Edit tour

Linux Analysis Report
ub8ehJSePAfc9FYqZIT6.arm.elf

Overview

General Information

Sample name:	ub8ehJSePAfc9FYqZIT6.arm.elf
Analysis ID:	1583846
MD5:	382edb367d457557fbc1c4593bfe393f
SHA1:	7639eae0fb8d2523155572e721c9e003f9c83fb3
SHA256:	88652bbf95c9ef10f2a72c92d46096bd4d8605e77fbbffadf9d5dfc46e9a58e2
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583846
Start date and time:	2025-01-03 18:32:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ub8ehJSePAfc9FYqZIT6.arm.elf
Detection:	MAL
Classification:	mal68.troj.evad.linELF@0/0@0/0

Warnings

VT rate limit hit for: ub8ehJSePAfc9FYqZIT6.arm.elf

Runtime Messages

Command:	/tmp/ub8ehJSePAfc9FYqZIT6.arm.elf
PID:	5424
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424, Parent: 5349, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf

ub8ehJSePAfc9FYqZIT6.arm.elf New Fork (PID: 5426, Parent: 5424)

ub8ehJSePAfc9FYqZIT6.arm.elf New Fork (PID: 5428, Parent: 5426)

ub8ehJSePAfc9FYqZIT6.arm.elf New Fork (PID: 5429, Parent: 5426)

ub8ehJSePAfc9FYqZIT6.arm.elf New Fork (PID: 5440, Parent: 5424)

ub8ehJSePAfc9FYqZIT6.arm.elf New Fork (PID: 5442, Parent: 5424)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5440.1.00007f9784017000.00007f978402c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5440.1.00007f9784017000.00007f978402c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11f2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1201c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12030:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12044:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1206c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5426.1.00007f9784017000.00007f978402c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5426.1.00007f9784017000.00007f978402c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11f2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1201c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12030:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12044:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1206c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5428.1.00007f9784017000.00007f978402c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5428.1.00007f9784017000.00007f978402c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11f2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1201c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12030:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12044:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1206c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5424.1.00007f9784017000.00007f978402c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5424.1.00007f9784017000.00007f978402c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11f2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1201c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12030:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12044:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1206c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5424	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5424	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3e5cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e5e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e5f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e609:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e61d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e631:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e645:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e659:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e66d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e681:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e695:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e6a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e6bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e6d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e6e5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e6f9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e70d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e721:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e735:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e749:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e75d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5426	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5426	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x168:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x208:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5428	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5428	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x291ae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x291c2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x291d6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x291ea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x291fe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x29212:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x29226:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2923a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2924e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x29262:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x29276:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2928a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2929e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x292b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x292c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x292da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x292ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x29302:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x29316:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2932a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2933e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5440	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5440	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x168:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x208:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 11 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ub8ehJSePAfc9FYqZIT6.arm.elf

ReversingLabs: Detection: 31%

Source: global traffic

TCP traffic: 192.168.2.13:44052 -> 141.11.33.73:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73

Source: ub8ehJSePAfc9FYqZIT6.arm.elf

String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 5440.1.00007f9784017000.00007f978402c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5426.1.00007f9784017000.00007f978402c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5428.1.00007f9784017000.00007f978402c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5424.1.00007f9784017000.00007f978402c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5424, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5426, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5428, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5440, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0x8000

Source: 5440.1.00007f9784017000.00007f978402c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5426.1.00007f9784017000.00007f978402c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5428.1.00007f9784017000.00007f978402c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5424.1.00007f9784017000.00007f978402c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5424, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5426, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5428, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5440, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal68.troj.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/5268/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/238/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/239/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/3633/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/914/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/917/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/3771/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/19/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/240/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/3095/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/241/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/242/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/244/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/245/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/1588/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/246/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/5/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/247/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/7/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/129/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/8/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/1906/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/802/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/803/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/3420/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/1482/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/490/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/1480/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/371/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/131/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/1238/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/134/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/378/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/3413/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)	File opened: /proc/30/status	Jump to behavior

