Edit tour

Linux Analysis Report
x86.elf

Overview

General Information

Sample name:	x86.elf
Analysis ID:	1581800
MD5:	92b80338268fbd97f2994bad4c4e98d6
SHA1:	289d89e8a7c944bb18f5119ababb276f49f1e2f1
SHA256:	06858102f6c443b53241baa576c4ecfce5c61bd729379fea88a40323227ee34a
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Detected TCP or UDP traffic on non-standard ports

Sample has stripped symbol table

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581800
Start date and time:	2024-12-29 01:07:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	x86.elf
Detection:	MAL
Classification:	mal60.linELF@0/0@21/0

Runtime Messages

Command:	/tmp/x86.elf
PID:	5434
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	have onna deez nutz
Standard Error:

Process Tree

system is lnxubuntu20

x86.elf (PID: 5434, Parent: 5357, MD5: 92b80338268fbd97f2994bad4c4e98d6) Arguments: /tmp/x86.elf

x86.elf New Fork (PID: 5435, Parent: 5434)

x86.elf New Fork (PID: 5436, Parent: 5435)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
x86.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x3d60:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
x86.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x5472:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
x86.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x7066:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
x86.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x5442:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88

Memory Dumps

Source	Rule	Description	Author	Strings
5434.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x3d60:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5434.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x5472:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5434.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x7066:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5434.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x5442:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: x86.elf	ReversingLabs: Detection: 31%
Source: x86.elf	Virustotal: Detection: 22%			Perma Link

Machine Learning detection for sample

Source: x86.elf

Joe Sandbox ML: detected

Source: global traffic

TCP traffic: 192.168.2.13:58832 -> 83.222.191.146:33211

Source: global traffic

DNS traffic detected: DNS query: secure-network-rebirthltd.ru

System Summary

Malicious sample detected (through community Yara rule)

Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5434.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5434.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5434.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5434.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown

Source: ELF static info symbol of initial sample

.symtab present: no

Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5434.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5434.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26

Source: classification engine

Classification label: mal60.linELF@0/0@21/0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
x86.elf	32%	ReversingLabs	Linux.Backdoor.Mirai
x86.elf	23%	Virustotal		Browse
x86.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
secure-network-rebirthltd.ru	83.222.191.146	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
83.222.191.146	secure-network-rebirthltd.ru	Bulgaria		43561	NET1-ASBG	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
83.222.191.146	dlr.arm6.elf	Get hash	malicious	Gafgyt	Browse	/binaries/arm6
	dlr.mpsl.elf	Get hash	malicious	Gafgyt	Browse	/binaries/mpsl
	dlr.arm7.elf	Get hash	malicious	Unknown	Browse	/binaries/arm7
	dlr.mips.elf	Get hash	malicious	Gafgyt	Browse	/binaries/mips

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
secure-network-rebirthltd.ru	x86_64.elf	Get hash	malicious	Unknown	Browse	83.222.191.146
	arm5.elf	Get hash	malicious	Unknown	Browse	83.222.191.146
	m68k.elf	Get hash	malicious	Unknown	Browse	83.222.191.146
	arm4.elf	Get hash	malicious	Unknown	Browse	83.222.191.146
	arm7.elf	Get hash	malicious	Mirai	Browse	83.222.191.146
	spc.elf	Get hash	malicious	Unknown	Browse	83.222.191.146
	mpsl.elf	Get hash	malicious	Unknown	Browse	83.222.191.146
	mips.elf	Get hash	malicious	Unknown	Browse	83.222.191.146
	x86_64.elf	Get hash	malicious	Gafgyt	Browse	83.222.191.146
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	83.222.191.146

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NET1-ASBG	x86_64.elf	Get hash	malicious	Unknown	Browse	83.222.191.146
	arm5.elf	Get hash	malicious	Unknown	Browse	83.222.191.146
	m68k.elf	Get hash	malicious	Unknown	Browse	83.222.191.146
	arm4.elf	Get hash	malicious	Unknown	Browse	83.222.191.146
	arm7.elf	Get hash	malicious	Mirai	Browse	83.222.191.146
	spc.elf	Get hash	malicious	Unknown	Browse	83.222.191.146
	mpsl.elf	Get hash	malicious	Unknown	Browse	83.222.191.146
	mips.elf	Get hash	malicious	Unknown	Browse	83.222.191.146
	x86_64.elf	Get hash	malicious	Gafgyt	Browse	83.222.191.146
	dlr.arm6.elf	Get hash	malicious	Gafgyt	Browse	83.222.191.146

