Edit tour

Linux Analysis Report
Kloki.spc.elf

Overview

General Information

Sample name:	Kloki.spc.elf
Analysis ID:	1586168
MD5:	a72465eba9e4ff86f1b35a4951660124
SHA1:	d9348f8c5bdfc9e00f6364a3a8683d2ea90a5be9
SHA256:	03d0cc1607db3d49d7658c9f00e097a2f03b5d3ba682f0454777acc7f5e189d1
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample tries to kill multiple processes (SIGKILL)

Detected TCP or UDP traffic on non-standard ports

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Suricata IDS alerts with low severity for network traffic

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1586168
Start date and time:	2025-01-08 19:45:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Kloki.spc.elf
Detection:	MAL
Classification:	mal60.spre.linELF@0/0@1/0

Warnings

VT rate limit hit for: Kloki.spc.elf

Runtime Messages

Command:	/tmp/Kloki.spc.elf
PID:	5472
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	suka
Standard Error:

Process Tree

system is lnxubuntu20

Kloki.spc.elf (PID: 5472, Parent: 5398, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/Kloki.spc.elf

Kloki.spc.elf New Fork (PID: 5475, Parent: 5472)

Kloki.spc.elf New Fork (PID: 5477, Parent: 5475)

Kloki.spc.elf New Fork (PID: 5478, Parent: 5475)

gnome-session-binary New Fork (PID: 5481, Parent: 1588)

sh (PID: 5481, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

gnome-session-binary New Fork (PID: 5500, Parent: 1588)

sh (PID: 5500, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 5500, Parent: 1588, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gnome-session-binary New Fork (PID: 5502, Parent: 1588)

sh (PID: 5502, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 5502, Parent: 1588, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gnome-session-binary New Fork (PID: 5503, Parent: 1588)

sh (PID: 5503, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5503, Parent: 1588, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gdm3 New Fork (PID: 5504, Parent: 1400)

Default (PID: 5504, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5508, Parent: 1400)

Default (PID: 5508, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5514, Parent: 1)

systemd-user-runtime-dir (PID: 5514, Parent: 1, MD5: d55f4b0847f88131dbcfb07435178e54) Arguments: /lib/systemd/systemd-user-runtime-dir stop 127

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

ET COMPROMISED Known Compromised or Hostile Host Traffic group 19

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T19:47:02.341594+0100	2500036	2	Misc Attack	83.222.191.90	13566	192.168.2.13	42774	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Kloki.spc.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: Kloki.spc.elf

ReversingLabs: Detection: 28%

Source: Kloki.spc.elf

String: ppid/proc/net/tcp/proc/self/exe/proc//status/fd//dev/null/dev/consolesocket05/proc/%d/exepkillkillkillallechowgetcurlpsbusyboxiptablesrebootinitinit 6catgrepshbash

Source: global traffic	TCP traffic: 192.168.2.13:37720 -> 83.222.250.57:13566
Source: global traffic	TCP traffic: 192.168.2.13:38042 -> 83.222.232.99:13566
Source: global traffic	TCP traffic: 192.168.2.13:50000 -> 83.222.22.67:13566
Source: global traffic	TCP traffic: 192.168.2.13:60022 -> 83.222.103.225:13566
Source: global traffic	TCP traffic: 192.168.2.13:43840 -> 83.222.41.233:13566
Source: global traffic	TCP traffic: 192.168.2.13:47684 -> 83.222.225.208:13566
Source: global traffic	TCP traffic: 192.168.2.13:39006 -> 83.222.33.179:13566
Source: global traffic	TCP traffic: 192.168.2.13:48448 -> 83.222.89.105:13566
Source: global traffic	TCP traffic: 192.168.2.13:44368 -> 83.222.125.205:13566
Source: global traffic	TCP traffic: 192.168.2.13:33332 -> 83.222.89.20:13566
Source: global traffic	TCP traffic: 192.168.2.13:49408 -> 83.222.101.184:13566
Source: global traffic	TCP traffic: 192.168.2.13:46876 -> 83.222.65.247:13566
Source: global traffic	TCP traffic: 192.168.2.13:51394 -> 83.222.161.76:13566
Source: global traffic	TCP traffic: 192.168.2.13:60276 -> 83.222.155.93:13566
Source: global traffic	TCP traffic: 192.168.2.13:40544 -> 83.222.211.212:13566
Source: global traffic	TCP traffic: 192.168.2.13:34042 -> 83.222.54.205:13566
Source: global traffic	TCP traffic: 192.168.2.13:49768 -> 83.222.13.30:13566
Source: global traffic	TCP traffic: 192.168.2.13:35238 -> 83.222.48.35:13566
Source: global traffic	TCP traffic: 192.168.2.13:53782 -> 83.222.97.151:13566
Source: global traffic	TCP traffic: 192.168.2.13:57654 -> 83.222.4.138:13566
Source: global traffic	TCP traffic: 192.168.2.13:47654 -> 83.222.129.230:13566
Source: global traffic	TCP traffic: 192.168.2.13:49744 -> 83.222.90.162:13566
Source: global traffic	TCP traffic: 192.168.2.13:60744 -> 83.222.153.179:13566
Source: global traffic	TCP traffic: 192.168.2.13:37344 -> 83.222.12.23:13566
Source: global traffic	TCP traffic: 192.168.2.13:36624 -> 83.222.129.101:13566
Source: global traffic	TCP traffic: 192.168.2.13:59938 -> 83.222.43.230:13566
Source: global traffic	TCP traffic: 192.168.2.13:60960 -> 83.222.29.108:13566
Source: global traffic	TCP traffic: 192.168.2.13:54158 -> 83.222.222.190:13566
Source: global traffic	TCP traffic: 192.168.2.13:47848 -> 83.222.185.121:13566
Source: global traffic	TCP traffic: 192.168.2.13:58574 -> 83.222.28.140:13566
Source: global traffic	TCP traffic: 192.168.2.13:46546 -> 83.222.77.82:13566
Source: global traffic	TCP traffic: 192.168.2.13:38754 -> 83.222.89.90:13566
Source: global traffic	TCP traffic: 192.168.2.13:35166 -> 83.222.112.137:13566
Source: global traffic	TCP traffic: 192.168.2.13:41846 -> 83.222.126.209:13566
Source: global traffic	TCP traffic: 192.168.2.13:42672 -> 83.222.32.130:13566
Source: global traffic	TCP traffic: 192.168.2.13:55788 -> 83.222.91.161:13566
Source: global traffic	TCP traffic: 192.168.2.13:51190 -> 83.222.104.181:13566
Source: global traffic	TCP traffic: 192.168.2.13:56636 -> 83.222.68.2:13566
Source: global traffic	TCP traffic: 192.168.2.13:34444 -> 83.222.104.80:13566
Source: global traffic	TCP traffic: 192.168.2.13:42902 -> 83.222.25.233:13566
Source: global traffic	TCP traffic: 192.168.2.13:49104 -> 83.222.181.68:13566
Source: global traffic	TCP traffic: 192.168.2.13:54940 -> 83.222.208.210:13566
Source: global traffic	TCP traffic: 192.168.2.13:44086 -> 83.222.176.174:13566
Source: global traffic	TCP traffic: 192.168.2.13:47872 -> 83.222.145.105:13566
Source: global traffic	TCP traffic: 192.168.2.13:59540 -> 83.222.39.173:13566
Source: global traffic	TCP traffic: 192.168.2.13:42120 -> 83.222.245.116:13566
Source: global traffic	TCP traffic: 192.168.2.13:35824 -> 83.222.255.78:13566
Source: global traffic	TCP traffic: 192.168.2.13:55768 -> 83.222.206.111:13566
Source: global traffic	TCP traffic: 192.168.2.13:34236 -> 83.222.215.76:13566
Source: global traffic	TCP traffic: 192.168.2.13:51046 -> 83.222.64.248:13566
Source: global traffic	TCP traffic: 192.168.2.13:50602 -> 83.222.207.155:13566
Source: global traffic	TCP traffic: 192.168.2.13:47608 -> 83.222.153.55:13566
Source: global traffic	TCP traffic: 192.168.2.13:47134 -> 83.222.80.221:13566
Source: global traffic	TCP traffic: 192.168.2.13:42774 -> 83.222.191.90:13566

