Edit tour

Linux Analysis Report
Space.arm6.elf

Overview

General Information

Sample name:	Space.arm6.elf
Analysis ID:	1580595
MD5:	2a439612d6e2ab17b57e852c9dc9f8f1
SHA1:	b8d4282fd83e9439ac664a879a87d892592befd5
SHA256:	14cda25625d15478439287d983927cb1796fdd8de8e20ae1152f4892c2f989eb
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580595
Start date and time:	2024-12-25 11:29:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Space.arm6.elf
Detection:	MAL
Classification:	mal60.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/Space.arm6.elf
PID:	5827
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

Space.arm6.elf (PID: 5827, Parent: 5755, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Space.arm6.elf

Space.arm6.elf New Fork (PID: 5829, Parent: 5827)

Space.arm6.elf New Fork (PID: 5831, Parent: 5829)

Space.arm6.elf New Fork (PID: 5833, Parent: 5829)

Space.arm6.elf New Fork (PID: 5837, Parent: 5827)

Space.arm6.elf New Fork (PID: 5839, Parent: 5827)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5827.1.00007fdfc4017000.00007fdfc402f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15320:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15334:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15348:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1535c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15370:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15384:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15398:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15410:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15424:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15438:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1544c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15460:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15474:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15488:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1549c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5837.1.00007fdfc4017000.00007fdfc402f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15320:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15334:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15348:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1535c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15370:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15384:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15398:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15410:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15424:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15438:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1544c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15460:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15474:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15488:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1549c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5831.1.00007fdfc4017000.00007fdfc402f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15320:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15334:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15348:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1535c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15370:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15384:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15398:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15410:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15424:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15438:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1544c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15460:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15474:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15488:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1549c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5829.1.00007fdfc4017000.00007fdfc402f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15320:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15334:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15348:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1535c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15370:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15384:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15398:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15410:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15424:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15438:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1544c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15460:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15474:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15488:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1549c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.arm6.elf PID: 5827	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x162:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x176:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x202:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x216:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x252:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x266:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x28e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2de:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.arm6.elf PID: 5829	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x18210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1824c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1829c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x182b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x182c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x182d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x182ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1833c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1838c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x183a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.arm6.elf PID: 5831	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x18416:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1842a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1843e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18452:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18466:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1847a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1848e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184de:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18506:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1851a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1852e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18542:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18556:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1856a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1857e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18592:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.arm6.elf PID: 5837	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x404:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x418:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x47c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 3 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Space.arm6.elf	Virustotal: Detection: 33%			Perma Link
Source: Space.arm6.elf	ReversingLabs: Detection: 52%

Source: global traffic

TCP traffic: 192.168.2.15:41024 -> 154.216.20.216:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.216

Source: Space.arm6.elf

String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 5827.1.00007fdfc4017000.00007fdfc402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5837.1.00007fdfc4017000.00007fdfc402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5831.1.00007fdfc4017000.00007fdfc402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5829.1.00007fdfc4017000.00007fdfc402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.arm6.elf PID: 5827, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.arm6.elf PID: 5829, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.arm6.elf PID: 5831, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.arm6.elf PID: 5837, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0x8000

Source: 5827.1.00007fdfc4017000.00007fdfc402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5837.1.00007fdfc4017000.00007fdfc402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5831.1.00007fdfc4017000.00007fdfc402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5829.1.00007fdfc4017000.00007fdfc402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.arm6.elf PID: 5827, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.arm6.elf PID: 5829, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.arm6.elf PID: 5831, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.arm6.elf PID: 5837, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal60.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/1333/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/1695/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/911/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/5810/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/5811/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/914/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/917/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/19/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/1591/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/5827/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/1588/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/246/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/5/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/1585/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/7/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/129/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/8/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/802/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/803/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/804/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/3407/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/1484/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/490/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/131/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/133/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/1479/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/378/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/931/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/1595/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/812/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/933/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/5833/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/3419/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/3310/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/260/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/261/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/262/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/142/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/263/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/264/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/265/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/145/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/266/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/267/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/268/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/3303/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/269/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5827)	File opened: /proc/1486/status	Jump to behavior

Source: Space.arm6.elf

Submission file: segment LOAD with 7.9744 entropy (max. 8.0)