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.474896081221385
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	x86.elf
File size:	47'248 bytes
MD5:	92b80338268fbd97f2994bad4c4e98d6
SHA1:	289d89e8a7c944bb18f5119ababb276f49f1e2f1
SHA256:	06858102f6c443b53241baa576c4ecfce5c61bd729379fea88a40323227ee34a
SHA512:	456c4e72d9d56fcef1d3b03852f54fdd46959bf93ef8c2fd80ec10664519c07fe840182c808763d6ff668d3935f854111bd9ac1029bf086ee9fef84d5a75d1fb
SSDEEP:	768:a54i9LjisyJzrSONOiOnAo00nBnMwdz3j1QfaeRXngtzY6sK86mSMIC:a54i9LjisyJzOO8iOnPnBnhhzOngtM6G
TLSH:	AE236CC8B543D5F1FC170475207BF7379B72F53A0029EEA7C759E632AC92A01A51629C
File Content Preview:	.ELF....................d...4...........4. ...(..............................................D...D.......&..........Q.td............................U..S.......7....h........[]...$.............U......=.F...t..5.....D......D......u........t....h.4..........

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	46848
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0xa026	0x0	0x6	AX	16
.fini	PROGBITS	0x80520d6	0xa0d6	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x8052100	0xa100	0x13bc	0x0	0x2	A	32
.ctors	PROGBITS	0x80544c0	0xb4c0	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x80544c8	0xb4c8	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x80544e0	0xb4e0	0x1e0	0x0	0x3	WA	32
.bss	NOBITS	0x80546c0	0xb6c0	0x24c0	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0xb6c0	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0xb4bc	0xb4bc	6.5235	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0xb4c0	0x80544c0	0x80544c0	0x200	0x26c0	2.1324	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2024 01:07:52.452259064 CET	58832	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:07:52.571700096 CET	33211	58832	83.222.191.146	192.168.2.13
Dec 29, 2024 01:07:52.571768045 CET	58832	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:07:52.571803093 CET	58832	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:07:52.691293955 CET	33211	58832	83.222.191.146	192.168.2.13
Dec 29, 2024 01:07:52.691440105 CET	58832	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:07:52.810916901 CET	33211	58832	83.222.191.146	192.168.2.13
Dec 29, 2024 01:07:53.918230057 CET	33211	58832	83.222.191.146	192.168.2.13
Dec 29, 2024 01:07:53.918296099 CET	58832	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:07:53.918323040 CET	58832	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:07:55.157047033 CET	58834	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:07:55.276480913 CET	33211	58834	83.222.191.146	192.168.2.13
Dec 29, 2024 01:07:55.276635885 CET	58834	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:07:55.276655912 CET	58834	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:07:55.396150112 CET	33211	58834	83.222.191.146	192.168.2.13
Dec 29, 2024 01:07:55.396301985 CET	58834	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:07:55.516253948 CET	33211	58834	83.222.191.146	192.168.2.13
Dec 29, 2024 01:07:56.648314953 CET	33211	58834	83.222.191.146	192.168.2.13
Dec 29, 2024 01:07:56.648509026 CET	58834	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:07:56.648509026 CET	58834	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:07:58.049019098 CET	58836	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:07:58.168833971 CET	33211	58836	83.222.191.146	192.168.2.13
Dec 29, 2024 01:07:58.168904066 CET	58836	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:07:58.168925047 CET	58836	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:07:58.337327957 CET	33211	58836	83.222.191.146	192.168.2.13
Dec 29, 2024 01:07:58.337557077 CET	58836	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:07:58.457349062 CET	33211	58836	83.222.191.146	192.168.2.13
Dec 29, 2024 01:07:59.564039946 CET	33211	58836	83.222.191.146	192.168.2.13
Dec 29, 2024 01:07:59.564209938 CET	58836	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:07:59.564268112 CET	58836	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:00.700571060 CET	58838	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:00.820045948 CET	33211	58838	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:00.820122957 CET	58838	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:00.820358038 CET	58838	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:00.939913988 CET	33211	58838	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:00.940054893 CET	58838	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:01.059612036 CET	33211	58838	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:02.213407993 CET	33211	58838	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:02.213527918 CET	58838	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:02.213617086 CET	58838	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:03.454014063 CET	58840	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:03.573627949 CET	33211	58840	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:03.573833942 CET	58840	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:03.573833942 CET	58840	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:03.693361998 CET	33211	58840	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:03.693669081 CET	58840	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:03.813123941 CET	33211	58840	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:04.873995066 CET	33211	58840	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:04.874142885 CET	58840	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:04.874161959 CET	58840	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:06.009398937 CET	58842	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:06.129189968 CET	33211	58842	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:06.129338980 CET	58842	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:06.129338980 CET	58842	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:06.248889923 CET	33211	58842	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:06.248941898 CET	58842	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:06.368489027 CET	33211	58842	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:07.476178885 CET	33211	58842	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:07.476528883 CET	58842	