Source: /tmp/Kloki.spc.elf (PID: 5472)

Socket: 127.0.0.1:14435

Jump to behavior

Source: Network traffic

Suricata IDS: 2500036 - Severity 2 - ET COMPROMISED Known Compromised or Hostile Host Traffic group 19 : 83.222.191.90:13566 -> 192.168.2.13:42774

Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.250.57
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.250.57
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.232.99
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.232.99
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.232.99
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.22.67
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.232.99
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.22.67
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.22.67
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.22.67
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.103.225
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.41.233
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.103.225
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.41.233
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.225.208
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.225.208
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.225.208
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.33.179
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.89.105
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.225.208
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.125.205
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.33.179
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.89.20
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.89.105
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.125.205
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.101.184
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.89.20
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.65.247
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.101.184
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.161.76
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.65.247
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.155.93
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.161.76
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.155.93
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.211.212
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.54.205
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.211.212
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.13.30
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.54.205
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.48.35
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.13.30
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.97.151
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.4.138
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.48.35
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.129.230
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.97.151
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.90.162
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.4.138
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.129.230
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.153.179

Source: global traffic

DNS traffic detected: DNS query: secure-network-rebirthltd.ru

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 914, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 1691, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 1866, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 1881, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 1884, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 3246, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 3442, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 5457, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 5481, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 5500, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 5502, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 5503, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 5504, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: ppid/proc/net/tcp/proc/self/exe/proc//status/fd//dev/null/dev/consolesocket05/proc/%d/exepkillkillkillallechowgetcurlpsbusyboxiptablesrebootinitinit 6catgrepshbash

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 914, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 1691, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 1866, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 1881, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 1884, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 3246, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 3442, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 5457, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 5481, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 5500, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 5502, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 5503, result: successful	Jump to behavior
Source: /tmp/Kloki.spc.elf (PID: 5478)	SIGKILL sent: pid: 5504, result: successful	Jump to behavior

Source: classification engine

Classification label: mal60.spre.linELF@0/0@1/0

Source: /tmp/Kloki.spc.elf (PID: 5472)

Queries kernel information via 'uname':

Jump to behavior

Source: Kloki.spc.elf, 5472.1.00005636b8248000.00005636b82d2000.rw-.sdmp, Kloki.spc.elf, 5477.1.00005636b8248000.00005636b82d2000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: Kloki.spc.elf, 5472.1.00007ffee26ec000.00007ffee270d000.rw-.sdmp, Kloki.spc.elf, 5477.1.00007ffee26ec000.00007ffee270d000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/Kloki.spc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Kloki.spc.elf
Source: Kloki.spc.elf, 5472.1.00005636b8248000.00005636b82d2000.rw-.sdmp, Kloki.spc.elf, 5477.1.00005636b8248000.00005636b82d2000.rw-.sdmp	Binary or memory string: 6V!/etc/qemu-binfmt/sparc
Source: Kloki.spc.elf, 5472.1.00007ffee26ec000.00007ffee270d000.rw-.sdmp, Kloki.spc.elf, 5477.1.00007ffee26ec000.00007ffee270d000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Kloki.spc.elf	29%	ReversingLabs	Linux.Backdoor.Mirai
Kloki.spc.elf	100%	Avira	EXP/ELF.Mirai.W

