Edit tour

Linux Analysis Report
Space.x86.elf

Overview

General Information

Sample name:	Space.x86.elf
Analysis ID:	1581299
MD5:	86b0dbac78477aca5c3dd080ba53e837
SHA1:	2542925378bca24e31bfcbfb9197cb0ba874fb21
SHA256:	43a4a0183be4f67dc7757fd2068e7c3a604423abe3b5e71ad03b9f382a70899f
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581299
Start date and time:	2024-12-27 10:37:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Space.x86.elf
Detection:	MAL
Classification:	mal64.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/Space.x86.elf
PID:	5466
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

Space.x86.elf (PID: 5466, Parent: 5391, MD5: 86b0dbac78477aca5c3dd080ba53e837) Arguments: /tmp/Space.x86.elf

Space.x86.elf New Fork (PID: 5467, Parent: 5466)

Space.x86.elf New Fork (PID: 5468, Parent: 5467)

Space.x86.elf New Fork (PID: 5469, Parent: 5467)

Space.x86.elf New Fork (PID: 5478, Parent: 5466)

Space.x86.elf New Fork (PID: 5479, Parent: 5466)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5468.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1089c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1093c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1098c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5468.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f3b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
5468.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7726:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
5468.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7052:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
5478.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1089c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1093c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1098c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5478.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f3b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
5478.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7726:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
5478.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7052:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
5467.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1089c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1093c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1098c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5467.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f3b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
5467.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7726:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
5467.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7052:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
5466.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1089c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1093c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1098c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5466.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f3b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
5466.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7726:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
5466.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7052:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Process Memory Space: Space.x86.elf PID: 5466	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1984:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1998:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.x86.elf PID: 5467	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x655:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x669:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x67d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x691:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x709:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x71d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x731:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x745:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x759:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x76d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x781:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x795:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7e5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.x86.elf PID: 5468	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.x86.elf PID: 5478	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x655:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x669:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x67d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x691:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x709:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x71d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x731:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x745:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x759:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x76d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x781:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x795:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7e5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 15 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Space.x86.elf	Virustotal: Detection: 42%			Perma Link
Source: Space.x86.elf	ReversingLabs: Detection: 47%

Machine Learning detection for sample

Source: Space.x86.elf

Joe Sandbox ML: detected

Source: global traffic

TCP traffic: 192.168.2.14:52026 -> 159.100.18.129:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129

Source: Space.x86.elf

String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 5468.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5468.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 5468.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 5468.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5478.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5478.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 5478.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 5478.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5467.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5467.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 5467.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 5467.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5466.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5466.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 5466.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 5466.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: Process Memory Space: Space.x86.elf PID: 5466, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.x86.elf PID: 5467, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.x86.elf PID: 5468, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.x86.elf PID: 5478, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0xc01000

Source: 5468.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5468.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 5468.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 5468.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5478.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5478.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 5478.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 5478.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5467.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5467.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 5467.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 5467.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5466.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5466.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 5466.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 5466.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: Process Memory Space: Space.x86.elf PID: 5466, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.x86.elf PID: 5467, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.x86.elf PID: 5468, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.x86.elf PID: 5478, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal64.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/3760/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/1583/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/2672/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/3759/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/1577/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/3757/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/917/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/3758/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/19/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/1593/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/240/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/3094/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/242/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/3406/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/244/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/1589/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/245/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/1588/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/246/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/3402/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/5/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/247/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/7/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/8/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/129/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/801/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/803/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/806/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/807/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/928/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/3420/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/490/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/131/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/135/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/1599/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/378/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/3412/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/1371/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/260/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/261/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5466)	File opened: /proc/262/status	Jump to behavior

Source: Space.x86.elf

Submission file: segment LOAD with 7.9623 entropy (max. 8.0)

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Space.x86.elf	43%	Virustotal		Browse
Space.x86.elf	47%	ReversingLabs	Linux.Backdoor.Mirai
Space.x86.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Space.x86.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
159.100.18.129	unknown	Germany		44066	DE-FIRSTCOLOwwwfirst-colonetDE	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
159.100.18.129	Space.ppc.elf	Get hash	malicious	Unknown	Browse
159.100.18.129	Space.mips.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DE-FIRSTCOLOwwwfirst-colonetDE	Space.ppc.elf	Get hash	malicious	Unknown	Browse	159.100.18.129
	Space.mips.elf	Get hash	malicious	Unknown	Browse	159.100.18.129
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	159.100.14.33
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	159.100.14.33
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	159.100.14.33
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	159.100.14.33
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	159.100.14.33
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	159.100.14.33
	159.100.14.33-boatnet.arm-2024-12-25T14_31_19.elf	Get hash	malicious	Mirai	Browse	159.100.14.33
	159.100.14.33-boatnet.arm7-2024-12-25T14_32_39.elf	Get hash	malicious	Mirai	Browse	159.100.14.33