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:07.476548910 CET	58842	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:08.611835957 CET	58844	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:08.731343031 CET	33211	58844	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:08.731609106 CET	58844	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:08.731868982 CET	58844	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:08.851267099 CET	33211	58844	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:08.851479053 CET	58844	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:08.971050024 CET	33211	58844	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:10.077899933 CET	33211	58844	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:10.078134060 CET	58844	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:10.078134060 CET	58844	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:11.213505983 CET	58846	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:11.332995892 CET	33211	58846	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:11.333301067 CET	58846	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:11.333301067 CET	58846	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:11.452836037 CET	33211	58846	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:11.452903986 CET	58846	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:11.572550058 CET	33211	58846	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:17.646544933 CET	58848	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:17.766079903 CET	33211	58848	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:17.766140938 CET	58848	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:17.766164064 CET	58848	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:17.885735035 CET	33211	58848	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:17.885920048 CET	58848	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:18.005438089 CET	33211	58848	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:19.118689060 CET	33211	58848	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:19.118822098 CET	58848	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:19.118870020 CET	58848	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:20.243247032 CET	58850	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:20.362910032 CET	33211	58850	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:20.363183975 CET	58850	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:20.363274097 CET	58850	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:20.482887983 CET	33211	58850	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:20.483052015 CET	58850	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:20.602596045 CET	33211	58850	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:21.343377113 CET	58846	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:21.463150978 CET	33211	58846	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:21.716259003 CET	33211	58850	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:21.716362953 CET	58850	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:21.716362953 CET	58850	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:21.783440113 CET	33211	58846	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:21.783489943 CET	58846	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:22.956738949 CET	58852	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:23.076498032 CET	33211	58852	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:23.076723099 CET	58852	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:23.076759100 CET	58852	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:23.196578026 CET	33211	58852	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:23.196741104 CET	58852	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:23.316227913 CET	33211	58852	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:24.377423048 CET	33211	58852	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:24.377674103 CET	58852	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:24.377772093 CET	58852	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:25.514058113 CET	58854	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:25.633583069 CET	33211	58854	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:25.633971930 CET	58854	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:25.633971930 CET	58854	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:25.753542900 CET	33211	58854	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:25.753787041 CET	58854	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:25.873328924 CET	33211	58854	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:27.025964022 CET	33211	58854	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:27.026180983 CET	58854	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:27.026240110 CET	58854	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:28.162775040 CET	58856	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:28.282494068 CET	33211	58856	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:28.282762051 CET	58856	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:28.282861948 CET	58856	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:28.402313948 CET	33211	58856	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:28.402426004 CET	58856	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:28.521958113 CET	33211	58856	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:29.644599915 CET	33211	58856	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:29.644735098 CET	58856	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:29.644785881 CET	58856	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:30.780277967 CET	58858	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:30.899816990 CET	33211	58858	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:30.899897099 CET	58858	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:30.899921894 CET	58858	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:31.019442081 CET	33211	58858	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:31.019495010 CET	58858	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:31.139153957 CET	33211	58858	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:32.200212002 