Edit tour

Linux Analysis Report
m68k.elf

Overview

General Information

Sample name:	m68k.elf
Analysis ID:	1580619
MD5:	42e1b6259d7e5d5c4561770058615cd3
SHA1:	7d6322737fcec2195f2a6592de1749e254c9da44
SHA256:	9e7882226b114e7adb1bd8d319debba8301c707c0266fcd12552c537125d6228
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Moobot

Score:	84
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Yara detected Moobot

Sample deletes itself

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580619
Start date and time:	2024-12-25 12:53:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	m68k.elf
Detection:	MAL
Classification:	mal84.troj.evad.linELF@0/0@118/0

Runtime Messages

Command:	/tmp/m68k.elf
PID:	6243
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

m68k.elf (PID: 6243, Parent: 6161, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/m68k.elf

m68k.elf New Fork (PID: 6245, Parent: 6243)

m68k.elf New Fork (PID: 6247, Parent: 6245)

m68k.elf New Fork (PID: 6249, Parent: 6245)

m68k.elf New Fork (PID: 6251, Parent: 6249)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
MooBot		No Attribution	https://blog.netlab.360.com/ddos-botnet-moobot-en/ https://blog.netlab.360.com/moobot-0day-unixcctv-dvr-en/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://media.defense.gov/2024/Feb/27/2003400753/-1/-1/0/CSA-RUSSIAN-ACTORS-USE-ROUTERS-FACILITATE-CYBER_OPERATIONS.PDF https://otx.alienvault.com/pulse/6075b645942d5adf9bb8949b	https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
m68k.elf	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
m68k.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
m68k.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x119df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x119f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a07:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a1b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a2f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a43:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a57:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a6b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a7f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a93:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11aa7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11abb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11acf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ae3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11af7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b0b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b1f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b33:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b47:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b5b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b6f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6243.1.00007f33bc001000.00007f33bc015000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6243.1.00007f33bc001000.00007f33bc015000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6243.1.00007f33bc001000.00007f33bc015000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x119df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x119f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a07:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a1b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a2f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a43:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a57:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a6b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a7f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a93:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11aa7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11abb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11acf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ae3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11af7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b0b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b1f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b33:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b47:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b5b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b6f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: m68k.elf PID: 6243	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: m68k.elf PID: 6243	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: m68k.elf PID: 6243	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x14a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x156c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x160c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1620:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1634:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 1 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: m68k.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: m68k.elf	Virustotal: Detection: 50%			Perma Link
Source: m68k.elf	ReversingLabs: Detection: 47%

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown

DNS traffic detected: query: chinagov.one replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: global traffic

DNS traffic detected: DNS query: chinagov.one

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6243.1.00007f33bc001000.00007f33bc015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: m68k.elf PID: 6243, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6243.1.00007f33bc001000.00007f33bc015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: m68k.elf PID: 6243, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal84.troj.evad.linELF@0/0@118/0

Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/6251/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/6249/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/6265/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/6264/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/6267/cmdline	Jump to behavior
Source: /tmp/m68k.elf (PID: 6247)	File opened: /proc/6266/cmdline	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/m68k.elf (PID: 6243)

File: /tmp/m68k.elf

Jump to behavior

Source: /tmp/m68k.elf (PID: 6243)

Queries kernel information via 'uname':

Jump to behavior

Source: m68k.elf, 6243.1.000055c0b6a64000.000055c0b6ae9000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: m68k.elf, 6243.1.00007fff7eeb3000.00007fff7eed4000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: m68k.elf, 6243.1.000055c0b6a64000.000055c0b6ae9000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k
Source: m68k.elf, 6243.1.00007fff7eeb3000.00007fff7eed4000.rw-.sdmp	Binary or memory string: =%rx86_64/usr/bin/qemu-m68k/tmp/m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/m68k.elf

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: m68k.elf, type: SAMPLE
Source: Yara match	File source: 6243.1.00007f33bc001000.00007f33bc015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: m68k.elf PID: 6243, type: MEMORYSTR

Yara detected Moobot

Source: Yara match	File source: m68k.elf, type: SAMPLE
Source: Yara match	File source: 6243.1.00007f33bc001000.00007f33bc015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: m68k.elf PID: 6243, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: m68k.elf, type: SAMPLE
Source: Yara match	File source: 6243.1.00007f33bc001000.00007f33bc015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: m68k.elf PID: 6243, type: MEMORYSTR