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.960369981594731
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	Space.x86.elf
File size:	38'740 bytes
MD5:	86b0dbac78477aca5c3dd080ba53e837
SHA1:	2542925378bca24e31bfcbfb9197cb0ba874fb21
SHA256:	43a4a0183be4f67dc7757fd2068e7c3a604423abe3b5e71ad03b9f382a70899f
SHA512:	6189287779a998d158de62b5b434338f7cfb556b92dc11280f0bbb6bedc267864c6b48085c80109169204f1d27b12abb5a268fa58da57b2d6200eb4d6eb25758
SSDEEP:	768:Za+BWS+ZPwIIBPGpssqVuAIrRMvOGnQ55RT7iIUeLgffYyIFgsjCiUnbcuyD7Urc:Za+BH+hKBZrhIynQ55BiTeLgffbJThnG
TLSH:	8903F162B1E9CF01CA1FA37200BFF40F3651B53A6066625E7D84953609C2F9A4D387EB
File Content Preview:	.ELF....................h...4...........4. ...(.....................\...\...........................................Q.td.............................-..UPX!.........2...2......W..........?..k.I/.j....\.R......)..n.4go.\|.>#.....{~q..`.mm.XCp.ch....i.E'.)..

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0xc09468
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0xc01000	0xc01000	0x965c	0x965c	7.9623	0x5	R E	0x1000
LOAD	0xc08	0x805bc08	0x805bc08	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 10:38:11.074340105 CET	52026	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:11.194053888 CET	3778	52026	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:11.194128990 CET	52026	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:11.194194078 CET	52026	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:11.313764095 CET	3778	52026	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:11.313847065 CET	52026	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:11.433461905 CET	3778	52026	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:12.558654070 CET	3778	52026	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:12.558845997 CET	52026	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:12.558887005 CET	52026	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:12.559005976 CET	52028	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:12.678713083 CET	3778	52028	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:12.678889990 CET	52028	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:12.679069996 CET	52028	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:12.798765898 CET	3778	52028	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:12.798907995 CET	52028	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:12.918597937 CET	3778	52028	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:13.988540888 CET	3778	52028	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:13.988854885 CET	52028	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:13.988915920 CET	52028	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:13.988962889 CET	52030	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:14.108700037 CET	3778	52030	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:14.108916044 CET	52030	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:14.108977079 CET	52030	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:14.228652954 CET	3778	52030	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:14.228910923 CET	52030	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:14.348565102 CET	3778	52030	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:15.368191004 CET	3778	52030	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:15.368341923 CET	52030	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:15.368387938 CET	52030	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:15.368488073 CET	52032	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:15.488224030 CET	3778	52032	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:15.488614082 CET	52032	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:15.488614082 CET	52032	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:15.608539104 CET	3778	52032	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:15.608946085 CET	52032	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:15.728554964 CET	3778	52032	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:16.590893984 CET	52034	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:16.710853100 CET	3778	52034	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:16.711019039 CET	52034	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:16.711146116 CET	52034	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:16.830931902 CET	3778	52034	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:16.831306934 CET	52034	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:16.843995094 CET	3778	52032	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:16.844134092 CET	52032	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:16.844189882 CET	52032	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:16.844255924 CET	52036	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:16.951008081 CET	3778	52034	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:16.963869095 CET	3778	52036	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:16.964068890 CET	52036	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:16.964129925 CET	52036	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:17.084042072 CET	3778	52036	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:17.084420919 CET	52036	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:17.204277039 CET	3778	52036	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:18.063306093 CET	3778	52034	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:18.063473940 CET	52034	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:18.063519955 CET	52034	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:18.063580990 CET	52038	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:18.183409929 CET	3778	52038	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:18.183497906 CET	52038	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:18.183546066 CET	52038	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:18.270117044 CET	3778	52036	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:18.270337105 CET	52036	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:18.270337105 CET	52036	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:18.270381927 CET	52040	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:18.303203106 CET	3778	52038	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:18.303287029 CET	52038	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:18.390075922 CET	3778	52040	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:18.390175104 CET	52040	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:18.390213013 CET	52040	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:18.422844887 CET	3778	52038	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:18.509850979 CET	3778	52040	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:18.510035992 CET	52040	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:18.629770994 CET	3778	52040	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:19.442291975 CET	3778	52038	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:19.442501068 CET	52038	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:19.442553997 CET	52038	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:19.442641020 CET	52042	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:19.562515974 CET	3778	52042	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:19.562684059 CET	52042	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:19.562800884 CET	52042	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:19.682578087 CET	3778	52042	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:19.682701111 CET	52042	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:19.742095947 CET	3778	52040	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:19.742192984 CET	52040	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:19.742212057 CET	52040	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:19.742264032 CET	52044	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:19.802330017 CET	3778	52042	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:19.862035036 CET	3778	52044	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:19.862310886 CET	52044	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:19.862310886 CET	52044	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:19.982222080 CET	3778	52044	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:19.982465982 CET	52044	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:20.102106094 CET	3778	52044	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:21.131052017 CET	3778	52044	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:21.131263971 CET	52044	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:21.131534100 CET	52046	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:21.131534100 CET	52044	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:21.251154900 CET	3778	52046	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:21.251355886 