Source: /tmp/Space.arm6.elf (PID: 5827)

Queries kernel information via 'uname':

Jump to behavior

Source: Space.arm6.elf, 5827.1.00007ffde2b4e000.00007ffde2b6f000.rw-.sdmp, Space.arm6.elf, 5829.1.00007ffde2b4e000.00007ffde2b6f000.rw-.sdmp, Space.arm6.elf, 5831.1.00007ffde2b4e000.00007ffde2b6f000.rw-.sdmp, Space.arm6.elf, 5837.1.00007ffde2b4e000.00007ffde2b6f000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/Space.arm6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Space.arm6.elf
Source: Space.arm6.elf, 5827.1.00005625b7587000.00005625b7775000.rw-.sdmp, Space.arm6.elf, 5829.1.00005625b7587000.00005625b7775000.rw-.sdmp, Space.arm6.elf, 5831.1.00005625b7587000.00005625b7775000.rw-.sdmp, Space.arm6.elf, 5837.1.00005625b7587000.00005625b7775000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Space.arm6.elf, 5827.1.00005625b7587000.00005625b7775000.rw-.sdmp, Space.arm6.elf, 5829.1.00005625b7587000.00005625b7775000.rw-.sdmp, Space.arm6.elf, 5831.1.00005625b7587000.00005625b7775000.rw-.sdmp, Space.arm6.elf, 5837.1.00005625b7587000.00005625b7775000.rw-.sdmp	Binary or memory string: %V!/etc/qemu-binfmt/arm
Source: Space.arm6.elf, 5827.1.00007ffde2b4e000.00007ffde2b6f000.rw-.sdmp, Space.arm6.elf, 5829.1.00007ffde2b4e000.00007ffde2b6f000.rw-.sdmp, Space.arm6.elf, 5831.1.00007ffde2b4e000.00007ffde2b6f000.rw-.sdmp, Space.arm6.elf, 5837.1.00007ffde2b4e000.00007ffde2b6f000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Space.arm6.elf	34%	Virustotal		Browse
Space.arm6.elf	53%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Space.arm6.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
154.216.20.216	unknown	Seychelles		135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
154.216.20.216	Space.ppc.elf	Get hash	malicious	Unknown	Browse
	Space.x86_64.elf	Get hash	malicious	Unknown	Browse
	Space.sh4.elf	Get hash	malicious	Unknown	Browse
	Space.arm.elf	Get hash	malicious	Mirai	Browse
	Space.mips.elf	Get hash	malicious	Unknown	Browse
	Space.mpsl.elf	Get hash	malicious	Unknown	Browse
	Space.m68k.elf	Get hash	malicious	Mirai	Browse
	Space.i686.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SKHT-ASShenzhenKatherineHengTechnologyInformationCo	Space.ppc.elf	Get hash	malicious	Unknown	Browse	154.216.20.216
	Space.x86_64.elf	Get hash	malicious	Unknown	Browse	154.216.20.216
	Space.sh4.elf	Get hash	malicious	Unknown	Browse	154.216.20.216
	Space.arm.elf	Get hash	malicious	Mirai	Browse	154.216.20.216
	Space.mips.elf	Get hash	malicious	Unknown	Browse	154.216.20.216
	Space.mpsl.elf	Get hash	malicious	Unknown	Browse	154.216.20.216
	Space.m68k.elf	Get hash	malicious	Mirai	Browse	154.216.20.216
	Space.i686.elf	Get hash	malicious	Unknown	Browse	154.216.20.216
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.19.138
	zerarm7.elf	Get hash	malicious	Unknown	Browse	154.216.16.250