Source: ub8ehJSePAfc9FYqZIT6.arm.elf

Submission file: segment LOAD with 7.9685 entropy (max. 8.0)

Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5424)

Queries kernel information via 'uname':

Jump to behavior

Source: ub8ehJSePAfc9FYqZIT6.arm.elf, 5424.1.00007ffe21e96000.00007ffe21eb7000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5426.1.00007ffe21e96000.00007ffe21eb7000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5428.1.00007ffe21e96000.00007ffe21eb7000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5440.1.00007ffe21e96000.00007ffe21eb7000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/ub8ehJSePAfc9FYqZIT6.arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ub8ehJSePAfc9FYqZIT6.arm.elf
Source: ub8ehJSePAfc9FYqZIT6.arm.elf, 5424.1.0000560a78846000.0000560a789f5000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5426.1.0000560a78846000.0000560a789d4000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5428.1.0000560a78846000.0000560a789d4000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5440.1.0000560a78846000.0000560a789f5000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: ub8ehJSePAfc9FYqZIT6.arm.elf, 5424.1.00007ffe21e96000.00007ffe21eb7000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5426.1.00007ffe21e96000.00007ffe21eb7000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5428.1.00007ffe21e96000.00007ffe21eb7000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5440.1.00007ffe21e96000.00007ffe21eb7000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: ub8ehJSePAfc9FYqZIT6.arm.elf, 5424.1.0000560a78846000.0000560a789f5000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5426.1.0000560a78846000.0000560a789d4000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5428.1.0000560a78846000.0000560a789d4000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5440.1.0000560a78846000.0000560a789f5000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 5440.1.00007f9784017000.00007f978402c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5426.1.00007f9784017000.00007f978402c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5428.1.00007f9784017000.00007f978402c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5424.1.00007f9784017000.00007f978402c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5424, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5426, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5440, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 5440.1.00007f9784017000.00007f978402c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5426.1.00007f9784017000.00007f978402c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5428.1.00007f9784017000.00007f978402c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5424.1.00007f9784017000.00007f978402c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5424, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5426, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5440, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ub8ehJSePAfc9FYqZIT6.arm.elf	32%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	ub8ehJSePAfc9FYqZIT6.arm.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
141.11.33.73	unknown	United Kingdom		553	BELWUEBelWue-KoordinationEU	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
141.11.33.73	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse
	141.11.33.73-boatnet.arm-2025-01-03T05_39_17.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BELWUEBelWue-KoordinationEU	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse	141.11.33.73
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	141.11.33.73
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	141.11.33.73
	141.11.33.73-boatnet.arm-2025-01-03T05_39_17.elf	Get hash	malicious	Mirai	Browse	141.11.33.73
	Hilix.mips.elf	Get hash	malicious	Mirai	Browse	134.155.120.154
	armv5l.elf	Get hash	malicious	Unknown	Browse	141.79.218.248
	kwari.arm.elf	Get hash	malicious	Unknown	Browse	134.34.202.108
	kwari.arm7.elf	Get hash	malicious	Mirai	Browse	134.155.120.139
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	141.79.120.12
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	141.59.77.71

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, no section header
Entropy (8bit):	7.966580437425329
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	ub8ehJSePAfc9FYqZIT6.arm.elf
File size:	39'288 bytes
MD5:	382edb367d457557fbc1c4593bfe393f
SHA1:	7639eae0fb8d2523155572e721c9e003f9c83fb3
SHA256:	88652bbf95c9ef10f2a72c92d46096bd4d8605e77fbbffadf9d5dfc46e9a58e2
SHA512:	68f2998b3bf425fda1f24c8f6c7fb03be35702abc2e27bfbaa7e67be6d7f81e81ebb00d616d1bf6d43f346b5e92b9682a11ece99b040269707a24d9ab8028e9f
SSDEEP:	768:dBKNWbxNdoZd64sVhUQX9bS9CL+v7TqvnGQre6warL5/+qEn92a2gs3UozOx:rQiDdY4hUQNb/yv72vnGFpaH5/q0bzOx
TLSH:	F20301199AEF2801C7AAD376BDD8C9DAE72E1BF5A5B831B77331447031E451436680B2
File Content Preview:	.ELF...a..........(.........4...........4. ...(.....................W...W................{...{...{..................Q.td............................s.y.UPX!.........T...T......S..........?.E.h;.}...^..........fK..z..,vU...].XLU..0.)..0(7n..V5.'...,;.q9...

