Edit tour

Linux Analysis Report
ub8ehJSePAfc9FYqZIT6.x86.elf

Overview

General Information

Sample name:	ub8ehJSePAfc9FYqZIT6.x86.elf
Analysis ID:	1583833
MD5:	45f47c10e0d27c00ac46899fda99f1f3
SHA1:	f68e23694abb254e1a5c7b169547516baead730b
SHA256:	39e7164325dd360f891bf0f9f8e7bebb1c90eb071bb5e98d621793d416647482
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583833
Start date and time:	2025-01-03 17:17:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ub8ehJSePAfc9FYqZIT6.x86.elf
Detection:	MAL
Classification:	mal64.evad.linELF@0/0@0/0

Warnings

VT rate limit hit for: ub8ehJSePAfc9FYqZIT6.x86.elf

Runtime Messages

Command:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
PID:	6240
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240, Parent: 6162, MD5: 45f47c10e0d27c00ac46899fda99f1f3) Arguments: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf

ub8ehJSePAfc9FYqZIT6.x86.elf New Fork (PID: 6241, Parent: 6240)

ub8ehJSePAfc9FYqZIT6.x86.elf New Fork (PID: 6242, Parent: 6241)

ub8ehJSePAfc9FYqZIT6.x86.elf New Fork (PID: 6243, Parent: 6241)

ub8ehJSePAfc9FYqZIT6.x86.elf New Fork (PID: 6246, Parent: 6240)

ub8ehJSePAfc9FYqZIT6.x86.elf New Fork (PID: 6247, Parent: 6240)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
6242.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1089c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1093c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1098c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6242.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f3b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
6242.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7726:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
6242.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7052:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6240.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1089c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1093c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1098c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6240.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f3b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
6240.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7726:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
6240.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7052:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6246.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1089c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1093c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1098c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6246.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f3b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
6246.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7726:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
6246.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7052:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6241.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1089c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1093c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1098c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6241.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f3b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
6241.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7726:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
6241.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7052:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6240	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1948:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x195c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1970:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1984:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1998:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6241	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1447:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x146f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1483:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1497:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x150f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1523:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1537:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1573:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1587:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6242	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1447:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x146f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1483:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1497:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x150f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1523:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1537:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1573:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1587:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6246	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xa02:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa16:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa2a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa3e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa52:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa66:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa7a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa8e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaa2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xab6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xade:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaf2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb06:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb1a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb2e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb42:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb56:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb7e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb92:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 15 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ub8ehJSePAfc9FYqZIT6.x86.elf

ReversingLabs: Detection: 42%

Machine Learning detection for sample

Source: ub8ehJSePAfc9FYqZIT6.x86.elf

Joe Sandbox ML: detected

Source: global traffic

TCP traffic: 192.168.2.23:46920 -> 141.11.33.73:3778

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73

Source: ub8ehJSePAfc9FYqZIT6.x86.elf

String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 6242.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6242.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 6242.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 6242.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6240.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6240.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 6240.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 6240.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6246.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6246.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 6246.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 6246.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6240, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6241, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6242, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6246, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0xc01000

Source: 6242.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6242.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 6242.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 6242.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6240.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6240.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 6240.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 6240.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6246.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6246.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 6246.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 6246.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6240, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6241, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6242, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6246, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal64.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/1582/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/3088/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/1579/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/1699/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/1335/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/1698/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/1334/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/1576/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/2302/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/910/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/912/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/2307/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/918/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/6240/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/6243/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/1594/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/1349/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/1344/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/1465/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/1586/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/1463/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/801/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/1900/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/491/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/1599/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/1477/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/379/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/1476/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/2208/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/1809/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/1494/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/260/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6240)	File opened: /proc/261/status	Jump to behavior

Source: ub8ehJSePAfc9FYqZIT6.x86.elf

Submission file: segment LOAD with 7.964 entropy (max. 8.0)