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.972777485774196
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Space.arm6.elf
File size:	44'600 bytes
MD5:	2a439612d6e2ab17b57e852c9dc9f8f1
SHA1:	b8d4282fd83e9439ac664a879a87d892592befd5
SHA256:	14cda25625d15478439287d983927cb1796fdd8de8e20ae1152f4892c2f989eb
SHA512:	5bc6fa7cdf7d6a9ed6b3550f9022a700d941e4354fea53dd9bff92978ebcb3d37b371f3797957e57c6329bbaa97ef5e7b4f62244329b2a8dcea9d5a4fe91068f
SSDEEP:	768:ocZOKj8x/QSQ3y/4qFTOdeoJWBhdYnjWcBWDW4s5GyZDa6XX44R9q3UELw:jXwQSYPqFHI8rOjBn4+9DXnELw
TLSH:	D113F290CF06BDC2DD517D73EBE4D9CB471C9AF6C27A2613A62849BC4C93640E4D8487
File Content Preview:	.ELF..............(.........4...........4. ...(.........................................H...H...H...................Q.td...............................OUPX!...................._..........?.E.h;....#..$.......L..T.\|..r.F..ZS..n.8.I+.e......rQN..D....I.:#/.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0x11b00
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8000	0x8000	0xaced	0xaced	7.9744	0x5	R E	0x8000
LOAD	0xb48	0x20b48	0x20b48	0x0	0x0	0.0000	0x6	RW	0x8000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 25, 2024 11:30:46.539093971 CET	41024	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:46.658795118 CET	3778	41024	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:46.658870935 CET	41024	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:46.665481091 CET	41024	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:46.785044909 CET	3778	41024	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:46.785098076 CET	41024	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:46.904639959 CET	3778	41024	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:47.961419106 CET	3778	41024	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:47.961755991 CET	41024	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:47.961755991 CET	41024	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:47.962364912 CET	41026	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:48.081943989 CET	3778	41026	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:48.082037926 CET	41026	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:48.083194017 CET	41026	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:48.202896118 CET	3778	41026	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:48.203031063 CET	41026	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:48.322864056 CET	3778	41026	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:49.384002924 CET	3778	41026	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:49.384231091 CET	41026	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:49.384231091 CET	41026	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:49.384681940 CET	41028	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:49.504174948 CET	3778	41028	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:49.504481077 CET	41028	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:49.505146027 CET	41028	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:49.624645948 CET	3778	41028	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:49.624720097 CET	41028	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:49.744246006 CET	3778	41028	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:50.802131891 CET	3778	41028	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:50.802423954 CET	41028	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:50.802509069 CET	41028	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:50.803327084 CET	41030	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:50.923088074 CET	3778	41030	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:50.923333883 CET	41030	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:50.924158096 CET	41030	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:51.043823004 CET	3778	41030	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:51.044110060 CET	41030	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:51.163954020 CET	3778	41030	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:52.224332094 CET	3778	41030	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:52.224616051 CET	41030	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:52.224648952 CET	41030	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:52.225181103 CET	41032	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:52.344908953 CET	3778	41032	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:52.345029116 CET	41032	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:52.345787048 CET	41032	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:52.465409994 CET	3778	41032	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:52.465614080 CET	41032	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:52.516505003 CET	41034	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:52.585407972 CET	3778	41032	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:52.636284113 CET	3778	41034	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:52.636354923 CET	41034	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:52.641542912 CET	41034	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:52.761234045 CET	3778	41034	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:52.761292934 CET	41034	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:52.881022930 CET	3778	41034	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:53.648421049 CET	3778	41032	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:53.648684978 CET	41032	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:53.648747921 CET	41032	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:53.649527073 CET	41036	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:53.769052982 CET	3778	41036	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:53.769254923 CET	41036	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:53.770390987 CET	41036	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:53.890048981 CET	3778	41036	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:53.890337944 CET	41036	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:53.935853958 CET	3778	41034	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:53.936243057 CET	41034	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:53.936243057 CET	41034	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:53.936688900 CET	41038	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:54.010056973 CET	3778	41036	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:54.056277037 CET	3778	41038	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:54.056545973 CET	41038	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:54.057362080 CET	41038	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:54.178155899 CET	3778	41038	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:54.178263903 CET	41038	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:54.299350023 CET	3778	41038	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:55.072841883 CET	3778	41036	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:55.073054075 CET	41036	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:55.073128939 CET	41036	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:55.073703051 CET	41040	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:55.193304062 CET	3778	41040	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:55.193552017 CET	41040	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:55.194478989 CET	41040	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:55.314416885 CET	3778	41040	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:55.314625025 CET	41040	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:55.358534098 CET	3778	41038	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:55.358705044 CET	41038	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:55.358705997 CET	41038	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:55.359635115 CET	41042	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:55.434453011 CET	3778	41040	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:55.479253054 CET	3778	41042	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:55.479598999 CET	41042	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:55.480324984 CET	41042	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:55.600369930 CET	3778	41042	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:55.600493908 CET	41042	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:55.720271111 CET	3778	41042	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:56.492494106 CET	3778	41040	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:56.492733955 CET	41040	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:56.492780924 CET	41040	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:56.493451118 CET	41044	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:56.613126993 CET	3778	41044	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:56.613320112 CET	41044	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:56.614425898 CET	41044	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:56.734052896 CET	3778	41044	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:56.734419107 CET	41044	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:56.780679941 CET	3778	41042	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:56.780903101 CET	