Edit tour

Linux Analysis Report
arm5.elf

Overview

General Information

Sample name:	arm5.elf
Analysis ID:	1588733
MD5:	8da1fbd34e60ab2bd393d4422dc3f6bc
SHA1:	62bb112fe9bd41accb44379c934fa3c7d225247b
SHA256:	499d5ae87707bf9914888f6bf4fbe88ac6b8e2f76ac3f466bcdf6269c40dacba
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Detected TCP or UDP traffic on non-standard ports

Sample has stripped symbol table

Sample listens on a socket

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588733
Start date and time:	2025-01-11 04:46:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	arm5.elf
Detection:	MAL
Classification:	mal56.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/arm5.elf
PID:	5494
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	wormbot
Standard Error:

Process Tree

system is lnxubuntu20

arm5.elf (PID: 5494, Parent: 5418, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm5.elf

arm5.elf New Fork (PID: 5496, Parent: 5494)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
arm5.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe5f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe604:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe618:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe62c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe640:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe654:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe668:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe67c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe690:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe708:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe71c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe730:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe744:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe758:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe76c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe780:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5494.1.00007fe644017000.00007fe644027000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe5f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe604:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe618:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe62c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe640:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe654:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe668:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe67c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe690:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe708:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe71c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe730:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe744:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe758:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe76c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe780:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: arm5.elf PID: 5494	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x121:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x135:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x149:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x199:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x211:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x225:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x239:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x261:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x275:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x289:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x29d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: arm5.elf

Virustotal: Detection: 30%

Perma Link

Source: global traffic

TCP traffic: 192.168.2.14:49794 -> 85.239.34.134:999

Source: /tmp/arm5.elf (PID: 5494)

Socket: 127.0.0.1:7567

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknown	TCP traffic detected without corresponding DNS query: 85.239.34.134

System Summary

Malicious sample detected (through community Yara rule)

Source: arm5.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5494.1.00007fe644017000.00007fe644027000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: arm5.elf PID: 5494, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: ELF static info symbol of initial sample

.symtab present: no

Source: arm5.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5494.1.00007fe644017000.00007fe644027000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: arm5.elf PID: 5494, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal56.linELF@0/0@0/0

Source: /tmp/arm5.elf (PID: 5494)

Queries kernel information via 'uname':

Jump to behavior

Source: arm5.elf, 5494.1.00007ffe268e4000.00007ffe26905000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm5.elf
Source: arm5.elf, 5494.1.00005557ec07a000.00005557ec1a8000.rw-.sdmp	Binary or memory string: WU!/etc/qemu-binfmt/arm
Source: arm5.elf, 5494.1.00005557ec07a000.00005557ec1a8000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: arm5.elf, 5494.1.00007ffe268e4000.00007ffe26905000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
arm5.elf	30%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
85.239.34.134	unknown	Russian Federation		134121	RAINBOW-HKRainbownetworklimitedHK	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
85.239.34.134	m68k.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	harm.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	spc.elf	Get hash	malicious	Unknown	Browse
	x86.elf	Get hash	malicious	Unknown	Browse
	arm.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Mirai	Browse
	arm.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RAINBOW-HKRainbownetworklimitedHK	m68k.elf	Get hash	malicious	Unknown	Browse	85.239.34.134
	mpsl.elf	Get hash	malicious	Unknown	Browse	85.239.34.134
	harm.elf	Get hash	malicious	Unknown	Browse	85.239.34.134
	mips.elf	Get hash	malicious	Unknown	Browse	85.239.34.134
	spc.elf	Get hash	malicious	Unknown	Browse	85.239.34.134
	x86.elf	Get hash	malicious	Unknown	Browse	85.239.34.134
	arm.elf	Get hash	malicious	Unknown	Browse	85.239.34.134
	arm7.elf	Get hash	malicious	Mirai	Browse	85.239.34.134
	arm.elf	Get hash	malicious	Unknown	Browse	85.239.34.134
	arm7.elf	Get hash	malicious	Unknown	Browse	85.239.34.134