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ub8ehJSePAfc9FYqZIT6.x86.elf	42%	ReversingLabs	Linux.Backdoor.Mirai
ub8ehJSePAfc9FYqZIT6.x86.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	ub8ehJSePAfc9FYqZIT6.x86.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
141.11.33.73	unknown	United Kingdom	553	BELWUEBelWue-KoordinationEU	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
141.11.33.73	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse
	141.11.33.73-boatnet.arm-2025-01-03T05_39_17.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	UDMp3dZ7nc.elf	Get hash	malicious	XorDDoS	Browse
	nova2.elf	Get hash	malicious	Unknown	Browse
	154.216.18.23-boatnet.arm7-2025-01-03T11_41_00.elf	Get hash	malicious	Mirai	Browse
	g.elf	Get hash	malicious	Unknown	Browse
	aarch643308.elf	Get hash	malicious	Unknown	Browse
	ARMV7L.elf	Get hash	malicious	Unknown	Browse
	bash.elf	Get hash	malicious	Unknown	Browse
	ARMV5L.elf	Get hash	malicious	Unknown	Browse
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse
	cedhat	Get hash	malicious	Kaiji	Browse
91.189.91.42	UDMp3dZ7nc.elf	Get hash	malicious	XorDDoS	Browse
	nova2.elf	Get hash	malicious	Unknown	Browse
	154.216.18.23-boatnet.arm7-2025-01-03T11_41_00.elf	Get hash	malicious	Mirai	Browse
	g.elf	Get hash	malicious	Unknown	Browse
	aarch643308.elf	Get hash	malicious	Unknown	Browse
	ARMV7L.elf	Get hash	malicious	Unknown	Browse
	bash.elf	Get hash	malicious	Unknown	Browse
	ARMV5L.elf	Get hash	malicious	Unknown	Browse
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse
	cedhat	Get hash	malicious	Kaiji	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BELWUEBelWue-KoordinationEU	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	141.11.33.73
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	141.11.33.73
	141.11.33.73-boatnet.arm-2025-01-03T05_39_17.elf	Get hash	malicious	Mirai	Browse	141.11.33.73
	Hilix.mips.elf	Get hash	malicious	Mirai	Browse	134.155.120.154
	armv5l.elf	Get hash	malicious	Unknown	Browse	141.79.218.248
	kwari.arm.elf	Get hash	malicious	Unknown	Browse	134.34.202.108
	kwari.arm7.elf	Get hash	malicious	Mirai	Browse	134.155.120.139
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	141.79.120.12
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	141.59.77.71
	armv5l.elf	Get hash	malicious	Mirai	Browse	134.63.70.100
CANONICAL-ASGB	UDMp3dZ7nc.elf	Get hash	malicious	XorDDoS	Browse	91.189.91.42
	nova2.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	154.216.18.23-boatnet.arm7-2025-01-03T11_41_00.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	g.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	aarch643308.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ARMV7L.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	bash.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ARMV5L.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	cedhat	Get hash	malicious	Kaiji	Browse	91.189.91.42
CANONICAL-ASGB	UDMp3dZ7nc.elf	Get hash	malicious	XorDDoS	Browse	91.189.91.42
	nova2.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	154.216.18.23-boatnet.arm7-2025-01-03T11_41_00.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	g.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	aarch643308.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ARMV7L.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	bash.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ARMV5L.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	cedhat	Get hash	malicious	Kaiji	Browse	91.189.91.42
INIT7CH	UDMp3dZ7nc.elf	Get hash	malicious	XorDDoS	Browse	109.202.202.202
	nova2.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	154.216.18.23-boatnet.arm7-2025-01-03T11_41_00.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	g.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	aarch643308.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	ARMV7L.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	bash.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	ARMV5L.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	cedhat	Get hash	malicious	Kaiji	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.962140216649861
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	ub8ehJSePAfc9FYqZIT6.x86.elf
File size:	38'724 bytes
MD5:	45f47c10e0d27c00ac46899fda99f1f3
SHA1:	f68e23694abb254e1a5c7b169547516baead730b
SHA256:	39e7164325dd360f891bf0f9f8e7bebb1c90eb071bb5e98d621793d416647482
SHA512:	dde1d3c1a50cc5647bb2003309da0d1211bb2261de1655ae21bc7782bf36648b08793667ab5b91992f40829f019ee3cda4de48caf5245960b162c7f5f6b3bc6e
SSDEEP:	768:MxaYe0syQ8ETE9v4uNc5B0G3kSKs+NNt1nbcuyD7UrQRjU:BYgBboHcfNUSKs+bnouy8ryA
TLSH:	2F03F17DD78C7FC2E1152034F867F88F2D16D109D0D08A62ABC0A1B789BD6562A9C3D6
File Content Preview:	.ELF....................X...4...........4. ...(.....................L...L...........................................Q.td.............................-..UPX!.........2...2......W..........?..k.I/.j....\.R......)..n.4go.\|.>#.....{~o....8.F.^...MFL.f.5 ..I.r