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
secure-network-rebirthltd.ru	83.222.191.90	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
83.222.89.20	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.232.99	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.65.247	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.77.82	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.215.76	unknown	Russian Federation	25159	SONICDUO-ASRU	false
83.222.129.230	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.90.162	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.97.151	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.64.248	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.176.174	unknown	Bulgaria	12615	GCN-ASGCNAD-SofiaBulgariaBG	false
83.222.32.130	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.222.190	unknown	Russian Federation	25159	SONICDUO-ASRU	false
83.222.29.108	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.101.184	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.54.205	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.206.111	unknown	Russian Federation	6854	SYNTERRA-ASRU	false
83.222.89.105	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.28.140	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.145.105	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.129.101	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.207.155	unknown	Russian Federation	6854	SYNTERRA-ASRU	false
83.222.25.233	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.4.138	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.103.225	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.155.93	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.33.179	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.80.221	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.250.57	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.43.230	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.48.35	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.126.209	unknown	Russian Federation	47328	TRI-ASTrueRecordsIncES	false
83.222.153.179	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.185.121	unknown	Bulgaria	43561	NET1-ASBG	false
83.222.22.67	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.208.210	unknown	Russian Federation	6854	SYNTERRA-ASRU	false
83.222.255.78	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.41.233	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.12.23	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.125.205	unknown	Russian Federation	47328	TRI-ASTrueRecordsIncES	false
83.222.13.30	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.104.181	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.68.2	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.161.76	unknown	Bulgaria	12615	GCN-ASGCNAD-SofiaBulgariaBG	false
83.222.39.173	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.91.161	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.191.90	secure-network-rebirthltd.ru	Bulgaria	43561	NET1-ASBG	false
83.222.89.90	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.181.68	unknown	Bulgaria	12615	GCN-ASGCNAD-SofiaBulgariaBG	false
83.222.104.80	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.112.137	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.211.212	unknown	Russian Federation	6854	SYNTERRA-ASRU	false
83.222.245.116	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.225.208	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.153.55	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
secure-network-rebirthltd.ru	Kloki.arm5.elf	Get hash	malicious	Unknown	Browse	83.222.191.90

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	Kloki.arm5.elf	Get hash	malicious	Unknown	Browse	83.222.64.159
	skid.x86.elf	Get hash	malicious	Moobot	Browse	83.222.64.191
	XfUkJyh9A3.elf	Get hash	malicious	Mirai	Browse	37.209.228.199
	nSQgTX0uEc.dll	Get hash	malicious	Wannacry	Browse	213.141.249.89
	e7N7Kz9Bar	Get hash	malicious	Unknown	Browse	37.209.226.155
	G2JJHi7jyh	Get hash	malicious	Mirai	Browse	212.75.151.147
	KiDRFl2BaN	Get hash	malicious	Mirai	Browse	212.75.129.46
	UbjnMZrdW8	Get hash	malicious	Mirai	Browse	37.209.228.197
	vEjGHdNRFj	Get hash	malicious	Gafgyt Mirai	Browse	37.209.228.196
	6LmZoebUdA	Get hash	malicious	Mirai	Browse	37.209.236.25
COGECO-PEER1CA	Kloki.arm5.elf	Get hash	malicious	Unknown	Browse	83.222.237.30
	http://plnbl.io/review/VdCYQSoKp54z	Get hash	malicious	HTMLPhisher	Browse	66.33.60.194
	miori.sh4.elf	Get hash	malicious	Unknown	Browse	209.35.191.178
	https://bawarq.org/r.php?id=YoExsdlTj9ej3sIxs1X7aZn3DzYWS8OQ2	Get hash	malicious	Unknown	Browse	162.254.38.37
	Mes_Drivers_3.0.4.exe	Get hash	malicious	Unknown	Browse	69.90.254.78
	https://app.saner.ai/shared/notes/7353e5ae-dd5f-410b-92c3-210c9e88052a	Get hash	malicious	HTMLPhisher	Browse	66.33.60.194
	https://u43161309.ct.sendgrid.net/ls/click?upn=u001.L9-2FCbhkaoUACh7As3yZ8i4iABGphfl-2FJgS6Xiu1aw6I-3DgXpA_qO4VbBWAKg4gLfGs-2BfuSyZki3gKzG4I1DrYN15Q8fD7JV1twLeLo1AFs1GBSG3ZgA22dFJdXJloKc56aXDeV3olJKTBJd8NprednZ2LeXdX-2BkcSQE-2F2FRwgBng5RbUCLfjS8-2FI3mrpwyYu9lRatIB62qUwPSax-2Fhh2c7R-2B7pT3Kos0wK0SEJGj4ZMkgOGYhEniKYT7Kn7jN25xFz2sFdtPlVQkIdCFKwDNWmq-2BrAxerZE2GuKgfkuf3l1UY4J42sOOltybAAVyLhV-2BXfmbuQpN4NpshXRIuhta8ho3ChcTA5NtgjludQThyLtwhGns-2ByLqSbpO1Bhhc-2FCgdgP-2BAOxYrGHvKHjVYRr6-2BiryADxfM-3D	Get hash	malicious	HTMLPhisher	Browse	66.33.60.35
	armv4l.elf	Get hash	malicious	Unknown	Browse	176.74.182.119
	fuckunix.x86.elf	Get hash	malicious	Mirai	Browse	69.90.30.210
	Fantazy.x86.elf	Get hash	malicious	Unknown	Browse	72.51.27.59
ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	Kloki.arm5.elf	Get hash	malicious	Unknown	Browse	83.222.64.159
	skid.x86.elf	Get hash	malicious	Moobot	Browse	83.222.64.191
	XfUkJyh9A3.elf	Get hash	malicious	Mirai	Browse	37.209.228.199
	nSQgTX0uEc.dll	Get hash	malicious	Wannacry	Browse	213.141.249.89
	e7N7Kz9Bar	Get hash	malicious	Unknown	Browse	37.209.226.155
	G2JJHi7jyh	Get hash	malicious	Mirai	Browse	212.75.151.147
	KiDRFl2BaN	Get hash	malicious	Mirai	Browse	212.75.129.46
	UbjnMZrdW8	Get hash	malicious	Mirai	Browse	37.209.228.197
	vEjGHdNRFj	Get hash	malicious	Gafgyt Mirai	Browse	37.209.228.196
	6LmZoebUdA	Get hash	malicious	Mirai	Browse	37.209.236.25

