Edit tour

Linux Analysis Report
Space.x86_64.elf

Overview

General Information

Sample name:	Space.x86_64.elf
Analysis ID:	1581301
MD5:	d247ab84c9c090053b129afa0e59bfff
SHA1:	0710e52bdb6ee2c8c4d0d1f88b402f1584d7d3cc
SHA256:	0d6e8522651a07c5b58e1abafb454b35ee08238a9a7512e50e37e72c1b17dfbd
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581301
Start date and time:	2024-12-27 10:38:28 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Space.x86_64.elf
Detection:	MAL
Classification:	mal64.evad.linELF@0/0@0/0

Warnings

VT rate limit hit for: Space.x86_64.elf

Runtime Messages

Command:	/tmp/Space.x86_64.elf
PID:	5544
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

Space.x86_64.elf (PID: 5544, Parent: 5461, MD5: d247ab84c9c090053b129afa0e59bfff) Arguments: /tmp/Space.x86_64.elf

Space.x86_64.elf New Fork (PID: 5545, Parent: 5544)

Space.x86_64.elf New Fork (PID: 5546, Parent: 5545)

Space.x86_64.elf New Fork (PID: 5547, Parent: 5545)

Space.x86_64.elf New Fork (PID: 5550, Parent: 5544)

Space.x86_64.elf New Fork (PID: 5551, Parent: 5544)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5544.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xfeb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfecc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfee0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfef4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffe4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfff8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1000c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10020:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10034:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10048:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5544.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x49b2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
5546.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xfeb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfecc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfee0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfef4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffe4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfff8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1000c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10020:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10034:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10048:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5546.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x49b2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
5550.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xfeb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfecc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfee0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfef4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffe4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfff8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1000c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10020:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10034:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10048:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5550.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x49b2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
5545.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xfeb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfecc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfee0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfef4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffe4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfff8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1000c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10020:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10034:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10048:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5545.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x49b2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
Process Memory Space: Space.x86_64.elf PID: 5544	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a02:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a16:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a52:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a66:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ade:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1af2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b06:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b1a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b2e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b42:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b56:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b6a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.x86_64.elf PID: 5545	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1153:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1167:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1207:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x121b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1243:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1257:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1293:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.x86_64.elf PID: 5546	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x125c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x134c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.x86_64.elf PID: 5550	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1756:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x176a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x177e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1792:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x180a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x181e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1832:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1846:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x186e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1882:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1896:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 7 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Space.x86_64.elf

ReversingLabs: Detection: 39%

Machine Learning detection for sample

Source: Space.x86_64.elf

Joe Sandbox ML: detected

Source: global traffic

TCP traffic: 192.168.2.15:39308 -> 159.100.18.129:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.18.129

Source: Space.x86_64.elf

String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 5544.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5544.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 5546.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5546.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 5550.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5550.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 5545.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5545.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: Process Memory Space: Space.x86_64.elf PID: 5544, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.x86_64.elf PID: 5545, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.x86_64.elf PID: 5546, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.x86_64.elf PID: 5550, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0x400000

Source: 5544.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5544.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 5546.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5546.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 5550.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5550.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 5545.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5545.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: Process Memory Space: Space.x86_64.elf PID: 5544, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.x86_64.elf PID: 5545, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.x86_64.elf PID: 5546, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.x86_64.elf PID: 5550, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal64.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/5380/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/1333/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/1695/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/911/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/914/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/917/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/19/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/1591/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/1588/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/246/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/5/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/1585/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/7/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/129/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/8/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/802/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/803/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/804/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/3407/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/1484/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/490/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/131/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/133/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/1479/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/378/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/931/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/1595/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/812/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/933/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/3419/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/3310/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/260/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/261/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/262/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/142/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/263/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/264/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/265/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/145/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/266/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/267/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/268/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/3303/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/269/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/1486/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/1806/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/3440/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5544)	File opened: /proc/270/status	Jump to behavior

Source: Space.x86_64.elf

Submission file: segment LOAD with 7.9622 entropy (max. 8.0)