CET	33211	58858	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:32.200458050 CET	58858	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:32.200516939 CET	58858	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:33.336045027 CET	58860	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:33.455605984 CET	33211	58860	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:33.455725908 CET	58860	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:33.455873966 CET	58860	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:33.575510025 CET	33211	58860	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:33.575617075 CET	58860	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:33.695302963 CET	33211	58860	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:35.001211882 CET	33211	58860	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:35.001353979 CET	58860	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:35.001373053 CET	58860	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:35.045233965 CET	33211	58860	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:35.045294046 CET	58860	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:36.136831999 CET	58862	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:36.256479025 CET	33211	58862	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:36.256639004 CET	58862	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:36.256660938 CET	58862	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:36.376378059 CET	33211	58862	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:36.376429081 CET	58862	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:36.496109962 CET	33211	58862	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:37.664289951 CET	33211	58862	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:37.664391041 CET	58862	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:37.664391041 CET	58862	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:38.800914049 CET	58864	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:38.920391083 CET	33211	58864	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:38.920466900 CET	58864	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:38.920480967 CET	58864	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:39.039961100 CET	33211	58864	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:39.040013075 CET	58864	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:39.159610033 CET	33211	58864	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:40.317409992 CET	33211	58864	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:40.317586899 CET	58864	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:40.317625999 CET	58864	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:41.453114986 CET	58866	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:41.575467110 CET	33211	58866	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:41.575541019 CET	58866	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:41.575645924 CET	58866	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:41.695180893 CET	33211	58866	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:41.695236921 CET	58866	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:41.814917088 CET	33211	58866	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:42.876127005 CET	33211	58866	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:42.876281023 CET	58866	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:42.876355886 CET	58866	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:44.116324902 CET	58868	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:44.235838890 CET	33211	58868	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:44.236078024 CET	58868	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:44.236181974 CET	58868	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:44.355586052 CET	33211	58868	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:44.355726957 CET	58868	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:44.475269079 CET	33211	58868	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:45.641390085 CET	33211	58868	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:45.641514063 CET	58868	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:45.641566038 CET	58868	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:46.777515888 CET	58870	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:46.897085905 CET	33211	58870	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:46.897166014 CET	58870	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:46.897294998 CET	58870	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:47.016936064 CET	33211	58870	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:47.016992092 CET	58870	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:47.136651993 CET	33211	58870	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:48.243753910 CET	33211	58870	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:48.243849039 CET	58870	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:48.243995905 CET	58870	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:49.379698992 CET	58872	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:49.499258995 CET	33211	58872	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:49.499335051 CET	58872	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:49.499450922 CET	58872	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:49.619151115 CET	33211	58872	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:49.619332075 CET	58872	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:49.738847971 CET	33211	58872	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:59.509577036 CET	58872	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:08:59.629410028 CET	33211	58872	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:59.940134048 CET	33211	58872	83.222.191.146	192.168.2.13
Dec 29, 2024 01:08:59.940382957 CET	58872	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:09:21.835551977 CET	58846	33211	192.168.2.13	83.222.191.146
Dec 29, 2024 01:09:21.957488060 CET	33211	58846	83.222.191.146	192.168.2.13
Dec 29, 2024 01:09:22.275846958 CET	33211	58846	83.222.191.146	192.168.2.13
Dec 29, 2024 01:09:22.276138067 CET	58846	33211	192.168.2.13	83.222.191.146