41042	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:56.780950069 CET	41042	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:56.781388044 CET	41046	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:56.854079008 CET	3778	41044	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:56.900949001 CET	3778	41046	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:56.901034117 CET	41046	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:56.901988029 CET	41046	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:57.021825075 CET	3778	41046	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:57.022038937 CET	41046	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:57.141725063 CET	3778	41046	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:57.914386988 CET	3778	41044	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:57.914536953 CET	41044	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:57.914727926 CET	41044	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:57.915450096 CET	41048	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:58.035139084 CET	3778	41048	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:58.035262108 CET	41048	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:58.036498070 CET	41048	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:58.156517982 CET	3778	41048	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:58.156661034 CET	41048	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:58.200218916 CET	3778	41046	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:58.200331926 CET	41046	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:58.200386047 CET	41046	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:58.200908899 CET	41050	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:58.276407003 CET	3778	41048	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:58.320702076 CET	3778	41050	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:58.320879936 CET	41050	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:58.321832895 CET	41050	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:58.441401005 CET	3778	41050	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:58.441492081 CET	41050	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:58.561176062 CET	3778	41050	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:59.334738016 CET	3778	41048	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:59.334849119 CET	41048	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:59.334878922 CET	41048	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:59.335465908 CET	41052	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:59.455012083 CET	3778	41052	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:59.455140114 CET	41052	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:59.456204891 CET	41052	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:59.575700045 CET	3778	41052	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:59.575779915 CET	41052	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:59.618899107 CET	3778	41050	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:59.619151115 CET	41050	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:59.619151115 CET	41050	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:59.619621992 CET	41054	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:59.695343018 CET	3778	41052	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:59.739186049 CET	3778	41054	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:59.739361048 CET	41054	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:59.740098953 CET	41054	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:59.859694004 CET	3778	41054	154.216.20.216	192.168.2.15
Dec 25, 2024 11:30:59.859833002 CET	41054	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:30:59.979444027 CET	3778	41054	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:00.756345034 CET	3778	41052	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:00.756509066 CET	41052	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:00.756509066 CET	41052	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:00.757091045 CET	41056	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:00.877877951 CET	3778	41056	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:00.877988100 CET	41056	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:00.879148960 CET	41056	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:00.998699903 CET	3778	41056	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:00.998956919 CET	41056	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:01.034410954 CET	3778	41054	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:01.034564972 CET	41054	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:01.034616947 CET	41054	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:01.035142899 CET	41058	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:01.119024038 CET	3778	41056	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:01.154685974 CET	3778	41058	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:01.154854059 CET	41058	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:01.156048059 CET	41058	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:01.275741100 CET	3778	41058	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:01.275938988 CET	41058	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:01.396209955 CET	3778	41058	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:02.178062916 CET	3778	41056	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:02.178400993 CET	41056	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:02.178452015 CET	41056	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:02.179076910 CET	41060	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:02.298674107 CET	3778	41060	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:02.298783064 CET	41060	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:02.299825907 CET	41060	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:02.419439077 CET	3778	41060	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:02.419557095 CET	41060	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:02.455852032 CET	3778	41058	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:02.455974102 CET	41058	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:02.456053972 CET	41058	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:02.456769943 CET	41062	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:02.539369106 CET	3778	41060	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:02.576297045 CET	3778	41062	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:02.576571941 CET	41062	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:02.577825069 CET	41062	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:02.697556019 CET	3778	41062	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:02.697854042 CET	41062	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:02.817504883 CET	3778	41062	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:03.599401951 CET	3778	41060	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:03.599576950 CET	41060	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:03.599617958 CET	41060	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:03.600178003 CET	41064	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:03.719795942 CET	3778	41064	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:03.720053911 CET	41064	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:03.721174955 CET	41064	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:03.840959072 CET	3778	41064	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:03.841229916 CET	41064	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:03.873126030 CET	3778	41062	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:03.873393059 CET	41062	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:03.873567104 CET	41062	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:03.874244928 CET	41066	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:03.960903883 CET	3778	41064	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:03.993710041 CET	3778	41066	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:03.994062901 CET	41066	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:03.995294094 CET	41066	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:04.114850998 CET	3778	41066	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:04.115025997 CET	41066	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:04.234786034 CET	3778	41066	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:05.016530991 CET	3778	41064	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:05.016966105 CET	41064	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:05.016966105 CET	41064	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:05.018080950 CET	41068	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:05.137723923 CET	3778	41068	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:05.138051987 CET	41068	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:05.139667034 CET	41068	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:05.259215117 CET	3778	41068	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:05.259357929 CET	41068	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:05.293318987 CET	3778	41066	