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.030471737874306
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	arm5.elf
File size:	64'112 bytes
MD5:	8da1fbd34e60ab2bd393d4422dc3f6bc
SHA1:	62bb112fe9bd41accb44379c934fa3c7d225247b
SHA256:	499d5ae87707bf9914888f6bf4fbe88ac6b8e2f76ac3f466bcdf6269c40dacba
SHA512:	4d42c702ebef5b4a4e6d0d5a5a43aad6054fff85564649cbc0379a2c064eb0fbec7e2c3f1f1d5407b85a2125dde9d2b9ab11008de9656a8b36b8887346c3dd21
SSDEEP:	1536:Amn2YUGwUWDHNMwV2CIwnQYUcENlkqiIWjdqVf/nP:Cbn2CIwnQYhpjdqZ/
TLSH:	33532A49F9815F21C4D522BAFA5E018D336357ECE3EEB1129D211B2037CA92B0E77E46
File Content Preview:	.ELF..............(.........4...........4. ...(........p.....q...q..................................................................0...@3..........................................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	63432
Section Header Size:	40
Number of Section Headers:	17
Header String Table Index:	16

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	4
.text	PROGBITS	0x80f0	0xf0	0xe414	0x0	0x6	AX	0	16
.fini	PROGBITS	0x16504	0xe504	0x10	0x0	0x6	AX	0	4
.rodata	PROGBITS	0x16514	0xe514	0xcb4	0x0	0x2	A	0	4
.ARM.extab	PROGBITS	0x171c8	0xf1c8	0x18	0x0	0x2	A	0	4
.ARM.exidx	ARM_EXIDX	0x171e0	0xf1e0	0x118	0x0	0x82	AL	2	4
.eh_frame	PROGBITS	0x182f8	0xf2f8	0x4	0x0	0x3	WA	0	4
.tbss	NOBITS	0x182fc	0xf2fc	0x8	0x0	0x403	WAT	0	4
.init_array	INIT_ARRAY	0x182fc	0xf2fc	0x4	0x0	0x3	WA	0	4
.fini_array	FINI_ARRAY	0x18300	0xf300	0x4	0x0	0x3	WA	0	4
.jcr	PROGBITS	0x18304	0xf304	0x4	0x0	0x3	WA	0	4
.got	PROGBITS	0x18308	0xf308	0xa8	0x4	0x3	WA	0	4
.data	PROGBITS	0x183b0	0xf3b0	0x378	0x0	0x3	WA	0	4
.bss	NOBITS	0x18728	0xf728	0x2f10	0x0	0x3	WA	0	4
.ARM.attributes	ARM_ATTRIBUTES	0x0	0xf728	0x16	0x0	0x0		0	1
.shstrtab	STRTAB	0x0	0xf73e	0x88	0x0	0x0		0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0xf1e0	0x171e0	0x171e0	0x118	0x118	4.5015	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0xf2f8	0xf2f8	6.0406	0x5	R E	0x1000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0xf2f8	0x182f8	0x182f8	0x430	0x3340	4.9666	0x6	RW	0x1000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0xf2fc	0x182fc	0x182fc	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:47:40.952255011 CET	49794	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:40.957479000 CET	999	49794	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:40.957545042 CET	49794	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:40.957724094 CET	49794	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:40.962546110 CET	999	49794	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:40.962634087 CET	49794	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:40.967566967 CET	999	49794	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:42.733392000 CET	999	49794	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:42.733895063 CET	49794	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:42.738817930 CET	999	49794	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:43.736865044 CET	49796	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:43.742161036 CET	999	49796	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:43.742300034 CET	49796	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:43.742342949 CET	49796	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:43.747257948 CET	999	49796	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:43.747351885 CET	49796	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:43.752304077 CET	999	49796	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:45.483385086 CET	999	49796	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:45.483649969 CET	49796	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:45.488497019 CET	999	49796	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:46.485574961 CET	49798	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:46.490457058 CET	999	49798	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:46.490511894 CET	49798	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:46.490544081 CET	49798	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:46.495322943 CET	999	49798	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:46.495367050 CET	49798	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:46.500204086 CET	999	49798	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:48.236666918 CET	999	49798	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:48.237005949 CET	49798	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:48.242868900 CET	999	49798	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:49.239751101 CET	49800	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:49.244707108 CET	999	49800	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:49.244827986 CET	49800	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:49.244827986 CET	49800	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:49.249763966 CET	999	49800	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:49.249839067 CET	49800	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:49.254621983 CET	999	49800	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:51.027143002 CET	999	49800	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:51.027621984 CET	49800	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:51.032525063 CET	999	49800	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:52.029763937 CET	49802	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:52.034919977 CET	999	49802	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:52.034986019 CET	49802	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:52.035028934 CET	49802	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:52.039872885 CET	999	49802	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:52.039932013 CET	49802	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:52.044769049 CET	999	49802	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:53.795279026 CET	999	49802	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:53.795732021 CET	49802	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:53.800652981 CET	999	49802	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:54.798162937 CET	49804	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:54.803237915 CET	999	49804	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:54.803422928 CET	49804	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:54.803474903 CET	49804	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:54.808374882 CET	999	49804	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:54.808481932 CET	49804	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:54.813426018 CET	999	49804	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:56.580562115 CET	999	49804	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:56.581024885 CET	49804	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:56.585877895 CET	999	49804	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:57.583920002 CET	49806	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:57.589047909 CET	999	49806	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:57.589137077 CET	49806	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:57.589191914 CET	49806	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:57.594014883 CET	999	49806	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:57.594084024 CET	49806	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:57.598880053 CET	999	49806	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:59.357673883 CET	999	49806	85.239.34.134	192.168.2.14