CET	52046	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:21.251504898 CET	52046	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:21.370992899 CET	3778	52046	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:21.371239901 CET	52046	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:21.490919113 CET	3778	52046	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:22.602536917 CET	3778	52046	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:22.602715969 CET	52046	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:22.602767944 CET	52046	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:22.602859974 CET	52048	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:22.811723948 CET	3778	52048	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:22.811873913 CET	52048	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:22.811901093 CET	52048	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:22.931580067 CET	3778	52048	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:22.931679010 CET	52048	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:23.051522017 CET	3778	52048	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:24.073242903 CET	3778	52048	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:24.073599100 CET	52050	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:24.073600054 CET	52048	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:24.073600054 CET	52048	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:24.193732977 CET	3778	52050	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:24.194026947 CET	52050	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:24.194026947 CET	52050	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:24.314022064 CET	3778	52050	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:24.314415932 CET	52050	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:24.434154034 CET	3778	52050	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:25.501050949 CET	3778	52050	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:25.501418114 CET	52050	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:25.501502991 CET	52050	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:25.501511097 CET	52052	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:25.621198893 CET	3778	52052	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:25.621334076 CET	52052	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:25.621385098 CET	52052	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:25.741072893 CET	3778	52052	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:25.741224051 CET	52052	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:25.860883951 CET	3778	52052	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:26.928692102 CET	3778	52052	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:26.929004908 CET	52052	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:26.929058075 CET	52052	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:26.929203987 CET	52054	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:27.049024105 CET	3778	52054	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:27.049365044 CET	52054	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:27.049470901 CET	52054	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:27.169222116 CET	3778	52054	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:27.169542074 CET	52054	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:27.289268017 CET	3778	52054	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:28.402230978 CET	3778	52054	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:28.402406931 CET	52054	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:28.402455091 CET	52054	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:28.402524948 CET	52056	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:28.522267103 CET	3778	52056	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:28.522442102 CET	52056	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:28.522547007 CET	52056	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:28.642175913 CET	3778	52056	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:28.642306089 CET	52056	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:28.761949062 CET	3778	52056	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:29.569576979 CET	52042	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:29.689290047 CET	3778	52042	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:29.839978933 CET	3778	52056	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:29.840316057 CET	52056	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:29.840316057 CET	52056	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:29.840358973 CET	52058	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:29.960113049 CET	3778	52058	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:29.960349083 CET	52058	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:29.960469961 CET	52058	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:29.979901075 CET	3778	52042	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:29.979995966 CET	52042	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:30.080127001 CET	3778	52058	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:30.080353975 CET	52058	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:30.200122118 CET	3778	52058	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:31.219470978 CET	3778	52058	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:31.219824076 CET	52058	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:31.219891071 CET	52058	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:31.219985962 CET	52060	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:31.339647055 CET	3778	52060	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:31.339798927 CET	52060	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:31.339965105 CET	52060	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:31.459527016 CET	3778	52060	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:31.459748030 CET	52060	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:31.579400063 CET	3778	52060	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:32.601464033 CET	3778	52060	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:32.601680994 CET	52060	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:32.601743937 CET	52060	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:32.601821899 CET	52062	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:32.721457958 CET	3778	52062	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:32.721623898 CET	52062	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:32.721739054 CET	52062	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:32.841445923 CET	3778	52062	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:32.841607094 CET	52062	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:32.961416960 CET	3778	52062	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:34.037358999 CET	3778	52062	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:34.037570000 CET	52062	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:34.037627935 CET	52062	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:34.037666082 CET	52064	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:34.157411098 CET	3778	52064	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:34.157812119 CET	52064	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:34.158169031 CET	52064	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:34.277718067 CET	3778	52064	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:34.277874947 CET	52064	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:34.397627115 CET	3778	52064	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:35.509577990 CET	3778	52064	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:35.509756088 CET	52064	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:35.509800911 CET	52064	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:35.509860992 CET	52066	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:35.629436970 CET	3778	52066	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:35.629646063 CET	52066	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:35.629808903 CET	52066	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:35.749309063 CET	3778	52066	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:35.749470949 CET	52066	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:35.869180918 CET	3778	52066	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:36.935578108 CET	3778	52066	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:36.935831070 CET	52066	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:36.935869932 CET	52066	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:36.935935020 CET	52068	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:37.055444002 CET	3778	52068	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:37.055563927 CET	