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Space.x86_64.elf	39%	ReversingLabs	Linux.Backdoor.Mirai
Space.x86_64.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Space.x86_64.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
159.100.18.129	unknown	Germany		44066	DE-FIRSTCOLOwwwfirst-colonetDE	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
159.100.18.129	Space.m68k.elf	Get hash	malicious	Mirai	Browse
	Space.x86.elf	Get hash	malicious	Unknown	Browse
	Space.ppc.elf	Get hash	malicious	Unknown	Browse
	Space.mips.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DE-FIRSTCOLOwwwfirst-colonetDE	Space.m68k.elf	Get hash	malicious	Mirai	Browse	159.100.18.129
	Space.x86.elf	Get hash	malicious	Unknown	Browse	159.100.18.129
	Space.ppc.elf	Get hash	malicious	Unknown	Browse	159.100.18.129
	Space.mips.elf	Get hash	malicious	Unknown	Browse	159.100.18.129
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	159.100.14.33
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	159.100.14.33
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	159.100.14.33
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	159.100.14.33
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	159.100.14.33
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	159.100.14.33

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, no section header
Entropy (8bit):	7.960163825190544
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Space.x86_64.elf
File size:	37'540 bytes
MD5:	d247ab84c9c090053b129afa0e59bfff
SHA1:	0710e52bdb6ee2c8c4d0d1f88b402f1584d7d3cc
SHA256:	0d6e8522651a07c5b58e1abafb454b35ee08238a9a7512e50e37e72c1b17dfbd
SHA512:	994e66ff08246807783f8ca10df97ebef03fa05aa1ef3eac7f08f285b1057d5e2bb6c5159f6731380a3014e7d2e4a2596e0a9f6cbd1a1f147ae23123adc77520
SSDEEP:	768:8+4qtvWUAASje6lhaVG5CHb4diYjLMWf5CcWHdbL5fPr8X2qiWx07:n9tvWrASje4wVGigJmFL578moa
TLSH:	42F2E182C66AD57CD9336E7500C79F18DA32E0B0D402975B0BDD629F1D7EA287D0EB90
File Content Preview:	.ELF..............>.....`.@.....@...................@.8...@.......................@.......@....................... ......................Ka......Ka.............................Q.td.....................................................I..UPX!D.......8:..8:.

