET	36190	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:27.233762026 CET	36190	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:27.354146004 CET	3778	36192	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:27.354609013 CET	36192	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:27.354851961 CET	36192	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:27.475030899 CET	3778	36192	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:27.475372076 CET	36192	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:27.595485926 CET	3778	36192	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:28.494092941 CET	3778	36192	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:28.494518995 CET	36192	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:28.494756937 CET	36192	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:28.494756937 CET	36194	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:28.614949942 CET	3778	36194	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:28.615108013 CET	36194	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:28.615134001 CET	36194	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:28.735443115 CET	3778	36194	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:28.735718012 CET	36194	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:28.855909109 CET	3778	36194	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:29.753545046 CET	3778	36194	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:29.753739119 CET	36194	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:29.753771067 CET	36194	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:29.753946066 CET	36196	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:29.873881102 CET	3778	36196	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:29.874299049 CET	36196	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:29.874299049 CET	36196	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:29.994559050 CET	3778	36196	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:29.995096922 CET	36196	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:30.115492105 CET	3778	36196	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:31.016124964 CET	3778	36196	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:31.016844034 CET	36196	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:31.016844034 CET	36196	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:31.016844034 CET	36198	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:31.137212992 CET	3778	36198	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:31.137739897 CET	36198	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:31.137741089 CET	36198	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:31.258040905 CET	3778	36198	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:31.258658886 CET	36198	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:31.379209042 CET	3778	36198	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:32.278143883 CET	3778	36198	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:32.278590918 CET	36200	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:32.278672934 CET	36198	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:32.278672934 CET	36198	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:32.398706913 CET	3778	36200	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:32.399104118 CET	36200	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:32.399123907 CET	36200	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:32.518914938 CET	3778	36200	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:32.519364119 CET	36200	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:32.639404058 CET	3778	36200	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:33.537502050 CET	3778	36200	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:33.537914991 CET	36200	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:33.537914991 CET	36200	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:33.537945032 CET	36202	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:33.658063889 CET	3778	36202	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:33.658420086 CET	36202	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:33.658696890 CET	36202	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:33.778660059 CET	3778	36202	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:33.779138088 CET	36202	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:33.899383068 CET	3778	36202	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:34.797204018 CET	3778	36202	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:34.797553062 CET	36202	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:34.797729015 CET	36202	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:34.797904968 CET	36204	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:34.917915106 CET	3778	36204	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:34.918421030 CET	36204	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:34.918421984 CET	36204	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:35.038688898 CET	3778	36204	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:35.039133072 CET	36204	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:35.159341097 CET	3778	36204	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:36.057641029 CET	3778	36204	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:36.058160067 CET	36204	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:36.058160067 CET	36204	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:36.058160067 CET	36206	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:36.178680897 CET	3778	36206	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:36.178935051 CET	36206	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:36.179307938 CET	36206	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:36.299442053 CET	3778	36206	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:36.299911976 CET	36206	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:36.420059919 CET	3778	36206	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:37.318326950 CET	3778	36206	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:37.318968058 CET	36206	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:37.318968058 CET	36206	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:37.319179058 CET	36208	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:37.439071894 CET	3778	36208	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:37.439608097 CET	36208	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:37.439913988 CET	36208	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:37.559880972 CET	3778	36208	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:37.560245037 CET	36208	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:37.680382967 CET	3778	36208	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:38.603487015 CET	3778	36208	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:38.603810072 CET	36208	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:38.603810072 CET	36208	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:38.603810072 CET	36210	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:38.723984003 CET	3778	36210	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:38.724416018 CET	36210	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:38.724416971 CET	36210	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:38.844439030 CET	3778	36210	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:38.844624043 CET	36210	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:38.965203047 CET	3778	36210	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:39.863209963 CET	3778	36210	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:39.863617897 CET	36212	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:39.863632917 CET	36210	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:39.863632917 CET	36210	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:39.983866930 CET	3778	36212	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:39.984072924 CET	36212	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:39.984312057 CET	36212	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:40.104393959 CET	3778	36212	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:40.104499102 CET	36212	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:40.224720955 CET	3778	36212	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:41.122342110 CET	3778	36212	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:41.122742891 CET	36212	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:41.122742891 CET	36212	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:41.122769117 CET	36214	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:41.243016005 CET	3778	36214	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:41.243400097 CET	36214	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:41.243400097 CET	36214	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:41.363338947 CET	3778	36214	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:41.363714933 CET	36214	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:41.483793020 CET	3778	36214	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:42.382057905 CET	3778	36214	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:42.382314920 CET	36214	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:42.382314920 CET	36214	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:42.382462025 CET	36216	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:42.502582073 CET	3778	36216	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:42.503204107 CET	36216	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:42.503204107 CET	36216	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:42.623428106 CET	3778	36216	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:42.623816013 CET	36216	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:42.743937016 CET	3778	36216	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:43.643944025 CET	3778	36216	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:43.644537926 CET	36216	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:43.644537926 CET	36216	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:43.644539118 CET	36218	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:43.764436007 CET	3778	36218	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:43.764730930 CET	36218	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:43.764925957 CET	36218	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:43.885382891 CET	3778	36218	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:43.885952950 CET	36218	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:44.005938053 CET	3778	36218	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:44.903389931 CET	3778	36218	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:44.903820038 CET	36218	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:44.904035091 CET	36220	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:44.904052973 CET	36218	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:45.023964882 CET	3778	36220	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:45.024384022 CET	36220	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:45.024384022 CET	36220	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:45.144345999 CET	3778	36220	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:45.144788980 CET	36220	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:45.265141010 CET	3778	36220	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:46.187184095 CET	3778	36220	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:46.187633991 CET	36220	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:46.187633991 CET	36220	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:46.187844992 CET	36222	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:46.307601929 CET	3778	36222	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:46.307965040 CET	36222	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:46.308223963 CET	36222	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:46.428210974 CET	3778	36222	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:46.428539038 CET	36222	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:46.548712015 CET	3778	36222	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:47.447833061 CET	3778	36222	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:47.448136091 CET	36222	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:47.448312998 CET	36222	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:47.448636055 CET	36224	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:47.568299055 CET	3778	36224	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:47.568739891 CET	36224	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:47.568739891 CET	36224	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:47.688757896 CET	3778	36224	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:47.689374924 CET	36224	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:47.809252977 CET	3778	36224	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:48.709538937 CET	3778	36224	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:48.709871054 CET	36224	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:48.709872007 CET	36224	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:48.709872007 CET	36226	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:48.829834938 CET	3778	36226	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:48.830239058 CET	36226	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:48.830339909 CET	36226	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:48.950248957 CET	3778	36226	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:48.950778961 CET	36226	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:49.070519924 CET	3778	36226	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:49.973062992 CET	3778	36226	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:49.973552942 CET	36226	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:49.973552942 CET	36226	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:49.973603964 CET	36228	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:50.093436003 CET	3778	36228	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:50.093760014 CET	36228	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:50.093801022 CET	36228	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:50.213417053 CET	3778	36228	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:50.213742018 CET	36228	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:50.333563089 CET	3778	36228	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:51.230422020 CET	3778	36228	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:51.230658054 CET	36228	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:51.230696917 CET	36228	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:51.230706930 CET	36230	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:51.350653887 CET	3778	36230	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:51.350967884 CET	36230	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:51.351064920 CET	36230	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:51.470923901 CET	3778	36230	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:51.471324921 CET	36230	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:51.591388941 CET	3778	36230	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:52.503668070 CET	3778	36230	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:52.504115105 CET	36230	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:52.504278898 CET	36230	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:52.504501104 CET	36232	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:52.624401093 CET	3778	36232	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:52.624942064 CET	36232	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:52.625291109 CET	36232	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:52.745081902 CET	3778	36232	195.26.252.19	192.168.2.13
Dec 23, 2024 03:23:52.745373964 CET	36232	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:23:52.865233898 CET	3778	36232	195.26.252.19	192.168.2.13
Dec 23, 2024 03:24:02.627990007 CET	36232	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:24:02.748191118 CET	3778	36232	195.26.252.19	192.168.2.13
Dec 23, 2024 03:24:02.968781948 CET	3778	36232	195.26.252.19	192.168.2.13
Dec 23, 2024 03:24:02.969162941 CET	36232	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:24:14.608899117 CET	36156	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:24:14.728740931 CET	3778	36156	195.26.252.19	192.168.2.13
Dec 23, 2024 03:24:14.949649096 CET	3778	36156	195.26.252.19	192.168.2.13
Dec 23, 2024 03:24:14.949927092 CET	36156	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:25:03.030415058 CET	36232	3778	192.168.2.13	195.26.252.19
Dec 23, 2024 03:25:03.150662899 CET	3778	36232	195.26.252.19	192.168.2.13
Dec 23, 2024 03:25:03.379076958 CET	3778	36232	195.26.252.19	192.168.2.13
Dec 23, 2024 03:25:03.379570961 CET	36232	3778	192.168.2.13	195.26.252.19