52068	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:37.055633068 CET	52068	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:37.175427914 CET	3778	52068	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:37.175570011 CET	52068	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:37.295197964 CET	3778	52068	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:38.362059116 CET	3778	52068	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:38.362307072 CET	52068	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:38.362368107 CET	52068	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:38.362459898 CET	52070	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:38.482110977 CET	3778	52070	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:38.482306957 CET	52070	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:38.482435942 CET	52070	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:38.602097034 CET	3778	52070	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:38.602350950 CET	52070	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:38.722068071 CET	3778	52070	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:39.834436893 CET	3778	52070	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:39.834804058 CET	52070	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:39.834851980 CET	52070	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:39.834875107 CET	52072	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:39.954557896 CET	3778	52072	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:39.954873085 CET	52072	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:39.954921007 CET	52072	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:40.074568987 CET	3778	52072	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:40.074824095 CET	52072	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:40.194557905 CET	3778	52072	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:41.306885958 CET	3778	52072	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:41.307064056 CET	52072	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:41.307090998 CET	52072	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:41.307107925 CET	52074	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:41.426740885 CET	3778	52074	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:41.427000046 CET	52074	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:41.427212954 CET	52074	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:41.546746016 CET	3778	52074	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:41.546976089 CET	52074	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:41.666789055 CET	3778	52074	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:42.778619051 CET	3778	52074	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:42.778789997 CET	52074	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:42.778852940 CET	52074	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:42.778937101 CET	52076	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:42.898467064 CET	3778	52076	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:42.898778915 CET	52076	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:42.898941994 CET	52076	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:43.018523932 CET	3778	52076	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:43.018702030 CET	52076	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:43.138606071 CET	3778	52076	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:44.204225063 CET	3778	52076	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:44.204569101 CET	52076	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:44.204621077 CET	52076	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:44.204710960 CET	52078	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:44.324239969 CET	3778	52078	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:44.324490070 CET	52078	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:44.324668884 CET	52078	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:44.444325924 CET	3778	52078	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:44.444499969 CET	52078	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:44.564157009 CET	3778	52078	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:45.630373001 CET	3778	52078	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:45.630749941 CET	52078	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:45.630939007 CET	52078	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:45.630949020 CET	52080	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:45.750529051 CET	3778	52080	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:45.750950098 CET	52080	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:45.750951052 CET	52080	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:45.870851994 CET	3778	52080	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:45.871072054 CET	52080	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:45.990789890 CET	3778	52080	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:47.102220058 CET	3778	52080	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:47.102443933 CET	52080	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:47.102567911 CET	52080	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:47.102670908 CET	52082	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:47.222322941 CET	3778	52082	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:47.222518921 CET	52082	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:47.222577095 CET	52082	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:47.342281103 CET	3778	52082	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:47.342416048 CET	52082	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:47.462155104 CET	3778	52082	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:48.481336117 CET	3778	52082	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:48.481527090 CET	52082	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:48.481580973 CET	52082	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:48.481673956 CET	52084	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:48.611788988 CET	3778	52084	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:48.611991882 CET	52084	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:48.612104893 CET	52084	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:48.731822968 CET	3778	52084	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:48.732028961 CET	52084	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:48.851640940 CET	3778	52084	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:53.800319910 CET	3778	52084	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:53.800497055 CET	52084	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:53.800497055 CET	52084	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:53.800539017 CET	52086	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:53.920197010 CET	3778	52086	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:53.920315027 CET	52086	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:53.920342922 CET	52086	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:54.039932013 CET	3778	52086	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:54.040040016 CET	52086	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:54.159549952 CET	3778	52086	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:55.183088064 CET	3778	52086	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:55.183212996 CET	52086	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:55.183232069 CET	52086	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:55.183284998 CET	52088	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:55.302730083 CET	3778	52088	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:55.302838087 CET	52088	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:55.302921057 CET	52088	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:55.422384024 CET	3778	52088	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:55.422527075 CET	52088	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:55.542041063 CET	3778	52088	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:56.655486107 CET	3778	52088	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:56.655628920 CET	52088	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:56.655647039 CET	52088	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:56.655678988 CET	52090	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:56.775207043 CET	3778	52090	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:56.775337934 CET	52090	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:56.775337934 CET	52090	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:56.894970894 CET	3778	52090	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:56.895140886 CET	52090	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:57.014801025 CET	3778	52090	