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x408060
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	64
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x400000	0x400000	0x919c	0x919c	7.9622	0x5	R E	0x200000
LOAD	0xb00	0x614b00	0x614b00	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 10:39:14.741156101 CET	39308	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:14.860621929 CET	3778	39308	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:14.860690117 CET	39308	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:14.861547947 CET	39308	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:14.981060028 CET	3778	39308	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:14.981116056 CET	39308	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:15.100568056 CET	3778	39308	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:16.211227894 CET	3778	39308	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:16.211491108 CET	39308	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:16.211491108 CET	39308	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:16.219052076 CET	39310	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:16.338443041 CET	3778	39310	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:16.338556051 CET	39310	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:16.340399027 CET	39310	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:16.460210085 CET	3778	39310	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:16.460458040 CET	39310	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:16.580351114 CET	3778	39310	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:17.645889044 CET	3778	39310	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:17.646224022 CET	39310	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:17.646224022 CET	39310	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:17.646872997 CET	39312	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:17.766426086 CET	3778	39312	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:17.766535997 CET	39312	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:17.767328978 CET	39312	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:17.886729956 CET	3778	39312	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:17.886913061 CET	39312	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:18.006427050 CET	3778	39312	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:19.117082119 CET	3778	39312	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:19.117317915 CET	39312	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:19.117367983 CET	39312	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:19.117846966 CET	39314	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:19.237302065 CET	3778	39314	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:19.237514973 CET	39314	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:19.238332033 CET	39314	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:19.357777119 CET	3778	39314	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:19.357906103 CET	39314	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:19.477463007 CET	3778	39314	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:20.201211929 CET	39316	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:20.320926905 CET	3778	39316	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:20.321048975 CET	39316	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:20.321949959 CET	39316	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:20.441414118 CET	3778	39316	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:20.441560984 CET	39316	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:20.561218977 CET	3778	39316	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:20.591422081 CET	3778	39314	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:20.591543913 CET	39314	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:20.591613054 CET	39314	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:20.592058897 CET	39318	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:20.711613894 CET	3778	39318	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:20.711752892 CET	39318	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:20.712630987 CET	39318	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:20.832298040 CET	3778	39318	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:20.832387924 CET	39318	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:20.951898098 CET	3778	39318	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:21.578825951 CET	3778	39316	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:21.578932047 CET	39316	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:21.578932047 CET	39316	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:21.579457045 CET	39320	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:21.699012041 CET	3778	39320	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:21.699103117 CET	39320	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:21.699851990 CET	39320	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:21.819360018 CET	3778	39320	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:21.819448948 CET	39320	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:21.938930988 CET	3778	39320	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:22.020889044 CET	3778	39318	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:22.020982981 CET	39318	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:22.021023035 CET	39318	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:22.021495104 CET	39322	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:22.140989065 CET	3778	39322	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:22.141073942 CET	39322	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:22.141796112 CET	39322	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:22.261193037 CET	3778	39322	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:22.261249065 CET	39322	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:22.380688906 CET	3778	39322	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:23.004169941 CET	3778	39320	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:23.004448891 CET	39320	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:23.004448891 CET	39320	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:23.004961014 CET	39324	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:23.124411106 CET	3778	39324	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:23.124614954 CET	39324	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:23.125403881 CET	39324	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:23.244999886 CET	3778	39324	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:23.245150089 CET	39324	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:23.364651918 CET	3778	39324	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:23.492217064 CET	3778	39322	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:23.492463112 CET	39322	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:23.492463112 CET	39322	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:23.492942095 CET	39326	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:23.612396002 CET	3778	39326	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:23.612620115 CET	39326	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:23.613390923 CET	39326	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:23.732840061 CET	3778	39326	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:23.732944965 CET	39326	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:23.852583885 CET	3778	39326	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:24.428782940 CET	3778	39324	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:24.429033041 CET	39324	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:24.429033041 CET	39324	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:24.429481983 CET	39328	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:24.549031973 CET	3778	39328	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:24.549124002 CET	39328	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:24.549833059 CET	39328	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:24.669596910 CET	3778	39328	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:24.669692993 CET	39328	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:24.789272070 CET	3778	39328	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:24.918072939 CET	3778	39326	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:24.918338060 CET	39326	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:24.918338060 CET	39326	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:24.918673992 CET	39330	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:25.038405895 CET	3778	39330	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:25.038542032 CET	39330	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:25.039237976 CET	39330	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:25.158700943 CET	3778	39330	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:25.158899069 CET	39330	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:25.278609991 CET	3778	39330	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:25.900131941 CET	3778	39328	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:25.900270939 CET	39328	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:25.900317907 CET	39328	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:25.900764942 CET	39332	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:26.020262003 CET	3778	39332	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:26.020456076 CET	39332	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:26.021182060 CET	39332	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:26.141066074 CET	3778	39332	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:26.141319990 CET	39332	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:26.261097908 CET	3778	39332	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:26.297101021 