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:05.293436050 CET	41066	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:05.293541908 CET	41066	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:05.294380903 CET	41070	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:05.379009008 CET	3778	41068	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:05.413980961 CET	3778	41070	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:05.414184093 CET	41070	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:05.415532112 CET	41070	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:05.535006046 CET	3778	41070	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:05.535243034 CET	41070	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:05.654927969 CET	3778	41070	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:06.436985970 CET	3778	41068	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:06.437408924 CET	41068	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:06.437408924 CET	41068	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:06.438306093 CET	41072	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:06.558109045 CET	3778	41072	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:06.558482885 CET	41072	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:06.559827089 CET	41072	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:06.679573059 CET	3778	41072	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:06.679851055 CET	41072	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:06.712429047 CET	3778	41070	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:06.712779045 CET	41070	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:06.712779045 CET	41070	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:06.713561058 CET	41074	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:06.799689054 CET	3778	41072	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:06.833121061 CET	3778	41074	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:06.833194971 CET	41074	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:06.835622072 CET	41074	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:06.955286026 CET	3778	41074	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:06.955581903 CET	41074	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:07.075474977 CET	3778	41074	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:07.858212948 CET	3778	41072	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:07.858568907 CET	41072	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:07.858661890 CET	41072	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:07.859517097 CET	41076	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:07.979345083 CET	3778	41076	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:07.979778051 CET	41076	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:07.981404066 CET	41076	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:08.101012945 CET	3778	41076	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:08.101259947 CET	41076	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:08.132915020 CET	3778	41074	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:08.133266926 CET	41074	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:08.133266926 CET	41074	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:08.133687019 CET	41078	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:08.221450090 CET	3778	41076	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:08.253395081 CET	3778	41078	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:08.253590107 CET	41078	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:08.255074024 CET	41078	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:08.374933958 CET	3778	41078	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:08.375220060 CET	41078	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:08.495098114 CET	3778	41078	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:09.279620886 CET	3778	41076	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:09.280091047 CET	41076	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:09.280134916 CET	41076	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:09.281184912 CET	41080	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:09.400958061 CET	3778	41080	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:09.401283979 CET	41080	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:09.402620077 CET	41080	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:09.522842884 CET	3778	41080	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:09.523180962 CET	41080	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:09.552746058 CET	3778	41078	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:09.552964926 CET	41078	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:09.552964926 CET	41078	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:09.553822041 CET	41082	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:09.642884016 CET	3778	41080	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:09.673410892 CET	3778	41082	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:09.673660040 CET	41082	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:09.675158024 CET	41082	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:09.794956923 CET	3778	41082	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:09.795254946 CET	41082	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:09.914930105 CET	3778	41082	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:10.700812101 CET	3778	41080	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:10.701154947 CET	41080	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:10.701339960 CET	41080	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:10.702249050 CET	41084	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:10.821907043 CET	3778	41084	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:10.822143078 CET	41084	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:10.823473930 CET	41084	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:10.943156004 CET	3778	41084	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:10.943413973 CET	41084	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:10.970679045 CET	3778	41082	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:10.970824957 CET	41082	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:10.971070051 CET	41082	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:10.972034931 CET	41086	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:11.063330889 CET	3778	41084	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:11.091686964 CET	3778	41086	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:11.092005014 CET	41086	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:11.093314886 CET	41086	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:11.212974072 CET	3778	41086	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:11.213385105 CET	41086	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:11.333352089 CET	3778	41086	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:12.119132996 CET	3778	41084	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:12.119471073 CET	41084	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:12.119471073 CET	41084	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:12.120691061 CET	41088	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:12.240690947 CET	3778	41088	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:12.241154909 CET	41088	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:12.243514061 CET	41088	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:12.363221884 CET	3778	41088	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:12.363543034 CET	41088	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:12.393671036 CET	3778	41086	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:12.393843889 CET	41086	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:12.393937111 CET	41086	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:12.394676924 CET	41090	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:12.483268023 CET	3778	41088	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:12.514523983 CET	3778	41090	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:12.514657974 CET	41090	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:12.516396999 CET	41090	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:12.636112928 CET	3778	41090	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:12.636483908 CET	41090	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:12.756251097 CET	3778	41090	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:13.543442965 CET	3778	41088	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:13.544019938 CET	41088	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:13.544111013 CET	41088	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:13.545793056 CET	41092	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:13.665779114 CET	3778	41092	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:13.666039944 CET	41092	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:13.668725014 CET	41092	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:13.788871050 CET	3778	41092	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:13.789146900 CET	41092	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:13.814244986 