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x106a8
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8000	0x8000	0x9857	0x9857	7.9685	0x5	R E	0x8000
LOAD	0x7bc8	0x27bc8	0x27bc8	0x0	0x0	0.0000	0x6	RW	0x8000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 18:32:54.299626112 CET	44052	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:54.304511070 CET	3778	44052	141.11.33.73	192.168.2.13
Jan 3, 2025 18:32:54.304553032 CET	44052	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:54.344805956 CET	44052	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:54.349562883 CET	3778	44052	141.11.33.73	192.168.2.13
Jan 3, 2025 18:32:54.349595070 CET	44052	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:54.354429960 CET	3778	44052	141.11.33.73	192.168.2.13
Jan 3, 2025 18:32:55.337548018 CET	3778	44052	141.11.33.73	192.168.2.13
Jan 3, 2025 18:32:55.337677956 CET	44052	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:55.337893963 CET	44052	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:55.338426113 CET	44054	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:55.343180895 CET	3778	44054	141.11.33.73	192.168.2.13
Jan 3, 2025 18:32:55.343276978 CET	44054	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:55.344366074 CET	44054	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:55.349126101 CET	3778	44054	141.11.33.73	192.168.2.13
Jan 3, 2025 18:32:55.349196911 CET	44054	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:55.353931904 CET	3778	44054	141.11.33.73	192.168.2.13
Jan 3, 2025 18:32:56.375607967 CET	3778	44054	141.11.33.73	192.168.2.13
Jan 3, 2025 18:32:56.375761986 CET	44054	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:56.375794888 CET	44054	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:56.376372099 CET	44056	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:56.381182909 CET	3778	44056	141.11.33.73	192.168.2.13
Jan 3, 2025 18:32:56.381244898 CET	44056	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:56.382016897 CET	44056	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:56.386820078 CET	3778	44056	141.11.33.73	192.168.2.13
Jan 3, 2025 18:32:56.386959076 CET	44056	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:56.391741037 CET	3778	44056	141.11.33.73	192.168.2.13
Jan 3, 2025 18:32:57.405791044 CET	3778	44056	141.11.33.73	192.168.2.13
Jan 3, 2025 18:32:57.406191111 CET	44056	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:57.406191111 CET	44056	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:57.408404112 CET	44058	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:57.413176060 CET	3778	44058	141.11.33.73	192.168.2.13
Jan 3, 2025 18:32:57.413230896 CET	44058	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:57.415081978 CET	44058	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:57.419852018 CET	3778	44058	141.11.33.73	192.168.2.13
Jan 3, 2025 18:32:57.419909954 CET	44058	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:57.424701929 CET	3778	44058	141.11.33.73	192.168.2.13
Jan 3, 2025 18:32:59.070986986 CET	3778	44058	141.11.33.73	192.168.2.13
Jan 3, 2025 18:32:59.071116924 CET	44058	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:59.071201086 CET	44058	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:59.071856976 CET	44060	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:59.076615095 CET	3778	44060	141.11.33.73	192.168.2.13
Jan 3, 2025 18:32:59.076725960 CET	44060	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:59.077611923 CET	44060	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:59.082349062 CET	3778	44060	141.11.33.73	192.168.2.13
Jan 3, 2025 18:32:59.082422018 CET	44060	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:32:59.087188959 CET	3778	44060	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:00.065792084 CET	44062	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:00.070612907 CET	3778	44062	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:00.070667982 CET	44062	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:00.106379986 CET	44062	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:00.108772039 CET	3778	44060	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:00.108829021 CET	44060	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:00.108859062 CET	44060	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:00.109529972 CET	44064	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:00.111113071 CET	3778	44062	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:00.111160040 CET	44062	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:00.114401102 CET	3778	44064	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:00.114437103 CET	44064	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:00.115928888 CET	3778	44062	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:00.126779079 CET	44064	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:00.131581068 CET	3778	44064	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:00.131624937 CET	44064	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:00.136405945 CET	3778	44064	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:01.105633020 CET	3778	44062	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:01.105943918 CET	44062	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:01.105943918 CET	44062	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:01.106463909 CET	44066	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:01.111193895 CET	3778	44066	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:01.111453056 CET	44066	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:01.112211943 CET	44066	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:01.116982937 CET	3778	44066	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:01.117038012 CET	44066	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:01.121795893 CET	3778	44066	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:01.131552935 CET	3778	44064	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:01.131612062 CET	44064	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:01.131695032 CET	44064	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:01.132616043 CET	44068	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:01.137445927 CET	3778	44068	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:01.137510061 CET	44068	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:01.138700008 CET	44068	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:01.143439054 CET	3778	44068	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:01.143532038 CET	44068	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:01.148281097 CET	3778	44068	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:02.154742956 CET	3778	44068	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:02.154849052 CET	44068	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:02.155003071 CET	44068	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:02.155754089 CET	44070	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:02.160541058 CET	3778	44070	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:02.160609961 CET	44070	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:02.161863089 CET	44070	