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:58.128606081 CET	3778	52090	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:58.128756046 CET	52090	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:58.128777981 CET	52090	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:58.128832102 CET	52092	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:58.248459101 CET	3778	52092	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:58.248600006 CET	52092	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:58.248770952 CET	52092	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:58.368307114 CET	3778	52092	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:58.368419886 CET	52092	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:58.488363981 CET	3778	52092	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:59.553673983 CET	3778	52092	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:59.553837061 CET	52092	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:59.553872108 CET	52092	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:59.553913116 CET	52094	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:59.673538923 CET	3778	52094	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:59.673625946 CET	52094	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:59.673691034 CET	52094	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:59.794106960 CET	3778	52094	159.100.18.129	192.168.2.14
Dec 27, 2024 10:38:59.794217110 CET	52094	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:38:59.913785934 CET	3778	52094	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:00.978523016 CET	3778	52094	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:00.978646994 CET	52094	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:00.978693962 CET	52094	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:00.978704929 CET	52096	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:01.098342896 CET	3778	52096	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:01.098469019 CET	52096	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:01.098603964 CET	52096	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:01.218354940 CET	3778	52096	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:01.218478918 CET	52096	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:01.338943005 CET	3778	52096	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:02.403399944 CET	3778	52096	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:02.403563023 CET	52096	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:02.403626919 CET	52096	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:02.403784037 CET	52098	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:02.523345947 CET	3778	52098	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:02.523663044 CET	52098	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:02.523803949 CET	52098	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:02.643466949 CET	3778	52098	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:02.643779039 CET	52098	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:02.763509989 CET	3778	52098	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:03.877372026 CET	3778	52098	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:03.877989054 CET	52098	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:03.878086090 CET	52098	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:03.878194094 CET	52100	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:03.997631073 CET	3778	52100	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:03.997800112 CET	52100	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:03.997931004 CET	52100	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:04.117708921 CET	3778	52100	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:04.117855072 CET	52100	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:04.237565994 CET	3778	52100	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:05.301799059 CET	3778	52100	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:05.301964998 CET	52100	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:05.301964998 CET	52100	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:05.302047014 CET	52102	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:05.421509981 CET	3778	52102	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:05.421753883 CET	52102	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:05.421813965 CET	52102	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:05.541366100 CET	3778	52102	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:05.541656971 CET	52102	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:05.662448883 CET	3778	52102	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:06.793142080 CET	3778	52102	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:06.793343067 CET	52102	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:06.793385029 CET	52102	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:06.793486118 CET	52104	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:06.913096905 CET	3778	52104	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:06.913234949 CET	52104	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:06.913283110 CET	52104	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:07.033010960 CET	3778	52104	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:07.033206940 CET	52104	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:07.152853012 CET	3778	52104	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:08.217880011 CET	3778	52104	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:08.218200922 CET	52104	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:08.218202114 CET	52104	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:08.218322039 CET	52106	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:08.337887049 CET	3778	52106	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:08.338170052 CET	52106	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:08.338193893 CET	52106	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:08.457794905 CET	3778	52106	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:08.457973957 CET	52106	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:08.577683926 CET	3778	52106	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:09.658655882 CET	3778	52106	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:09.658848047 CET	52106	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:09.658885002 CET	52106	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:09.658911943 CET	52108	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:09.778398991 CET	3778	52108	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:09.778590918 CET	52108	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:09.778661966 CET	52108	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:09.899326086 CET	3778	52108	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:09.899435997 CET	52108	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:10.018871069 CET	3778	52108	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:11.086333990 CET	3778	52108	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:11.086488008 CET	52108	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:11.086488008 CET	52108	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:11.086534023 CET	52110	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:11.206249952 CET	3778	52110	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:11.206394911 CET	52110	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:11.206461906 CET	52110	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:11.325949907 CET	3778	52110	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:11.326117039 CET	52110	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:11.445672989 CET	3778	52110	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:12.558681965 CET	3778	52110	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:12.558847904 CET	52110	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:12.558883905 CET	52110	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:12.558912039 CET	52112	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:12.678575039 CET	3778	52112	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:12.678710938 CET	52112	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:12.678807974 CET	52112	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:12.798382044 CET	3778	52112	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:12.798471928 CET	52112	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:12.917957067 CET	3778	52112	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:13.983818054 CET	3778	52112	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:13.984050035 CET	52112	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:13.984050035 CET	52112	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:13.984050035 CET	52114	