CET	3778	39330	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:26.297194004 CET	39330	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:26.297241926 CET	39330	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:26.297672987 CET	39334	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:26.417303085 CET	3778	39334	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:26.417452097 CET	39334	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:26.418152094 CET	39334	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:26.537678957 CET	3778	39334	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:26.537899017 CET	39334	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:26.657399893 CET	3778	39334	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:27.768740892 CET	3778	39334	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:27.768892050 CET	39334	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:27.768892050 CET	39334	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:27.769387960 CET	39336	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:27.889177084 CET	3778	39336	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:27.889416933 CET	39336	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:27.890477896 CET	39336	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:28.010041952 CET	3778	39336	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:28.010169983 CET	39336	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:28.130301952 CET	3778	39336	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:29.196022034 CET	3778	39336	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:29.196180105 CET	39336	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:29.196228981 CET	39336	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:29.196680069 CET	39338	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:29.316221952 CET	3778	39338	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:29.316319942 CET	39338	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:29.317091942 CET	39338	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:29.436577082 CET	3778	39338	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:29.436763048 CET	39338	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:29.556422949 CET	3778	39338	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:30.621579885 CET	3778	39338	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:30.621819019 CET	39338	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:30.621819019 CET	39338	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:30.622358084 CET	39340	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:30.742024899 CET	3778	39340	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:30.742168903 CET	39340	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:30.742894888 CET	39340	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:30.862328053 CET	3778	39340	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:30.862613916 CET	39340	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:30.998565912 CET	3778	39340	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:32.048803091 CET	3778	39340	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:32.049017906 CET	39340	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:32.049017906 CET	39340	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:32.049860954 CET	39342	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:32.169975996 CET	3778	39342	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:32.170237064 CET	39342	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:32.171976089 CET	39342	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:32.291579962 CET	3778	39342	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:32.291699886 CET	39342	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:32.411293030 CET	3778	39342	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:33.474457979 CET	3778	39342	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:33.474625111 CET	39342	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:33.474839926 CET	39342	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:33.475547075 CET	39344	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:33.596040964 CET	3778	39344	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:33.596201897 CET	39344	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:33.597239017 CET	39344	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:33.716775894 CET	3778	39344	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:33.716900110 CET	39344	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:33.836407900 CET	3778	39344	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:34.862483025 CET	3778	39344	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:34.862607956 CET	39344	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:34.862626076 CET	39344	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:34.863053083 CET	39346	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:34.982445002 CET	3778	39346	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:34.982580900 CET	39346	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:34.983537912 CET	39346	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:35.105465889 CET	3778	39346	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:35.105722904 CET	39346	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:35.225290060 CET	3778	39346	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:36.031097889 CET	39332	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:36.150665998 CET	3778	39332	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:36.287446976 CET	3778	39346	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:36.287640095 CET	39346	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:36.287717104 CET	39346	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:36.288376093 CET	39348	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:36.407855034 CET	3778	39348	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:36.408071995 CET	39348	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:36.409226894 CET	39348	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:36.455104113 CET	3778	39332	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:36.455182076 CET	39332	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:36.528834105 CET	3778	39348	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:36.529000044 CET	39348	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:36.648516893 CET	3778	39348	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:41.179500103 CET	3778	39348	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:41.179796934 CET	39348	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:41.179840088 CET	39348	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:41.180476904 CET	39350	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:41.299948931 CET	3778	39350	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:41.300235033 CET	39350	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:41.301203966 CET	39350	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:41.420687914 CET	3778	39350	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:41.420953035 CET	39350	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:41.540599108 CET	3778	39350	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:42.569310904 CET	3778	39350	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:42.569659948 CET	39350	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:42.569705009 CET	39350	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:42.570269108 CET	39352	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:42.689794064 CET	3778	39352	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:42.689917088 CET	39352	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:42.690800905 CET	39352	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:42.810422897 CET	3778	39352	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:42.810551882 CET	39352	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:42.930389881 CET	3778	39352	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:44.043548107 CET	3778	39352	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:44.043682098 CET	39352	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:44.043682098 CET	39352	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:44.044075012 CET	39354	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:44.163743973 CET	3778	39354	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:44.163857937 CET	39354	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:44.164741993 CET	39354	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:44.287404060 CET	3778	39354	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:44.287517071 CET	39354	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:44.407372952 CET	3778	39354	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:45.469398975 CET	3778	39354	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:45.469583035 CET	39354	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:45.469583035 CET	39354	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:45.470120907 CET	39356	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:45.589715958 CET	3778	39356	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:45.589914083 CET	39356	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:45.591223001 CET	39356	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:45.710946083 CET	3778	39356	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:45.711179018 CET	39356	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:45.830714941 CET	3778	39356	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:46.861568928 CET	3778	39356	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:46.861725092 CET	39356	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:46.861725092 CET	39356	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:46.862210035 CET	39358	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:46.981676102 