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:02.166620970 CET	3778	44070	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:02.166680098 CET	44070	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:02.171530008 CET	3778	44070	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:02.747761965 CET	3778	44066	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:02.747849941 CET	44066	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:02.747891903 CET	44066	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:02.751414061 CET	44072	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:02.756225109 CET	3778	44072	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:02.756313086 CET	44072	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:02.756972075 CET	44072	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:02.761780024 CET	3778	44072	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:02.761863947 CET	44072	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:02.766614914 CET	3778	44072	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:03.179613113 CET	3778	44070	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:03.179774046 CET	44070	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:03.179825068 CET	44070	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:03.180509090 CET	44074	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:03.185317993 CET	3778	44074	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:03.185383081 CET	44074	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:03.186203003 CET	44074	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:03.190978050 CET	3778	44074	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:03.191047907 CET	44074	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:03.195857048 CET	3778	44074	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:03.791119099 CET	3778	44072	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:03.791341066 CET	44072	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:03.791409969 CET	44072	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:03.791831017 CET	44076	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:03.796648026 CET	3778	44076	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:03.796741009 CET	44076	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:03.797386885 CET	44076	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:03.802129984 CET	3778	44076	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:03.802181005 CET	44076	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:03.806890965 CET	3778	44076	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:04.201553106 CET	3778	44074	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:04.201659918 CET	44074	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:04.201819897 CET	44074	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:04.202527046 CET	44078	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:04.207302094 CET	3778	44078	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:04.207360029 CET	44078	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:04.208456039 CET	44078	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:04.213208914 CET	3778	44078	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:04.213262081 CET	44078	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:04.218064070 CET	3778	44078	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:04.821928024 CET	3778	44076	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:04.822010994 CET	44076	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:04.822032928 CET	44076	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:04.822388887 CET	44080	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:04.827248096 CET	3778	44080	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:04.827291965 CET	44080	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:04.827893019 CET	44080	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:04.832645893 CET	3778	44080	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:04.832685947 CET	44080	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:04.837451935 CET	3778	44080	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:05.849234104 CET	3778	44080	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:05.849354982 CET	44080	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:05.849394083 CET	44080	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:05.849806070 CET	44082	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:05.854566097 CET	3778	44082	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:05.854657888 CET	44082	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:05.855238914 CET	44082	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:05.860096931 CET	3778	44082	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:05.860145092 CET	44082	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:05.864893913 CET	3778	44082	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:06.870969057 CET	3778	44082	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:06.871098995 CET	44082	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:06.871161938 CET	44082	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:06.871740103 CET	44084	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:06.876617908 CET	3778	44084	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:06.876672983 CET	44084	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:06.877305984 CET	44084	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:06.882116079 CET	3778	44084	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:06.882154942 CET	44084	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:06.886990070 CET	3778	44084	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:07.908711910 CET	3778	44084	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:07.908834934 CET	44084	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:07.908870935 CET	44084	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:07.909280062 CET	44086	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:07.914092064 CET	3778	44086	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:07.914261103 CET	44086	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:07.914900064 CET	44086	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:07.919707060 CET	3778	44086	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:07.919776917 CET	44086	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:07.924578905 CET	3778	44086	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:08.199583054 CET	3778	44078	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:08.199812889 CET	44078	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:08.199848890 CET	44078	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:08.200439930 CET	44088	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:08.205219030 CET	3778	44088	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:08.205324888 CET	44088	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:08.206151962 CET	44088	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:08.210936069 CET	3778	44088	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:08.210978031 