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2024 01:07:52.215197086 CET	46683	53	192.168.2.13	8.8.8.8
Dec 29, 2024 01:07:52.452153921 CET	53	46683	8.8.8.8	192.168.2.13
Dec 29, 2024 01:07:54.919317961 CET	46084	53	192.168.2.13	8.8.8.8
Dec 29, 2024 01:07:55.156816959 CET	53	46084	8.8.8.8	192.168.2.13
Dec 29, 2024 01:07:57.649430990 CET	57891	53	192.168.2.13	8.8.8.8
Dec 29, 2024 01:07:58.048823118 CET	53	57891	8.8.8.8	192.168.2.13
Dec 29, 2024 01:08:00.566540003 CET	44683	53	192.168.2.13	8.8.8.8
Dec 29, 2024 01:08:00.700350046 CET	53	44683	8.8.8.8	192.168.2.13
Dec 29, 2024 01:08:03.215189934 CET	51396	53	192.168.2.13	8.8.8.8
Dec 29, 2024 01:08:03.453797102 CET	53	51396	8.8.8.8	192.168.2.13
Dec 29, 2024 01:08:05.875346899 CET	55864	53	192.168.2.13	8.8.8.8
Dec 29, 2024 01:08:06.009222984 CET	53	55864	8.8.8.8	192.168.2.13
Dec 29, 2024 01:08:08.477915049 CET	33681	53	192.168.2.13	8.8.8.8
Dec 29, 2024 01:08:08.611604929 CET	53	33681	8.8.8.8	192.168.2.13
Dec 29, 2024 01:08:11.079560041 CET	54815	53	192.168.2.13	8.8.8.8
Dec 29, 2024 01:08:11.213298082 CET	53	54815	8.8.8.8	192.168.2.13
Dec 29, 2024 01:08:17.249125004 CET	32906	53	192.168.2.13	8.8.8.8
Dec 29, 2024 01:08:17.646446943 CET	53	32906	8.8.8.8	192.168.2.13
Dec 29, 2024 01:08:20.120217085 CET	53122	53	192.168.2.13	8.8.8.8
Dec 29, 2024 01:08:20.242964029 CET	53	53122	8.8.8.8	192.168.2.13
Dec 29, 2024 01:08:22.717556000 CET	41952	53	192.168.2.13	8.8.8.8
Dec 29, 2024 01:08:22.956640959 CET	53	41952	8.8.8.8	192.168.2.13
Dec 29, 2024 01:08:25.379539013 CET	59165	53	192.168.2.13	8.8.8.8
Dec 29, 2024 01:08:25.513746023 CET	53	59165	8.8.8.8	192.168.2.13
Dec 29, 2024 01:08:28.027865887 CET	60818	53	192.168.2.13	8.8.8.8
Dec 29, 2024 01:08:28.162453890 CET	53	60818	8.8.8.8	192.168.2.13
Dec 29, 2024 01:08:30.646369934 CET	35872	53	192.168.2.13	8.8.8.8
Dec 29, 2024 01:08:30.780189991 CET	53	35872	8.8.8.8	192.168.2.13
Dec 29, 2024 01:08:33.201977015 CET	46281	53	192.168.2.13	8.8.8.8
Dec 29, 2024 01:08:33.335864067 CET	53	46281	8.8.8.8	192.168.2.13
Dec 29, 2024 01:08:36.002609015 CET	47503	53	192.168.2.13	8.8.8.8
Dec 29, 2024 01:08:36.136763096 CET	53	47503	8.8.8.8	192.168.2.13
Dec 29, 2024 01:08:38.665515900 CET	54167	53	192.168.2.13	8.8.8.8
Dec 29, 2024 01:08:38.800781965 CET	53	54167	8.8.8.8	192.168.2.13
Dec 29, 2024 01:08:41.319089890 CET	41593	53	192.168.2.13	8.8.8.8
Dec 29, 2024 01:08:41.452920914 CET	53	41593	8.8.8.8	192.168.2.13
Dec 29, 2024 01:08:43.877226114 CET	48340	53	192.168.2.13	8.8.8.8
Dec 29, 2024 01:08:44.115989923 CET	53	48340	8.8.8.8	192.168.2.13
Dec 29, 2024 01:08:46.642874956 CET	53099	53	192.168.2.13	8.8.8.8
Dec 29, 2024 01:08:46.777292967 CET	53	53099	8.8.8.8	192.168.2.13
Dec 29, 2024 01:08:49.245424986 CET	55239	53	192.168.2.13	8.8.8.8
Dec 29, 2024 01:08:49.379291058 CET	53	55239	8.8.8.8	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 29, 2024 01:07:52.215197086 CET	192.168.2.13	8.8.8.8	0x30b0	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:07:54.919317961 CET	192.168.2.13	8.8.8.8	0x515d	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:07:57.649430990 CET	192.168.2.13	8.8.8.8	0x416b	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:00.566540003 CET	192.168.2.13	8.8.8.8	0x400b	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:03.215189934 CET	192.168.2.13	8.8.8.8	0x1d4c	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:05.875346899 CET	192.168.2.13	8.8.8.8	0xe73d	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:08.477915049 CET	192.168.2.13	8.8.8.8	0xfe5d	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:11.079560041 CET	192.168.2.13	8.8.8.8	0xc20e	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:17.249125004 CET	192.168.2.13	8.8.8.8	0x30b0	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:20.120217085 CET	192.168.2.13	8.8.8.8	0x515d	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:22.717556000 CET	192.168.2.13	8.8.8.8	0x416b	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:25.379539013 CET	192.168.2.13	8.8.8.8	0x400b	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:28.027865887 CET	192.168.2.13	8.8.8.8	0x1d4c	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:30.646369934 CET	192.168.2.13	8.8.8.8	0xe73d	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:33.201977015 CET	192.168.2.13	8.8.8.8	0xfe5d	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:36.002609015 CET	192.168.2.13	8.8.8.8	0xc20e	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:38.665515900 CET	192.168.2.13	8.8.8.8	0xf4f5	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:41.319089890 CET	192.168.2.13	8.8.8.8	0x78e9	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:43.877226114 