CET	3778	39358	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:46.981867075 CET	39358	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:46.983055115 CET	39358	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:47.102461100 CET	3778	39358	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:47.102632999 CET	39358	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:47.222193003 CET	3778	39358	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:48.286442041 CET	3778	39358	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:48.286655903 CET	39358	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:48.286868095 CET	39358	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:48.287534952 CET	39360	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:48.407064915 CET	3778	39360	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:48.407166958 CET	39360	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:48.408186913 CET	39360	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:48.527858019 CET	3778	39360	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:48.527942896 CET	39360	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:48.647495985 CET	3778	39360	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:49.713130951 CET	3778	39360	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:49.713357925 CET	39360	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:49.713359118 CET	39360	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:49.713799953 CET	39362	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:49.833363056 CET	3778	39362	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:49.833601952 CET	39362	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:49.834492922 CET	39362	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:49.953963995 CET	3778	39362	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:49.954129934 CET	39362	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:50.073712111 CET	3778	39362	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:51.092097044 CET	3778	39362	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:51.092266083 CET	39362	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:51.092318058 CET	39362	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:51.093017101 CET	39364	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:51.212687969 CET	3778	39364	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:51.212856054 CET	39364	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:51.213965893 CET	39364	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:51.333434105 CET	3778	39364	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:51.333748102 CET	39364	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:51.453574896 CET	3778	39364	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:52.532733917 CET	3778	39364	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:52.532990932 CET	39364	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:52.533031940 CET	39364	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:52.533638954 CET	39366	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:52.653214931 CET	3778	39366	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:52.653481960 CET	39366	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:52.654824018 CET	39366	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:52.774457932 CET	3778	39366	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:52.774650097 CET	39366	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:52.894396067 CET	3778	39366	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:54.022186041 CET	3778	39366	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:54.022326946 CET	39366	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:54.022536993 CET	39366	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:54.023200035 CET	39368	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:54.142822981 CET	3778	39368	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:54.143003941 CET	39368	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:54.144251108 CET	39368	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:54.263725996 CET	3778	39368	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:54.263916016 CET	39368	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:54.383503914 CET	3778	39368	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:55.450695038 CET	3778	39368	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:55.451025009 CET	39368	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:55.451025009 CET	39368	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:55.451651096 CET	39370	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:55.571183920 CET	3778	39370	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:55.571322918 CET	39370	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:55.572423935 CET	39370	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:55.691875935 CET	3778	39370	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:55.691994905 CET	39370	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:55.811436892 CET	3778	39370	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:56.876751900 CET	3778	39370	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:56.877002001 CET	39370	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:56.877002954 CET	39370	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:56.877366066 CET	39372	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:56.996877909 CET	3778	39372	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:56.996973038 CET	39372	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:56.997579098 CET	39372	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:57.117079973 CET	3778	39372	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:57.117193937 CET	39372	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:57.236783981 CET	3778	39372	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:58.303415060 CET	3778	39372	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:58.303528070 CET	39372	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:58.303529024 CET	39372	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:58.303930044 CET	39374	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:58.423470020 CET	3778	39374	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:58.423552036 CET	39374	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:58.424210072 CET	39374	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:58.543694973 CET	3778	39374	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:58.543776989 CET	39374	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:58.663368940 CET	3778	39374	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:59.684644938 CET	3778	39374	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:59.684905052 CET	39374	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:59.684927940 CET	39374	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:59.685461044 CET	39376	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:59.804930925 CET	3778	39376	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:59.805005074 CET	39376	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:59.805658102 CET	39376	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:39:59.925112963 CET	3778	39376	159.100.18.129	192.168.2.15
Dec 27, 2024 10:39:59.925246954 CET	39376	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:00.044826031 CET	3778	39376	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:01.123286009 CET	3778	39376	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:01.123451948 CET	39376	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:01.123501062 CET	39376	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:01.124207020 CET	39378	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:01.245100975 CET	3778	39378	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:01.245225906 CET	39378	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:01.246319056 CET	39378	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:01.365822077 CET	3778	39378	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:01.366000891 CET	39378	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:01.485557079 CET	3778	39378	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:02.551595926 CET	3778	39378	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:02.551754951 CET	39378	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:02.551788092 CET	39378	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:02.552306890 CET	39380	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:02.671809912 CET	3778	39380	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:02.672038078 CET	39380	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:02.672823906 CET	39380	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:02.792267084 CET	3778	39380	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:02.792512894 CET	39380	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:02.912162066 CET	3778	39380	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:03.941077948 CET	3778	39380	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:03.941196918 CET	39380	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:03.941241980 CET	39380	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:03.941848993 CET	39382	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:04.061351061 CET	3778	39382	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:04.061454058 CET	39382	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:04.062475920 CET	39382	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:04.181947947 CET	3778	39382	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:04.182101011 CET	39382	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:04.301846027 CET	3778	39382	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:05.369205952 CET	3778	39382	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:05.369404078 CET	39382	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:05.369540930 