CET	44088	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:08.215728045 CET	3778	44088	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:08.927581072 CET	3778	44086	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:08.927769899 CET	44086	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:08.927864075 CET	44086	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:08.928395033 CET	44090	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:08.933213949 CET	3778	44090	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:08.933263063 CET	44090	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:08.933859110 CET	44090	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:08.938685894 CET	3778	44090	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:08.938728094 CET	44090	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:08.943489075 CET	3778	44090	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:09.982827902 CET	3778	44090	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:09.983167887 CET	44090	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:09.983244896 CET	44090	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:09.983906984 CET	44092	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:09.988742113 CET	3778	44092	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:09.988840103 CET	44092	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:09.989460945 CET	44092	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:09.994208097 CET	3778	44092	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:09.994251966 CET	44092	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:09.999114990 CET	3778	44092	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:10.669616938 CET	3778	44088	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:10.669809103 CET	44088	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:10.669841051 CET	44088	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:10.670578957 CET	44094	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:10.675381899 CET	3778	44094	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:10.675457001 CET	44094	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:10.676446915 CET	44094	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:10.681210041 CET	3778	44094	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:10.681272030 CET	44094	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:10.686002016 CET	3778	44094	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:11.711766005 CET	3778	44094	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:11.712027073 CET	44094	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:11.712064981 CET	44094	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:11.712656021 CET	44096	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:11.717557907 CET	3778	44096	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:11.717612982 CET	44096	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:11.718461990 CET	44096	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:11.723277092 CET	3778	44096	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:11.723330975 CET	44096	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:11.728400946 CET	3778	44096	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:12.728827000 CET	3778	44096	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:12.728986979 CET	44096	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:12.729042053 CET	44096	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:12.729650974 CET	44098	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:12.734988928 CET	3778	44098	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:12.735054970 CET	44098	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:12.735950947 CET	44098	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:12.741084099 CET	3778	44098	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:12.741141081 CET	44098	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:12.745907068 CET	3778	44098	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:14.034113884 CET	3778	44092	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:14.034369946 CET	44092	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:14.034449100 CET	44092	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:14.035036087 CET	44100	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:14.039834023 CET	3778	44100	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:14.039901972 CET	44100	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:14.040882111 CET	44100	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:14.045622110 CET	3778	44100	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:14.045674086 CET	44100	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:14.050537109 CET	3778	44100	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:14.404648066 CET	3778	44098	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:14.404763937 CET	44098	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:14.404814959 CET	44098	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:14.405529976 CET	44102	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:14.410335064 CET	3778	44102	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:14.410391092 CET	44102	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:14.411062002 CET	44102	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:14.415878057 CET	3778	44102	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:14.415927887 CET	44102	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:14.420855045 CET	3778	44102	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:15.432158947 CET	3778	44102	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:15.432420015 CET	44102	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:15.432449102 CET	44102	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:15.433207989 CET	44104	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:15.438117981 CET	3778	44104	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:15.438175917 CET	44104	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:15.439182043 CET	44104	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:15.444113970 CET	3778	44104	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:15.444175005 CET	44104	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:15.449053049 CET	3778	44104	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:15.698168993 CET	3778	44100	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:15.698271990 CET	44100	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:15.698479891 CET	44100	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:15.699292898 CET	44106	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:15.704235077 CET	3778	44106	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:15.704318047 CET	44106	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:15.705676079 CET	44106	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:15.710431099 CET	3778	44106	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:15.710496902 CET	44106	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:15.715323925 CET	3778	44106	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:16.729384899 