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.03148104046998
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Kloki.spc.elf
File size:	66'920 bytes
MD5:	a72465eba9e4ff86f1b35a4951660124
SHA1:	d9348f8c5bdfc9e00f6364a3a8683d2ea90a5be9
SHA256:	03d0cc1607db3d49d7658c9f00e097a2f03b5d3ba682f0454777acc7f5e189d1
SHA512:	5cbd96950633996d0c1b55b9b1ae86bf4d2498863f00bab1b4ad7eea402e29be7f50148f5b2000fadd898da4a7dc1090c1d68057e53966338aaaf16af14ce1c3
SSDEEP:	1536:QUNqSMAxF+mFm0+4YhZeGpatVV7y5F8t/dlq:Fju8411pa57CGd0
TLSH:	39635C32B9751E2BC4D1A87A61F74724F2F2474A25ECCA1E7D620E4EFF21A4022576F4
File Content Preview:	.ELF...........................4.........4. ...(....................... ... ..............................5.........dt.Q................................@..(....@.9S................#.....c...`.....!..... ...@.....".........`......$ ... ...@...........`....

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101a4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	66520
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	4
.text	PROGBITS	0x100b0	0xb0	0xe584	0x0	0x6	AX	4
.fini	PROGBITS	0x1e634	0xe634	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x1e648	0xe648	0x13d8	0x0	0x2	A	8
.ctors	PROGBITS	0x20000	0x10000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x20008	0x10008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x20018	0x10018	0x380	0x0	0x3	WA	8
.bss	NOBITS	0x20398	0x10398	0x3178	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0x10398	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0xfa20	0xfa20	6.1497	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x10000	0x20000	0x20000	0x398	0x3510	2.7122	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-08T19:47:02.341594+0100	2500036	ET COMPROMISED Known Compromised or Hostile Host Traffic group 19	2	83.222.191.90	13566	192.168.2.13	42774	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 19:47:02.058218956 CET	37720	13566	192.168.2.13	83.222.250.57
Jan 8, 2025 19:47:02.065064907 CET	13566	37720	83.222.250.57	192.168.2.13
Jan 8, 2025 19:47:02.065119982 CET	37720	13566	192.168.2.13	83.222.250.57
Jan 8, 2025 19:47:02.077619076 CET	38042	13566	192.168.2.13	83.222.232.99
Jan 8, 2025 19:47:02.082438946 CET	13566	38042	83.222.232.99	192.168.2.13
Jan 8, 2025 19:47:02.082498074 CET	38042	13566	192.168.2.13	83.222.232.99
Jan 8, 2025 19:47:02.111215115 CET	38042	13566	192.168.2.13	83.222.232.99
Jan 8, 2025 19:47:02.115597963 CET	50000	13566	192.168.2.13	83.222.22.67
Jan 8, 2025 19:47:02.115988970 CET	13566	38042	83.222.232.99	192.168.2.13
Jan 8, 2025 19:47:02.116034031 CET	38042	13566	192.168.2.13	83.222.232.99
Jan 8, 2025 19:47:02.120383024 CET	13566	50000	83.222.22.67	192.168.2.13
Jan 8, 2025 19:47:02.120428085 CET	50000	13566	192.168.2.13	83.222.22.67
Jan 8, 2025 19:47:02.126040936 CET	50000	13566	192.168.2.13	83.222.22.67
Jan 8, 2025 19:47:02.130913973 CET	13566	50000	83.222.22.67	192.168.2.13
Jan 8, 2025 19:47:02.130955935 CET	50000	13566	192.168.2.13	83.222.22.67
Jan 8, 2025 19:47:02.134083033 CET	60022	13566	192.168.2.13	83.222.103.225
Jan 8, 2025 19:47:02.136558056 CET	43840	13566	192.168.2.13	83.222.41.233
Jan 8, 2025 19:47:02.138917923 CET	13566	60022	83.222.103.225	192.168.2.13
Jan 8, 2025 19:47:02.138969898 CET	60022	13566	192.168.2.13	83.222.103.225
Jan 8, 2025 19:47:02.141360044 CET	13566	43840	83.222.41.233	192.168.2.13
Jan 8, 2025 19:47:02.141411066 CET	43840	13566	192.168.2.13	83.222.41.233
Jan 8, 2025 19:47:02.148840904 CET	47684	13566	192.168.2.13	83.222.225.208
Jan 8, 2025 19:47:02.153661966 CET	13566	47684	83.222.225.208	192.168.2.13
Jan 8, 2025 19:47:02.153708935 CET	47684	13566	192.168.2.13	83.222.225.208
Jan 8, 2025 19:47:02.200808048 CET	47684	13566	192.168.2.13	83.222.225.208
Jan 8, 2025 19:47:02.202267885 CET	39006	13566	192.168.2.13	83.222.33.179
Jan 8, 2025 19:47:02.205030918 CET	48448	13566	192.168.2.13	83.222.89.105
Jan 8, 2025 19:47:02.205600023 CET	13566	47684	83.222.225.208	192.168.2.13