Jan 11, 2025 04:47:59.358129978 CET	49806	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:47:59.362931013 CET	999	49806	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:00.360327005 CET	49808	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:00.365530014 CET	999	49808	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:00.365586996 CET	49808	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:00.365601063 CET	49808	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:00.370410919 CET	999	49808	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:00.370484114 CET	49808	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:00.375283003 CET	999	49808	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:02.128231049 CET	999	49808	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:02.128427982 CET	49808	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:02.133225918 CET	999	49808	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:03.129785061 CET	49810	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:03.136357069 CET	999	49810	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:03.136583090 CET	49810	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:03.136605024 CET	49810	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:03.141361952 CET	999	49810	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:03.141448975 CET	49810	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:03.146244049 CET	999	49810	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:04.910175085 CET	999	49810	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:04.910521984 CET	49810	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:04.915327072 CET	999	49810	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:05.913310051 CET	49812	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:05.918329000 CET	999	49812	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:05.918392897 CET	49812	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:05.918415070 CET	49812	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:05.923187971 CET	999	49812	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:05.923234940 CET	49812	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:05.928111076 CET	999	49812	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:07.670310974 CET	999	49812	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:07.670675039 CET	49812	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:07.675503016 CET	999	49812	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:08.672751904 CET	49814	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:08.677912951 CET	999	49814	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:08.678061008 CET	49814	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:08.678093910 CET	49814	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:08.682920933 CET	999	49814	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:08.682991028 CET	49814	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:08.687809944 CET	999	49814	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:10.438055038 CET	999	49814	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:10.438389063 CET	49814	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:10.443192959 CET	999	49814	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:11.440685034 CET	49816	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:11.445765972 CET	999	49816	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:11.445832968 CET	49816	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:11.445867062 CET	49816	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:11.451649904 CET	999	49816	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:11.451711893 CET	49816	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:11.457588911 CET	999	49816	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:13.202265978 CET	999	49816	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:13.202704906 CET	49816	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:13.207673073 CET	999	49816	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:14.205018044 CET	49818	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:14.209999084 CET	999	49818	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:14.210105896 CET	49818	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:14.210149050 CET	49818	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:14.214891911 CET	999	49818	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:14.214962959 CET	49818	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:14.219769955 CET	999	49818	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:15.971177101 CET	999	49818	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:15.971506119 CET	49818	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:15.976299047 CET	999	49818	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:16.973076105 CET	49820	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:16.977976084 CET	999	49820	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:16.978040934 CET	49820	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:16.978064060 CET	49820	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:16.983361006 CET	999	49820	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:16.983401060 CET	49820	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:16.988478899 CET	999	49820	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:18.752269030 CET	999	49820	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:18.752577066 CET	49820	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:18.757421017 CET	999	49820	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:19.754828930 CET	49822	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:19.759788036 CET	999	49822	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:19.759924889 CET	49822	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:19.759975910 CET	49822	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:19.764770031 CET	999	49822	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:19.764842987 CET	49822	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:19.769579887 CET	999	49822	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:21.533994913 CET	999	49822	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:21.534173965 CET	49822	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:21.539891005 CET	999	49822	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:22.537086964 CET	49824	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:22.542002916 CET	999	49824	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:22.542110920 CET	49824	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:22.542159081 CET	49824	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:22.546951056 CET	999	49824	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:22.547009945 CET	49824	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:22.551753998 CET	999	49824	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:24.295463085 CET	999	49824	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:24.295764923 CET	49824	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:24.300594091 CET	999	49824	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:25.297409058 CET	49826	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:25.302304029 CET	999	49826	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:25.302401066 CET	49826	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:25.302401066 CET	49826	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:25.307305098 CET	999	49826	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:25.307398081 CET	49826	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:25.312216043 CET	999	