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0xc09458
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0xc01000	0xc01000	0x964c	0x964c	7.9640	0x5	R E	0x1000
LOAD	0xc08	0x805bc08	0x805bc08	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 17:17:48.937299967 CET	46920	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:48.942198038 CET	3778	46920	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:48.942262888 CET	46920	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:48.942420006 CET	46920	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:48.947165012 CET	3778	46920	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:48.947210073 CET	46920	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:48.951967001 CET	3778	46920	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:49.960037947 CET	43928	443	192.168.2.23	91.189.91.42
Jan 3, 2025 17:17:50.073848009 CET	3778	46920	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:50.073968887 CET	46920	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:50.074027061 CET	46920	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:50.074070930 CET	46922	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:50.078828096 CET	3778	46922	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:50.078908920 CET	46922	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:50.078934908 CET	46922	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:50.083734035 CET	3778	46922	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:50.083794117 CET	46922	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:50.088629961 CET	3778	46922	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:51.116905928 CET	3778	46922	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:51.117062092 CET	46922	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:51.117106915 CET	46922	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:51.117147923 CET	46924	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:51.121932030 CET	3778	46924	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:51.122013092 CET	46924	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:51.122037888 CET	46924	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:51.126847982 CET	3778	46924	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:51.126914978 CET	46924	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:51.131695032 CET	3778	46924	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:53.703668118 CET	3778	46924	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:53.703800917 CET	46924	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:53.703845978 CET	46924	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:53.703881979 CET	46926	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:53.708652020 CET	3778	46926	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:53.708719015 CET	46926	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:53.708748102 CET	46926	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:53.713581085 CET	3778	46926	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:53.713634014 CET	46926	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:53.718441963 CET	3778	46926	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:54.368674994 CET	46928	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:54.373636961 CET	3778	46928	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:54.373692989 CET	46928	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:54.373796940 CET	46928	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:54.378585100 CET	3778	46928	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:54.378632069 CET	46928	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:54.383414030 CET	3778	46928	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:54.749994993 CET	3778	46926	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:54.750137091 CET	46926	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:54.750178099 CET	46926	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:54.750263929 CET	46930	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:54.755014896 CET	3778	46930	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:54.755079985 CET	46930	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:54.755104065 CET	46930	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:54.759841919 CET	3778	46930	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:54.759890079 CET	46930	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:54.764642000 CET	3778	46930	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:55.399127007 CET	3778	46928	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:55.399261951 CET	46928	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:55.399305105 CET	46928	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:55.399377108 CET	46932	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:55.404201984 CET	3778	46932	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:55.404253960 CET	46932	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:55.404279947 CET	46932	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:55.409044027 CET	3778	46932	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:55.409086943 CET	46932	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:55.413809061 CET	3778	46932	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:55.591207027 CET	42836	443	192.168.2.23	91.189.91.43
Jan 3, 2025 17:17:55.775671005 CET	3778	46930	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:55.775934935 CET	46930	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:55.775935888 CET	46930	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:55.775944948 CET	46934	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:55.781989098 CET	3778	46934	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:55.782094002 CET	46934	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:55.782169104 CET	46934	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:55.788800001 CET	3778	46934	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:55.788852930 CET	46934	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:55.794789076 CET	3778	46934	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:56.829473019 CET	3778	46934	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:56.829615116 CET	46934	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:56.829651117 CET	46934	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:56.829714060 CET	46936	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:56.834481001 CET	3778	46936	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:56.834536076 CET	46936	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:56.834583998 CET	46936	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:56.840483904 CET	3778	46936	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:56.840578079 CET	46936	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:56.845741034 CET	3778	46936	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:57.131078005 CET	42516	80	192.168.2.23	109.202.202.202
Jan 3, 2025 17:17:57.854028940 CET	3778	46936	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:57.854248047 CET	46936	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:57.854248047 CET	46936	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:57.854248047 CET	46938	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:57.859112978 CET	3778	46938	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:57.859164953 CET	46938	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:57.859188080 CET	46938	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:57.863923073 CET	3778	46938	141.11.33.73	192.168.2.23
Jan 3, 2025 17:17:57.863965988 CET	46938	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:17:57.868716955 CET	3778	46938	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:00.074728012 CET	3778	46932	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:00.074897051 CET	46940	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:00.074913979 CET	46932	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:00.074913979 CET	46932	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:00.079716921 CET	3778	46940	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:00.079768896 CET	46940	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:00.079781055 CET	46940	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:00.084508896 CET	3778	46940	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:00.084557056 CET	46940	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:00.089297056 CET	3778	46940	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:04.183185101 CET	3778	46940	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:04.183466911 CET	46940	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:04.183494091 CET	46940	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:04.183584929 CET	46942	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:04.188374996 CET	3778	46942	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:04.188451052 CET	46942	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:04.188530922 CET	46942	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:04.193296909 CET	3778	46942	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:04.193427086 CET	46942	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:04.198219061 CET	3778	46942	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:07.863996983 CET	46938	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:07.956321001 