CET	3778	41090	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:13.814645052 CET	41090	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:13.814687967 CET	41090	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:13.815679073 CET	41094	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:13.909209013 CET	3778	41092	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:13.935451031 CET	3778	41094	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:13.935883999 CET	41094	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:13.937957048 CET	41094	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:14.058337927 CET	3778	41094	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:14.058478117 CET	41094	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:14.178862095 CET	3778	41094	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:14.967195034 CET	3778	41092	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:14.967495918 CET	41092	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:14.967495918 CET	41092	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:14.968066931 CET	41096	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:15.087713003 CET	3778	41096	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:15.088051081 CET	41096	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:15.089134932 CET	41096	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:15.208854914 CET	3778	41096	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:15.209398031 CET	41096	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:15.329381943 CET	3778	41096	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:16.385454893 CET	3778	41096	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:16.385617971 CET	41096	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:16.385704041 CET	41096	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:16.386496067 CET	41098	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:16.506479979 CET	3778	41098	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:16.506865025 CET	41098	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:16.507989883 CET	41098	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:16.627619028 CET	3778	41098	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:16.627815962 CET	41098	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:16.749331951 CET	3778	41098	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:17.806663036 CET	3778	41098	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:17.807118893 CET	41098	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:17.807118893 CET	41098	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:17.807710886 CET	41100	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:17.927908897 CET	3778	41100	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:17.928127050 CET	41100	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:17.929204941 CET	41100	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:18.048755884 CET	3778	41100	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:18.048881054 CET	41100	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:18.168570042 CET	3778	41100	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:19.229907990 CET	3778	41100	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:19.230159998 CET	41100	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:19.230159998 CET	41100	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:19.230629921 CET	41102	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:19.350074053 CET	3778	41102	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:19.350182056 CET	41102	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:19.351376057 CET	41102	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:19.471329927 CET	3778	41102	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:19.471520901 CET	41102	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:19.591166973 CET	3778	41102	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:20.650576115 CET	3778	41102	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:20.650757074 CET	41102	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:20.650803089 CET	41102	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:20.651513100 CET	41104	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:20.771076918 CET	3778	41104	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:20.771383047 CET	41104	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:20.772440910 CET	41104	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:20.891902924 CET	3778	41104	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:20.892040014 CET	41104	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:21.011604071 CET	3778	41104	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:22.073441029 CET	3778	41104	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:22.073585987 CET	41104	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:22.073632956 CET	41104	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:22.074249029 CET	41106	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:22.193864107 CET	3778	41106	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:22.194032907 CET	41106	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:22.195116997 CET	41106	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:22.314798117 CET	3778	41106	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:22.314944029 CET	41106	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:22.434685946 CET	3778	41106	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:23.490878105 CET	3778	41106	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:23.491051912 CET	41106	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:23.491095066 CET	41106	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:23.491679907 CET	41108	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:23.611346006 CET	3778	41108	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:23.611478090 CET	41108	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:23.612323046 CET	41108	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:23.731987953 CET	3778	41108	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:23.732151031 CET	41108	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:23.851830006 CET	3778	41108	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:23.947916985 CET	41094	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:24.067552090 CET	3778	41094	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:24.370199919 CET	3778	41094	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:24.370367050 CET	41094	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:24.911151886 CET	3778	41108	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:24.911362886 CET	41108	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:24.911438942 CET	41108	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:24.912146091 CET	41110	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:25.031836033 CET	3778	41110	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:25.031992912 CET	41110	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:25.933518887 CET	41110	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:26.053138971 CET	3778	41110	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:26.053265095 CET	41110	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:26.054379940 CET	41110	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:26.173886061 CET	3778	41110	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:26.174063921 CET	41110	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:26.293625116 CET	3778	41110	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:27.353671074 CET	3778	41110	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:27.353890896 CET	41110	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:27.353979111 CET	41110	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:27.354839087 CET	41112	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:27.475486040 CET	3778	41112	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:27.475774050 CET	41112	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:27.477370977 CET	41112	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:27.596955061 CET	3778	41112	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:27.597121954 CET	41112	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:27.716761112 CET	3778	41112	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:37.487425089 CET	41112	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:31:37.607341051 CET	3778	41112	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:37.907983065 CET	3778	41112	154.216.20.216	192.168.2.15
Dec 25, 2024 11:31:37.908158064 CET	41112	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:32:24.430154085 CET	41094	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:32:24.549865961 CET	3778	41094	154.216.20.216	192.168.2.15
Dec 25, 2024 11:32:24.851607084 CET	3778	41094	154.216.20.216	192.168.2.15
Dec 25, 2024 11:32:24.851833105 CET	41094	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:32:37.964092970 CET	41112	3778	192.168.2.15	154.216.20.216
Dec 25, 2024 11:32:38.084497929 CET	3778	41112	154.216.20.216	192.168.2.15
Dec 25, 2024 11:32:38.385062933 CET	3778	41112	154.216.20.216	192.168.2.15
Dec 25, 2024 11:32:38.385240078 CET	41112	3778	192.168.2.15	154.216.20.216