Yara detected Moobot

Source: Yara match	File source: m68k.elf, type: SAMPLE
Source: Yara match	File source: 6243.1.00007f33bc001000.00007f33bc015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: m68k.elf PID: 6243, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
m68k.elf	51%	Virustotal		Browse
m68k.elf	47%	ReversingLabs	Linux.Trojan.Mirai
m68k.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chinagov.one	unknown	unknown	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	win.elf	Get hash	malicious	Unknown	Browse
	165.3.86.135-mips-2024-12-25T09_39_46.elf	Get hash	malicious	Mirai, Moobot	Browse
	Space.arc.elf	Get hash	malicious	Mirai	Browse
	Space.arm5.elf	Get hash	malicious	Unknown	Browse
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	armv4eb.elf	Get hash	malicious	Unknown	Browse
	armv5l.elf	Get hash	malicious	Unknown	Browse
	armv4eb.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	armv4eb.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	spc.elf	Get hash	malicious	Mirai, Moobot	Browse
	win.elf	Get hash	malicious	Unknown	Browse
	165.3.86.135-mips-2024-12-25T09_39_46.elf	Get hash	malicious	Mirai, Moobot	Browse
	Space.x86.elf	Get hash	malicious	Unknown	Browse
	Space.x86_64.elf	Get hash	malicious	Unknown	Browse
	Space.arc.elf	Get hash	malicious	Mirai	Browse
	Space.arm5.elf	Get hash	malicious	Unknown	Browse
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	armv4eb.elf	Get hash	malicious	Unknown	Browse
	armv5l.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	91.189.91.42
	win.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	165.3.86.135-mips-2024-12-25T09_39_46.elf	Get hash	malicious	Mirai, Moobot	Browse	91.189.91.42
	Space.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Space.x86_64.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Space.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Space.m68k.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	Space.arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	armv4eb.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
CANONICAL-ASGB	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	91.189.91.42
	win.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	165.3.86.135-mips-2024-12-25T09_39_46.elf	Get hash	malicious	Mirai, Moobot	Browse	91.189.91.42
	Space.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Space.x86_64.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Space.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Space.m68k.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	Space.arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	armv4eb.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
INIT7CH	arm6.elf	Get hash	malicious	Mirai, Moobot	Browse	109.202.202.202
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	109.202.202.202
	win.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	165.3.86.135-mips-2024-12-25T09_39_46.elf	Get hash	malicious	Mirai, Moobot	Browse	109.202.202.202
	Space.x86.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Space.x86_64.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Space.arc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Space.arm5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	armv4eb.elf	Get hash	malicious	Unknown	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:
Entropy (8bit):	6.188745925994609
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	m68k.elf
File size:	79'652 bytes
MD5:	42e1b6259d7e5d5c4561770058615cd3
SHA1:	7d6322737fcec2195f2a6592de1749e254c9da44
SHA256:	9e7882226b114e7adb1bd8d319debba8301c707c0266fcd12552c537125d6228
SHA512:	485eeabaa5f20bc9dad4e446b731238a1740e31c4e2bb0740e2a46965904a6bdfdb56166f4fe84850ae8f7860211692747f2901ce04b1204509e85f3e1180d4c
SSDEEP:	1536:zMVSCiOhSuIifw58OqJeYQeuacWjcW0JcWcBc9v21bsXBzThbTyG8Lut6JV/8YP2:MSCivuIiqqAYQeuacWjcW0JcWcBov21c
TLSH:	3C733BCAF401D9BEF84AD77B0C570D097671B2E107830B36639BBA6BF976198141BD81
File Content Preview:	.ELF.......................D...4..5......4. ...(......................2...2....... .......2...R...R....x..'`...... .dt.Q............................NV..a....da....0N^NuNV..J9..UTf>"y..R. QJ.g.X.#...R.N."y..R. QJ.f.A.....J.g.Hy..R.N.X.......UTN^NuNV..N^NuN

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 25, 2024 12:54:43.781794071 CET	43928	443	192.168.2.23	91.189.91.42
Dec 25, 2024 12:54:49.413011074 CET	42836	443	192.168.2.23	91.189.91.43
Dec 25, 2024 12:54:50.180967093 CET	42516	80	192.168.2.23	109.202.202.202
Dec 25, 2024 12:55:05.538783073 CET	43928	443	192.168.2.23	91.189.91.42
Dec 25, 2024 12:55:15.777446985 CET	42836	443	192.168.2.23	91.189.91.43
Dec 25, 2024 12:55:19.872821093 CET	42516	80	192.168.2.23	109.202.202.202
Dec 25, 2024 12:55:46.493268013 CET	43928	443	192.168.2.23	91.189.91.42