CET	3778	46938	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:07.956568003 CET	46938	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:07.956681013 CET	46938	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:07.956794024 CET	46944	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:07.958236933 CET	3778	46938	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:07.958308935 CET	46938	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:07.961546898 CET	3778	46944	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:07.961661100 CET	46944	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:07.961719990 CET	46944	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:07.966491938 CET	3778	46944	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:07.966552973 CET	46944	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:07.971307039 CET	3778	46944	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:09.622672081 CET	3778	46944	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:09.622884035 CET	46944	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:09.622924089 CET	46944	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:09.622961044 CET	46946	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:09.627707005 CET	3778	46946	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:09.627937078 CET	46946	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:09.627948999 CET	46946	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:09.632744074 CET	3778	46946	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:09.632808924 CET	46946	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:09.637592077 CET	3778	46946	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:11.461095095 CET	43928	443	192.168.2.23	91.189.91.42
Jan 3, 2025 17:18:14.197259903 CET	46942	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:14.202116013 CET	3778	46942	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:16.543817043 CET	3778	46942	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:16.543966055 CET	46942	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:16.543966055 CET	46942	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:16.544008970 CET	46948	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:16.548793077 CET	3778	46948	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:16.548945904 CET	46948	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:16.548971891 CET	46948	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:16.553747892 CET	3778	46948	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:16.553824902 CET	46948	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:16.558573961 CET	3778	46948	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:18.214670897 CET	3778	46948	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:18.214903116 CET	46948	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:18.214904070 CET	46948	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:18.214904070 CET	46950	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:18.219782114 CET	3778	46950	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:18.219846010 CET	46950	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:18.219907045 CET	46950	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:18.224610090 CET	3778	46950	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:18.224657059 CET	46950	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:18.229423046 CET	3778	46950	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:19.257036924 CET	3778	46950	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:19.257236958 CET	46950	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:19.257236958 CET	46950	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:19.257272959 CET	46952	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:19.262001991 CET	3778	46952	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:19.262092113 CET	46952	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:19.262120962 CET	46952	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:19.266885042 CET	3778	46952	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:19.266985893 CET	46952	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:19.271676064 CET	3778	46952	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:21.699578047 CET	42836	443	192.168.2.23	91.189.91.43
Jan 3, 2025 17:18:27.842861891 CET	42516	80	192.168.2.23	109.202.202.202
Jan 3, 2025 17:18:40.615869999 CET	3778	46952	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:40.616204023 CET	46952	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:40.620979071 CET	3778	46952	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:41.618480921 CET	46954	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:41.623344898 CET	3778	46954	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:41.623423100 CET	46954	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:41.623502016 CET	46954	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:41.628222942 CET	3778	46954	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:41.628279924 CET	46954	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:41.633019924 CET	3778	46954	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:42.692651033 CET	3778	46954	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:42.692760944 CET	46954	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:42.692805052 CET	46954	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:42.692852020 CET	46956	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:42.697616100 CET	3778	46956	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:42.697674036 CET	46956	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:42.697694063 CET	46956	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:42.702538967 CET	3778	46956	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:42.702620983 CET	46956	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:42.707348108 CET	3778	46956	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:43.712644100 CET	3778	46956	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:43.712791920 CET	46956	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:43.712862015 CET	46956	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:43.712941885 CET	46958	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:43.717742920 CET	3778	46958	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:43.717792034 CET	46958	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:43.717808962 CET	46958	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:43.722577095 CET	3778	46958	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:43.722637892 CET	46958	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:43.727421999 CET	3778	46958	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:44.743339062 CET	3778	46958	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:44.743611097 CET	46958	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:44.743705988 CET	46958	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:44.743799925 CET	46960	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:44.748538971 CET	3778	46960	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:44.748614073 CET	46960	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:44.748688936 CET	46960	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:44.753439903 CET	3778	46960	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:44.753500938 CET	46960	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:44.758284092 CET	3778	46960	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:48.822855949 CET	3778	46960	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:48.822957993 CET	46960	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:48.822985888 CET	46960	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:48.823015928 CET	46962	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:48.827840090 CET	3778	46962	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:48.827893019 CET	46962	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:48.827920914 CET	46962	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:48.832676888 CET	3778	46962	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:48.832725048 CET	46962	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:48.837462902 CET	3778	46962	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:52.415277958 CET	43928	443	192.168.2.23	91.189.91.42
Jan 3, 2025 17:18:58.865097046 CET	3778	46962	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:58.865261078 CET	46962	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:58.865313053 CET	46962	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:58.865398884 CET	46964	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:58.870148897 CET	3778	46964	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:58.870223999 CET	46964	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:58.870296955 CET	46964	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:58.875015974 CET	3778	46964	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:58.875072956 CET	46964	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:58.879817963 CET	3778	46964	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:59.902615070 CET	3778	46964	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:59.902734041 CET	46964	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:59.902769089 CET	46964	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:59.902831078 CET	46966	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:59.907596111 CET	3778	46966	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:59.907675028 CET	46966	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:59.907746077 CET	46966	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:59.912525892 CET	3778	46966	141.11.33.73	192.168.2.23