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:14.103940010 CET	3778	52114	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:14.104250908 CET	52114	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:14.104455948 CET	52114	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:14.223875999 CET	3778	52114	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:14.224049091 CET	52114	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:14.343581915 CET	3778	52114	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:15.410576105 CET	3778	52114	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:15.410779953 CET	52114	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:15.410824060 CET	52114	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:15.410851955 CET	52116	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:15.530343056 CET	3778	52116	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:15.530469894 CET	52116	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:15.530606985 CET	52116	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:15.650026083 CET	3778	52116	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:15.650394917 CET	52116	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:15.769857883 CET	3778	52116	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:16.845244884 CET	3778	52116	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:16.845381021 CET	52116	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:16.845424891 CET	52116	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:16.845438957 CET	52118	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:16.964987040 CET	3778	52118	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:16.965114117 CET	52118	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:16.965331078 CET	52118	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:17.085163116 CET	3778	52118	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:17.085367918 CET	52118	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:17.204835892 CET	3778	52118	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:18.281043053 CET	3778	52118	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:18.281198978 CET	52118	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:18.281394958 CET	52118	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:18.281500101 CET	52120	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:18.400926113 CET	3778	52120	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:18.401050091 CET	52120	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:18.401133060 CET	52120	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:18.520550966 CET	3778	52120	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:18.520632029 CET	52120	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:18.640045881 CET	3778	52120	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:19.705084085 CET	3778	52120	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:19.705296040 CET	52120	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:19.705384016 CET	52120	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:19.705537081 CET	52122	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:19.826145887 CET	3778	52122	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:19.826272964 CET	52122	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:19.826338053 CET	52122	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:20.006779909 CET	3778	52122	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:20.007050037 CET	52122	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:20.126586914 CET	3778	52122	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:21.087511063 CET	3778	52122	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:21.087644100 CET	52122	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:21.087673903 CET	52122	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:21.087709904 CET	52124	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:21.207195997 CET	3778	52124	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:21.207361937 CET	52124	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:21.207478046 CET	52124	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:21.326889992 CET	3778	52124	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:21.327028990 CET	52124	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:21.446477890 CET	3778	52124	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:22.511858940 CET	3778	52124	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:22.512032986 CET	52124	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:22.512063980 CET	52124	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:22.512139082 CET	52126	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:22.631607056 CET	3778	52126	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:22.631722927 CET	52126	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:22.631783009 CET	52126	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:22.751336098 CET	3778	52126	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:22.751486063 CET	52126	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:22.871104002 CET	3778	52126	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:23.890914917 CET	3778	52126	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:23.891032934 CET	52126	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:23.891287088 CET	52126	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:23.891366005 CET	52128	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:24.010858059 CET	3778	52128	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:24.010948896 CET	52128	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:24.011230946 CET	52128	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:24.130661964 CET	3778	52128	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:24.130775928 CET	52128	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:24.250468016 CET	3778	52128	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:25.316936970 CET	3778	52128	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:25.317156076 CET	52128	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:25.317389011 CET	52128	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:25.317493916 CET	52130	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:25.437022924 CET	3778	52130	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:25.437186003 CET	52130	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:25.437280893 CET	52130	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:25.557007074 CET	3778	52130	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:25.557213068 CET	52130	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:25.676837921 CET	3778	52130	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:26.744173050 CET	3778	52130	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:26.744349003 CET	52130	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:26.744437933 CET	52130	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:26.744501114 CET	52132	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:26.864116907 CET	3778	52132	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:26.864238024 CET	52132	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:26.864280939 CET	52132	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:26.984067917 CET	3778	52132	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:26.984234095 CET	52132	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:27.103982925 CET	3778	52132	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:28.169936895 CET	3778	52132	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:28.170083046 CET	52132	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:28.170120001 CET	52132	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:28.170155048 CET	52134	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:28.289936066 CET	3778	52134	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:28.290091991 CET	52134	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:28.290123940 CET	52134	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:28.409831047 CET	3778	52134	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:28.409991980 CET	52134	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:28.529545069 CET	3778	52134	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:30.036601067 CET	52042	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:30.156193018 CET	3778	52042	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:30.446680069 CET	3778	52042	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:30.446854115 CET	52042	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:38.293543100 CET	52134	3778	192.168.2.14	159.100.18.129
Dec 27, 2024 10:39:38.413829088 CET	3778	52134	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:38.704104900 CET	3778	52134	159.100.18.129	192.168.2.14
Dec 27, 2024 10:39:38.704252005 CET	52134	3778	192.168.2.14	159.100.18.129