CET	39382	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:05.370217085 CET	39384	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:05.490910053 CET	3778	39384	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:05.491101027 CET	39384	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:05.492155075 CET	39384	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:05.611660957 CET	3778	39384	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:05.611938000 CET	39384	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:05.731538057 CET	3778	39384	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:06.842557907 CET	3778	39384	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:06.842938900 CET	39384	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:06.842938900 CET	39384	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:06.843492985 CET	39386	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:06.963056087 CET	3778	39386	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:06.963293076 CET	39386	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:06.964227915 CET	39386	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:07.083914042 CET	3778	39386	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:07.084192038 CET	39386	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:07.203900099 CET	3778	39386	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:08.269100904 CET	3778	39386	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:08.269289017 CET	39386	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:08.269356966 CET	39386	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:08.270045042 CET	39388	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:08.434165955 CET	3778	39388	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:08.434307098 CET	39388	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:08.435705900 CET	39388	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:08.555156946 CET	3778	39388	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:08.555262089 CET	39388	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:08.674755096 CET	3778	39388	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:09.743244886 CET	3778	39388	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:09.743382931 CET	39388	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:09.743454933 CET	39388	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:09.744148970 CET	39390	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:09.863687992 CET	3778	39390	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:09.863847017 CET	39390	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:09.865144968 CET	39390	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:09.985902071 CET	3778	39390	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:09.986007929 CET	39390	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:10.105720043 CET	3778	39390	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:11.173420906 CET	3778	39390	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:11.173557997 CET	39390	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:11.173588991 CET	39390	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:11.174108028 CET	39392	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:11.293708086 CET	3778	39392	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:11.293840885 CET	39392	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:11.294672012 CET	39392	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:11.414469004 CET	3778	39392	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:11.414561033 CET	39392	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:11.534176111 CET	3778	39392	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:12.554325104 CET	3778	39392	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:12.554593086 CET	39392	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:12.554650068 CET	39392	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:12.555146933 CET	39394	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:12.675203085 CET	3778	39394	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:12.675417900 CET	39394	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:12.676035881 CET	39394	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:12.795639992 CET	3778	39394	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:12.795794010 CET	39394	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:12.915550947 CET	3778	39394	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:14.140441895 CET	3778	39394	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:14.140577078 CET	39394	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:14.140690088 CET	39394	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:14.141407013 CET	39396	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:14.225333929 CET	3778	39394	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:14.225440025 CET	39394	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:14.263619900 CET	3778	39396	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:14.263725996 CET	39396	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:14.264868021 CET	39396	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:14.384546041 CET	3778	39396	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:14.384670973 CET	39396	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:14.504280090 CET	3778	39396	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:15.569801092 CET	3778	39396	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:15.569936991 CET	39396	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:15.569977999 CET	39396	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:15.570489883 CET	39398	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:15.691029072 CET	3778	39398	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:15.691114902 CET	39398	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:15.692218065 CET	39398	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:15.812263966 CET	3778	39398	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:15.812372923 CET	39398	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:15.931946993 CET	3778	39398	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:16.950699091 CET	3778	39398	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:16.950880051 CET	39398	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:16.950927973 CET	39398	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:16.951579094 CET	39400	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:17.071286917 CET	3778	39400	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:17.071516037 CET	39400	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:17.072434902 CET	39400	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:17.192483902 CET	3778	39400	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:17.192662954 CET	39400	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:17.312351942 CET	3778	39400	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:18.377773046 CET	3778	39400	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:18.377960920 CET	39400	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:18.377995014 CET	39400	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:18.378498077 CET	39402	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:18.498109102 CET	3778	39402	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:18.498327017 CET	39402	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:18.499403954 CET	39402	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:18.619211912 CET	3778	39402	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:18.619380951 CET	39402	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:18.739115000 CET	3778	39402	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:19.757738113 CET	3778	39402	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:19.757936954 CET	39402	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:19.757977009 CET	39402	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:19.758605957 CET	39404	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:19.878099918 CET	3778	39404	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:19.878277063 CET	39404	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:19.879230022 CET	39404	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:19.998680115 CET	3778	39404	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:19.998845100 CET	39404	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:20.118700027 CET	3778	39404	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:21.229881048 CET	3778	39404	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:21.230101109 CET	39404	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:21.230164051 CET	39404	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:21.230926991 CET	39406	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:21.350466013 CET	3778	39406	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:21.350692034 CET	39406	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:21.351953983 CET	39406	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:21.471503019 CET	3778	39406	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:21.471648932 CET	39406	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:21.591393948 CET	3778	39406	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:31.354823112 CET	39406	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:31.474764109 CET	3778	39406	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:31.765376091 CET	3778	39406	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:31.765520096 CET	39406	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:36.496642113 CET	39332	3778	192.168.2.15	159.100.18.129
Dec 27, 2024 10:40:36.616339922 CET	3778	39332	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:36.906831026 CET	3778	39332	159.100.18.129	192.168.2.15
Dec 27, 2024 10:40:36.906951904 CET	39332	3778	192.168.2.15	159.100.18.129