Jan 3, 2025 17:18:59.912585974 CET	46966	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:18:59.917347908 CET	3778	46966	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:00.933989048 CET	3778	46966	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:00.934266090 CET	46966	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:00.934362888 CET	46966	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:00.934457064 CET	46968	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:00.939213037 CET	3778	46968	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:00.939292908 CET	46968	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:00.939356089 CET	46968	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:00.944148064 CET	3778	46968	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:00.944211006 CET	46968	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:00.949048996 CET	3778	46968	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:02.626813889 CET	3778	46968	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:02.627123117 CET	46968	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:02.627217054 CET	46968	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:02.627310038 CET	46970	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:02.632036924 CET	3778	46970	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:02.632141113 CET	46970	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:02.632210016 CET	46970	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:02.636941910 CET	3778	46970	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:02.637005091 CET	46970	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:02.642616034 CET	3778	46970	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:05.221009970 CET	3778	46970	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:05.221282959 CET	46970	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:05.221368074 CET	46970	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:05.221508980 CET	46972	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:05.226295948 CET	3778	46972	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:05.226368904 CET	46972	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:05.226443052 CET	46972	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:05.231192112 CET	3778	46972	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:05.231256008 CET	46972	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:05.236021042 CET	3778	46972	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:09.361732006 CET	3778	46972	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:09.361912012 CET	46972	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:09.361984015 CET	46972	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:09.362072945 CET	46974	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:09.366862059 CET	3778	46974	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:09.366964102 CET	46974	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:09.367018938 CET	46974	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:09.371815920 CET	3778	46974	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:09.371881008 CET	46974	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:09.376631021 CET	3778	46974	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:09.677979946 CET	46946	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:09.682889938 CET	3778	46946	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:10.689815998 CET	3778	46946	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:10.690257072 CET	46946	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:11.076942921 CET	3778	46974	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:11.077172041 CET	46976	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:11.077172995 CET	46974	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:11.077172995 CET	46974	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:11.082032919 CET	3778	46976	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:11.082108974 CET	46976	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:11.082206964 CET	46976	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:11.086954117 CET	3778	46976	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:11.087013960 CET	46976	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:11.091789007 CET	3778	46976	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:12.129513025 CET	3778	46976	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:12.129663944 CET	46976	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:12.129663944 CET	46976	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:12.129663944 CET	46978	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:12.134505033 CET	3778	46978	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:12.134557009 CET	46978	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:12.134576082 CET	46978	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:12.139363050 CET	3778	46978	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:12.139410973 CET	46978	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:12.144237995 CET	3778	46978	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:13.383552074 CET	3778	46978	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:13.383687019 CET	46978	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:13.383723021 CET	46978	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:13.383748055 CET	46980	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:13.386729002 CET	3778	46978	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:13.386785030 CET	46978	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:13.389213085 CET	3778	46980	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:13.389262915 CET	46980	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:13.389276981 CET	46980	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:13.394078970 CET	3778	46980	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:13.394120932 CET	46980	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:13.398890018 CET	3778	46980	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:17.445734978 CET	3778	46980	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:17.445858955 CET	46980	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:17.445894957 CET	46980	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:17.445913076 CET	46982	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:17.450820923 CET	3778	46982	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:17.450875044 CET	46982	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:17.450891018 CET	46982	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:17.455713987 CET	3778	46982	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:17.455758095 CET	46982	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:17.460486889 CET	3778	46982	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:18.488574028 CET	3778	46982	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:18.488684893 CET	46982	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:18.488715887 CET	46982	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:18.488749027 CET	46984	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:18.493554115 CET	3778	46984	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:18.493613005 CET	46984	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:18.493639946 CET	46984	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:18.498413086 CET	3778	46984	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:18.498457909 CET	46984	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:18.503240108 CET	3778	46984	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:22.999355078 CET	3778	46984	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:22.999469042 CET	46984	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:22.999500036 CET	46984	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:22.999533892 CET	46986	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:23.004647017 CET	3778	46986	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:23.004699945 CET	46986	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:23.004735947 CET	46986	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:23.009516954 CET	3778	46986	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:23.009562016 CET	46986	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:23.014296055 CET	3778	46986	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:33.043766022 CET	3778	46986	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:33.043885946 CET	46986	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:33.043885946 CET	46986	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:33.043940067 CET	46988	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:33.048744917 CET	3778	46988	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:33.048803091 CET	46988	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:33.048825026 CET	46988	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:33.053667068 CET	3778	46988	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:33.053709984 CET	46988	