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 25, 2024 12:54:44.985974073 CET	59756	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:54:45.108768940 CET	53	59756	8.8.8.8	192.168.2.23
Dec 25, 2024 12:54:45.110378981 CET	49740	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:54:45.232852936 CET	53	49740	8.8.8.8	192.168.2.23
Dec 25, 2024 12:54:45.234344006 CET	41986	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:54:45.357749939 CET	53	41986	8.8.8.8	192.168.2.23
Dec 25, 2024 12:54:45.359262943 CET	37828	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:54:45.481956959 CET	53	37828	8.8.8.8	192.168.2.23
Dec 25, 2024 12:54:45.483494997 CET	42667	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:54:45.607036114 CET	53	42667	8.8.8.8	192.168.2.23
Dec 25, 2024 12:54:53.612718105 CET	54827	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:54:53.735378981 CET	53	54827	8.8.8.8	192.168.2.23
Dec 25, 2024 12:54:53.736637115 CET	33397	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:54:53.859447002 CET	53	33397	8.8.8.8	192.168.2.23
Dec 25, 2024 12:54:53.860824108 CET	39244	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:54:53.984709024 CET	53	39244	8.8.8.8	192.168.2.23
Dec 25, 2024 12:54:53.985860109 CET	56637	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:54:54.108690023 CET	53	56637	8.8.8.8	192.168.2.23
Dec 25, 2024 12:54:54.109857082 CET	59799	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:54:54.232498884 CET	53	59799	8.8.8.8	192.168.2.23
Dec 25, 2024 12:54:56.235413074 CET	41995	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:54:56.358186007 CET	53	41995	8.8.8.8	192.168.2.23
Dec 25, 2024 12:54:56.359169006 CET	50273	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:54:56.481690884 CET	53	50273	8.8.8.8	192.168.2.23
Dec 25, 2024 12:54:56.483133078 CET	56536	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:54:56.617427111 CET	53	56536	8.8.8.8	192.168.2.23
Dec 25, 2024 12:54:56.618788004 CET	50097	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:54:56.741517067 CET	53	50097	8.8.8.8	192.168.2.23
Dec 25, 2024 12:54:56.743904114 CET	42762	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:54:56.866419077 CET	53	42762	8.8.8.8	192.168.2.23
Dec 25, 2024 12:54:57.869643927 CET	48215	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:54:57.992324114 CET	53	48215	8.8.8.8	192.168.2.23
Dec 25, 2024 12:54:57.993468046 CET	56564	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:54:58.116128922 CET	53	56564	8.8.8.8	192.168.2.23
Dec 25, 2024 12:54:58.117193937 CET	58928	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:54:58.241147995 CET	53	58928	8.8.8.8	192.168.2.23
Dec 25, 2024 12:54:58.242194891 CET	49050	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:54:58.376162052 CET	53	49050	8.8.8.8	192.168.2.23
Dec 25, 2024 12:54:58.377176046 CET	58051	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:54:58.499644995 CET	53	58051	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:03.501910925 CET	42742	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:03.624563932 CET	53	42742	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:03.625799894 CET	40877	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:03.748231888 CET	53	40877	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:03.749697924 CET	58474	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:03.872195005 CET	53	58474	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:03.875427961 CET	50976	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:03.998132944 CET	53	50976	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:03.999583006 CET	42470	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:04.133331060 CET	53	42470	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:07.151979923 CET	53908	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:07.285964012 CET	53	53908	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:07.287264109 CET	48484	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:07.415311098 CET	53	48484	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:07.416629076 CET	58966	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:07.539242029 CET	53	58966	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:07.540514946 CET	38130	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:07.663208961 CET	53	38130	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:07.664484978 CET	52342	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:07.787400007 CET	53	52342	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:12.798711061 CET	49571	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:12.921475887 CET	53	49571	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:12.922647953 CET	53468	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:13.045290947 CET	53	53468	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:13.046538115 CET	44736	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:13.169584990 CET	53	44736	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:13.170747042 CET	39488	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:13.293415070 CET	53	39488	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:13.294142962 CET	37519	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:13.416841984 CET	53	37519	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:18.419287920 CET	47990	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:18.541852951 CET	53	47990	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:18.542882919 CET	52050	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:18.665478945 CET	53	52050	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:18.666385889 CET	47581	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:18.788973093 CET	53	47581	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:18.790158033 CET	45802	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:18.912744999 CET	53	45802	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:18.913845062 CET	53307	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:19.037295103 CET	53	53307	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:20.039954901 CET	54268	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:20.162846088 CET	53	54268	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:20.163882971 CET	38285	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:20.286400080 CET	53	38285	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:20.287533045 CET	39649	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:20.410058975 CET	53	39649	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:20.411127090 CET	41793	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:20.534068108 CET	53	41793	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:20.535530090 CET	39887	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:20.658665895 CET	53	39887	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:29.660681963 CET	58690	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:29.783904076 CET	53	58690	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:29.785068035 CET	57940	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:29.907624006 CET	53	57940	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:29.908962011 CET	55484	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:30.031579018 CET	53	55484	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:30.033102989 CET	46285	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:30.155735970 CET	53	46285	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:30.157157898 CET	32914	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:30.279836893 CET	53	32914	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:35.282236099 CET	51741	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:35.405195951 CET	53	51741	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:35.406002998 CET	53662	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:35.528624058 CET	53	53662	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:35.529652119 CET	48637	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:35.652190924 CET	53	48637	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:35.653352022 CET	41519	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:35.776204109 CET	53	41519	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:35.777211905 