System Behavior

Analysis Process: Space.arm6.elf PID: 5827, Parent PID: 5755

General

Start time (UTC):	10:30:45
Start date (UTC):	25/12/2024
Path:	/tmp/Space.arm6.elf
Arguments:	/tmp/Space.arm6.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Space.arm6.elf PID: 5829, Parent PID: 5827

General

Start time (UTC):	10:30:45
Start date (UTC):	25/12/2024
Path:	/tmp/Space.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Space.arm6.elf PID: 5831, Parent PID: 5829

General

Start time (UTC):	10:30:45
Start date (UTC):	25/12/2024
Path:	/tmp/Space.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Space.arm6.elf PID: 5833, Parent PID: 5829

General

Start time (UTC):	10:30:45
Start date (UTC):	25/12/2024
Path:	/tmp/Space.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Space.arm6.elf PID: 5837, Parent PID: 5827

General

Start time (UTC):	10:30:51
Start date (UTC):	25/12/2024
Path:	/tmp/Space.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Space.arm6.elf PID: 5839, Parent PID: 5827

General

Start time (UTC):	10:30:51
Start date (UTC):	25/12/2024
Path:	/tmp/Space.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Space.arm6.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: Space.arm6.elf PID: 5827, Parent PID: 5755

General

Chronological Activities

Analysis Process: Space.arm6.elf PID: 5829, Parent PID: 5827

General

Chronological Activities

Analysis Process: Space.arm6.elf PID: 5831, Parent PID: 5829

General

Chronological Activities

Analysis Process: Space.arm6.elf PID: 5833, Parent PID: 5829

General

Chronological Activities

Analysis Process: Space.arm6.elf PID: 5837, Parent PID: 5827

General

Chronological Activities

Analysis Process: Space.arm6.elf PID: 5839, Parent PID: 5827

General

Chronological Activities

Linux Analysis Report
Space.arm6.elf