49826	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:27.064747095 CET	999	49826	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:27.064898014 CET	49826	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:27.069720030 CET	999	49826	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:28.067348957 CET	49828	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:28.072320938 CET	999	49828	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:28.072412968 CET	49828	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:28.072432995 CET	49828	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:28.077240944 CET	999	49828	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:28.077341080 CET	49828	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:28.082194090 CET	999	49828	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:29.811552048 CET	999	49828	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:29.811767101 CET	49828	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:29.816540003 CET	999	49828	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:30.814903021 CET	49830	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:30.819854975 CET	999	49830	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:30.819937944 CET	49830	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:30.819983959 CET	49830	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:30.824898958 CET	999	49830	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:30.824989080 CET	49830	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:30.829770088 CET	999	49830	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:32.611989021 CET	999	49830	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:32.612231970 CET	49830	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:32.617113113 CET	999	49830	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:33.614379883 CET	49832	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:33.619235992 CET	999	49832	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:33.619344950 CET	49832	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:33.619395971 CET	49832	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:33.624118090 CET	999	49832	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:33.624524117 CET	49832	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:33.629302979 CET	999	49832	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:35.373996019 CET	999	49832	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:35.374202967 CET	49832	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:35.379065990 CET	999	49832	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:36.376367092 CET	49834	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:36.381232977 CET	999	49834	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:36.381282091 CET	49834	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:36.381308079 CET	49834	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:36.386224985 CET	999	49834	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:36.386284113 CET	49834	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:36.391055107 CET	999	49834	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:38.142540932 CET	999	49834	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:38.142724991 CET	49834	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:38.147555113 CET	999	49834	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:39.145709991 CET	49836	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:39.150743008 CET	999	49836	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:39.150878906 CET	49836	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:39.150899887 CET	49836	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:39.155822039 CET	999	49836	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:39.155886889 CET	49836	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:39.160742998 CET	999	49836	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:40.907922983 CET	999	49836	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:40.908103943 CET	49836	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:40.912905931 CET	999	49836	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:41.910608053 CET	49838	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:41.915640116 CET	999	49838	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:41.915747881 CET	49838	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:41.915786982 CET	49838	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:41.920609951 CET	999	49838	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:41.920747042 CET	49838	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:41.925563097 CET	999	49838	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:43.678394079 CET	999	49838	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:43.678679943 CET	49838	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:43.684078932 CET	999	49838	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:44.680453062 CET	49840	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:44.685390949 CET	999	49840	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:44.685460091 CET	49840	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:44.685530901 CET	49840	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:44.690351963 CET	999	49840	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:44.690408945 CET	49840	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:44.695256948 CET	999	49840	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:46.471321106 CET	999	49840	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:46.471828938 CET	49840	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:46.476568937 CET	999	49840	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:47.474036932 CET	49842	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:47.478980064 CET	999	49842	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:47.479088068 CET	49842	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:47.479125977 CET	49842	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:47.483887911 CET	999	49842	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:47.483959913 CET	49842	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:47.488753080 CET	999	49842	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:49.236999989 CET	999	49842	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:49.237180948 CET	49842	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:49.241966963 CET	999	49842	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:50.239764929 CET	49844	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:50.244628906 CET	999	49844	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:50.244764090 CET	49844	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:50.244797945 CET	49844	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:50.249629021 CET	999	49844	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:50.249708891 CET	49844	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:50.254534960 CET	999	49844	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:52.028395891 CET	999	49844	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:52.028784037 CET	49844	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:52.033592939 CET	999	49844	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:53.031116009 CET	49846	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:53.037223101 CET	999	49846	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:53.037312984 CET	49846	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:53.037328005 CET	49846	