CET	58790	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:35.905172110 CET	53	58790	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:45.906419039 CET	34300	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:46.028877020 CET	53	34300	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:46.029922962 CET	47243	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:46.155283928 CET	53	47243	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:46.156085968 CET	47890	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:46.290067911 CET	53	47890	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:46.291140079 CET	46061	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:46.413631916 CET	53	46061	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:46.414678097 CET	41753	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:46.537178040 CET	53	41753	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:49.539254904 CET	49707	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:49.661825895 CET	53	49707	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:49.662602901 CET	44824	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:49.785073996 CET	53	44824	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:49.785912991 CET	36967	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:49.920778036 CET	53	36967	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:49.921726942 CET	53584	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:50.045216084 CET	53	53584	8.8.8.8	192.168.2.23
Dec 25, 2024 12:55:50.046058893 CET	60717	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:55:50.168453932 CET	53	60717	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:00.169501066 CET	54916	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:00.295285940 CET	53	54916	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:00.295952082 CET	56037	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:00.418441057 CET	53	56037	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:00.419110060 CET	52610	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:00.553067923 CET	53	52610	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:00.553940058 CET	40830	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:00.676484108 CET	53	40830	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:00.677459955 CET	42040	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:00.800009012 CET	53	42040	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:01.803205967 CET	36402	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:01.925781012 CET	53	36402	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:01.927463055 CET	53570	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:02.050137043 CET	53	53570	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:02.050836086 CET	57049	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:02.173393965 CET	53	57049	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:02.174195051 CET	35964	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:02.296678066 CET	53	35964	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:02.297461987 CET	49155	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:02.419939995 CET	53	49155	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:04.422081947 CET	50253	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:04.544640064 CET	53	50253	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:04.545450926 CET	40596	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:04.668004036 CET	53	40596	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:04.669466972 CET	34095	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:04.792191029 CET	53	34095	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:04.793028116 CET	34227	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:04.915568113 CET	53	34227	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:04.916506052 CET	35983	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:05.039139032 CET	53	35983	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:07.040663958 CET	37783	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:07.163324118 CET	53	37783	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:07.164458990 CET	51184	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:07.286775112 CET	53	51184	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:07.287587881 CET	55704	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:07.421611071 CET	53	55704	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:07.422496080 CET	43112	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:07.545084953 CET	53	43112	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:07.546030998 CET	38256	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:07.668426991 CET	53	38256	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:12.671078920 CET	34497	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:12.794315100 CET	53	34497	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:12.796015978 CET	49855	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:12.918418884 CET	53	49855	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:12.920131922 CET	56909	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:13.042797089 CET	53	56909	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:13.043504953 CET	49320	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:13.165832996 CET	53	49320	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:13.167026997 CET	52222	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:13.289518118 CET	53	52222	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:20.291337013 CET	48454	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:20.414036989 CET	53	48454	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:20.414839983 CET	54077	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:20.537834883 CET	53	54077	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:20.538621902 CET	38044	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:20.661604881 CET	53	38044	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:20.662439108 CET	51021	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:20.784887075 CET	53	51021	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:20.785710096 CET	41324	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:20.908233881 CET	53	41324	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:25.910115957 CET	36859	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:26.032751083 CET	53	36859	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:26.033668041 CET	45153	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:26.156436920 CET	53	45153	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:26.157200098 CET	47404	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:26.279558897 CET	53	47404	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:26.280337095 CET	53597	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:26.402728081 CET	53	53597	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:26.403449059 CET	57891	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:26.525811911 CET	53	57891	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:32.527875900 CET	53508	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:32.667490959 CET	53	53508	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:32.668533087 CET	34053	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:32.791122913 CET	53	34053	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:32.792372942 CET	49961	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:32.914819956 CET	53	49961	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:32.915693998 CET	54359	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:33.038121939 CET	53	54359	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:33.038963079 CET	53930	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:33.161746025 CET	53	53930	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:36.164889097 CET	52910	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:36.287478924 CET	53	52910	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:36.288789988 CET	50834	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:36.411597967 CET	53	50834	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:36.413170099 