CET	3778	44106	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:16.729722977 CET	44106	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:16.729722977 CET	44106	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:16.730421066 CET	44108	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:16.735218048 CET	3778	44108	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:16.735332966 CET	44108	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:16.736419916 CET	44108	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:16.741139889 CET	3778	44108	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:16.741244078 CET	44108	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:16.746001959 CET	3778	44108	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:17.084939957 CET	3778	44104	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:17.085163116 CET	44104	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:17.085201025 CET	44104	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:17.086024046 CET	44110	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:17.090805054 CET	3778	44110	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:17.090905905 CET	44110	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:17.091942072 CET	44110	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:17.096688986 CET	3778	44110	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:17.096765041 CET	44110	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:17.101612091 CET	3778	44110	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:17.738815069 CET	3778	44108	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:17.738909006 CET	44108	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:17.739078045 CET	44108	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:17.739877939 CET	44112	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:17.744668007 CET	3778	44112	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:17.744738102 CET	44112	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:17.746022940 CET	44112	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:17.750844002 CET	3778	44112	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:17.750901937 CET	44112	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:17.755655050 CET	3778	44112	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:18.793735027 CET	3778	44112	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:18.794009924 CET	44112	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:18.794085979 CET	44112	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:18.794796944 CET	44114	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:18.799674988 CET	3778	44114	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:18.799777031 CET	44114	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:18.800836086 CET	44114	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:18.805644035 CET	3778	44114	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:18.805704117 CET	44114	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:18.810545921 CET	3778	44114	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:21.127007961 CET	3778	44110	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:21.127172947 CET	44110	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:21.127266884 CET	44110	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:21.128109932 CET	44116	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:21.133559942 CET	3778	44116	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:21.133642912 CET	44116	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:21.134857893 CET	44116	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:21.139866114 CET	3778	44116	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:21.139926910 CET	44116	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:21.144743919 CET	3778	44116	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:22.276185036 CET	3778	44116	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:22.276396990 CET	44116	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:22.276638031 CET	44116	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:22.277458906 CET	44118	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:22.282207012 CET	3778	44118	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:22.282305956 CET	44118	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:22.283447027 CET	44118	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:22.288306952 CET	3778	44118	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:22.288371086 CET	44118	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:22.293144941 CET	3778	44118	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:23.543487072 CET	3778	44118	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:23.543678999 CET	44118	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:23.543752909 CET	44118	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:23.544506073 CET	44120	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:23.549279928 CET	3778	44120	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:23.549350977 CET	44120	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:23.550425053 CET	44120	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:23.555223942 CET	3778	44120	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:23.555299044 CET	44120	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:23.560070992 CET	3778	44120	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:24.445106983 CET	3778	44114	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:24.445252895 CET	44114	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:24.445476055 CET	44114	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:24.446223021 CET	44122	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:24.450993061 CET	3778	44122	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:24.451064110 CET	44122	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:24.451960087 CET	44122	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:24.456713915 CET	3778	44122	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:24.456773043 CET	44122	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:24.461498976 CET	3778	44122	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:25.257749081 CET	3778	44120	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:25.257862091 CET	44120	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:25.257908106 CET	44120	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:25.258829117 CET	44124	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:25.263597012 CET	3778	44124	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:25.263653040 CET	44124	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:25.264848948 CET	44124	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:25.269674063 CET	3778	44124	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:25.269752026 CET	44124	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:25.274559975 CET	3778	44124	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:25.485661030 CET	3778	44122	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:25.485923052 CET	44122	