System Behavior

Analysis Process: Space.x86_64.elf PID: 5544, Parent PID: 5461

General

Start time (UTC):	09:39:13
Start date (UTC):	27/12/2024
Path:	/tmp/Space.x86_64.elf
Arguments:	/tmp/Space.x86_64.elf
File size:	37540 bytes
MD5 hash:	d247ab84c9c090053b129afa0e59bfff

Chronological Activities

Analysis Process: Space.x86_64.elf PID: 5545, Parent PID: 5544

General

Start time (UTC):	09:39:13
Start date (UTC):	27/12/2024
Path:	/tmp/Space.x86_64.elf
Arguments:	-
File size:	37540 bytes
MD5 hash:	d247ab84c9c090053b129afa0e59bfff

Chronological Activities

Analysis Process: Space.x86_64.elf PID: 5546, Parent PID: 5545

General

Start time (UTC):	09:39:13
Start date (UTC):	27/12/2024
Path:	/tmp/Space.x86_64.elf
Arguments:	-
File size:	37540 bytes
MD5 hash:	d247ab84c9c090053b129afa0e59bfff

Chronological Activities

Analysis Process: Space.x86_64.elf PID: 5547, Parent PID: 5545

General

Start time (UTC):	09:39:13
Start date (UTC):	27/12/2024
Path:	/tmp/Space.x86_64.elf
Arguments:	-
File size:	37540 bytes
MD5 hash:	d247ab84c9c090053b129afa0e59bfff

Chronological Activities

Analysis Process: Space.x86_64.elf PID: 5550, Parent PID: 5544

General

Start time (UTC):	09:39:19
Start date (UTC):	27/12/2024
Path:	/tmp/Space.x86_64.elf
Arguments:	-
File size:	37540 bytes
MD5 hash:	d247ab84c9c090053b129afa0e59bfff

Chronological Activities

Analysis Process: Space.x86_64.elf PID: 5551, Parent PID: 5544

General

Start time (UTC):	09:39:19
Start date (UTC):	27/12/2024
Path:	/tmp/Space.x86_64.elf
Arguments:	-
File size:	37540 bytes
MD5 hash:	d247ab84c9c090053b129afa0e59bfff

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Space.x86_64.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: Space.x86_64.elf PID: 5544, Parent PID: 5461

General

Chronological Activities

Analysis Process: Space.x86_64.elf PID: 5545, Parent PID: 5544

General

Chronological Activities

Analysis Process: Space.x86_64.elf PID: 5546, Parent PID: 5545

General

Chronological Activities

Analysis Process: Space.x86_64.elf PID: 5547, Parent PID: 5545

General

Chronological Activities

Analysis Process: Space.x86_64.elf PID: 5550, Parent PID: 5544

General

Chronological Activities

Analysis Process: Space.x86_64.elf PID: 5551, Parent PID: 5544

General

Chronological Activities

Linux Analysis Report
Space.x86_64.elf