CET	54452	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:36.535870075 CET	53	54452	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:36.537301064 CET	40504	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:36.660079002 CET	53	40504	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:36.661602020 CET	56037	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:36.784183025 CET	53	56037	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:40.787761927 CET	39191	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:40.910276890 CET	53	39191	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:40.911725998 CET	57114	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:41.034161091 CET	53	57114	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:41.035624027 CET	55974	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:41.158217907 CET	53	55974	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:41.159780979 CET	50260	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:41.282228947 CET	53	50260	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:41.283930063 CET	40471	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:41.406421900 CET	53	40471	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:49.409553051 CET	57513	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:49.532500029 CET	53	57513	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:49.533972025 CET	46653	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:56:49.656430960 CET	53	46653	8.8.8.8	192.168.2.23
Dec 25, 2024 12:56:49.657951117 CET	57033	53	192.168.2.23	8.8.8.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 25, 2024 12:54:44.985974073 CET	192.168.2.23	8.8.8.8	0x9402	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:45.110378981 CET	192.168.2.23	8.8.8.8	0x9402	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:45.234344006 CET	192.168.2.23	8.8.8.8	0x9402	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:45.359262943 CET	192.168.2.23	8.8.8.8	0x9402	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:45.483494997 CET	192.168.2.23	8.8.8.8	0x9402	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:53.612718105 CET	192.168.2.23	8.8.8.8	0x326f	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:53.736637115 CET	192.168.2.23	8.8.8.8	0x326f	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:53.860824108 CET	192.168.2.23	8.8.8.8	0x326f	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:53.985860109 CET	192.168.2.23	8.8.8.8	0x326f	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:54.109857082 CET	192.168.2.23	8.8.8.8	0x326f	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:56.235413074 CET	192.168.2.23	8.8.8.8	0x1a9	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:56.359169006 CET	192.168.2.23	8.8.8.8	0x1a9	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:56.483133078 CET	192.168.2.23	8.8.8.8	0x1a9	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:56.618788004 CET	192.168.2.23	8.8.8.8	0x1a9	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:56.743904114 CET	192.168.2.23	8.8.8.8	0x1a9	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:57.869643927 CET	192.168.2.23	8.8.8.8	0x9fd8	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:57.993468046 CET	192.168.2.23	8.8.8.8	0x9fd8	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:58.117193937 CET	192.168.2.23	8.8.8.8	0x9fd8	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:58.242194891 CET	192.168.2.23	8.8.8.8	0x9fd8	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:58.377176046 CET	192.168.2.23	8.8.8.8	0x9fd8	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:03.501910925 CET	192.168.2.23	8.8.8.8	0xf678	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:03.625799894 CET	192.168.2.23	8.8.8.8	0xf678	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:03.749697924 CET	192.168.2.23	8.8.8.8	0xf678	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:03.875427961 CET	192.168.2.23	8.8.8.8	0xf678	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:03.999583006 CET	192.168.2.23	8.8.8.8	0xf678	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:07.151979923 CET	192.168.2.23	8.8.8.8	0x80e4	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:07.287264109 CET	192.168.2.23	8.8.8.8	0x80e4	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:07.416629076 CET	192.168.2.23	8.8.8.8	0x80e4	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:07.540514946 CET	192.168.2.23	8.8.8.8	0x80e4	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:07.664484978 CET	192.168.2.23	8.8.8.8	0x80e4	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:12.798711061 CET	192.168.2.23	8.8.8.8	0xfaf3	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:12.922647953 CET	192.168.2.23	8.8.8.8	0xfaf3	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:13.046538115 CET	192.168.2.23	8.8.8.8	0xfaf3	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:13.170747042 CET	192.168.2.23	8.8.8.8	0xfaf3	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:13.294142962 CET	192.168.2.23	8.8.8.8	0xfaf3	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:18.419287920 CET	192.168.2.23	8.8.8.8	0xdb7a	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:18.542882919 CET	192.168.2.23	8.8.8.8	0xdb7a	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:18.666385889 CET	192.168.2.23	8.8.8.8	0xdb7a	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:18.790158033 CET	192.168.2.23	8.8.8.8	0xdb7a	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:18.913845062 CET	192.168.2.23	8.8.8.8	0xdb7a	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:20.039954901 CET	192.168.2.23	8.8.8.8	0x62c4	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:20.163882971 CET	192.168.2.23	8.8.8.8	0x62c4	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:20.287533045 CET	192.168.2.23	8.8.8.8	0x62c4	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:20.411127090 CET	192.168.2.23	8.8.8.8	0x62c4	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:20.535530090 CET	192.168.2.23	8.8.8.8	0x62c4	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:29.660681963 CET	192.168.2.23	8.8.8.8	0x4b11	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:29.785068035 CET	192.168.2.23	8.8.8.8	0x4b11	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:29.908962011 CET	192.168.2.23	8.8.8.8	0x4b11	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:30.033102989 CET	192.168.2.23	8.8.8.8	0x4b11	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:30.157157898 CET	192.168.2.23	8.8.8.8	0x4b11	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:35.282236099 CET	192.168.2.23	8.8.8.8	0x9cc9	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:35.406002998 CET	192.168.2.23	8.8.8.8	0x9cc9	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:35.529652119 CET	192.168.2.23	8.8.8.8	0x9cc9	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:35.653352022 CET	192.168.2.23	8.8.8.8	0x9cc9	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:35.777211905 CET	192.168.2.23	8.8.8.8	0x9cc9	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:45.906419039 CET	192.168.2.23	8.8.8.8	0xaac7	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:46.029922962 CET	192.168.2.23	8.8.8.8	0xaac7	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:46.156085968 CET	192.168.2.23	8.8.8.8	0xaac7	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:46.291140079 CET	192.168.2.23	8.8.8.8	0xaac7	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:46.414678097 CET	192.168.2.23	8.8.8.8	0xaac7	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:49.539254904 CET	192.168.2.23	8.8.8.8	0x75b6	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:49.662602901 CET	192.168.2.23	8.8.8.8	0x75b6	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:49.785912991 CET	192.168.2.23	8.8.8.8	0x75b6	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:49.921726942 CET	192.168.2.23	8.8.8.8	0x75b6	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:50.046058893 CET	192.168.2.23	8.8.8.8	0x75b6	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:00.169501066 CET	192.168.2.23	8.8.8.8	0xbbc9	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:00.295952082 CET	192.168.2.23	8.8.8.8	0xbbc9	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:00.419110060 CET	192.168.2.23	