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:25.486038923 CET	44122	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:25.486780882 CET	44126	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:25.492650986 CET	3778	44126	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:25.492738962 CET	44126	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:25.493824959 CET	44126	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:25.500663996 CET	3778	44126	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:25.500729084 CET	44126	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:25.505574942 CET	3778	44126	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:26.292897940 CET	3778	44124	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:26.293009996 CET	44124	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:26.293050051 CET	44124	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:26.293545961 CET	44128	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:26.298300028 CET	3778	44128	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:26.298347950 CET	44128	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:26.299022913 CET	44128	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:26.303749084 CET	3778	44128	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:26.303788900 CET	44128	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:26.308526993 CET	3778	44128	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:29.545996904 CET	3778	44126	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:29.546148062 CET	44126	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:29.546205997 CET	44126	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:29.546894073 CET	44130	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:29.551697016 CET	3778	44130	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:29.551796913 CET	44130	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:29.552804947 CET	44130	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:29.557549953 CET	3778	44130	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:29.557600975 CET	44130	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:29.562350988 CET	3778	44130	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:30.572443962 CET	3778	44130	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:30.572551966 CET	44130	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:30.572662115 CET	44130	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:30.573447943 CET	44132	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:30.578260899 CET	3778	44132	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:30.578332901 CET	44132	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:30.579519987 CET	44132	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:30.584347010 CET	3778	44132	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:30.584407091 CET	44132	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:30.589206934 CET	3778	44132	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:32.231964111 CET	3778	44132	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:32.232171059 CET	44132	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:32.232211113 CET	44132	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:32.232948065 CET	44134	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:32.237766981 CET	3778	44134	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:32.237854958 CET	44134	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:32.238821030 CET	44134	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:32.243597984 CET	3778	44134	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:32.243643999 CET	44134	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:32.248465061 CET	3778	44134	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:36.260029078 CET	3778	44134	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:36.260292053 CET	44134	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:36.260375977 CET	44134	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:36.261084080 CET	44136	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:36.265938997 CET	3778	44136	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:36.266007900 CET	44136	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:36.266638994 CET	44136	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:36.272763968 CET	3778	44136	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:36.272834063 CET	44136	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:36.278836966 CET	3778	44136	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:36.306184053 CET	44128	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:36.310921907 CET	3778	44128	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:36.678282022 CET	3778	44128	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:36.678555965 CET	44128	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:46.276813030 CET	44136	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:33:46.281723976 CET	3778	44136	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:46.659812927 CET	3778	44136	141.11.33.73	192.168.2.13
Jan 3, 2025 18:33:46.659936905 CET	44136	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:34:36.726161957 CET	44128	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:34:36.731033087 CET	3778	44128	141.11.33.73	192.168.2.13
Jan 3, 2025 18:34:37.098164082 CET	3778	44128	141.11.33.73	192.168.2.13
Jan 3, 2025 18:34:37.098412037 CET	44128	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:34:46.719933033 CET	44136	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:34:46.724806070 CET	3778	44136	141.11.33.73	192.168.2.13
Jan 3, 2025 18:34:48.256144047 CET	3778	44136	141.11.33.73	192.168.2.13
Jan 3, 2025 18:34:48.256289959 CET	44136	3778	192.168.2.13	141.11.33.73

System Behavior

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5424, Parent PID: 5349

General

Start time (UTC):	17:32:53
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm.elf
Arguments:	/tmp/ub8ehJSePAfc9FYqZIT6.arm.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5426, Parent PID: 5424

General

Start time (UTC):	17:32:53
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5428, Parent PID: 5426

General

Start time (UTC):	17:32:53
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5429, Parent PID: 5426

General

Start time (UTC):	17:32:53
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5440, Parent PID: 5424

General

Start time (UTC):	17:32:59
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5442, Parent PID: 5424

General

Start time (UTC):	17:32:59
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ub8ehJSePAfc9FYqZIT6.arm.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5424, Parent PID: 5349

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5426, Parent PID: 5424

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5428, Parent PID: 5426

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5429, Parent PID: 5426

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5440, Parent PID: 5424

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5442, Parent PID: 5424

General

Chronological Activities

Linux Analysis Report
ub8ehJSePAfc9FYqZIT6.arm.elf