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:53.043272972 CET	999	49846	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:53.043323994 CET	49846	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:53.049127102 CET	999	49846	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:54.796669960 CET	999	49846	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:54.796859026 CET	49846	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:54.801846981 CET	999	49846	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:55.799144983 CET	49848	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:55.804033995 CET	999	49848	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:55.804152966 CET	49848	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:55.804152966 CET	49848	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:55.808892965 CET	999	49848	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:55.808974981 CET	49848	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:55.813787937 CET	999	49848	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:57.561625957 CET	999	49848	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:57.561892986 CET	49848	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:57.566766977 CET	999	49848	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:58.564095974 CET	49850	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:58.569020033 CET	999	49850	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:58.569135904 CET	49850	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:58.569176912 CET	49850	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:58.573991060 CET	999	49850	85.239.34.134	192.168.2.14
Jan 11, 2025 04:48:58.574073076 CET	49850	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:48:58.578860998 CET	999	49850	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:00.330918074 CET	999	49850	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:00.331327915 CET	49850	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:00.336293936 CET	999	49850	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:01.333585024 CET	49852	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:01.338515997 CET	999	49852	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:01.338629007 CET	49852	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:01.338674068 CET	49852	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:01.343435049 CET	999	49852	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:01.343477964 CET	49852	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:01.348293066 CET	999	49852	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:03.092236996 CET	999	49852	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:03.092542887 CET	49852	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:03.097374916 CET	999	49852	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:04.094610929 CET	49854	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:04.099514961 CET	999	49854	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:04.099597931 CET	49854	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:04.099608898 CET	49854	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:04.104530096 CET	999	49854	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:04.104595900 CET	49854	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:04.109445095 CET	999	49854	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:05.880456924 CET	999	49854	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:05.880805016 CET	49854	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:05.885574102 CET	999	49854	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:06.882708073 CET	49856	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:06.887701988 CET	999	49856	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:06.887778044 CET	49856	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:06.887821913 CET	49856	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:06.892705917 CET	999	49856	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:06.892785072 CET	49856	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:06.897707939 CET	999	49856	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:08.639709949 CET	999	49856	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:08.639895916 CET	49856	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:08.644829035 CET	999	49856	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:09.642147064 CET	49858	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:09.647068977 CET	999	49858	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:09.647173882 CET	49858	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:09.647212982 CET	49858	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:09.652401924 CET	999	49858	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:09.652467966 CET	49858	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:09.657542944 CET	999	49858	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:11.422667027 CET	999	49858	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:11.422903061 CET	49858	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:11.427748919 CET	999	49858	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:12.425158978 CET	49860	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:12.430048943 CET	999	49860	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:12.430113077 CET	49860	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:12.430160046 CET	49860	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:12.435046911 CET	999	49860	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:12.435184956 CET	49860	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:12.440012932 CET	999	49860	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:14.208698988 CET	999	49860	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:14.209062099 CET	49860	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:14.213813066 CET	999	49860	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:15.211168051 CET	49862	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:15.217690945 CET	999	49862	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:15.217792988 CET	49862	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:15.217844963 CET	49862	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:15.225022078 CET	999	49862	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:15.225087881 CET	49862	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:15.231832027 CET	999	49862	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:16.986602068 CET	999	49862	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:16.986825943 CET	49862	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:16.991909981 CET	999	49862	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:17.988943100 CET	49864	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:17.993758917 CET	999	49864	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:17.993855953 CET	49864	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:17.993896961 CET	49864	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:17.998675108 CET	999	49864	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:17.998744965 CET	49864	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:18.003603935 CET	999	49864	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:19.771750927 CET	999	49864	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:19.772310019 CET	49864	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:19.777262926 CET	999	49864	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:20.774971008 CET	49866	