8.8.8.8	0xbbc9	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:00.553940058 CET	192.168.2.23	8.8.8.8	0xbbc9	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:00.677459955 CET	192.168.2.23	8.8.8.8	0xbbc9	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:01.803205967 CET	192.168.2.23	8.8.8.8	0x4f50	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:01.927463055 CET	192.168.2.23	8.8.8.8	0x4f50	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:02.050836086 CET	192.168.2.23	8.8.8.8	0x4f50	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:02.174195051 CET	192.168.2.23	8.8.8.8	0x4f50	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:02.297461987 CET	192.168.2.23	8.8.8.8	0x4f50	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:04.422081947 CET	192.168.2.23	8.8.8.8	0x2c4c	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:04.545450926 CET	192.168.2.23	8.8.8.8	0x2c4c	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:04.669466972 CET	192.168.2.23	8.8.8.8	0x2c4c	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:04.793028116 CET	192.168.2.23	8.8.8.8	0x2c4c	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:04.916506052 CET	192.168.2.23	8.8.8.8	0x2c4c	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:07.040663958 CET	192.168.2.23	8.8.8.8	0x42b8	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:07.164458990 CET	192.168.2.23	8.8.8.8	0x42b8	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:07.287587881 CET	192.168.2.23	8.8.8.8	0x42b8	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:07.422496080 CET	192.168.2.23	8.8.8.8	0x42b8	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:07.546030998 CET	192.168.2.23	8.8.8.8	0x42b8	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:12.671078920 CET	192.168.2.23	8.8.8.8	0x60e3	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:12.796015978 CET	192.168.2.23	8.8.8.8	0x60e3	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:12.920131922 CET	192.168.2.23	8.8.8.8	0x60e3	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:13.043504953 CET	192.168.2.23	8.8.8.8	0x60e3	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:13.167026997 CET	192.168.2.23	8.8.8.8	0x60e3	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:20.291337013 CET	192.168.2.23	8.8.8.8	0x10d9	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:20.414839983 CET	192.168.2.23	8.8.8.8	0x10d9	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:20.538621902 CET	192.168.2.23	8.8.8.8	0x10d9	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:20.662439108 CET	192.168.2.23	8.8.8.8	0x10d9	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:20.785710096 CET	192.168.2.23	8.8.8.8	0x10d9	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:25.910115957 CET	192.168.2.23	8.8.8.8	0x8749	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:26.033668041 CET	192.168.2.23	8.8.8.8	0x8749	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:26.157200098 CET	192.168.2.23	8.8.8.8	0x8749	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:26.280337095 CET	192.168.2.23	8.8.8.8	0x8749	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:26.403449059 CET	192.168.2.23	8.8.8.8	0x8749	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:32.527875900 CET	192.168.2.23	8.8.8.8	0xa303	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:32.668533087 CET	192.168.2.23	8.8.8.8	0xa303	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:32.792372942 CET	192.168.2.23	8.8.8.8	0xa303	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:32.915693998 CET	192.168.2.23	8.8.8.8	0xa303	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:33.038963079 CET	192.168.2.23	8.8.8.8	0xa303	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:36.164889097 CET	192.168.2.23	8.8.8.8	0x9b6e	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:36.288789988 CET	192.168.2.23	8.8.8.8	0x9b6e	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:36.413170099 CET	192.168.2.23	8.8.8.8	0x9b6e	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:36.537301064 CET	192.168.2.23	8.8.8.8	0x9b6e	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:36.661602020 CET	192.168.2.23	8.8.8.8	0x9b6e	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:40.787761927 CET	192.168.2.23	8.8.8.8	0x60d3	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:40.911725998 CET	192.168.2.23	8.8.8.8	0x60d3	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:41.035624027 CET	192.168.2.23	8.8.8.8	0x60d3	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:41.159780979 CET	192.168.2.23	8.8.8.8	0x60d3	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:41.283930063 CET	192.168.2.23	8.8.8.8	0x60d3	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:49.409553051 CET	192.168.2.23	8.8.8.8	0x5812	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:49.533972025 CET	192.168.2.23	8.8.8.8	0x5812	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:49.657951117 CET	192.168.2.23	8.8.8.8	0x5812	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 25, 2024 12:54:45.108768940 CET	8.8.8.8	192.168.2.23	0x9402	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:45.232852936 CET	8.8.8.8	192.168.2.23	0x9402	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:45.357749939 CET	8.8.8.8	192.168.2.23	0x9402	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:45.481956959 CET	8.8.8.8	192.168.2.23	0x9402	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:45.607036114 CET	8.8.8.8	192.168.2.23	0x9402	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:53.735378981 CET	8.8.8.8	192.168.2.23	0x326f	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:53.859447002 CET	8.8.8.8	192.168.2.23	0x326f	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:53.984709024 CET	8.8.8.8	192.168.2.23	0x326f	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:54.108690023 CET	8.8.8.8	192.168.2.23	0x326f	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:54.232498884 CET	8.8.8.8	192.168.2.23	0x326f	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:56.358186007 CET	8.8.8.8	192.168.2.23	0x1a9	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:56.481690884 CET	8.8.8.8	192.168.2.23	0x1a9	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:56.617427111 CET	8.8.8.8	192.168.2.23	0x1a9	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:56.741517067 CET	8.8.8.8	192.168.2.23	0x1a9	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:56.866419077 CET	8.8.8.8	192.168.2.23	0x1a9	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:57.992324114 CET	8.8.8.8	192.168.2.23	0x9fd8	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:58.116128922 CET	8.8.8.8	192.168.2.23	0x9fd8	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:58.241147995 CET	8.8.8.8	192.168.2.23	0x9fd8	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:58.376162052 CET	8.8.8.8	192.168.2.23	0x9fd8	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:54:58.499644995 CET	8.8.8.8	192.168.2.23	0x9fd8	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:03.624563932 CET	8.8.8.8	192.168.2.23	0xf678	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:03.748231888 CET	8.8.8.8	192.168.2.23	0xf678	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:03.872195005 CET	8.8.8.8	192.168.2.23	0xf678	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:03.998132944 CET	8.8.8.8	192.168.2.23	0xf678	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:04.133331060 CET	8.8.8.8	192.168.2.23	0xf678	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:07.285964012 CET	8.8.8.8	192.168.2.23	0x80e4	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:07.415311098 CET	8.8.8.8	192.168.2.23	0x80e4	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:07.539242029 CET	8.8.8.8	192.168.2.23	0x80e4	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:07.663208961 CET	8.8.8.8	192.168.2.23	0x80e4	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:07.787400007 CET	8.8.8.8	192.168.2.23	0x80e4	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:12.921475887 CET	8.8.8.8	192.168.2.23	0xfaf3	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:13.045290947 CET	8.8.8.8	192.168.2.23	0xfaf3	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:13.169584990 CET	8.8.8.8	192.168.2.23	0xfaf3	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:13.293415070 CET	8.8.8.8	192.168.2.23	