Jan 8, 2025 19:47:02.205657005 CET	47684	13566	192.168.2.13	83.222.225.208
Jan 8, 2025 19:47:02.207106113 CET	44368	13566	192.168.2.13	83.222.125.205
Jan 8, 2025 19:47:02.207129955 CET	13566	39006	83.222.33.179	192.168.2.13
Jan 8, 2025 19:47:02.207184076 CET	39006	13566	192.168.2.13	83.222.33.179
Jan 8, 2025 19:47:02.209690094 CET	33332	13566	192.168.2.13	83.222.89.20
Jan 8, 2025 19:47:02.209889889 CET	13566	48448	83.222.89.105	192.168.2.13
Jan 8, 2025 19:47:02.209944963 CET	48448	13566	192.168.2.13	83.222.89.105
Jan 8, 2025 19:47:02.211924076 CET	13566	44368	83.222.125.205	192.168.2.13
Jan 8, 2025 19:47:02.211973906 CET	44368	13566	192.168.2.13	83.222.125.205
Jan 8, 2025 19:47:02.212899923 CET	49408	13566	192.168.2.13	83.222.101.184
Jan 8, 2025 19:47:02.214507103 CET	13566	33332	83.222.89.20	192.168.2.13
Jan 8, 2025 19:47:02.214553118 CET	33332	13566	192.168.2.13	83.222.89.20
Jan 8, 2025 19:47:02.216134071 CET	46876	13566	192.168.2.13	83.222.65.247
Jan 8, 2025 19:47:02.217715025 CET	13566	49408	83.222.101.184	192.168.2.13
Jan 8, 2025 19:47:02.217758894 CET	49408	13566	192.168.2.13	83.222.101.184
Jan 8, 2025 19:47:02.218871117 CET	51394	13566	192.168.2.13	83.222.161.76
Jan 8, 2025 19:47:02.220987082 CET	13566	46876	83.222.65.247	192.168.2.13
Jan 8, 2025 19:47:02.221023083 CET	46876	13566	192.168.2.13	83.222.65.247
Jan 8, 2025 19:47:02.222161055 CET	60276	13566	192.168.2.13	83.222.155.93
Jan 8, 2025 19:47:02.223658085 CET	13566	51394	83.222.161.76	192.168.2.13
Jan 8, 2025 19:47:02.223721027 CET	51394	13566	192.168.2.13	83.222.161.76
Jan 8, 2025 19:47:02.227008104 CET	13566	60276	83.222.155.93	192.168.2.13
Jan 8, 2025 19:47:02.227065086 CET	60276	13566	192.168.2.13	83.222.155.93
Jan 8, 2025 19:47:02.227272034 CET	40544	13566	192.168.2.13	83.222.211.212
Jan 8, 2025 19:47:02.231328011 CET	34042	13566	192.168.2.13	83.222.54.205
Jan 8, 2025 19:47:02.232079029 CET	13566	40544	83.222.211.212	192.168.2.13
Jan 8, 2025 19:47:02.232131004 CET	40544	13566	192.168.2.13	83.222.211.212
Jan 8, 2025 19:47:02.234371901 CET	49768	13566	192.168.2.13	83.222.13.30
Jan 8, 2025 19:47:02.236103058 CET	13566	34042	83.222.54.205	192.168.2.13
Jan 8, 2025 19:47:02.236155033 CET	34042	13566	192.168.2.13	83.222.54.205
Jan 8, 2025 19:47:02.236772060 CET	35238	13566	192.168.2.13	83.222.48.35
Jan 8, 2025 19:47:02.239223957 CET	13566	49768	83.222.13.30	192.168.2.13
Jan 8, 2025 19:47:02.239265919 CET	49768	13566	192.168.2.13	83.222.13.30
Jan 8, 2025 19:47:02.239435911 CET	53782	13566	192.168.2.13	83.222.97.151
Jan 8, 2025 19:47:02.240837097 CET	57654	13566	192.168.2.13	83.222.4.138
Jan 8, 2025 19:47:02.241662025 CET	13566	35238	83.222.48.35	192.168.2.13
Jan 8, 2025 19:47:02.241704941 CET	35238	13566	192.168.2.13	83.222.48.35
Jan 8, 2025 19:47:02.243155003 CET	47654	13566	192.168.2.13	83.222.129.230
Jan 8, 2025 19:47:02.244199991 CET	13566	53782	83.222.97.151	192.168.2.13
Jan 8, 2025 19:47:02.244239092 CET	53782	13566	192.168.2.13	83.222.97.151
Jan 8, 2025 19:47:02.245508909 CET	49744	13566	192.168.2.13	83.222.90.162
Jan 8, 2025 19:47:02.245603085 CET	13566	57654	83.222.4.138	192.168.2.13
Jan 8, 2025 19:47:02.245646000 CET	57654	13566	192.168.2.13	83.222.4.138
Jan 8, 2025 19:47:02.247958899 CET	13566	47654	83.222.129.230	192.168.2.13
Jan 8, 2025 19:47:02.248002052 CET	47654	13566	192.168.2.13	83.222.129.230
Jan 8, 2025 19:47:02.249994993 CET	60744	13566	192.168.2.13	83.222.153.179
Jan 8, 2025 19:47:02.250267029 CET	13566	49744	83.222.90.162	192.168.2.13
Jan 8, 2025 19:47:02.250317097 CET	49744	13566	192.168.2.13	83.222.90.162
Jan 8, 2025 19:47:02.251677036 CET	37344	13566	192.168.2.13	83.222.12.23
Jan 8, 2025 19:47:02.253662109 CET	36624	13566	192.168.2.13	83.222.129.101
Jan 8, 2025 19:47:02.254789114 CET	13566	60744	83.222.153.179	192.168.2.13
Jan 8, 2025 19:47:02.254829884 CET	60744	13566	192.168.2.13	83.222.153.179
Jan 8, 2025 19:47:02.255757093 CET	59938	13566	192.168.2.13	83.222.43.230
Jan 8, 2025 19:47:02.256459951 CET	13566	37344	83.222.12.23	192.168.2.13