CET	192.168.2.13	8.8.8.8	0x4b64	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:46.642874956 CET	192.168.2.13	8.8.8.8	0xdc57	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:49.245424986 CET	192.168.2.13	8.8.8.8	0x5796	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 29, 2024 01:07:52.452153921 CET	8.8.8.8	192.168.2.13	0x30b0	No error (0)	secure-network-rebirthltd.ru	83.222.191.146	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:07:55.156816959 CET	8.8.8.8	192.168.2.13	0x515d	No error (0)	secure-network-rebirthltd.ru	83.222.191.146	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:07:58.048823118 CET	8.8.8.8	192.168.2.13	0x416b	No error (0)	secure-network-rebirthltd.ru	83.222.191.146	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:00.700350046 CET	8.8.8.8	192.168.2.13	0x400b	No error (0)	secure-network-rebirthltd.ru	83.222.191.146	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:03.453797102 CET	8.8.8.8	192.168.2.13	0x1d4c	No error (0)	secure-network-rebirthltd.ru	83.222.191.146	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:06.009222984 CET	8.8.8.8	192.168.2.13	0xe73d	No error (0)	secure-network-rebirthltd.ru	83.222.191.146	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:08.611604929 CET	8.8.8.8	192.168.2.13	0xfe5d	No error (0)	secure-network-rebirthltd.ru	83.222.191.146	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:11.213298082 CET	8.8.8.8	192.168.2.13	0xc20e	No error (0)	secure-network-rebirthltd.ru	83.222.191.146	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:17.646446943 CET	8.8.8.8	192.168.2.13	0x30b0	No error (0)	secure-network-rebirthltd.ru	83.222.191.146	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:20.242964029 CET	8.8.8.8	192.168.2.13	0x515d	No error (0)	secure-network-rebirthltd.ru	83.222.191.146	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:22.956640959 CET	8.8.8.8	192.168.2.13	0x416b	No error (0)	secure-network-rebirthltd.ru	83.222.191.146	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:25.513746023 CET	8.8.8.8	192.168.2.13	0x400b	No error (0)	secure-network-rebirthltd.ru	83.222.191.146	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:28.162453890 CET	8.8.8.8	192.168.2.13	0x1d4c	No error (0)	secure-network-rebirthltd.ru	83.222.191.146	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:30.780189991 CET	8.8.8.8	192.168.2.13	0xe73d	No error (0)	secure-network-rebirthltd.ru	83.222.191.146	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:33.335864067 CET	8.8.8.8	192.168.2.13	0xfe5d	No error (0)	secure-network-rebirthltd.ru	83.222.191.146	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:36.136763096 CET	8.8.8.8	192.168.2.13	0xc20e	No error (0)	secure-network-rebirthltd.ru	83.222.191.146	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:38.800781965 CET	8.8.8.8	192.168.2.13	0xf4f5	No error (0)	secure-network-rebirthltd.ru	83.222.191.146	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:41.452920914 CET	8.8.8.8	192.168.2.13	0x78e9	No error (0)	secure-network-rebirthltd.ru	83.222.191.146	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:44.115989923 CET	8.8.8.8	192.168.2.13	0x4b64	No error (0)	secure-network-rebirthltd.ru	83.222.191.146	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:46.777292967 CET	8.8.8.8	192.168.2.13	0xdc57	No error (0)	secure-network-rebirthltd.ru	83.222.191.146	A (IP address)	IN (0x0001)	false
Dec 29, 2024 01:08:49.379291058 CET	8.8.8.8	192.168.2.13	0x5796	No error (0)	secure-network-rebirthltd.ru	83.222.191.146	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: x86.elf PID: 5434, Parent PID: 5357

General

Start time (UTC):	00:07:50
Start date (UTC):	29/12/2024
Path:	/tmp/x86.elf
Arguments:	/tmp/x86.elf
File size:	47248 bytes
MD5 hash:	92b80338268fbd97f2994bad4c4e98d6

Chronological Activities

Analysis Process: x86.elf PID: 5435, Parent PID: 5434

General

Start time (UTC):	00:07:51
Start date (UTC):	29/12/2024
Path:	/tmp/x86.elf
Arguments:	-
File size:	47248 bytes
MD5 hash:	92b80338268fbd97f2994bad4c4e98d6

Chronological Activities

Analysis Process: x86.elf PID: 5436, Parent PID: 5435

General

Start time (UTC):	00:07:51
Start date (UTC):	29/12/2024
Path:	/tmp/x86.elf
Arguments:	-
File size:	47248 bytes
MD5 hash:	92b80338268fbd97f2994bad4c4e98d6

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: x86.elf PID: 5434, Parent PID: 5357

General

Chronological Activities

Analysis Process: x86.elf PID: 5435, Parent PID: 5434

General

Chronological Activities

Analysis Process: x86.elf PID: 5436, Parent PID: 5435

General

Chronological Activities

Linux Analysis Report
x86.elf