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:33.058573961 CET	3778	46988	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:34.074172974 CET	3778	46988	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:34.074302912 CET	46988	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:34.074333906 CET	46988	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:34.074387074 CET	46990	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:34.079133987 CET	3778	46990	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:34.079190016 CET	46990	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:34.079209089 CET	46990	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:34.084019899 CET	3778	46990	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:34.084064007 CET	46990	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:34.088870049 CET	3778	46990	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:35.130409956 CET	3778	46990	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:35.130536079 CET	46990	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:35.130536079 CET	46990	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:35.130573988 CET	46992	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:35.135390997 CET	3778	46992	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:35.135442019 CET	46992	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:35.135459900 CET	46992	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:35.140247107 CET	3778	46992	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:35.140295029 CET	46992	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:35.145049095 CET	3778	46992	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:39.172390938 CET	3778	46992	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:39.172560930 CET	46992	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:39.172595978 CET	46992	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:39.172621012 CET	46994	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:39.177495003 CET	3778	46994	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:39.177548885 CET	46994	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:39.177577019 CET	46994	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:39.182339907 CET	3778	46994	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:39.182384014 CET	46994	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:39.187201023 CET	3778	46994	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:41.721223116 CET	3778	46994	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:41.721389055 CET	46994	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:41.721446991 CET	46994	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:41.721539021 CET	46996	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:41.726377010 CET	3778	46996	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:41.726454020 CET	46996	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:41.726526976 CET	46996	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:41.731328964 CET	3778	46996	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:41.731411934 CET	46996	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:41.736193895 CET	3778	46996	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:42.844310045 CET	3778	46996	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:42.844440937 CET	46996	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:42.844469070 CET	46996	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:42.844500065 CET	46998	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:42.849288940 CET	3778	46998	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:42.849342108 CET	46998	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:42.849360943 CET	46998	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:42.854139090 CET	3778	46998	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:42.854187012 CET	46998	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:42.858985901 CET	3778	46998	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:43.878021955 CET	3778	46998	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:43.878189087 CET	46998	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:43.878248930 CET	46998	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:43.878340006 CET	47000	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:43.883120060 CET	3778	47000	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:43.883193016 CET	47000	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:43.883264065 CET	47000	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:43.888021946 CET	3778	47000	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:43.888098001 CET	47000	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:43.892879963 CET	3778	47000	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:44.946620941 CET	3778	47000	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:44.946787119 CET	47000	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:44.946852922 CET	47000	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:44.946935892 CET	47002	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:44.951699972 CET	3778	47002	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:44.951771975 CET	47002	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:44.951843977 CET	47002	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:44.956614017 CET	3778	47002	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:44.956681013 CET	47002	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:44.961484909 CET	3778	47002	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:46.027892113 CET	3778	47002	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:46.028182983 CET	47002	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:46.028280973 CET	47002	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:46.028383970 CET	47004	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:46.033126116 CET	3778	47004	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:46.033205986 CET	47004	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:46.033303022 CET	47004	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:46.038086891 CET	3778	47004	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:46.038150072 CET	47004	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:46.042905092 CET	3778	47004	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:50.892034054 CET	3778	47004	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:50.892153978 CET	47004	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:50.892185926 CET	47004	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:50.892210007 CET	47006	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:50.897001982 CET	3778	47006	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:50.897058010 CET	47006	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:50.897075891 CET	47006	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:50.901866913 CET	3778	47006	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:50.901911974 CET	47006	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:50.906735897 CET	3778	47006	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:51.945060968 CET	3778	47006	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:51.945184946 CET	47006	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:51.945207119 CET	47006	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:51.945246935 CET	47008	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:51.950083971 CET	3778	47008	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:51.950153112 CET	47008	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:51.950153112 CET	47008	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:51.954921007 CET	3778	47008	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:51.954968929 CET	47008	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:51.959770918 CET	3778	47008	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:56.861112118 CET	3778	47008	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:56.861207962 CET	47008	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:56.861241102 CET	47008	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:56.861275911 CET	47010	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:56.866017103 CET	3778	47010	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:56.866076946 CET	47010	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:56.866103888 CET	47010	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:56.870829105 CET	3778	47010	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:56.870876074 CET	47010	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:56.875593901 CET	3778	47010	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:58.515813112 CET	3778	47010	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:58.515881062 CET	47010	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:58.515914917 CET	47010	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:58.515942097 CET	47012	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:58.520699024 CET	3778	47012	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:58.520765066 CET	47012	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:58.520803928 CET	47012	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:58.525610924 CET	3778	47012	141.11.33.73	192.168.2.23
Jan 3, 2025 17:19:58.525674105 CET	47012	3778	192.168.2.23	141.11.33.73
Jan 3, 2025 17:19:58.530457020 CET	3778	47012	141.11.33.73	192.168.2.23