Jan 8, 2025 19:47:02.256525040 CET	37344	13566	192.168.2.13	83.222.12.23
Jan 8, 2025 19:47:02.257386923 CET	60960	13566	192.168.2.13	83.222.29.108
Jan 8, 2025 19:47:02.258410931 CET	13566	36624	83.222.129.101	192.168.2.13
Jan 8, 2025 19:47:02.258464098 CET	36624	13566	192.168.2.13	83.222.129.101
Jan 8, 2025 19:47:02.259203911 CET	54158	13566	192.168.2.13	83.222.222.190
Jan 8, 2025 19:47:02.260504961 CET	13566	59938	83.222.43.230	192.168.2.13
Jan 8, 2025 19:47:02.260550022 CET	59938	13566	192.168.2.13	83.222.43.230
Jan 8, 2025 19:47:02.260879040 CET	47848	13566	192.168.2.13	83.222.185.121
Jan 8, 2025 19:47:02.262181044 CET	13566	60960	83.222.29.108	192.168.2.13
Jan 8, 2025 19:47:02.262222052 CET	60960	13566	192.168.2.13	83.222.29.108
Jan 8, 2025 19:47:02.262608051 CET	58574	13566	192.168.2.13	83.222.28.140
Jan 8, 2025 19:47:02.264000893 CET	13566	54158	83.222.222.190	192.168.2.13
Jan 8, 2025 19:47:02.264045954 CET	54158	13566	192.168.2.13	83.222.222.190
Jan 8, 2025 19:47:02.264251947 CET	46546	13566	192.168.2.13	83.222.77.82
Jan 8, 2025 19:47:02.265635967 CET	13566	47848	83.222.185.121	192.168.2.13
Jan 8, 2025 19:47:02.265672922 CET	47848	13566	192.168.2.13	83.222.185.121
Jan 8, 2025 19:47:02.266256094 CET	38754	13566	192.168.2.13	83.222.89.90
Jan 8, 2025 19:47:02.267359018 CET	13566	58574	83.222.28.140	192.168.2.13
Jan 8, 2025 19:47:02.267391920 CET	58574	13566	192.168.2.13	83.222.28.140
Jan 8, 2025 19:47:02.268798113 CET	35166	13566	192.168.2.13	83.222.112.137
Jan 8, 2025 19:47:02.268974066 CET	13566	46546	83.222.77.82	192.168.2.13
Jan 8, 2025 19:47:02.269027948 CET	46546	13566	192.168.2.13	83.222.77.82
Jan 8, 2025 19:47:02.270970106 CET	13566	38754	83.222.89.90	192.168.2.13
Jan 8, 2025 19:47:02.271022081 CET	38754	13566	192.168.2.13	83.222.89.90
Jan 8, 2025 19:47:02.273588896 CET	13566	35166	83.222.112.137	192.168.2.13
Jan 8, 2025 19:47:02.273637056 CET	35166	13566	192.168.2.13	83.222.112.137
Jan 8, 2025 19:47:02.274149895 CET	41846	13566	192.168.2.13	83.222.126.209
Jan 8, 2025 19:47:02.276670933 CET	42672	13566	192.168.2.13	83.222.32.130
Jan 8, 2025 19:47:02.278541088 CET	55788	13566	192.168.2.13	83.222.91.161
Jan 8, 2025 19:47:02.278911114 CET	13566	41846	83.222.126.209	192.168.2.13
Jan 8, 2025 19:47:02.278954983 CET	41846	13566	192.168.2.13	83.222.126.209
Jan 8, 2025 19:47:02.281413078 CET	13566	42672	83.222.32.130	192.168.2.13
Jan 8, 2025 19:47:02.281455994 CET	42672	13566	192.168.2.13	83.222.32.130
Jan 8, 2025 19:47:02.283123970 CET	51190	13566	192.168.2.13	83.222.104.181
Jan 8, 2025 19:47:02.283333063 CET	13566	55788	83.222.91.161	192.168.2.13
Jan 8, 2025 19:47:02.283375025 CET	55788	13566	192.168.2.13	83.222.91.161
Jan 8, 2025 19:47:02.285862923 CET	56636	13566	192.168.2.13	83.222.68.2
Jan 8, 2025 19:47:02.288019896 CET	13566	51190	83.222.104.181	192.168.2.13
Jan 8, 2025 19:47:02.288058996 CET	51190	13566	192.168.2.13	83.222.104.181
Jan 8, 2025 19:47:02.290640116 CET	13566	56636	83.222.68.2	192.168.2.13
Jan 8, 2025 19:47:02.290688992 CET	56636	13566	192.168.2.13	83.222.68.2
Jan 8, 2025 19:47:02.292273045 CET	34444	13566	192.168.2.13	83.222.104.80
Jan 8, 2025 19:47:02.297019005 CET	13566	34444	83.222.104.80	192.168.2.13
Jan 8, 2025 19:47:02.297070026 CET	34444	13566	192.168.2.13	83.222.104.80
Jan 8, 2025 19:47:02.297432899 CET	34444	13566	192.168.2.13	83.222.104.80
Jan 8, 2025 19:47:02.298763037 CET	42902	13566	192.168.2.13	83.222.25.233
Jan 8, 2025 19:47:02.300939083 CET	49104	13566	192.168.2.13	83.222.181.68
Jan 8, 2025 19:47:02.303396940 CET	54940	13566	192.168.2.13	83.222.208.210
Jan 8, 2025 19:47:02.303558111 CET	13566	42902	83.222.25.233	192.168.2.13
Jan 8, 2025 19:47:02.303607941 CET	42902	13566	192.168.2.13	83.222.25.233
Jan 8, 2025 19:47:02.303764105 CET	13566	34444	83.222.104.80	192.168.2.13
Jan 8, 2025 19:47:02.303814888 CET	34444	13566	192.168.2.13	83.222.104.80
Jan 8, 2025 19:47:02.305072069 CET	44086	13566	192.168.2.13	83.222.176.174
Jan 8, 2025 19:47:02.305732012 CET	13566	49104	83.222.181.68	192.168.2.13