0xfaf3	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:13.416841984 CET	8.8.8.8	192.168.2.23	0xfaf3	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:18.541852951 CET	8.8.8.8	192.168.2.23	0xdb7a	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:18.665478945 CET	8.8.8.8	192.168.2.23	0xdb7a	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:18.788973093 CET	8.8.8.8	192.168.2.23	0xdb7a	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:18.912744999 CET	8.8.8.8	192.168.2.23	0xdb7a	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:19.037295103 CET	8.8.8.8	192.168.2.23	0xdb7a	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:20.162846088 CET	8.8.8.8	192.168.2.23	0x62c4	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:20.286400080 CET	8.8.8.8	192.168.2.23	0x62c4	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:20.410058975 CET	8.8.8.8	192.168.2.23	0x62c4	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:20.534068108 CET	8.8.8.8	192.168.2.23	0x62c4	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:20.658665895 CET	8.8.8.8	192.168.2.23	0x62c4	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:29.783904076 CET	8.8.8.8	192.168.2.23	0x4b11	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:29.907624006 CET	8.8.8.8	192.168.2.23	0x4b11	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:30.031579018 CET	8.8.8.8	192.168.2.23	0x4b11	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:30.155735970 CET	8.8.8.8	192.168.2.23	0x4b11	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:30.279836893 CET	8.8.8.8	192.168.2.23	0x4b11	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:35.405195951 CET	8.8.8.8	192.168.2.23	0x9cc9	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:35.528624058 CET	8.8.8.8	192.168.2.23	0x9cc9	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:35.652190924 CET	8.8.8.8	192.168.2.23	0x9cc9	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:35.776204109 CET	8.8.8.8	192.168.2.23	0x9cc9	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:35.905172110 CET	8.8.8.8	192.168.2.23	0x9cc9	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:46.028877020 CET	8.8.8.8	192.168.2.23	0xaac7	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:46.155283928 CET	8.8.8.8	192.168.2.23	0xaac7	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:46.290067911 CET	8.8.8.8	192.168.2.23	0xaac7	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:46.413631916 CET	8.8.8.8	192.168.2.23	0xaac7	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:46.537178040 CET	8.8.8.8	192.168.2.23	0xaac7	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:49.661825895 CET	8.8.8.8	192.168.2.23	0x75b6	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:49.785073996 CET	8.8.8.8	192.168.2.23	0x75b6	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:49.920778036 CET	8.8.8.8	192.168.2.23	0x75b6	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:50.045216084 CET	8.8.8.8	192.168.2.23	0x75b6	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:55:50.168453932 CET	8.8.8.8	192.168.2.23	0x75b6	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:00.295285940 CET	8.8.8.8	192.168.2.23	0xbbc9	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:00.418441057 CET	8.8.8.8	192.168.2.23	0xbbc9	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:00.553067923 CET	8.8.8.8	192.168.2.23	0xbbc9	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:00.676484108 CET	8.8.8.8	192.168.2.23	0xbbc9	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:00.800009012 CET	8.8.8.8	192.168.2.23	0xbbc9	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:01.925781012 CET	8.8.8.8	192.168.2.23	0x4f50	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:02.050137043 CET	8.8.8.8	192.168.2.23	0x4f50	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:02.173393965 CET	8.8.8.8	192.168.2.23	0x4f50	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:02.296678066 CET	8.8.8.8	192.168.2.23	0x4f50	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:02.419939995 CET	8.8.8.8	192.168.2.23	0x4f50	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:04.544640064 CET	8.8.8.8	192.168.2.23	0x2c4c	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:04.668004036 CET	8.8.8.8	192.168.2.23	0x2c4c	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:04.792191029 CET	8.8.8.8	192.168.2.23	0x2c4c	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:04.915568113 CET	8.8.8.8	192.168.2.23	0x2c4c	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:05.039139032 CET	8.8.8.8	192.168.2.23	0x2c4c	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:07.163324118 CET	8.8.8.8	192.168.2.23	0x42b8	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:07.286775112 CET	8.8.8.8	192.168.2.23	0x42b8	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:07.421611071 CET	8.8.8.8	192.168.2.23	0x42b8	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:07.545084953 CET	8.8.8.8	192.168.2.23	0x42b8	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:07.668426991 CET	8.8.8.8	192.168.2.23	0x42b8	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:12.794315100 CET	8.8.8.8	192.168.2.23	0x60e3	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:12.918418884 CET	8.8.8.8	192.168.2.23	0x60e3	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:13.042797089 CET	8.8.8.8	192.168.2.23	0x60e3	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:13.165832996 CET	8.8.8.8	192.168.2.23	0x60e3	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:13.289518118 CET	8.8.8.8	192.168.2.23	0x60e3	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:20.414036989 CET	8.8.8.8	192.168.2.23	0x10d9	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:20.537834883 CET	8.8.8.8	192.168.2.23	0x10d9	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:20.661604881 CET	8.8.8.8	192.168.2.23	0x10d9	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:20.784887075 CET	8.8.8.8	192.168.2.23	0x10d9	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:20.908233881 CET	8.8.8.8	192.168.2.23	0x10d9	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:26.032751083 CET	8.8.8.8	192.168.2.23	0x8749	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:26.156436920 CET	8.8.8.8	192.168.2.23	0x8749	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:26.279558897 CET	8.8.8.8	192.168.2.23	0x8749	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:26.402728081 CET	8.8.8.8	192.168.2.23	0x8749	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:26.525811911 CET	8.8.8.8	192.168.2.23	0x8749	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:32.667490959 CET	8.8.8.8	192.168.2.23	0xa303	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:32.791122913 CET	8.8.8.8	192.168.2.23	0xa303	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:32.914819956 CET	8.8.8.8	192.168.2.23	0xa303	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:33.038121939 CET	8.8.8.8	192.168.2.23	0xa303	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:33.161746025 CET	8.8.8.8	192.168.2.23	0xa303	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:36.287478924 CET	8.8.8.8	192.168.2.23	0x9b6e	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:36.411597967 CET	8.8.8.8	192.168.2.23	0x9b6e	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:36.535870075 CET	8.8.8.8	192.168.2.23	0x9b6e	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:36.660079002 CET	8.8.8.8	192.168.2.23	0x9b6e	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:36.784183025 CET	8.8.8.8	192.168.2.23	0x9b6e	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:40.910276890 CET	8.8.8.8	192.168.2.23	0x60d3	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:41.034161091 CET	8.8.8.8	192.168.2.23	0x60d3	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:41.158217907 CET	8.8.8.8	192.168.2.23	0x60d3	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:41.282228947 CET	8.8.8.8	192.168.2.23	0x60d3	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:41.406421900 CET	8.8.8.8	192.168.2.23	0x60d3	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:49.532500029 CET	8.8.8.8	192.168.2.23	0x5812	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:56:49.656430960 CET	8.8.8.8	192.168.2.23	0x5812	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: m68k.elf PID: 6243, Parent PID: 6161