System Behavior

Analysis Process: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5432, Parent PID: 5358

General

Start time (UTC):	02:22:59
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.i686.elf
Arguments:	/tmp/ub8ehJSePAfc9FYqZIT6.i686.elf
File size:	38304 bytes
MD5 hash:	5a0517d1fa30a6fab030e281d2957328

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5433, Parent PID: 5432

General

Start time (UTC):	02:22:59
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.i686.elf
Arguments:	-
File size:	38304 bytes
MD5 hash:	5a0517d1fa30a6fab030e281d2957328

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5434, Parent PID: 5433

General

Start time (UTC):	02:22:59
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.i686.elf
Arguments:	-
File size:	38304 bytes
MD5 hash:	5a0517d1fa30a6fab030e281d2957328

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5435, Parent PID: 5433

General

Start time (UTC):	02:22:59
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.i686.elf
Arguments:	-
File size:	38304 bytes
MD5 hash:	5a0517d1fa30a6fab030e281d2957328

Analysis Process: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5446, Parent PID: 5432

General

Start time (UTC):	02:23:05
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.i686.elf
Arguments:	-
File size:	38304 bytes
MD5 hash:	5a0517d1fa30a6fab030e281d2957328

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5447, Parent PID: 5432

General

Start time (UTC):	02:23:05
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.i686.elf
Arguments:	-
File size:	38304 bytes
MD5 hash:	5a0517d1fa30a6fab030e281d2957328

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ub8ehJSePAfc9FYqZIT6.i686.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5432, Parent PID: 5358

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5433, Parent PID: 5432

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5434, Parent PID: 5433

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5435, Parent PID: 5433

General

Analysis Process: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5446, Parent PID: 5432

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.i686.elf PID: 5447, Parent PID: 5432

General

Linux Analysis Report
ub8ehJSePAfc9FYqZIT6.i686.elf