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:20.779844999 CET	999	49866	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:20.779928923 CET	49866	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:20.779980898 CET	49866	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:20.784867048 CET	999	49866	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:20.784931898 CET	49866	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:20.789886951 CET	999	49866	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:22.550199986 CET	999	49866	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:22.550565958 CET	49866	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:22.555442095 CET	999	49866	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:23.553076029 CET	49868	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:23.557918072 CET	999	49868	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:23.557981014 CET	49868	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:23.558027029 CET	49868	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:23.562776089 CET	999	49868	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:23.562820911 CET	49868	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:23.567558050 CET	999	49868	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:25.313863993 CET	999	49868	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:25.314382076 CET	49868	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:25.319248915 CET	999	49868	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:26.316591024 CET	49870	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:26.321461916 CET	999	49870	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:26.321614027 CET	49870	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:26.321614027 CET	49870	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:26.326451063 CET	999	49870	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:26.326518059 CET	49870	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:26.331357002 CET	999	49870	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:28.077325106 CET	999	49870	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:28.077768087 CET	49870	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:28.082613945 CET	999	49870	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:29.080384016 CET	49872	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:29.085283041 CET	999	49872	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:29.085355043 CET	49872	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:29.085396051 CET	49872	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:29.090169907 CET	999	49872	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:29.090234041 CET	49872	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:29.094989061 CET	999	49872	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:30.864626884 CET	999	49872	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:30.864921093 CET	49872	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:30.869823933 CET	999	49872	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:31.867099047 CET	49874	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:31.872396946 CET	999	49874	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:31.872493029 CET	49874	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:31.872520924 CET	49874	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:31.877657890 CET	999	49874	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:31.877724886 CET	49874	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:31.882473946 CET	999	49874	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:33.643990040 CET	999	49874	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:33.644375086 CET	49874	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:33.649219036 CET	999	49874	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:34.646481991 CET	49876	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:34.651637077 CET	999	49876	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:34.651829958 CET	49876	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:34.651829958 CET	49876	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:34.656754017 CET	999	49876	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:34.656822920 CET	49876	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:34.661686897 CET	999	49876	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:36.423203945 CET	999	49876	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:36.423552036 CET	49876	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:36.428355932 CET	999	49876	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:37.425926924 CET	49878	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:37.430813074 CET	999	49878	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:37.430910110 CET	49878	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:37.430942059 CET	49878	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:37.435719013 CET	999	49878	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:37.435771942 CET	49878	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:37.440646887 CET	999	49878	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:39.187921047 CET	999	49878	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:39.188235998 CET	49878	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:39.192976952 CET	999	49878	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:40.190316916 CET	49880	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:40.195099115 CET	999	49880	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:40.195180893 CET	49880	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:40.195213079 CET	49880	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:40.199976921 CET	999	49880	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:40.200047016 CET	49880	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:40.204799891 CET	999	49880	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:41.952738047 CET	999	49880	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:41.952982903 CET	49880	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:41.957707882 CET	999	49880	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:42.956187010 CET	49882	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:42.960997105 CET	999	49882	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:42.961102009 CET	49882	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:42.961502075 CET	49882	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:42.966232061 CET	999	49882	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:42.966325045 CET	49882	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:42.971179962 CET	999	49882	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:44.718370914 CET	999	49882	85.239.34.134	192.168.2.14
Jan 11, 2025 04:49:44.718744993 CET	49882	999	192.168.2.14	85.239.34.134
Jan 11, 2025 04:49:44.723493099 CET	999	49882	85.239.34.134	192.168.2.14

System Behavior

Analysis Process: arm5.elf PID: 5494, Parent PID: 5418

General

Start time (UTC):	03:47:39
Start date (UTC):	11/01/2025
Path:	/tmp/arm5.elf
Arguments:	/tmp/arm5.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 5496, Parent PID: 5494

General

Start time (UTC):	03:47:39
Start date (UTC):	11/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report arm5.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: arm5.elf PID: 5494, Parent PID: 5418

General

Chronological Activities

Analysis Process: arm5.elf PID: 5496, Parent PID: 5494

General

Chronological Activities

Linux Analysis Report
arm5.elf