System Behavior

Analysis Process: Space.x86.elf PID: 5466, Parent PID: 5391

General

Start time (UTC):	09:38:10
Start date (UTC):	27/12/2024
Path:	/tmp/Space.x86.elf
Arguments:	/tmp/Space.x86.elf
File size:	38740 bytes
MD5 hash:	86b0dbac78477aca5c3dd080ba53e837

Chronological Activities

Analysis Process: Space.x86.elf PID: 5467, Parent PID: 5466

General

Start time (UTC):	09:38:10
Start date (UTC):	27/12/2024
Path:	/tmp/Space.x86.elf
Arguments:	-
File size:	38740 bytes
MD5 hash:	86b0dbac78477aca5c3dd080ba53e837

Chronological Activities

Analysis Process: Space.x86.elf PID: 5468, Parent PID: 5467

General

Start time (UTC):	09:38:10
Start date (UTC):	27/12/2024
Path:	/tmp/Space.x86.elf
Arguments:	-
File size:	38740 bytes
MD5 hash:	86b0dbac78477aca5c3dd080ba53e837

Chronological Activities

Analysis Process: Space.x86.elf PID: 5469, Parent PID: 5467

General

Start time (UTC):	09:38:10
Start date (UTC):	27/12/2024
Path:	/tmp/Space.x86.elf
Arguments:	-
File size:	38740 bytes
MD5 hash:	86b0dbac78477aca5c3dd080ba53e837

Analysis Process: Space.x86.elf PID: 5478, Parent PID: 5466

General

Start time (UTC):	09:38:15
Start date (UTC):	27/12/2024
Path:	/tmp/Space.x86.elf
Arguments:	-
File size:	38740 bytes
MD5 hash:	86b0dbac78477aca5c3dd080ba53e837

Chronological Activities

Analysis Process: Space.x86.elf PID: 5479, Parent PID: 5466

General

Start time (UTC):	09:38:15
Start date (UTC):	27/12/2024
Path:	/tmp/Space.x86.elf
Arguments:	-
File size:	38740 bytes
MD5 hash:	86b0dbac78477aca5c3dd080ba53e837

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Space.x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: Space.x86.elf PID: 5466, Parent PID: 5391

General

Chronological Activities

Analysis Process: Space.x86.elf PID: 5467, Parent PID: 5466

General

Chronological Activities

Analysis Process: Space.x86.elf PID: 5468, Parent PID: 5467

General

Chronological Activities

Analysis Process: Space.x86.elf PID: 5469, Parent PID: 5467

General

Analysis Process: Space.x86.elf PID: 5478, Parent PID: 5466

General

Chronological Activities

Analysis Process: Space.x86.elf PID: 5479, Parent PID: 5466

General

Linux Analysis Report
Space.x86.elf