System Behavior

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6240, Parent PID: 6162

General

Start time (UTC):	16:17:47
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
Arguments:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
File size:	38724 bytes
MD5 hash:	45f47c10e0d27c00ac46899fda99f1f3

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6241, Parent PID: 6240

General

Start time (UTC):	16:17:47
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
Arguments:	-
File size:	38724 bytes
MD5 hash:	45f47c10e0d27c00ac46899fda99f1f3

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6242, Parent PID: 6241

General

Start time (UTC):	16:17:47
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
Arguments:	-
File size:	38724 bytes
MD5 hash:	45f47c10e0d27c00ac46899fda99f1f3

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6243, Parent PID: 6241

General

Start time (UTC):	16:17:47
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
Arguments:	-
File size:	38724 bytes
MD5 hash:	45f47c10e0d27c00ac46899fda99f1f3

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6246, Parent PID: 6240

General

Start time (UTC):	16:17:53
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
Arguments:	-
File size:	38724 bytes
MD5 hash:	45f47c10e0d27c00ac46899fda99f1f3

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6247, Parent PID: 6240

General

Start time (UTC):	16:17:53
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
Arguments:	-
File size:	38724 bytes
MD5 hash:	45f47c10e0d27c00ac46899fda99f1f3

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ub8ehJSePAfc9FYqZIT6.x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6240, Parent PID: 6162

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6241, Parent PID: 6240

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6242, Parent PID: 6241

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6243, Parent PID: 6241

General

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6246, Parent PID: 6240

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6247, Parent PID: 6240

General

Chronological Activities

Linux Analysis Report
ub8ehJSePAfc9FYqZIT6.x86.elf