Jan 8, 2025 19:47:02.305784941 CET	49104	13566	192.168.2.13	83.222.181.68
Jan 8, 2025 19:47:02.306876898 CET	47872	13566	192.168.2.13	83.222.145.105
Jan 8, 2025 19:47:02.308192015 CET	13566	54940	83.222.208.210	192.168.2.13
Jan 8, 2025 19:47:02.308232069 CET	54940	13566	192.168.2.13	83.222.208.210
Jan 8, 2025 19:47:02.308301926 CET	59540	13566	192.168.2.13	83.222.39.173
Jan 8, 2025 19:47:02.309843063 CET	13566	44086	83.222.176.174	192.168.2.13
Jan 8, 2025 19:47:02.309906006 CET	44086	13566	192.168.2.13	83.222.176.174
Jan 8, 2025 19:47:02.310126066 CET	42120	13566	192.168.2.13	83.222.245.116
Jan 8, 2025 19:47:02.311619043 CET	13566	47872	83.222.145.105	192.168.2.13
Jan 8, 2025 19:47:02.311626911 CET	35824	13566	192.168.2.13	83.222.255.78
Jan 8, 2025 19:47:02.311676025 CET	47872	13566	192.168.2.13	83.222.145.105
Jan 8, 2025 19:47:02.313076973 CET	13566	59540	83.222.39.173	192.168.2.13
Jan 8, 2025 19:47:02.313185930 CET	59540	13566	192.168.2.13	83.222.39.173
Jan 8, 2025 19:47:02.313389063 CET	55768	13566	192.168.2.13	83.222.206.111
Jan 8, 2025 19:47:02.314846039 CET	34236	13566	192.168.2.13	83.222.215.76
Jan 8, 2025 19:47:02.314904928 CET	13566	42120	83.222.245.116	192.168.2.13
Jan 8, 2025 19:47:02.314941883 CET	42120	13566	192.168.2.13	83.222.245.116
Jan 8, 2025 19:47:02.316427946 CET	13566	35824	83.222.255.78	192.168.2.13
Jan 8, 2025 19:47:02.316476107 CET	35824	13566	192.168.2.13	83.222.255.78
Jan 8, 2025 19:47:02.316629887 CET	51046	13566	192.168.2.13	83.222.64.248
Jan 8, 2025 19:47:02.318072081 CET	50602	13566	192.168.2.13	83.222.207.155
Jan 8, 2025 19:47:02.318167925 CET	13566	55768	83.222.206.111	192.168.2.13
Jan 8, 2025 19:47:02.318218946 CET	55768	13566	192.168.2.13	83.222.206.111
Jan 8, 2025 19:47:02.319710970 CET	13566	34236	83.222.215.76	192.168.2.13
Jan 8, 2025 19:47:02.319747925 CET	34236	13566	192.168.2.13	83.222.215.76
Jan 8, 2025 19:47:02.319849014 CET	47608	13566	192.168.2.13	83.222.153.55
Jan 8, 2025 19:47:02.321261883 CET	47134	13566	192.168.2.13	83.222.80.221
Jan 8, 2025 19:47:02.321415901 CET	13566	51046	83.222.64.248	192.168.2.13
Jan 8, 2025 19:47:02.321456909 CET	51046	13566	192.168.2.13	83.222.64.248
Jan 8, 2025 19:47:02.322870970 CET	13566	50602	83.222.207.155	192.168.2.13
Jan 8, 2025 19:47:02.322918892 CET	50602	13566	192.168.2.13	83.222.207.155
Jan 8, 2025 19:47:02.324584961 CET	13566	47608	83.222.153.55	192.168.2.13
Jan 8, 2025 19:47:02.324626923 CET	47608	13566	192.168.2.13	83.222.153.55
Jan 8, 2025 19:47:02.326025963 CET	13566	47134	83.222.80.221	192.168.2.13
Jan 8, 2025 19:47:02.326059103 CET	47134	13566	192.168.2.13	83.222.80.221
Jan 8, 2025 19:47:02.336783886 CET	42774	13566	192.168.2.13	83.222.191.90
Jan 8, 2025 19:47:02.341593981 CET	13566	42774	83.222.191.90	192.168.2.13
Jan 8, 2025 19:47:02.341658115 CET	42774	13566	192.168.2.13	83.222.191.90
Jan 8, 2025 19:47:02.344378948 CET	42774	13566	192.168.2.13	83.222.191.90
Jan 8, 2025 19:47:02.349102020 CET	13566	42774	83.222.191.90	192.168.2.13
Jan 8, 2025 19:47:02.349138975 CET	42774	13566	192.168.2.13	83.222.191.90
Jan 8, 2025 19:47:02.353919983 CET	13566	42774	83.222.191.90	192.168.2.13
Jan 8, 2025 19:47:12.354691982 CET	42774	13566	192.168.2.13	83.222.191.90
Jan 8, 2025 19:47:12.359673023 CET	13566	42774	83.222.191.90	192.168.2.13
Jan 8, 2025 19:47:12.561984062 CET	13566	42774	83.222.191.90	192.168.2.13
Jan 8, 2025 19:47:12.562041044 CET	42774	13566	192.168.2.13	83.222.191.90
Jan 8, 2025 19:47:12.934690952 CET	13566	42774	83.222.191.90	192.168.2.13
Jan 8, 2025 19:47:12.934827089 CET	42774	13566	192.168.2.13	83.222.191.90
Jan 8, 2025 19:48:12.986052036 CET	42774	13566	192.168.2.13	83.222.191.90
Jan 8, 2025 19:48:12.990926027 CET	13566	42774	83.222.191.90	192.168.2.13
Jan 8, 2025 19:48:13.192918062 CET	13566	42774	83.222.191.90	192.168.2.13
Jan 8, 2025 19:48:13.192985058 CET	42774	13566	192.168.2.13	83.222.191.90
Jan 8, 2025 19:48:13.935069084 CET	13566	42774	83.222.191.90	192.168.2.13
Jan 8, 2025 19:48:13.935151100 CET	42774	13566	192.168.2.13	83.222.191.90