General

Start time (UTC):	11:54:43
Start date (UTC):	25/12/2024
Path:	/tmp/m68k.elf
Arguments:	/tmp/m68k.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: m68k.elf PID: 6245, Parent PID: 6243

General

Start time (UTC):	11:54:43
Start date (UTC):	25/12/2024
Path:	/tmp/m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: m68k.elf PID: 6247, Parent PID: 6245

General

Start time (UTC):	11:54:43
Start date (UTC):	25/12/2024
Path:	/tmp/m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: m68k.elf PID: 6249, Parent PID: 6245

General

Start time (UTC):	11:54:43
Start date (UTC):	25/12/2024
Path:	/tmp/m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: m68k.elf PID: 6251, Parent PID: 6249

General

Start time (UTC):	11:54:43
Start date (UTC):	25/12/2024
Path:	/tmp/m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report m68k.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: m68k.elf PID: 6243, Parent PID: 6161

General

Chronological Activities

Analysis Process: m68k.elf PID: 6245, Parent PID: 6243

General

Chronological Activities

Analysis Process: m68k.elf PID: 6247, Parent PID: 6245

General

Chronological Activities

Analysis Process: m68k.elf PID: 6249, Parent PID: 6245

General

Chronological Activities

Analysis Process: m68k.elf PID: 6251, Parent PID: 6249

General

Chronological Activities

Linux Analysis Report
m68k.elf