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 19:47:02.325058937 CET	58779	53	192.168.2.13	8.8.8.8
Jan 8, 2025 19:47:02.332154036 CET	53	58779	8.8.8.8	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 8, 2025 19:47:02.325058937 CET	192.168.2.13	8.8.8.8	0x2342	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 8, 2025 19:47:02.332154036 CET	8.8.8.8	192.168.2.13	0x2342	No error (0)	secure-network-rebirthltd.ru		83.222.191.90	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: Kloki.spc.elf PID: 5472, Parent PID: 5398

General

Start time (UTC):	18:47:01
Start date (UTC):	08/01/2025
Path:	/tmp/Kloki.spc.elf
Arguments:	/tmp/Kloki.spc.elf
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: Kloki.spc.elf PID: 5475, Parent PID: 5472

General

Start time (UTC):	18:47:01
Start date (UTC):	08/01/2025
Path:	/tmp/Kloki.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: Kloki.spc.elf PID: 5477, Parent PID: 5475

General

Start time (UTC):	18:47:01
Start date (UTC):	08/01/2025
Path:	/tmp/Kloki.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: Kloki.spc.elf PID: 5478, Parent PID: 5475

General

Start time (UTC):	18:47:01
Start date (UTC):	08/01/2025
Path:	/tmp/Kloki.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: gnome-session-binary PID: 5481, Parent PID: 1588

General

Start time (UTC):	18:47:01
Start date (UTC):	08/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: sh PID: 5481, Parent PID: 1588

General

Start time (UTC):	18:47:01
Start date (UTC):	08/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gnome-session-binary PID: 5500, Parent PID: 1588

General

Start time (UTC):	18:47:01
Start date (UTC):	08/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: sh PID: 5500, Parent PID: 1588

General

Start time (UTC):	18:47:01
Start date (UTC):	08/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gsd-print-notifications PID: 5500, Parent PID: 1588

General

Start time (UTC):	18:47:01
Start date (UTC):	08/01/2025
Path:	/usr/libexec/gsd-print-notifications
Arguments:	/usr/libexec/gsd-print-notifications
File size:	51840 bytes
MD5 hash:	71539698aa691718cee775d6b9450ae2

Chronological Activities

Analysis Process: gnome-session-binary PID: 5502, Parent PID: 1588

General

Start time (UTC):	18:47:01
Start date (UTC):	08/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: sh PID: 5502, Parent PID: 1588

General

Start time (UTC):	18:47:01
Start date (UTC):	08/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gsd-rfkill PID: 5502, Parent PID: 1588

General

Start time (UTC):	18:47:01
Start date (UTC):	08/01/2025
Path:	/usr/libexec/gsd-rfkill
Arguments:	/usr/libexec/gsd-rfkill
File size:	51808 bytes
MD5 hash:	88a16a3c0aba1759358c06215ecfb5cc

Chronological Activities

Analysis Process: gnome-session-binary PID: 5503, Parent PID: 1588

General

Start time (UTC):	18:47:01
Start date (UTC):	08/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: sh PID: 5503, Parent PID: 1588

General

Start time (UTC):	18:47:01
Start date (UTC):	08/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gnome-shell PID: 5503, Parent PID: 1588

General

Start time (UTC):	18:47:01
Start date (UTC):	08/01/2025
Path:	/usr/bin/gnome-shell
Arguments:	/usr/bin/gnome-shell
File size:	23168 bytes
MD5 hash:	da7a257239677622fe4b3a65972c9e87

Chronological Activities

Analysis Process: gdm3 PID: 5504, Parent PID: 1400

General

Start time (UTC):	18:47:01
Start date (UTC):	08/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 5504, Parent PID: 1400

General

Start time (UTC):	18:47:01
Start date (UTC):	08/01/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gdm3 PID: 5508, Parent PID: 1400

General

Start time (UTC):	18:47:01
Start date (UTC):	08/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 5508, Parent PID: 1400

General

Start time (UTC):	18:47:01
Start date (UTC):	08/01/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemd PID: 5514, Parent PID: 1

General

Start time (UTC):	18:47:11
Start date (UTC):	08/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-user-runtime-dir PID: 5514, Parent PID: 1

General

Start time (UTC):	18:47:11
Start date (UTC):	08/01/2025
Path:	/lib/systemd/systemd-user-runtime-dir
Arguments:	/lib/systemd/systemd-user-runtime-dir stop 127
File size:	22672 bytes
MD5 hash:	d55f4b0847f88131dbcfb07435178e54

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Kloki.spc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: Kloki.spc.elf PID: 5472, Parent PID: 5398

General

Chronological Activities

Analysis Process: Kloki.spc.elf PID: 5475, Parent PID: 5472

General

Chronological Activities

Analysis Process: Kloki.spc.elf PID: 5477, Parent PID: 5475

General

Chronological Activities

Analysis Process: Kloki.spc.elf PID: 5478, Parent PID: 5475

General

Chronological Activities

Analysis Process: gnome-session-binary PID: 5481, Parent PID: 1588

General

Chronological Activities

Analysis Process: sh PID: 5481, Parent PID: 1588

General

Analysis Process: gnome-session-binary PID: 5500, Parent PID: 1588

General

Chronological Activities

Analysis Process: sh PID: 5500, Parent PID: 1588

General

Linux Analysis Report
Kloki.spc.elf